@bobbykim/manguito-cms-api 0.2.0 → 0.3.0

package/dist/index.mjs

@@ -1,6 +1,15 @@
+import {
+  buildRelationsMap,
+  deleteParagraphField,
+  persistJunctionField,
+  persistParagraphField,
+  resolveRelationBareIds,
+  resolveRelationField
+} from "./chunk-FBS2RQI3.mjs";
+
 // src/app.ts
 import { Hono } from "hono";
-import { sql as sql10 } from "drizzle-orm";
+import { sql as sql9 } from "drizzle-orm";
 
 // src/middleware/cors.ts
 function createCorsMiddleware(corsConfig) {
@@ -31,26 +40,43 @@ function createCorsMiddleware(corsConfig) {
 }
 
 // src/middleware/security-headers.ts
+var GRAPHIQL_CDN = "https://unpkg.com";
 function createSecurityHeadersMiddleware(options = {}) {
   const connectSrc = ["'self'", ...options.connectSrc ?? []].join(" ");
-  const csp = [
-    "default-src 'self'",
-    "img-src 'self' data: https:",
-    "media-src 'self' https:",
-    "style-src 'self' 'unsafe-inline'",
-    "script-src 'self'",
-    "font-src 'self' data:",
-    `connect-src ${connectSrc}`,
-    "frame-ancestors 'none'",
-    "base-uri 'self'",
-    "form-action 'self'"
-  ].join("; ");
+  function buildCsp(parts) {
+    return [
+      "default-src 'self'",
+      "img-src 'self' data: https:",
+      "media-src 'self' https:",
+      `style-src ${parts.styleSrc}`,
+      `script-src ${parts.scriptSrc}`,
+      "font-src 'self' data:",
+      `connect-src ${parts.connectSrc}`,
+      ...parts.workerSrc ? [`worker-src ${parts.workerSrc}`] : [],
+      "frame-ancestors 'none'",
+      "base-uri 'self'",
+      "form-action 'self'"
+    ].join("; ");
+  }
+  const csp = buildCsp({
+    scriptSrc: "'self'",
+    styleSrc: "'self' 'unsafe-inline'",
+    connectSrc
+  });
+  const graphiqlCsp = buildCsp({
+    scriptSrc: `'self' 'unsafe-inline' ${GRAPHIQL_CDN}`,
+    styleSrc: `'self' 'unsafe-inline' ${GRAPHIQL_CDN}`,
+    connectSrc: `${connectSrc} ${GRAPHIQL_CDN}`,
+    workerSrc: "'self' blob:"
+  });
+  const graphiqlPath = options.graphiqlPath;
   return async function securityHeaders(c, next) {
     await next();
     c.res.headers.set("X-Content-Type-Options", "nosniff");
     c.res.headers.set("X-Frame-Options", "DENY");
     c.res.headers.set("Referrer-Policy", "no-referrer");
-    c.res.headers.set("Content-Security-Policy", csp);
+    const isGraphiql = graphiqlPath !== void 0 && c.req.path === graphiqlPath;
+    c.res.headers.set("Content-Security-Policy", isGraphiql ? graphiqlCsp : csp);
   };
 }
 
@@ -887,7 +913,7 @@ function registerPublicMediaRoutes(app, mediaRepo, listRateLimit) {
 }
 
 // src/routes/admin/content.ts
-import { sql as sql3 } from "drizzle-orm";
+import { sql as sql2 } from "drizzle-orm";
 
 // src/media-references.ts
 function extractMediaId(value) {
@@ -921,235 +947,14 @@ async function applyMediaReferenceDelta(delta, mediaRepo) {
   if (netRemove.length > 0) await mediaRepo.decrementReferenceCount(netRemove);
 }
 
-// src/relations.ts
-import crypto from "crypto";
-import { sql as sql2 } from "drizzle-orm";
-function quoteIdent(name) {
-  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
-  return `"${name}"`;
-}
-function paragraphMediaFieldNames(pType) {
-  return new Set(
-    pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.name)
-  );
-}
-async function fetchParagraphMediaIds(db, pType, itemId, fieldName) {
-  const mediaColumns = pType.fields.filter((f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file").map((f) => f.db_column.column_name);
-  if (mediaColumns.length === 0) return [];
-  const tbl = sql2.raw(quoteIdent(pType.db.table_name));
-  const cols = sql2.join(mediaColumns.map((c) => sql2.raw(quoteIdent(c))), sql2`, `);
-  const result = await db.execute(
-    sql2`SELECT ${cols} FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`
-  );
-  const ids = [];
-  for (const row of result.rows) {
-    for (const col of mediaColumns) {
-      const v = row[col];
-      if (typeof v === "string" && v !== "") ids.push(v);
-    }
-  }
-  return ids;
-}
-async function persistParagraphField(db, itemId, parentType, fieldName, pType, items) {
-  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
-  const tbl = sql2.raw(quoteIdent(pType.db.table_name));
-  await db.execute(sql2`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
-  const mediaFieldNames = paragraphMediaFieldNames(pType);
-  const added = [];
-  for (let i = 0; i < items.length; i++) {
-    const pItem = items[i];
-    const data = {
-      id: crypto.randomUUID(),
-      parent_id: itemId,
-      parent_type: parentType,
-      parent_field: fieldName,
-      order: i,
-      created_at: /* @__PURE__ */ new Date(),
-      updated_at: /* @__PURE__ */ new Date()
-    };
-    for (const pf of pType.fields) {
-      if (!pf.db_column || pf.db_column.junction) continue;
-      data[pf.db_column.column_name] = pItem[pf.name] ?? null;
-    }
-    const cols = sql2.join(Object.keys(data).map((k) => sql2.raw(quoteIdent(k))), sql2`, `);
-    const vals = sql2.join(Object.values(data).map((v) => sql2`${v}`), sql2`, `);
-    await db.execute(sql2`INSERT INTO ${tbl} (${cols}) VALUES (${vals})`);
-    for (const name of mediaFieldNames) {
-      const val = pItem[name];
-      if (typeof val === "string" && val !== "") added.push(val);
-    }
-  }
-  return { added, removed };
-}
-async function deleteParagraphField(db, itemId, fieldName, pType) {
-  const removed = await fetchParagraphMediaIds(db, pType, itemId, fieldName);
-  const tbl = sql2.raw(quoteIdent(pType.db.table_name));
-  await db.execute(sql2`DELETE FROM ${tbl} WHERE parent_id = ${itemId} AND parent_field = ${fieldName}`);
-  return { added: [], removed };
-}
-async function persistJunctionField(db, itemId, junction, relatedIds) {
-  const tbl = sql2.raw(quoteIdent(junction.table_name));
-  const left = sql2.raw(quoteIdent(junction.left_column));
-  const right = sql2.raw(quoteIdent(junction.right_column));
-  await db.execute(sql2`DELETE FROM ${tbl} WHERE ${left} = ${itemId}`);
-  for (const rid of relatedIds) {
-    await db.execute(sql2`INSERT INTO ${tbl} (${left}, ${right}) VALUES (${itemId}, ${rid})`);
-  }
-}
-function buildRelationsMap(fields, registry) {
-  const relations = {};
-  for (const field of fields) {
-    if (field.field_type === "image" || field.field_type === "video" || field.field_type === "file") {
-      if (!field.db_column) continue;
-      relations[field.name] = { type: "media", fk_column: field.db_column.column_name };
-    } else if (field.field_type === "paragraph") {
-      const ref = field.ui_component.ref;
-      const pType = ref ? registry.paragraph_types[ref] : void 0;
-      if (!pType) continue;
-      relations[field.name] = { type: "paragraph", table: pType.db.table_name };
-    } else if (field.field_type === "reference") {
-      if (!field.db_column) continue;
-      if (field.db_column.junction) {
-        const j = field.db_column.junction;
-        relations[field.name] = {
-          type: "junction",
-          table: j.right_table,
-          junction_table: j.table_name,
-          left_column: j.left_column,
-          right_column: j.right_column,
-          order_column: j.order_column
-        };
-      } else if (field.db_column.foreign_key) {
-        relations[field.name] = {
-          type: "reference",
-          table: field.db_column.foreign_key.table,
-          fk_column: field.db_column.column_name
-        };
-      }
-    }
-  }
-  return relations;
-}
-function groupBy(items, key) {
-  const result = {};
-  for (const item of items) {
-    const k = String(item[key]);
-    if (!result[k]) result[k] = [];
-    result[k].push(item);
-  }
-  return result;
-}
-async function resolveRelationField(db, rows, fieldName, rel, cache) {
-  if (rows.length === 0) return;
-  if (rel.type === "paragraph") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = sql2.join(parentIds.map((id) => sql2`${id}`), sql2`, `);
-    const result = await db.execute(
-      sql2`SELECT * FROM ${sql2.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
-    );
-    const byParent = groupBy(result.rows, "parent_id");
-    for (const row of rows) {
-      row[fieldName] = byParent[row["id"]] ?? [];
-    }
-  } else if (rel.type === "reference") {
-    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
-    if (fkValues.length === 0) {
-      for (const row of rows) row[fieldName] = null;
-      return;
-    }
-    const unique = [...new Set(fkValues)];
-    const uncached = unique.filter((id) => !cache.has(`${rel.table}:${id}`));
-    if (uncached.length > 0) {
-      const inList = sql2.join(uncached.map((id) => sql2`${id}`), sql2`, `);
-      const result = await db.execute(
-        sql2`SELECT * FROM ${sql2.raw(quoteIdent(rel.table))} WHERE id IN (${inList})`
-      );
-      for (const item of result.rows) {
-        cache.set(`${rel.table}:${item["id"]}`, item);
-      }
-    }
-    for (const row of rows) {
-      const fkVal = row[rel.fk_column];
-      row[fieldName] = fkVal ? cache.get(`${rel.table}:${fkVal}`) ?? null : null;
-    }
-  } else if (rel.type === "junction") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = sql2.join(parentIds.map((id) => sql2`${id}`), sql2`, `);
-    const orderBy = rel.order_column ? sql2` ORDER BY "order" ASC` : sql2``;
-    const junctionResult = await db.execute(
-      sql2`SELECT * FROM ${sql2.raw(quoteIdent(rel.junction_table))} WHERE ${sql2.raw(quoteIdent(rel.left_column))} IN (${inList})${orderBy}`
-    );
-    const jRows = junctionResult.rows;
-    const rightIds = [...new Set(jRows.map((r) => r[rel.right_column]))];
-    const uncached = rightIds.filter((id) => !cache.has(`${rel.table}:${id}`));
-    if (uncached.length > 0) {
-      const rightInList = sql2.join(uncached.map((id) => sql2`${id}`), sql2`, `);
-      const entitiesResult = await db.execute(
-        sql2`SELECT * FROM ${sql2.raw(quoteIdent(rel.table))} WHERE id IN (${rightInList})`
-      );
-      for (const item of entitiesResult.rows) {
-        cache.set(`${rel.table}:${item["id"]}`, item);
-      }
-    }
-    const byLeft = groupBy(jRows, rel.left_column);
-    for (const row of rows) {
-      const jEntries = byLeft[row["id"]] ?? [];
-      row[fieldName] = jEntries.map((jr) => cache.get(`${rel.table}:${jr[rel.right_column]}`)).filter(Boolean);
-    }
-  } else if (rel.type === "media") {
-    const fkValues = rows.map((r) => r[rel.fk_column]).filter(Boolean);
-    if (fkValues.length === 0) {
-      for (const row of rows) row[fieldName] = null;
-      return;
-    }
-    const unique = [...new Set(fkValues)];
-    const uncached = unique.filter((id) => !cache.has(`media:${id}`));
-    if (uncached.length > 0) {
-      const inList = sql2.join(uncached.map((id) => sql2`${id}`), sql2`, `);
-      const result = await db.execute(sql2`SELECT * FROM "media" WHERE id IN (${inList})`);
-      for (const item of result.rows) {
-        cache.set(`media:${item["id"]}`, item);
-      }
-    }
-    for (const row of rows) {
-      const fkVal = row[rel.fk_column];
-      row[fieldName] = fkVal ? cache.get(`media:${fkVal}`) ?? null : null;
-    }
-  }
-}
-async function resolveRelationBareIds(db, rows, fieldName, rel) {
-  if (rows.length === 0) return;
-  if (rel.type === "paragraph") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = sql2.join(parentIds.map((id) => sql2`${id}`), sql2`, `);
-    const result = await db.execute(
-      sql2`SELECT id, parent_id FROM ${sql2.raw(quoteIdent(rel.table))} WHERE parent_id IN (${inList}) ORDER BY "order" ASC`
-    );
-    const byParent = groupBy(result.rows, "parent_id");
-    for (const row of rows) {
-      row[fieldName] = (byParent[row["id"]] ?? []).map((r) => r["id"]);
-    }
-  } else if (rel.type === "junction") {
-    const parentIds = rows.map((r) => r["id"]);
-    const inList = sql2.join(parentIds.map((id) => sql2`${id}`), sql2`, `);
-    const result = await db.execute(
-      sql2`SELECT ${sql2.raw(quoteIdent(rel.left_column))} AS left_id, ${sql2.raw(quoteIdent(rel.right_column))} AS right_id FROM ${sql2.raw(quoteIdent(rel.junction_table))} WHERE ${sql2.raw(quoteIdent(rel.left_column))} IN (${inList})`
-    );
-    const byLeft = groupBy(result.rows, "left_id");
-    for (const row of rows) {
-      row[fieldName] = (byLeft[row["id"]] ?? []).map((r) => r["right_id"]);
-    }
-  }
-}
-
 // src/routes/admin/content.ts
-function quoteIdent2(name) {
+function quoteIdent(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
 async function lookupBasePathId(db, pathOrName) {
   const r = await db.execute(
-    sql3`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
+    sql2`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
   );
   return r.rows[0]?.id ?? null;
 }
@@ -1299,13 +1104,13 @@ function registerAdminContentRoutes(app, registry, repos, mediaRepo, requirePerm
               const pType = registry.paragraph_types[comp.ref];
               if (!pType) continue;
               const r = await db.execute(
-                sql3`SELECT * FROM ${sql3.raw(quoteIdent2(pType.db.table_name))} WHERE parent_id = ${id} AND parent_field = ${f.name} ORDER BY "order" ASC`
+                sql2`SELECT * FROM ${sql2.raw(quoteIdent(pType.db.table_name))} WHERE parent_id = ${id} AND parent_field = ${f.name} ORDER BY "order" ASC`
               );
               row[f.name] = r.rows;
             } else if (f.db_column.junction) {
               const j = f.db_column.junction;
               const r = await db.execute(
-                sql3`SELECT ${sql3.raw(quoteIdent2(j.right_column))} FROM ${sql3.raw(quoteIdent2(j.table_name))} WHERE ${sql3.raw(quoteIdent2(j.left_column))} = ${id}`
+                sql2`SELECT ${sql2.raw(quoteIdent(j.right_column))} FROM ${sql2.raw(quoteIdent(j.table_name))} WHERE ${sql2.raw(quoteIdent(j.left_column))} = ${id}`
               );
               row[f.name] = r.rows.map(
                 (row2) => row2[j.right_column]
@@ -2270,7 +2075,7 @@ function registerAdminMediaRoutes(app, mediaRepo, storage, requirePermission, ma
 
 // src/routes/admin/auth.ts
 import { getCookie as getCookie2 } from "hono/cookie";
-import { sql as sql4 } from "drizzle-orm";
+import { sql as sql3 } from "drizzle-orm";
 
 // src/auth/password.ts
 import { hashPassword, verifyPassword } from "@bobbykim/manguito-cms-core";
@@ -2336,7 +2141,7 @@ function registerAuthRoutes(app, db) {
       );
     }
     const userResult = await db.execute(
-      sql4`SELECT id, email, password_hash, role_id, token_version
+      sql3`SELECT id, email, password_hash, role_id, token_version
           FROM users WHERE email = ${email} LIMIT 1`
     );
     const user = userResult.rows[0];
@@ -2349,7 +2154,7 @@ function registerAuthRoutes(app, db) {
       return c.json(invalidCredentials, 401);
     }
     const roleResult = await db.execute(
-      sql4`SELECT r.name AS name, u.must_change_password
+      sql3`SELECT r.name AS name, u.must_change_password
           FROM roles r
           JOIN users u ON u.role_id = r.id
           WHERE r.id = ${user.role_id} AND u.id = ${user.id}
@@ -2409,7 +2214,7 @@ function registerAuthRoutes(app, db) {
       );
     }
     const rowResult = await db.execute(
-      sql4`SELECT u.token_version, r.name AS role
+      sql3`SELECT u.token_version, r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${payload.user_id}
@@ -2433,7 +2238,7 @@ function registerAuthRoutes(app, db) {
   app.post("/admin/api/auth/logout", authMiddleware, async (c) => {
     const user = c.get("user");
     await db.execute(
-      sql4`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
+      sql3`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
     );
     clearAuthCookie(c, "auth_token");
     clearAuthCookie(c, "refresh_token", "/admin/api/auth");
@@ -2442,7 +2247,7 @@ function registerAuthRoutes(app, db) {
 }
 
 // src/routes/admin/users.ts
-import { sql as sql5 } from "drizzle-orm";
+import { sql as sql4 } from "drizzle-orm";
 import { randomBytes } from "crypto";
 function getActingUser(c) {
   return c.get("user");
@@ -2477,7 +2282,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       );
     }
     const hashResult = await db.execute(
-      sql5`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      sql4`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const hashRow = hashResult.rows[0];
     if (!hashRow || !await verifyPassword(currentPassword, hashRow.password_hash)) {
@@ -2488,7 +2293,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
     }
     const newHash = await hashPassword(newPassword);
     await db.execute(
-      sql5`UPDATE users
+      sql4`UPDATE users
           SET password_hash       = ${newHash},
               must_change_password = false,
               token_version        = token_version + 1,
@@ -2499,7 +2304,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   });
   app.get("/admin/api/users", requirePermission("users:read"), async (c) => {
     const result = await db.execute(
-      sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      sql4`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -2510,7 +2315,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   app.get("/admin/api/users/:id", requirePermission("users:read"), async (c) => {
     const id = c.req.param("id");
     const result = await db.execute(
-      sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      sql4`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -2555,7 +2360,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const roleResult = await db.execute(
-        sql5`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
+        sql4`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
       );
       const roleRow = roleResult.rows[0];
       if (!roleRow) {
@@ -2570,7 +2375,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       const tempPassword = generateTempPassword();
       const passwordHash = await hashPassword(tempPassword);
       const insertResult = await db.execute(
-        sql5`INSERT INTO users
+        sql4`INSERT INTO users
               (id, email, password_hash, role_id, must_change_password, token_version,
                created_at, updated_at)
             VALUES
@@ -2625,7 +2430,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        sql5`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
+        sql4`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -2639,7 +2444,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       let changeRole = false;
       if (typeof body.role === "string" && body.role) {
         const roleResult = await db.execute(
-          sql5`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
+          sql4`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
         );
         const roleRow = roleResult.rows[0];
         if (!roleRow) {
@@ -2659,7 +2464,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       }
       if (changeRole) {
         await db.execute(
-          sql5`UPDATE users
+          sql4`UPDATE users
               SET email         = ${newEmail},
                   role_id       = ${newRoleId},
                   token_version = token_version + 1,
@@ -2668,7 +2473,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       } else {
         await db.execute(
-          sql5`UPDATE users
+          sql4`UPDATE users
               SET email      = ${newEmail},
                   role_id    = ${newRoleId},
                   updated_at = NOW()
@@ -2676,7 +2481,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const updatedResult = await db.execute(
-        sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+        sql4`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                    u.created_at, u.updated_at
             FROM users u
             JOIN roles r ON r.id = u.role_id
@@ -2713,7 +2518,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const result = await db.execute(
-        sql5`DELETE FROM users WHERE id = ${id} RETURNING id`
+        sql4`DELETE FROM users WHERE id = ${id} RETURNING id`
       );
       if (result.rows.length === 0) {
         return c.json(
@@ -2744,7 +2549,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        sql5`SELECT id FROM users WHERE id = ${id} LIMIT 1`
+        sql4`SELECT id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -2756,7 +2561,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       const tempPassword = generateTempPassword();
       const passwordHash = await hashPassword(tempPassword);
       await db.execute(
-        sql5`UPDATE users
+        sql4`UPDATE users
             SET password_hash        = ${passwordHash},
                 must_change_password = true,
                 token_version        = token_version + 1,
@@ -2769,10 +2574,10 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 }
 
 // src/routes/admin/config.ts
-import { sql as sql6 } from "drizzle-orm";
+import { sql as sql5 } from "drizzle-orm";
 var API_VERSION = (() => {
   try {
-    return "0.2.0";
+    return "0.3.0";
   } catch {
     return "0.0.0";
   }
@@ -2791,7 +2596,7 @@ function registerConfigRoute(app, config, registry, db) {
       permissions: r.permissions
     }));
     const userResult = await db.execute(
-      sql6`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      sql5`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const userRow = userResult.rows[0];
     return c.json({
@@ -2817,7 +2622,7 @@ function registerConfigRoute(app, config, registry, db) {
 }
 
 // src/routes/admin/schema.ts
-import { sql as sql7 } from "drizzle-orm";
+import { sql as sql6 } from "drizzle-orm";
 function registerSchemaRoute(app, registry, db) {
   app.get("/admin/api/schema", (c) => {
     const content_types = Object.values(registry.content_types).map((ct) => ({
@@ -2854,7 +2659,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.content_types).map(async (ct) => {
         const result = await db.execute(
-          sql7`SELECT COUNT(*)::int AS count FROM ${sql7.raw(`"${ct.db.table_name}"`)}`
+          sql6`SELECT COUNT(*)::int AS count FROM ${sql6.raw(`"${ct.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: ct.name, label: ct.label, only_one: ct.only_one, count };
@@ -2866,7 +2671,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.taxonomy_types).map(async (tt) => {
         const result = await db.execute(
-          sql7`SELECT COUNT(*)::int AS count FROM ${sql7.raw(`"${tt.db.table_name}"`)}`
+          sql6`SELECT COUNT(*)::int AS count FROM ${sql6.raw(`"${tt.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: tt.name, label: tt.label, count };
@@ -2877,15 +2682,15 @@ function registerSchemaRoute(app, registry, db) {
 }
 
 // src/repositories/content.ts
-import crypto2 from "crypto";
-import { sql as sql8 } from "drizzle-orm";
+import crypto from "crypto";
+import { sql as sql7 } from "drizzle-orm";
 var SORTABLE_FIELDS2 = /* @__PURE__ */ new Set(["title", "created_at", "updated_at"]);
 function codeError(code, message) {
   const err = new Error(message);
   err.code = code;
   return err;
 }
-function quoteIdent3(name) {
+function quoteIdent2(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Unsafe SQL identifier: ${name}`);
   }
@@ -2900,43 +2705,43 @@ function quoteField(name) {
 function buildConditions(published_only, filters, search) {
   const conds = [];
   if (published_only) {
-    conds.push(sql8`published = true`);
+    conds.push(sql7`published = true`);
   }
   if (search && search.term.trim() !== "" && search.columns.length > 0) {
     const pattern = `%${search.term.trim()}%`;
-    const orConds = search.columns.map((col) => sql8`${sql8.raw(quoteField(col))} ILIKE ${pattern}`);
-    conds.push(sql8`(${sql8.join(orConds, sql8` OR `)})`);
+    const orConds = search.columns.map((col) => sql7`${sql7.raw(quoteField(col))} ILIKE ${pattern}`);
+    conds.push(sql7`(${sql7.join(orConds, sql7` OR `)})`);
   }
   if (filters) {
     for (const [field, value] of Object.entries(filters)) {
-      const col = sql8.raw(quoteField(field));
+      const col = sql7.raw(quoteField(field));
       if (Array.isArray(value)) {
         if (value.length === 0) continue;
-        const inList = sql8.join(
-          value.map((v) => sql8`${v}`),
-          sql8`, `
+        const inList = sql7.join(
+          value.map((v) => sql7`${v}`),
+          sql7`, `
         );
-        conds.push(sql8`${col} IN (${inList})`);
+        conds.push(sql7`${col} IN (${inList})`);
       } else if (typeof value === "object" && value !== null) {
         const op = value;
-        if (op.gt !== void 0) conds.push(sql8`${col} > ${op.gt}`);
-        if (op.gte !== void 0) conds.push(sql8`${col} >= ${op.gte}`);
-        if (op.lt !== void 0) conds.push(sql8`${col} < ${op.lt}`);
-        if (op.lte !== void 0) conds.push(sql8`${col} <= ${op.lte}`);
+        if (op.gt !== void 0) conds.push(sql7`${col} > ${op.gt}`);
+        if (op.gte !== void 0) conds.push(sql7`${col} >= ${op.gte}`);
+        if (op.lt !== void 0) conds.push(sql7`${col} < ${op.lt}`);
+        if (op.lte !== void 0) conds.push(sql7`${col} <= ${op.lte}`);
       } else {
-        conds.push(sql8`${col} = ${value}`);
+        conds.push(sql7`${col} = ${value}`);
       }
     }
   }
   return conds;
 }
 function whereFragment(conds) {
-  return conds.length > 0 ? sql8` WHERE ${sql8.join(conds, sql8` AND `)}` : sql8``;
+  return conds.length > 0 ? sql7` WHERE ${sql7.join(conds, sql7` AND `)}` : sql7``;
 }
 function createDrizzleContentRepository(db, tableName, options = {}) {
-  const { relations = {} } = options;
+  const { relations = {}, publishedRelations = false } = options;
   function tableRaw() {
-    return sql8.raw(quoteIdent3(tableName));
+    return sql7.raw(quoteIdent2(tableName));
   }
   async function resolveRows(rows, include, cache) {
     if (rows.length === 0) return rows;
@@ -2947,7 +2752,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     }
     for (const [fieldName, rel] of Object.entries(relations)) {
       if (rel.type === "media") {
-        await resolveRelationField(db, rows, fieldName, rel, cache);
+        await resolveRelationField(db, rows, fieldName, rel, cache, publishedRelations);
       } else if (!include.includes(fieldName)) {
         await resolveRelationBareIds(db, rows, fieldName, rel);
       }
@@ -2955,7 +2760,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     for (const fieldName of include) {
       const rel = relations[fieldName];
       if (rel.type !== "media") {
-        await resolveRelationField(db, rows, fieldName, rel, cache);
+        await resolveRelationField(db, rows, fieldName, rel, cache, publishedRelations);
       }
     }
     return rows;
@@ -2978,14 +2783,14 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       const offset = (page - 1) * per_page;
       const conds = buildConditions(published_only, filters, search);
       const where = whereFragment(conds);
-      const sortCol = sql8.raw(quoteIdent3(sort_by));
-      const sortDir = sql8.raw(sort_order === "desc" ? "DESC" : "ASC");
+      const sortCol = sql7.raw(quoteIdent2(sort_by));
+      const sortDir = sql7.raw(sort_order === "desc" ? "DESC" : "ASC");
       const countResult = await db.execute(
-        sql8`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
+        sql7`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
       );
       const total = Number(countResult.rows[0]?.["total"] ?? 0);
       const dataResult = await db.execute(
-        sql8`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
+        sql7`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
       );
       const rows = dataResult.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -3006,7 +2811,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findOne(id, include = []) {
       const result = await db.execute(
-        sql8`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
+        sql7`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -3016,7 +2821,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findBySlug(slug, include = []) {
       const result = await db.execute(
-        sql8`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
+        sql7`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -3027,15 +2832,15 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     async create(data) {
       const record = {
         ...data,
-        id: crypto2.randomUUID(),
+        id: crypto.randomUUID(),
         created_at: /* @__PURE__ */ new Date(),
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = sql8.join(entries.map(([k]) => sql8.raw(quoteIdent3(k))), sql8`, `);
-      const valsSql = sql8.join(entries.map(([, v]) => sql8`${v}`), sql8`, `);
+      const colsSql = sql7.join(entries.map(([k]) => sql7.raw(quoteIdent2(k))), sql7`, `);
+      const valsSql = sql7.join(entries.map(([, v]) => sql7`${v}`), sql7`, `);
       const result = await db.execute(
-        sql8`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        sql7`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -3048,25 +2853,25 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       if (entries.length === 0) {
         return this.findOne(id);
       }
-      const setClauses = sql8.join(
-        entries.map(([k, v]) => sql8`${sql8.raw(quoteIdent3(k))} = ${v}`),
-        sql8`, `
+      const setClauses = sql7.join(
+        entries.map(([k, v]) => sql7`${sql7.raw(quoteIdent2(k))} = ${v}`),
+        sql7`, `
       );
       const result = await db.execute(
-        sql8`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        sql7`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(sql8`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
+      await db.execute(sql7`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
     },
     async findAll(opts = {}) {
       const { include = [], published_only } = opts;
       const conds = buildConditions(published_only, void 0, void 0);
       const where = whereFragment(conds);
       const result = await db.execute(
-        sql8`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
+        sql7`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
       );
       const rows = result.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -3077,24 +2882,24 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
 }
 
 // src/repositories/media.ts
-import crypto3 from "crypto";
-import { sql as sql9 } from "drizzle-orm";
+import crypto2 from "crypto";
+import { sql as sql8 } from "drizzle-orm";
 function createMediaRepository(db) {
-  const TABLE = sql9.raw('"media"');
+  const TABLE = sql8.raw('"media"');
   return {
     async findMany(opts = {}) {
       const { page = 1, per_page = 10, type, orphaned } = opts;
       const offset = (page - 1) * per_page;
       const conds = [];
-      if (type) conds.push(sql9`type = ${type}`);
-      if (orphaned) conds.push(sql9`reference_count = 0`);
-      const where = conds.length > 0 ? sql9` WHERE ${sql9.join(conds, sql9` AND `)}` : sql9``;
-      const countResult = await db.execute(sql9`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
+      if (type) conds.push(sql8`type = ${type}`);
+      if (orphaned) conds.push(sql8`reference_count = 0`);
+      const where = conds.length > 0 ? sql8` WHERE ${sql8.join(conds, sql8` AND `)}` : sql8``;
+      const countResult = await db.execute(sql8`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
       const total = Number(
         countResult.rows[0]?.["total"] ?? 0
       );
       const dataResult = await db.execute(
-        sql9`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
+        sql8`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
       );
       const total_pages = Math.ceil(total / per_page);
       return {
@@ -3112,7 +2917,7 @@ function createMediaRepository(db) {
     },
     async findOne(id) {
       const result = await db.execute(
-        sql9`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
+        sql8`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
@@ -3120,16 +2925,16 @@ function createMediaRepository(db) {
     async create(data) {
       const record = {
         ...data,
-        id: crypto3.randomUUID(),
+        id: crypto2.randomUUID(),
         reference_count: 0,
         created_at: /* @__PURE__ */ new Date(),
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = sql9.join(entries.map(([k]) => sql9.raw(`"${k}"`)), sql9`, `);
-      const valsSql = sql9.join(entries.map(([, v]) => sql9`${v}`), sql9`, `);
+      const colsSql = sql8.join(entries.map(([k]) => sql8.raw(`"${k}"`)), sql8`, `);
+      const valsSql = sql8.join(entries.map(([, v]) => sql8`${v}`), sql8`, `);
       const result = await db.execute(
-        sql9`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        sql8`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -3139,31 +2944,31 @@ function createMediaRepository(db) {
         ([k, v]) => k !== "id" && v !== void 0
       );
       if (entries.length === 0) return this.findOne(id);
-      const setClauses = sql9.join(
-        entries.map(([k, v]) => sql9`${sql9.raw(`"${k}"`)} = ${v}`),
-        sql9`, `
+      const setClauses = sql8.join(
+        entries.map(([k, v]) => sql8`${sql8.raw(`"${k}"`)} = ${v}`),
+        sql8`, `
       );
       const result = await db.execute(
-        sql9`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        sql8`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(sql9`DELETE FROM ${TABLE} WHERE id = ${id}`);
+      await db.execute(sql8`DELETE FROM ${TABLE} WHERE id = ${id}`);
     },
     async incrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = sql9.join(ids.map((id) => sql9`${id}`), sql9`, `);
+      const inList = sql8.join(ids.map((id) => sql8`${id}`), sql8`, `);
       await db.execute(
-        sql9`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
+        sql8`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
       );
     },
     async decrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = sql9.join(ids.map((id) => sql9`${id}`), sql9`, `);
+      const inList = sql8.join(ids.map((id) => sql8`${id}`), sql8`, `);
       await db.execute(
-        sql9`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
+        sql8`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
       );
     }
   };
@@ -3193,7 +2998,14 @@ function createCmsApp(options) {
   const programmaticResolver = createProgrammaticResolver(resolverMap);
   const app = new Hono();
   const uploadOrigins = storage.getUploadOrigins?.() ?? [];
-  app.use("*", createSecurityHeadersMiddleware({ connectSrc: uploadOrigins }));
+  const graphiqlEnabled = options.graphql?.enabled === true && options.graphql.graphiql === true;
+  app.use(
+    "*",
+    createSecurityHeadersMiddleware({
+      connectSrc: uploadOrigins,
+      ...graphiqlEnabled && { graphiqlPath: "/graphql" }
+    })
+  );
   app.use("*", createCorsMiddleware(cors ?? { origin: "*", enabled: true }));
   app.onError(errorHandler);
   const listRateLimit = resolveListRateLimit(rateLimit);
@@ -3201,7 +3013,7 @@ function createCmsApp(options) {
   const requirePermission = createPermissionMiddleware(rolesRegistry);
   const getUserRole = async (userId) => {
     const result = await db.execute(
-      sql10`SELECT r.name AS role
+      sql9`SELECT r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${userId}
@@ -3228,7 +3040,8 @@ function createCmsApp(options) {
     Object.entries(registry.content_types).map(([typeName, ct]) => [
       typeName,
       createDrizzleContentRepository(db, ct.db.table_name, {
-        relations: buildRelationsMap(ct.fields, registry)
+        relations: buildRelationsMap(ct.fields, registry),
+        publishedRelations: true
       })
     ])
   );
@@ -3236,7 +3049,8 @@ function createCmsApp(options) {
     Object.entries(registry.taxonomy_types).map(([typeName, tt]) => [
       typeName,
       createDrizzleContentRepository(db, tt.db.table_name, {
-        relations: buildRelationsMap(tt.fields, registry)
+        relations: buildRelationsMap(tt.fields, registry),
+        publishedRelations: true
       })
     ])
   );
@@ -3277,6 +3091,35 @@ function createCmsApp(options) {
   );
   registerPublicContentRoutes(app, registry, publicRepos, listRateLimit, programmaticResolver);
   registerPublicMediaRoutes(app, mediaRepo, listRateLimit);
+  if (options.graphql?.enabled) {
+    const gqlOptions = options.graphql;
+    let gqlHandler = null;
+    let initError = null;
+    const ready = import("./handler-GMCFYZY5.mjs").then(({ createGraphQLHandler }) => {
+      gqlHandler = createGraphQLHandler(registry, publicRepos, programmaticResolver, db, gqlOptions);
+    }).catch((err) => {
+      initError = err;
+      const message = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`\u2717 GraphQL schema failed to initialize; /graphql will return 500. ${message}
+`);
+    });
+    const invokeGraphQL = async (c) => {
+      if (!gqlHandler && !initError) await ready;
+      if (!gqlHandler) {
+        return c.json(
+          { ok: false, error: { code: "GRAPHQL_INIT_FAILED", message: "GraphQL schema failed to initialize" } },
+          500
+        );
+      }
+      return gqlHandler(c, async () => {
+      });
+    };
+    if (listRateLimit) {
+      app.all("/graphql", listRateLimit, invokeGraphQL);
+    } else {
+      app.all("/graphql", invokeGraphQL);
+    }
+  }
   registerConfigRoute(
     app,
     {
@@ -3323,13 +3166,24 @@ function createServer(options = {}) {
 }
 
 // src/index.ts
+function resolveGraphQL(cfg) {
+  const devDefault = process.env["NODE_ENV"] !== "production";
+  return {
+    enabled: cfg.enabled ?? false,
+    maxDepth: cfg.maxDepth ?? 8,
+    maxComplexity: cfg.maxComplexity ?? 1e3,
+    graphiql: cfg.graphiql ?? devDefault,
+    introspection: cfg.introspection ?? cfg.graphiql ?? devDefault
+  };
+}
 function createAPIAdapter(options = {}) {
   const prefix = options.prefix ?? "/api";
   const media = options.media?.max_file_size !== void 0 ? { max_file_size: options.media.max_file_size } : void 0;
   return {
     prefix,
     ...media !== void 0 && { media },
-    ...options.rateLimit !== void 0 && { rateLimit: options.rateLimit }
+    ...options.rateLimit !== void 0 && { rateLimit: options.rateLimit },
+    ...options.graphql !== void 0 && { graphql: resolveGraphQL(options.graphql) }
   };
 }
 export {