@bobbykim/manguito-cms-api 0.7.0 → 0.8.0

package/dist/index.mjs

@@ -4,11 +4,13 @@ import {
   createFieldKeyMapFromProjection,
   deleteParagraphField,
   isColumnBacked,
+  oneOrMany,
+  paragraphItems,
   persistJunctionField,
   persistParagraphField,
   resolveRelationBareIds,
   resolveRelationField
-} from "./chunk-FXPKGPYF.mjs";
+} from "./chunk-IHEIX6P4.mjs";
 
 // src/paths.ts
 function normalizePrefix(prefix) {
@@ -36,7 +38,7 @@ function createVersionedPaths(prefix, version) {
 
 // src/app.ts
 import { Hono } from "hono";
-import { sql as sql9 } from "drizzle-orm";
+import { sql as sql10 } from "drizzle-orm";
 
 // src/middleware/cors.ts
 function createCorsMiddleware(corsConfig) {
@@ -130,16 +132,20 @@ var ERROR_STATUS_MAP = {
   UNSUPPORTED_MIME_TYPE: 415,
   STORAGE_ERROR: 502,
   MEDIA_IN_USE: 409,
+  ITEM_IN_USE: 409,
   PRESIGNED_URL_EXPIRED: 410,
   RATE_LIMITED: 429,
   INTERNAL_ERROR: 500
 };
 var errorHandler = (err, c) => {
   console.error(err.stack ?? err.message);
-  const apiErr = err;
-  const code = apiErr.code ?? "INTERNAL_ERROR";
-  const status = ERROR_STATUS_MAP[code] ?? 500;
-  return c.json({ ok: false, error: { code, message: err.message } }, status);
+  const raw = err.code;
+  const deliberate = raw !== void 0 && raw !== "INTERNAL_ERROR" && raw in ERROR_STATUS_MAP;
+  if (!deliberate) {
+    return c.json({ ok: false, error: { code: "INTERNAL_ERROR", message: "Internal server error" } }, 500);
+  }
+  const status = ERROR_STATUS_MAP[raw] ?? 500;
+  return c.json({ ok: false, error: { code: raw, message: err.message } }, status);
 };
 
 // src/middleware/auth.ts
@@ -1043,7 +1049,55 @@ function registerPublicMediaRoutes(app, mediaRepo, paths, listRateLimit) {
 }
 
 // src/routes/admin/content.ts
+import { sql as sql3 } from "drizzle-orm";
+
+// src/references-in-use.ts
 import { sql as sql2 } from "drizzle-orm";
+import { relationCardinality } from "@bobbykim/manguito-cms-core";
+function quoteIdent(name) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
+  return `"${name}"`;
+}
+function isRequiredSingleReferenceTo(f, targetType) {
+  return f.field_type === "reference" && f.required && relationCardinality(f) === "one" && f.db_column?.foreign_key !== void 0 && f.ui_component.component === "typeahead-select" && f.ui_component.ref === targetType;
+}
+async function findRequiredReferrers(db, registry, targetType, id) {
+  const owners = [
+    ...Object.values(registry.content_types),
+    ...Object.values(registry.taxonomy_types),
+    ...Object.values(registry.paragraph_types)
+  ];
+  const out = [];
+  for (const owner of owners) {
+    for (const f of owner.fields) {
+      if (!isRequiredSingleReferenceTo(f, targetType)) continue;
+      const notSelf = owner.name === targetType ? sql2` AND id <> ${id}` : sql2``;
+      const r = await db.execute(
+        sql2`SELECT count(*)::int AS n FROM ${sql2.raw(quoteIdent(owner.db.table_name))} WHERE ${sql2.raw(quoteIdent(f.db_column.column_name))} = ${id}${notSelf}`
+      );
+      const n = r.rows[0].n;
+      if (n > 0) out.push({ type_label: owner.label, field_label: f.label, count: n });
+    }
+  }
+  return out;
+}
+function inUseMessage(referrers) {
+  const total = referrers.reduce((sum, r) => sum + r.count, 0);
+  const where = referrers.map((r) => `${r.count} in ${r.type_label} (${r.field_label})`).join(", ");
+  return `This item is still used by ${total} item${total === 1 ? "" : "s"}: ${where}. Remove it from those first.`;
+}
+var IN_USE_RACE_MESSAGE = "This item is still in use. Remove it from the items that use it first.";
+function isForeignKeyViolation(err) {
+  let e = err;
+  for (let depth = 0; depth < 3 && typeof e === "object" && e !== null; depth++) {
+    if (e.code === "23503") return true;
+    e = e.cause;
+  }
+  return false;
+}
+
+// src/routes/admin/content.ts
+import { relationCardinality as relationCardinality3 } from "@bobbykim/manguito-cms-core";
 
 // src/media-references.ts
 function extractMediaId(value) {
@@ -1079,14 +1133,60 @@ async function applyMediaReferenceDelta(delta, mediaRepo) {
   if (netRemove.length > 0) await mediaRepo.decrementReferenceCount(netRemove);
 }
 
+// src/relation-input.ts
+import { relationCardinality as relationCardinality2 } from "@bobbykim/manguito-cms-core";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(v) {
+  return typeof v === "string" && UUID_RE.test(v);
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function checkRelationInput(fields, body, registry, path = "") {
+  const errors = [];
+  for (const field of fields) {
+    if (!(field.name in body)) continue;
+    const cardinality = relationCardinality2(field);
+    if (cardinality === null) continue;
+    const value = body[field.name];
+    const name = `${path}${field.name}`;
+    if (field.field_type === "reference") {
+      const ok = cardinality === "one" ? value === null || isUuid(value) : Array.isArray(value) && value.every(isUuid);
+      if (!ok) {
+        errors.push({
+          field: name,
+          message: cardinality === "one" ? `${name} holds one item: send a UUID string or null.` : `${name} holds a list: send an array of UUID strings.`
+        });
+      }
+      continue;
+    }
+    const items = cardinality === "one" ? value === null ? [] : isPlainObject(value) ? [value] : void 0 : Array.isArray(value) && value.every(isPlainObject) ? value : void 0;
+    if (items === void 0) {
+      errors.push({
+        field: name,
+        message: cardinality === "one" ? `${name} holds one item: send an object or null.` : `${name} holds a list: send an array of objects.`
+      });
+      continue;
+    }
+    const comp = field.ui_component;
+    const pType = comp.component === "paragraph-embed" ? registry.paragraph_types[comp.ref] : void 0;
+    if (!pType) continue;
+    items.forEach((item, i) => {
+      const prefix = cardinality === "one" ? `${name}.` : `${name}[${i}].`;
+      errors.push(...checkRelationInput(pType.fields, item, registry, prefix));
+    });
+  }
+  return errors;
+}
+
 // src/routes/admin/content.ts
-function quoteIdent(name) {
+function quoteIdent2(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
 async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   const result = await db.execute(
-    sql2`SELECT * FROM ${sql2.raw(quoteIdent(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
+    sql3`SELECT * FROM ${sql3.raw(quoteIdent2(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
   );
   const rows = result.rows;
   for (const nf of pType.fields) {
@@ -1096,14 +1196,17 @@ async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
     const nType = registry.paragraph_types[comp.ref];
     if (!nType) continue;
     for (const row of rows) {
-      row[nf.name] = await loadParagraphRows(db, registry, nType, row["id"], nf.name);
+      row[nf.name] = oneOrMany(
+        relationCardinality3(nf) ?? "many",
+        await loadParagraphRows(db, registry, nType, row["id"], nf.name)
+      );
     }
   }
   return rows;
 }
 async function lookupBasePathId(db, pathOrName) {
   const r = await db.execute(
-    sql2`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
+    sql3`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
   );
   return r.rows[0]?.id ?? null;
 }
@@ -1117,6 +1220,14 @@ function isEmpty(value) {
 function checkRequiredFields(fields, data) {
   return fields.filter((f) => f.required && isEmpty(data[f.name])).map((f) => ({ field: f.name, message: `${f.label} is required` }));
 }
+function relationShapeError(c, fields, body, registry) {
+  const details = checkRelationInput(fields, body, registry);
+  if (details.length === 0) return null;
+  return c.json(
+    { ok: false, error: { code: "VALIDATION_ERROR", message: "Relation fields have the wrong shape", details } },
+    422
+  );
+}
 function parseListQuery(url, schemaFieldNames, relationFieldNames, columnFor) {
   const searchParams = new URL(url).searchParams;
   const pagination = parsePagination(
@@ -1258,11 +1369,11 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
               if (comp.component !== "paragraph-embed" || !comp.ref) continue;
               const pType = registry.paragraph_types[comp.ref];
               if (!pType) continue;
-              row[f.name] = await loadParagraphRows(db, registry, pType, id, f.name);
+              row[f.name] = oneOrMany(relationCardinality3(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name));
             } else if (f.db_column.junction) {
               const j = f.db_column.junction;
               const r = await db.execute(
-                sql2`SELECT ${sql2.raw(quoteIdent(j.right_column))} FROM ${sql2.raw(quoteIdent(j.table_name))} WHERE ${sql2.raw(quoteIdent(j.left_column))} = ${id}`
+                sql3`SELECT ${sql3.raw(quoteIdent2(j.right_column))} FROM ${sql3.raw(quoteIdent2(j.table_name))} WHERE ${sql3.raw(quoteIdent2(j.left_column))} = ${id}`
               );
               row[f.name] = r.rows.map(
                 (row2) => row2[j.right_column]
@@ -1338,6 +1449,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
     );
     const writeNewItem = async (c, body) => {
+      const shapeError = relationShapeError(c, contentType.fields, body, registry);
+      if (shapeError) return shapeError;
       const storageBody = fieldKeys.toStorage(body);
       const fieldErrors = checkRequiredFields(requiredFields, body);
       if (fieldErrors.length > 0) {
@@ -1401,7 +1514,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
           if (comp.component !== "paragraph-embed" || !comp.ref) continue;
           const pType = registry.paragraph_types[comp.ref];
           if (!pType) continue;
-          const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+          const items = paragraphItems(f, body[f.name]);
           mediaDeltas.push(await persistParagraphField(db, itemId, contentType.db.table_name, f.name, pType, items, registry));
         }
         for (const f of junctionFields) {
@@ -1472,6 +1585,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
     );
     const writeExistingItem = async (c, id, existing, body) => {
+      const shapeError = relationShapeError(c, contentType.fields, body, registry);
+      if (shapeError) return shapeError;
       const storageBody = fieldKeys.toStorage(body);
       if (body["published"] === true) {
         const publishDeny = await requirePermission("content:edit")(c, async () => {
@@ -1518,14 +1633,16 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       ];
       if (db) {
         for (const f of patchParagraphFields) {
+          if (!(f.name in body)) continue;
           const comp = f.ui_component;
           if (comp.component !== "paragraph-embed" || !comp.ref) continue;
           const pType = registry.paragraph_types[comp.ref];
           if (!pType) continue;
-          const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+          const items = paragraphItems(f, body[f.name]);
           mediaDeltas.push(await persistParagraphField(db, id, contentType.db.table_name, f.name, pType, items, registry));
         }
         for (const f of patchJunctionFields) {
+          if (!(f.name in body)) continue;
           const junction = f.db_column.junction;
           const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
           await persistJunctionField(db, id, junction, relatedIds);
@@ -1565,6 +1682,18 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
+        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
+        if (referrers.length > 0) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
+        }
+        try {
+          await repo.delete(id);
+        } catch (err) {
+          if (isForeignKeyViolation(err)) {
+            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
+          }
+          throw err;
+        }
         const mediaDeltas = [
           topLevelMediaDelta(mediaFields, item, null)
         ];
@@ -1578,7 +1707,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
           }
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
-        await repo.delete(id);
         return c.json({ ok: true });
       }
     );
@@ -1656,6 +1784,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       requirePermission("content:create"),
       async (c) => {
         const body = await c.req.json();
+        const shapeError = relationShapeError(c, taxonomyType.fields, body, registry);
+        if (shapeError) return shapeError;
         const storageBody = fieldKeys.toStorage(body);
         const fieldErrors = checkRequiredFields(requiredFields, body);
         if (fieldErrors.length > 0) {
@@ -1695,7 +1825,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             if (comp.component !== "paragraph-embed" || !comp.ref) continue;
             const pType = registry.paragraph_types[comp.ref];
             if (!pType) continue;
-            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+            const items = paragraphItems(f, body[f.name]);
             mediaDeltas.push(await persistParagraphField(db, taxItemId, taxonomyType.db.table_name, f.name, pType, items, registry));
           }
         }
@@ -1718,6 +1848,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
+        const shapeError = relationShapeError(c, taxonomyType.fields, body, registry);
+        if (shapeError) return shapeError;
         if (body["published"] === true) {
           const publishDeny = await requirePermission("content:edit")(c, async () => {
           });
@@ -1759,11 +1891,12 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         ];
         if (db) {
           for (const f of taxPatchParagraphFields) {
+            if (!(f.name in body)) continue;
             const comp = f.ui_component;
             if (comp.component !== "paragraph-embed" || !comp.ref) continue;
             const pType = registry.paragraph_types[comp.ref];
             if (!pType) continue;
-            const items = Array.isArray(body[f.name]) ? body[f.name] : [];
+            const items = paragraphItems(f, body[f.name]);
             mediaDeltas.push(await persistParagraphField(db, id, taxonomyType.db.table_name, f.name, pType, items, registry));
           }
         }
@@ -1784,6 +1917,18 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
+        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
+        if (referrers.length > 0) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
+        }
+        try {
+          await repo.delete(id);
+        } catch (err) {
+          if (isForeignKeyViolation(err)) {
+            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
+          }
+          throw err;
+        }
         const mediaDeltas = [
           topLevelMediaDelta(mediaFields, item, null)
         ];
@@ -1797,7 +1942,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
           }
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
-        await repo.delete(id);
         return c.json({ ok: true });
       }
     );
@@ -2259,7 +2403,7 @@ function registerAdminMediaRoutes(app, mediaRepo, storage, requirePermission, ma
 
 // src/routes/admin/auth.ts
 import { getCookie as getCookie2 } from "hono/cookie";
-import { sql as sql3 } from "drizzle-orm";
+import { sql as sql4 } from "drizzle-orm";
 
 // src/auth/password.ts
 import { hashPassword, verifyPassword } from "@bobbykim/manguito-cms-core";
@@ -2325,7 +2469,7 @@ function registerAuthRoutes(app, db) {
       );
     }
     const userResult = await db.execute(
-      sql3`SELECT id, email, password_hash, role_id, token_version
+      sql4`SELECT id, email, password_hash, role_id, token_version
           FROM users WHERE email = ${email} LIMIT 1`
     );
     const user = userResult.rows[0];
@@ -2338,7 +2482,7 @@ function registerAuthRoutes(app, db) {
       return c.json(invalidCredentials, 401);
     }
     const roleResult = await db.execute(
-      sql3`SELECT r.name AS name, u.must_change_password
+      sql4`SELECT r.name AS name, u.must_change_password
           FROM roles r
           JOIN users u ON u.role_id = r.id
           WHERE r.id = ${user.role_id} AND u.id = ${user.id}
@@ -2398,7 +2542,7 @@ function registerAuthRoutes(app, db) {
       );
     }
     const rowResult = await db.execute(
-      sql3`SELECT u.token_version, r.name AS role
+      sql4`SELECT u.token_version, r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${payload.user_id}
@@ -2422,7 +2566,7 @@ function registerAuthRoutes(app, db) {
   app.post("/admin/api/auth/logout", authMiddleware, async (c) => {
     const user = c.get("user");
     await db.execute(
-      sql3`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
+      sql4`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
     );
     clearAuthCookie(c, "auth_token");
     clearAuthCookie(c, "refresh_token", "/admin/api/auth");
@@ -2431,7 +2575,7 @@ function registerAuthRoutes(app, db) {
 }
 
 // src/routes/admin/users.ts
-import { sql as sql4 } from "drizzle-orm";
+import { sql as sql5 } from "drizzle-orm";
 import { randomBytes } from "crypto";
 function getActingUser(c) {
   return c.get("user");
@@ -2466,7 +2610,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       );
     }
     const hashResult = await db.execute(
-      sql4`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      sql5`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const hashRow = hashResult.rows[0];
     if (!hashRow || !await verifyPassword(currentPassword, hashRow.password_hash)) {
@@ -2477,7 +2621,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
     }
     const newHash = await hashPassword(newPassword);
     await db.execute(
-      sql4`UPDATE users
+      sql5`UPDATE users
           SET password_hash       = ${newHash},
               must_change_password = false,
               token_version        = token_version + 1,
@@ -2488,7 +2632,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   });
   app.get("/admin/api/users", requirePermission("users:read"), async (c) => {
     const result = await db.execute(
-      sql4`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -2499,7 +2643,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   app.get("/admin/api/users/:id", requirePermission("users:read"), async (c) => {
     const id = c.req.param("id");
     const result = await db.execute(
-      sql4`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -2544,7 +2688,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const roleResult = await db.execute(
-        sql4`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
+        sql5`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
       );
       const roleRow = roleResult.rows[0];
       if (!roleRow) {
@@ -2559,7 +2703,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       const tempPassword = generateTempPassword();
       const passwordHash = await hashPassword(tempPassword);
       const insertResult = await db.execute(
-        sql4`INSERT INTO users
+        sql5`INSERT INTO users
               (id, email, password_hash, role_id, must_change_password, token_version,
                created_at, updated_at)
             VALUES
@@ -2614,7 +2758,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        sql4`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
+        sql5`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -2628,7 +2772,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       let changeRole = false;
       if (typeof body.role === "string" && body.role) {
         const roleResult = await db.execute(
-          sql4`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
+          sql5`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
         );
         const roleRow = roleResult.rows[0];
         if (!roleRow) {
@@ -2648,7 +2792,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       }
       if (changeRole) {
         await db.execute(
-          sql4`UPDATE users
+          sql5`UPDATE users
               SET email         = ${newEmail},
                   role_id       = ${newRoleId},
                   token_version = token_version + 1,
@@ -2657,7 +2801,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       } else {
         await db.execute(
-          sql4`UPDATE users
+          sql5`UPDATE users
               SET email      = ${newEmail},
                   role_id    = ${newRoleId},
                   updated_at = NOW()
@@ -2665,7 +2809,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const updatedResult = await db.execute(
-        sql4`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+        sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                    u.created_at, u.updated_at
             FROM users u
             JOIN roles r ON r.id = u.role_id
@@ -2702,7 +2846,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const result = await db.execute(
-        sql4`DELETE FROM users WHERE id = ${id} RETURNING id`
+        sql5`DELETE FROM users WHERE id = ${id} RETURNING id`
       );
       if (result.rows.length === 0) {
         return c.json(
@@ -2733,7 +2877,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        sql4`SELECT id FROM users WHERE id = ${id} LIMIT 1`
+        sql5`SELECT id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -2745,7 +2889,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       const tempPassword = generateTempPassword();
       const passwordHash = await hashPassword(tempPassword);
       await db.execute(
-        sql4`UPDATE users
+        sql5`UPDATE users
             SET password_hash        = ${passwordHash},
                 must_change_password = true,
                 token_version        = token_version + 1,
@@ -2758,10 +2902,10 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 }
 
 // src/routes/admin/config.ts
-import { sql as sql5 } from "drizzle-orm";
+import { sql as sql6 } from "drizzle-orm";
 var API_VERSION = (() => {
   try {
-    return "0.7.0";
+    return "0.8.0";
   } catch {
     return "0.0.0";
   }
@@ -2780,7 +2924,7 @@ function registerConfigRoute(app, config, registry, db) {
       permissions: r.permissions
     }));
     const userResult = await db.execute(
-      sql5`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      sql6`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const userRow = userResult.rows[0];
     return c.json({
@@ -2806,7 +2950,7 @@ function registerConfigRoute(app, config, registry, db) {
 }
 
 // src/routes/admin/schema.ts
-import { sql as sql6 } from "drizzle-orm";
+import { sql as sql7 } from "drizzle-orm";
 function liveFields(fields) {
   return fields.filter((f) => f.removed !== true);
 }
@@ -2846,7 +2990,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.content_types).map(async (ct) => {
         const result = await db.execute(
-          sql6`SELECT COUNT(*)::int AS count FROM ${sql6.raw(`"${ct.db.table_name}"`)}`
+          sql7`SELECT COUNT(*)::int AS count FROM ${sql7.raw(`"${ct.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: ct.name, label: ct.label, only_one: ct.only_one, count };
@@ -2858,7 +3002,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.taxonomy_types).map(async (tt) => {
         const result = await db.execute(
-          sql6`SELECT COUNT(*)::int AS count FROM ${sql6.raw(`"${tt.db.table_name}"`)}`
+          sql7`SELECT COUNT(*)::int AS count FROM ${sql7.raw(`"${tt.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: tt.name, label: tt.label, count };
@@ -2870,14 +3014,14 @@ function registerSchemaRoute(app, registry, db) {
 
 // src/repositories/content.ts
 import crypto from "crypto";
-import { sql as sql7 } from "drizzle-orm";
+import { sql as sql8 } from "drizzle-orm";
 var SORTABLE_FIELDS2 = /* @__PURE__ */ new Set(["title", "created_at", "updated_at"]);
 function codeError(code, message) {
   const err = new Error(message);
   err.code = code;
   return err;
 }
-function quoteIdent2(name) {
+function quoteIdent3(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Unsafe SQL identifier: ${name}`);
   }
@@ -2892,43 +3036,43 @@ function quoteField(name) {
 function buildConditions(published_only, filters, search) {
   const conds = [];
   if (published_only) {
-    conds.push(sql7`published = true`);
+    conds.push(sql8`published = true`);
   }
   if (search && search.term.trim() !== "" && search.columns.length > 0) {
     const pattern = `%${search.term.trim()}%`;
-    const orConds = search.columns.map((col) => sql7`${sql7.raw(quoteField(col))} ILIKE ${pattern}`);
-    conds.push(sql7`(${sql7.join(orConds, sql7` OR `)})`);
+    const orConds = search.columns.map((col) => sql8`${sql8.raw(quoteField(col))} ILIKE ${pattern}`);
+    conds.push(sql8`(${sql8.join(orConds, sql8` OR `)})`);
   }
   if (filters) {
     for (const [field, value] of Object.entries(filters)) {
-      const col = sql7.raw(quoteField(field));
+      const col = sql8.raw(quoteField(field));
       if (Array.isArray(value)) {
         if (value.length === 0) continue;
-        const inList = sql7.join(
-          value.map((v) => sql7`${v}`),
-          sql7`, `
+        const inList = sql8.join(
+          value.map((v) => sql8`${v}`),
+          sql8`, `
         );
-        conds.push(sql7`${col} IN (${inList})`);
+        conds.push(sql8`${col} IN (${inList})`);
       } else if (typeof value === "object" && value !== null) {
         const op = value;
-        if (op.gt !== void 0) conds.push(sql7`${col} > ${op.gt}`);
-        if (op.gte !== void 0) conds.push(sql7`${col} >= ${op.gte}`);
-        if (op.lt !== void 0) conds.push(sql7`${col} < ${op.lt}`);
-        if (op.lte !== void 0) conds.push(sql7`${col} <= ${op.lte}`);
+        if (op.gt !== void 0) conds.push(sql8`${col} > ${op.gt}`);
+        if (op.gte !== void 0) conds.push(sql8`${col} >= ${op.gte}`);
+        if (op.lt !== void 0) conds.push(sql8`${col} < ${op.lt}`);
+        if (op.lte !== void 0) conds.push(sql8`${col} <= ${op.lte}`);
       } else {
-        conds.push(sql7`${col} = ${value}`);
+        conds.push(sql8`${col} = ${value}`);
       }
     }
   }
   return conds;
 }
 function whereFragment(conds) {
-  return conds.length > 0 ? sql7` WHERE ${sql7.join(conds, sql7` AND `)}` : sql7``;
+  return conds.length > 0 ? sql8` WHERE ${sql8.join(conds, sql8` AND `)}` : sql8``;
 }
 function createDrizzleContentRepository(db, tableName, options = {}) {
   const { relations = {}, publishedRelations = false, sortableColumns } = options;
   function tableRaw() {
-    return sql7.raw(quoteIdent2(tableName));
+    return sql8.raw(quoteIdent3(tableName));
   }
   async function resolveRows(rows, include, cache) {
     if (rows.length === 0) return rows;
@@ -2971,14 +3115,14 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       const offset = (page - 1) * per_page;
       const conds = buildConditions(published_only, filters, search);
       const where = whereFragment(conds);
-      const sortCol = sql7.raw(quoteIdent2(sort_by));
-      const sortDir = sql7.raw(sort_order === "desc" ? "DESC" : "ASC");
+      const sortCol = sql8.raw(quoteIdent3(sort_by));
+      const sortDir = sql8.raw(sort_order === "desc" ? "DESC" : "ASC");
       const countResult = await db.execute(
-        sql7`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
+        sql8`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
       );
       const total = Number(countResult.rows[0]?.["total"] ?? 0);
       const dataResult = await db.execute(
-        sql7`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
+        sql8`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
       );
       const rows = dataResult.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -2999,7 +3143,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findOne(id, include = []) {
       const result = await db.execute(
-        sql7`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
+        sql8`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -3009,7 +3153,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findBySlug(slug, include = []) {
       const result = await db.execute(
-        sql7`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
+        sql8`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -3025,10 +3169,10 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = sql7.join(entries.map(([k]) => sql7.raw(quoteIdent2(k))), sql7`, `);
-      const valsSql = sql7.join(entries.map(([, v]) => sql7`${v}`), sql7`, `);
+      const colsSql = sql8.join(entries.map(([k]) => sql8.raw(quoteIdent3(k))), sql8`, `);
+      const valsSql = sql8.join(entries.map(([, v]) => sql8`${v}`), sql8`, `);
       const result = await db.execute(
-        sql7`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        sql8`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -3041,25 +3185,25 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       if (entries.length === 0) {
         return this.findOne(id);
       }
-      const setClauses = sql7.join(
-        entries.map(([k, v]) => sql7`${sql7.raw(quoteIdent2(k))} = ${v}`),
-        sql7`, `
+      const setClauses = sql8.join(
+        entries.map(([k, v]) => sql8`${sql8.raw(quoteIdent3(k))} = ${v}`),
+        sql8`, `
       );
       const result = await db.execute(
-        sql7`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        sql8`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(sql7`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
+      await db.execute(sql8`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
     },
     async findAll(opts = {}) {
       const { include = [], published_only } = opts;
       const conds = buildConditions(published_only, void 0, void 0);
       const where = whereFragment(conds);
       const result = await db.execute(
-        sql7`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
+        sql8`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
       );
       const rows = result.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -3071,23 +3215,23 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
 
 // src/repositories/media.ts
 import crypto2 from "crypto";
-import { sql as sql8 } from "drizzle-orm";
+import { sql as sql9 } from "drizzle-orm";
 function createMediaRepository(db) {
-  const TABLE = sql8.raw('"media"');
+  const TABLE = sql9.raw('"media"');
   return {
     async findMany(opts = {}) {
       const { page = 1, per_page = 10, type, orphaned } = opts;
       const offset = (page - 1) * per_page;
       const conds = [];
-      if (type) conds.push(sql8`type = ${type}`);
-      if (orphaned) conds.push(sql8`reference_count = 0`);
-      const where = conds.length > 0 ? sql8` WHERE ${sql8.join(conds, sql8` AND `)}` : sql8``;
-      const countResult = await db.execute(sql8`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
+      if (type) conds.push(sql9`type = ${type}`);
+      if (orphaned) conds.push(sql9`reference_count = 0`);
+      const where = conds.length > 0 ? sql9` WHERE ${sql9.join(conds, sql9` AND `)}` : sql9``;
+      const countResult = await db.execute(sql9`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
       const total = Number(
         countResult.rows[0]?.["total"] ?? 0
       );
       const dataResult = await db.execute(
-        sql8`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
+        sql9`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
       );
       const total_pages = Math.ceil(total / per_page);
       return {
@@ -3105,7 +3249,7 @@ function createMediaRepository(db) {
     },
     async findOne(id) {
       const result = await db.execute(
-        sql8`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
+        sql9`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
@@ -3119,10 +3263,10 @@ function createMediaRepository(db) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = sql8.join(entries.map(([k]) => sql8.raw(`"${k}"`)), sql8`, `);
-      const valsSql = sql8.join(entries.map(([, v]) => sql8`${v}`), sql8`, `);
+      const colsSql = sql9.join(entries.map(([k]) => sql9.raw(`"${k}"`)), sql9`, `);
+      const valsSql = sql9.join(entries.map(([, v]) => sql9`${v}`), sql9`, `);
       const result = await db.execute(
-        sql8`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        sql9`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -3132,31 +3276,31 @@ function createMediaRepository(db) {
         ([k, v]) => k !== "id" && v !== void 0
       );
       if (entries.length === 0) return this.findOne(id);
-      const setClauses = sql8.join(
-        entries.map(([k, v]) => sql8`${sql8.raw(`"${k}"`)} = ${v}`),
-        sql8`, `
+      const setClauses = sql9.join(
+        entries.map(([k, v]) => sql9`${sql9.raw(`"${k}"`)} = ${v}`),
+        sql9`, `
       );
       const result = await db.execute(
-        sql8`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        sql9`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(sql8`DELETE FROM ${TABLE} WHERE id = ${id}`);
+      await db.execute(sql9`DELETE FROM ${TABLE} WHERE id = ${id}`);
     },
     async incrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = sql8.join(ids.map((id) => sql8`${id}`), sql8`, `);
+      const inList = sql9.join(ids.map((id) => sql9`${id}`), sql9`, `);
       await db.execute(
-        sql8`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
+        sql9`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
       );
     },
     async decrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = sql8.join(ids.map((id) => sql8`${id}`), sql8`, `);
+      const inList = sql9.join(ids.map((id) => sql9`${id}`), sql9`, `);
       await db.execute(
-        sql8`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
+        sql9`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
       );
     }
   };
@@ -3289,7 +3433,7 @@ function createCmsApp(options) {
   const requirePermission = createPermissionMiddleware(rolesRegistry);
   const getUserRole = async (userId) => {
     const result = await db.execute(
-      sql9`SELECT r.name AS role
+      sql10`SELECT r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${userId}
@@ -3459,7 +3603,7 @@ function createCmsApp(options) {
       handler: null,
       error: null
     }));
-    const ready = import("./handler-GED3I7Z2.mjs").then(({ createGraphQLHandler }) => {
+    const ready = import("./handler-VEOWJRAL.mjs").then(({ createGraphQLHandler }) => {
       gqlPasses.forEach((pass, i) => {
         const mount = mounts[i];
         try {