@bobbykim/manguito-cms-api 0.8.0 → 0.8.2

package/dist/index.js

@@ -1255,7 +1255,7 @@ function createVersionedPaths(prefix, version) {
 
 // src/app.ts
 var import_hono = require("hono");
-var import_drizzle_orm11 = require("drizzle-orm");
+var import_drizzle_orm12 = require("drizzle-orm");
 
 // src/middleware/cors.ts
 function createCorsMiddleware(corsConfig) {
@@ -2270,7 +2270,7 @@ function registerPublicMediaRoutes(app, mediaRepo, paths, listRateLimit) {
 }
 
 // src/routes/admin/content.ts
-var import_drizzle_orm4 = require("drizzle-orm");
+var import_drizzle_orm5 = require("drizzle-orm");
 
 // src/references-in-use.ts
 var import_drizzle_orm2 = require("drizzle-orm");
@@ -2358,6 +2358,7 @@ async function applyMediaReferenceDelta(delta, mediaRepo) {
 init_relations();
 
 // src/relation-input.ts
+var import_drizzle_orm4 = require("drizzle-orm");
 var import_manguito_cms_core3 = require("@bobbykim/manguito-cms-core");
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isUuid(v) {
@@ -2402,16 +2403,92 @@ function checkRelationInput(fields, body, registry, path = "") {
   }
   return errors;
 }
+function paragraphItemsIn(fields, body, registry, path) {
+  const out = [];
+  for (const field of fields) {
+    if (field.field_type !== "paragraph" || !(field.name in body)) continue;
+    const comp = field.ui_component;
+    const pType = comp.component === "paragraph-embed" ? registry.paragraph_types[comp.ref] : void 0;
+    if (!pType) continue;
+    const value = body[field.name];
+    const name = `${path}${field.name}`;
+    if ((0, import_manguito_cms_core3.relationCardinality)(field) === "one") {
+      if (isPlainObject(value)) out.push({ item: value, fields: pType.fields, prefix: `${name}.` });
+    } else if (Array.isArray(value)) {
+      value.forEach((item, i) => {
+        if (isPlainObject(item)) out.push({ item, fields: pType.fields, prefix: `${name}[${i}].` });
+      });
+    }
+  }
+  return out;
+}
+function isMissing(value) {
+  if (value === null || value === void 0) return true;
+  if (typeof value === "string" && value.trim() === "") return true;
+  if (Array.isArray(value) && value.length === 0) return true;
+  return false;
+}
+function checkRequiredInParagraphItems(fields, body, registry, path = "") {
+  const errors = [];
+  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry, path)) {
+    for (const f of itemFields) {
+      if (!f.required || f.removed === true || !f.db_column || f.db_column.junction) continue;
+      if (isMissing(item[f.name])) {
+        errors.push({ field: `${prefix}${f.name}`, message: `${prefix}${f.name} is required.` });
+      }
+    }
+    errors.push(...checkRequiredInParagraphItems(itemFields, item, registry, prefix));
+  }
+  return errors;
+}
+function quoteIdent3(name) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
+  return `"${name}"`;
+}
+function collectReferences(fields, body, registry, path, out) {
+  for (const f of fields) {
+    if (!(f.name in body) || !f.db_column) continue;
+    const table = f.db_column.junction ? f.db_column.junction.right_table : f.db_column.foreign_key?.table;
+    if (!table) continue;
+    const value = body[f.name];
+    const name = `${path}${f.name}`;
+    if (typeof value === "string") {
+      out.push({ table, id: value, field: name });
+    } else if (Array.isArray(value)) {
+      value.forEach((v, i) => {
+        if (typeof v === "string") out.push({ table, id: v, field: `${name}[${i}]` });
+      });
+    }
+  }
+  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry, path)) {
+    collectReferences(itemFields, item, registry, prefix, out);
+  }
+}
+async function findMissingReferences(db, fields, body, registry) {
+  const uses = [];
+  collectReferences(fields, body, registry, "", uses);
+  if (uses.length === 0) return [];
+  const lookups = [...new Set(uses.map((u) => u.table))].map(async (table) => {
+    const ids = [...new Set(uses.filter((u) => u.table === table && isUuid(u.id)).map((u) => u.id.toLowerCase()))];
+    if (ids.length === 0) return [table, /* @__PURE__ */ new Set()];
+    const result = await db.execute(
+      import_drizzle_orm4.sql`SELECT id FROM ${import_drizzle_orm4.sql.raw(quoteIdent3(table))} WHERE id IN (${import_drizzle_orm4.sql.join(ids.map((id) => import_drizzle_orm4.sql`${id}`), import_drizzle_orm4.sql`, `)})`
+    );
+    return [table, new Set(result.rows.map((r) => String(r.id).toLowerCase()))];
+  });
+  const found = new Map(await Promise.all(lookups));
+  return uses.filter((u) => !found.get(u.table).has(u.id.toLowerCase())).map((u) => ({ field: u.field, message: `${u.field} refers to an item that does not exist.` }));
+}
 
 // src/routes/admin/content.ts
 init_field_keys();
-function quoteIdent3(name) {
+function quoteIdent4(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
 async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   const result = await db.execute(
-    import_drizzle_orm4.sql`SELECT * FROM ${import_drizzle_orm4.sql.raw(quoteIdent3(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
+    import_drizzle_orm5.sql`SELECT * FROM ${import_drizzle_orm5.sql.raw(quoteIdent4(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
   );
   const rows = result.rows;
   for (const nf of pType.fields) {
@@ -2429,29 +2506,67 @@ async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   }
   return rows;
 }
+async function loadRelationsForEdit(db, registry, fields, id, row) {
+  for (const f of fields) {
+    if (f.db_column === null) {
+      const comp = f.ui_component;
+      if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+      const pType = registry.paragraph_types[comp.ref];
+      if (!pType) continue;
+      row[f.name] = oneOrMany((0, import_manguito_cms_core4.relationCardinality)(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name));
+    } else if (f.db_column.junction) {
+      const j = f.db_column.junction;
+      const r = await db.execute(
+        import_drizzle_orm5.sql`SELECT ${import_drizzle_orm5.sql.raw(quoteIdent4(j.right_column))} FROM ${import_drizzle_orm5.sql.raw(quoteIdent4(j.table_name))} WHERE ${import_drizzle_orm5.sql.raw(quoteIdent4(j.left_column))} = ${id}`
+      );
+      row[f.name] = r.rows.map((linked) => linked[j.right_column]);
+    }
+  }
+}
+async function valuesForPublishCheck(db, registry, requiredFields, id, storedLabels, body) {
+  const stored = { ...storedLabels };
+  if (db) await loadRelationsForEdit(db, registry, requiredFields.filter((f) => !(f.name in body)), id, stored);
+  return { ...stored, ...body };
+}
+async function persistRelationFields(db, registry, fields, body, itemId, ownerTable) {
+  const deltas = [];
+  for (const f of fields) {
+    if (!(f.name in body)) continue;
+    if (f.db_column === null) {
+      const comp = f.ui_component;
+      if (comp.component !== "paragraph-embed" || !comp.ref) continue;
+      const pType = registry.paragraph_types[comp.ref];
+      if (!pType) continue;
+      deltas.push(await persistParagraphField(db, itemId, ownerTable, f.name, pType, paragraphItems(f, body[f.name]), registry));
+    } else if (f.db_column.junction) {
+      const value = body[f.name];
+      const relatedIds = Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+      await persistJunctionField(db, itemId, f.db_column.junction, relatedIds);
+    }
+  }
+  return deltas;
+}
 async function lookupBasePathId(db, pathOrName) {
   const r = await db.execute(
-    import_drizzle_orm4.sql`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
+    import_drizzle_orm5.sql`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
   );
   return r.rows[0]?.id ?? null;
 }
 var SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-function isEmpty(value) {
-  if (value === null || value === void 0) return true;
-  if (typeof value === "string" && value.trim() === "") return true;
-  if (Array.isArray(value) && value.length === 0) return true;
-  return false;
-}
 function checkRequiredFields(fields, data) {
-  return fields.filter((f) => f.required && isEmpty(data[f.name])).map((f) => ({ field: f.name, message: `${f.label} is required` }));
-}
-function relationShapeError(c, fields, body, registry) {
-  const details = checkRelationInput(fields, body, registry);
-  if (details.length === 0) return null;
-  return c.json(
-    { ok: false, error: { code: "VALIDATION_ERROR", message: "Relation fields have the wrong shape", details } },
-    422
-  );
+  return fields.filter((f) => f.required && isMissing(data[f.name])).map((f) => ({ field: f.name, message: `${f.label} is required` }));
+}
+async function relationInputError(c, fields, body, registry, db) {
+  const refuse = (message, details) => c.json({ ok: false, error: { code: "VALIDATION_ERROR", message, details } }, 422);
+  const shape = checkRelationInput(fields, body, registry);
+  if (shape.length > 0) return refuse("Relation fields have the wrong shape", shape);
+  const required = checkRequiredInParagraphItems(fields, body, registry);
+  if (required.length > 0) return refuse("Required fields are missing", required);
+  if (db) {
+    const missing = await findMissingReferences(db, fields, body, registry);
+    if (missing.length > 0) return refuse("Relation fields refer to items that do not exist", missing);
+  }
+  return null;
 }
 function parseListQuery(url, schemaFieldNames, relationFieldNames, columnFor) {
   const searchParams = new URL(url).searchParams;
@@ -2586,26 +2701,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        if (db) {
-          const row = item;
-          for (const f of contentType.fields) {
-            if (f.db_column === null) {
-              const comp = f.ui_component;
-              if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-              const pType = registry.paragraph_types[comp.ref];
-              if (!pType) continue;
-              row[f.name] = oneOrMany((0, import_manguito_cms_core4.relationCardinality)(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name));
-            } else if (f.db_column.junction) {
-              const j = f.db_column.junction;
-              const r = await db.execute(
-                import_drizzle_orm4.sql`SELECT ${import_drizzle_orm4.sql.raw(quoteIdent3(j.right_column))} FROM ${import_drizzle_orm4.sql.raw(quoteIdent3(j.table_name))} WHERE ${import_drizzle_orm4.sql.raw(quoteIdent3(j.left_column))} = ${id}`
-              );
-              row[f.name] = r.rows.map(
-                (row2) => row2[j.right_column]
-              );
-            }
-          }
-        }
+        if (db) await loadRelationsForEdit(db, registry, contentType.fields, id, item);
         const data = projectRow(item, typeName, projectors);
         return c.json({ ok: true, data });
       }
@@ -2674,8 +2770,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
     );
     const writeNewItem = async (c, body) => {
-      const shapeError = relationShapeError(c, contentType.fields, body, registry);
-      if (shapeError) return shapeError;
+      const inputError = await relationInputError(c, contentType.fields, body, registry, db);
+      if (inputError) return inputError;
       const storageBody = fieldKeys.toStorage(body);
       const fieldErrors = checkRequiredFields(requiredFields, body);
       if (fieldErrors.length > 0) {
@@ -2696,10 +2792,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         });
         if (publishDeny) return publishDeny;
       }
-      const paragraphFields = contentType.fields.filter((f) => f.db_column === null);
-      const junctionFields = contentType.fields.filter(
-        (f) => f.db_column !== null && f.db_column.junction !== void 0
-      );
       const columnBackedFields = contentType.fields.filter(isColumnBacked);
       const columnData = {
         published: body["published"] ?? false
@@ -2734,19 +2826,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       const itemId = item["id"];
       const mediaDeltas = [topLevelMediaDelta(mediaFields, null, storageBody)];
       if (db) {
-        for (const f of paragraphFields) {
-          const comp = f.ui_component;
-          if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-          const pType = registry.paragraph_types[comp.ref];
-          if (!pType) continue;
-          const items = paragraphItems(f, body[f.name]);
-          mediaDeltas.push(await persistParagraphField(db, itemId, contentType.db.table_name, f.name, pType, items, registry));
-        }
-        for (const f of junctionFields) {
-          const junction = f.db_column.junction;
-          const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
-          await persistJunctionField(db, itemId, junction, relatedIds);
-        }
+        mediaDeltas.push(...await persistRelationFields(db, registry, contentType.fields, body, itemId, contentType.db.table_name));
       }
       await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
       const data = projectRow(item, typeName, projectors);
@@ -2810,14 +2890,14 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
     );
     const writeExistingItem = async (c, id, existing, body) => {
-      const shapeError = relationShapeError(c, contentType.fields, body, registry);
-      if (shapeError) return shapeError;
+      const inputError = await relationInputError(c, contentType.fields, body, registry, db);
+      if (inputError) return inputError;
       const storageBody = fieldKeys.toStorage(body);
       if (body["published"] === true) {
         const publishDeny = await requirePermission("content:edit")(c, async () => {
         });
         if (publishDeny) return publishDeny;
-        const merged = { ...fieldKeys.toLabels(existing), ...body };
+        const merged = await valuesForPublishCheck(db, registry, requiredFields, id, fieldKeys.toLabels(existing), body);
         const fieldErrors = checkRequiredFields(requiredFields, merged);
         if (fieldErrors.length > 0) {
           return c.json(
@@ -2833,10 +2913,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
           );
         }
       }
-      const patchParagraphFields = contentType.fields.filter((f) => f.db_column === null);
-      const patchJunctionFields = contentType.fields.filter(
-        (f) => f.db_column !== null && f.db_column.junction !== void 0
-      );
       const patchColumnBackedFields = contentType.fields.filter(isColumnBacked);
       const patchData = {};
       if (!contentType.only_one && "slug" in body) patchData["slug"] = body["slug"];
@@ -2857,21 +2933,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         topLevelMediaDelta(mediaFields, existing, storageBody)
       ];
       if (db) {
-        for (const f of patchParagraphFields) {
-          if (!(f.name in body)) continue;
-          const comp = f.ui_component;
-          if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-          const pType = registry.paragraph_types[comp.ref];
-          if (!pType) continue;
-          const items = paragraphItems(f, body[f.name]);
-          mediaDeltas.push(await persistParagraphField(db, id, contentType.db.table_name, f.name, pType, items, registry));
-        }
-        for (const f of patchJunctionFields) {
-          if (!(f.name in body)) continue;
-          const junction = f.db_column.junction;
-          const relatedIds = Array.isArray(body[f.name]) ? body[f.name].filter((v) => typeof v === "string") : [];
-          await persistJunctionField(db, id, junction, relatedIds);
-        }
+        mediaDeltas.push(...await persistRelationFields(db, registry, contentType.fields, body, id, contentType.db.table_name));
       }
       await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
       const data = projectRow(updated, typeName, projectors);
@@ -3000,6 +3062,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
+        if (db) await loadRelationsForEdit(db, registry, taxonomyType.fields, id, item);
         const data = projectRow(item, typeName, projectors);
         return c.json({ ok: true, data });
       }
@@ -3009,8 +3072,8 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       requirePermission("content:create"),
       async (c) => {
         const body = await c.req.json();
-        const shapeError = relationShapeError(c, taxonomyType.fields, body, registry);
-        if (shapeError) return shapeError;
+        const inputError = await relationInputError(c, taxonomyType.fields, body, registry, db);
+        if (inputError) return inputError;
         const storageBody = fieldKeys.toStorage(body);
         const fieldErrors = checkRequiredFields(requiredFields, body);
         if (fieldErrors.length > 0) {
@@ -3031,7 +3094,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
           });
           if (publishDeny) return publishDeny;
         }
-        const taxParagraphFields = taxonomyType.fields.filter((f) => f.db_column === null);
         const taxColumnBackedFields = taxonomyType.fields.filter(isColumnBacked);
         const taxColumnData = {
           published: body["published"] ?? false
@@ -3045,14 +3107,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         const taxItemId = item["id"];
         const mediaDeltas = [topLevelMediaDelta(mediaFields, null, storageBody)];
         if (db) {
-          for (const f of taxParagraphFields) {
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            const items = paragraphItems(f, body[f.name]);
-            mediaDeltas.push(await persistParagraphField(db, taxItemId, taxonomyType.db.table_name, f.name, pType, items, registry));
-          }
+          mediaDeltas.push(...await persistRelationFields(db, registry, taxonomyType.fields, body, taxItemId, taxonomyType.db.table_name));
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
         const data = projectRow(item, typeName, projectors);
@@ -3073,13 +3128,13 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        const shapeError = relationShapeError(c, taxonomyType.fields, body, registry);
-        if (shapeError) return shapeError;
+        const inputError = await relationInputError(c, taxonomyType.fields, body, registry, db);
+        if (inputError) return inputError;
         if (body["published"] === true) {
           const publishDeny = await requirePermission("content:edit")(c, async () => {
           });
           if (publishDeny) return publishDeny;
-          const merged = { ...fieldKeys.toLabels(existing), ...body };
+          const merged = await valuesForPublishCheck(db, registry, requiredFields, id, fieldKeys.toLabels(existing), body);
           const fieldErrors = checkRequiredFields(requiredFields, merged);
           if (fieldErrors.length > 0) {
             return c.json(
@@ -3095,7 +3150,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             );
           }
         }
-        const taxPatchParagraphFields = taxonomyType.fields.filter((f) => f.db_column === null);
         const taxPatchColumnBackedFields = taxonomyType.fields.filter(isColumnBacked);
         const taxPatchData = {};
         if ("published" in body) taxPatchData["published"] = body["published"];
@@ -3115,15 +3169,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
           topLevelMediaDelta(mediaFields, existing, storageBody)
         ];
         if (db) {
-          for (const f of taxPatchParagraphFields) {
-            if (!(f.name in body)) continue;
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            const items = paragraphItems(f, body[f.name]);
-            mediaDeltas.push(await persistParagraphField(db, id, taxonomyType.db.table_name, f.name, pType, items, registry));
-          }
+          mediaDeltas.push(...await persistRelationFields(db, registry, taxonomyType.fields, body, id, taxonomyType.db.table_name));
         }
         await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
         const data = projectRow(updated, typeName, projectors);
@@ -3628,7 +3674,7 @@ function registerAdminMediaRoutes(app, mediaRepo, storage, requirePermission, ma
 
 // src/routes/admin/auth.ts
 var import_cookie3 = require("hono/cookie");
-var import_drizzle_orm5 = require("drizzle-orm");
+var import_drizzle_orm6 = require("drizzle-orm");
 
 // src/auth/password.ts
 var import_manguito_cms_core5 = require("@bobbykim/manguito-cms-core");
@@ -3694,7 +3740,7 @@ function registerAuthRoutes(app, db) {
       );
     }
     const userResult = await db.execute(
-      import_drizzle_orm5.sql`SELECT id, email, password_hash, role_id, token_version
+      import_drizzle_orm6.sql`SELECT id, email, password_hash, role_id, token_version
           FROM users WHERE email = ${email} LIMIT 1`
     );
     const user = userResult.rows[0];
@@ -3707,7 +3753,7 @@ function registerAuthRoutes(app, db) {
       return c.json(invalidCredentials, 401);
     }
     const roleResult = await db.execute(
-      import_drizzle_orm5.sql`SELECT r.name AS name, u.must_change_password
+      import_drizzle_orm6.sql`SELECT r.name AS name, u.must_change_password
           FROM roles r
           JOIN users u ON u.role_id = r.id
           WHERE r.id = ${user.role_id} AND u.id = ${user.id}
@@ -3767,7 +3813,7 @@ function registerAuthRoutes(app, db) {
       );
     }
     const rowResult = await db.execute(
-      import_drizzle_orm5.sql`SELECT u.token_version, r.name AS role
+      import_drizzle_orm6.sql`SELECT u.token_version, r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${payload.user_id}
@@ -3791,7 +3837,7 @@ function registerAuthRoutes(app, db) {
   app.post("/admin/api/auth/logout", authMiddleware, async (c) => {
     const user = c.get("user");
     await db.execute(
-      import_drizzle_orm5.sql`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
+      import_drizzle_orm6.sql`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
     );
     clearAuthCookie(c, "auth_token");
     clearAuthCookie(c, "refresh_token", "/admin/api/auth");
@@ -3800,7 +3846,7 @@ function registerAuthRoutes(app, db) {
 }
 
 // src/routes/admin/users.ts
-var import_drizzle_orm6 = require("drizzle-orm");
+var import_drizzle_orm7 = require("drizzle-orm");
 var import_node_crypto2 = require("crypto");
 function getActingUser(c) {
   return c.get("user");
@@ -3835,7 +3881,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       );
     }
     const hashResult = await db.execute(
-      import_drizzle_orm6.sql`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      import_drizzle_orm7.sql`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const hashRow = hashResult.rows[0];
     if (!hashRow || !await (0, import_manguito_cms_core5.verifyPassword)(currentPassword, hashRow.password_hash)) {
@@ -3846,7 +3892,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
     }
     const newHash = await (0, import_manguito_cms_core5.hashPassword)(newPassword);
     await db.execute(
-      import_drizzle_orm6.sql`UPDATE users
+      import_drizzle_orm7.sql`UPDATE users
           SET password_hash       = ${newHash},
               must_change_password = false,
               token_version        = token_version + 1,
@@ -3857,7 +3903,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   });
   app.get("/admin/api/users", requirePermission("users:read"), async (c) => {
     const result = await db.execute(
-      import_drizzle_orm6.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      import_drizzle_orm7.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -3868,7 +3914,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   app.get("/admin/api/users/:id", requirePermission("users:read"), async (c) => {
     const id = c.req.param("id");
     const result = await db.execute(
-      import_drizzle_orm6.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      import_drizzle_orm7.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -3913,7 +3959,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const roleResult = await db.execute(
-        import_drizzle_orm6.sql`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
+        import_drizzle_orm7.sql`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
       );
       const roleRow = roleResult.rows[0];
       if (!roleRow) {
@@ -3928,7 +3974,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       const tempPassword = generateTempPassword();
       const passwordHash = await (0, import_manguito_cms_core5.hashPassword)(tempPassword);
       const insertResult = await db.execute(
-        import_drizzle_orm6.sql`INSERT INTO users
+        import_drizzle_orm7.sql`INSERT INTO users
               (id, email, password_hash, role_id, must_change_password, token_version,
                created_at, updated_at)
             VALUES
@@ -3983,7 +4029,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        import_drizzle_orm6.sql`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
+        import_drizzle_orm7.sql`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -3997,7 +4043,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       let changeRole = false;
       if (typeof body.role === "string" && body.role) {
         const roleResult = await db.execute(
-          import_drizzle_orm6.sql`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
+          import_drizzle_orm7.sql`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
         );
         const roleRow = roleResult.rows[0];
         if (!roleRow) {
@@ -4017,7 +4063,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       }
       if (changeRole) {
         await db.execute(
-          import_drizzle_orm6.sql`UPDATE users
+          import_drizzle_orm7.sql`UPDATE users
               SET email         = ${newEmail},
                   role_id       = ${newRoleId},
                   token_version = token_version + 1,
@@ -4026,7 +4072,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       } else {
         await db.execute(
-          import_drizzle_orm6.sql`UPDATE users
+          import_drizzle_orm7.sql`UPDATE users
               SET email      = ${newEmail},
                   role_id    = ${newRoleId},
                   updated_at = NOW()
@@ -4034,7 +4080,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const updatedResult = await db.execute(
-        import_drizzle_orm6.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+        import_drizzle_orm7.sql`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                    u.created_at, u.updated_at
             FROM users u
             JOIN roles r ON r.id = u.role_id
@@ -4071,7 +4117,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const result = await db.execute(
-        import_drizzle_orm6.sql`DELETE FROM users WHERE id = ${id} RETURNING id`
+        import_drizzle_orm7.sql`DELETE FROM users WHERE id = ${id} RETURNING id`
       );
       if (result.rows.length === 0) {
         return c.json(
@@ -4102,7 +4148,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        import_drizzle_orm6.sql`SELECT id FROM users WHERE id = ${id} LIMIT 1`
+        import_drizzle_orm7.sql`SELECT id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -4114,7 +4160,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       const tempPassword = generateTempPassword();
       const passwordHash = await (0, import_manguito_cms_core5.hashPassword)(tempPassword);
       await db.execute(
-        import_drizzle_orm6.sql`UPDATE users
+        import_drizzle_orm7.sql`UPDATE users
             SET password_hash        = ${passwordHash},
                 must_change_password = true,
                 token_version        = token_version + 1,
@@ -4127,10 +4173,10 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 }
 
 // src/routes/admin/config.ts
-var import_drizzle_orm7 = require("drizzle-orm");
+var import_drizzle_orm8 = require("drizzle-orm");
 var API_VERSION = (() => {
   try {
-    return "0.8.0";
+    return "0.8.2";
   } catch {
     return "0.0.0";
   }
@@ -4149,7 +4195,7 @@ function registerConfigRoute(app, config, registry, db) {
       permissions: r.permissions
     }));
     const userResult = await db.execute(
-      import_drizzle_orm7.sql`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      import_drizzle_orm8.sql`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const userRow = userResult.rows[0];
     return c.json({
@@ -4175,7 +4221,7 @@ function registerConfigRoute(app, config, registry, db) {
 }
 
 // src/routes/admin/schema.ts
-var import_drizzle_orm8 = require("drizzle-orm");
+var import_drizzle_orm9 = require("drizzle-orm");
 function liveFields(fields) {
   return fields.filter((f) => f.removed !== true);
 }
@@ -4215,7 +4261,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.content_types).map(async (ct) => {
         const result = await db.execute(
-          import_drizzle_orm8.sql`SELECT COUNT(*)::int AS count FROM ${import_drizzle_orm8.sql.raw(`"${ct.db.table_name}"`)}`
+          import_drizzle_orm9.sql`SELECT COUNT(*)::int AS count FROM ${import_drizzle_orm9.sql.raw(`"${ct.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: ct.name, label: ct.label, only_one: ct.only_one, count };
@@ -4227,7 +4273,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.taxonomy_types).map(async (tt) => {
         const result = await db.execute(
-          import_drizzle_orm8.sql`SELECT COUNT(*)::int AS count FROM ${import_drizzle_orm8.sql.raw(`"${tt.db.table_name}"`)}`
+          import_drizzle_orm9.sql`SELECT COUNT(*)::int AS count FROM ${import_drizzle_orm9.sql.raw(`"${tt.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: tt.name, label: tt.label, count };
@@ -4239,7 +4285,7 @@ function registerSchemaRoute(app, registry, db) {
 
 // src/repositories/content.ts
 var import_node_crypto3 = __toESM(require("crypto"));
-var import_drizzle_orm9 = require("drizzle-orm");
+var import_drizzle_orm10 = require("drizzle-orm");
 init_relations();
 var SORTABLE_FIELDS2 = /* @__PURE__ */ new Set(["title", "created_at", "updated_at"]);
 function codeError(code, message) {
@@ -4247,7 +4293,7 @@ function codeError(code, message) {
   err.code = code;
   return err;
 }
-function quoteIdent4(name) {
+function quoteIdent5(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Unsafe SQL identifier: ${name}`);
   }
@@ -4262,43 +4308,43 @@ function quoteField(name) {
 function buildConditions(published_only, filters, search) {
   const conds = [];
   if (published_only) {
-    conds.push(import_drizzle_orm9.sql`published = true`);
+    conds.push(import_drizzle_orm10.sql`published = true`);
   }
   if (search && search.term.trim() !== "" && search.columns.length > 0) {
     const pattern = `%${search.term.trim()}%`;
-    const orConds = search.columns.map((col) => import_drizzle_orm9.sql`${import_drizzle_orm9.sql.raw(quoteField(col))} ILIKE ${pattern}`);
-    conds.push(import_drizzle_orm9.sql`(${import_drizzle_orm9.sql.join(orConds, import_drizzle_orm9.sql` OR `)})`);
+    const orConds = search.columns.map((col) => import_drizzle_orm10.sql`${import_drizzle_orm10.sql.raw(quoteField(col))} ILIKE ${pattern}`);
+    conds.push(import_drizzle_orm10.sql`(${import_drizzle_orm10.sql.join(orConds, import_drizzle_orm10.sql` OR `)})`);
   }
   if (filters) {
     for (const [field, value] of Object.entries(filters)) {
-      const col = import_drizzle_orm9.sql.raw(quoteField(field));
+      const col = import_drizzle_orm10.sql.raw(quoteField(field));
       if (Array.isArray(value)) {
         if (value.length === 0) continue;
-        const inList = import_drizzle_orm9.sql.join(
-          value.map((v) => import_drizzle_orm9.sql`${v}`),
-          import_drizzle_orm9.sql`, `
+        const inList = import_drizzle_orm10.sql.join(
+          value.map((v) => import_drizzle_orm10.sql`${v}`),
+          import_drizzle_orm10.sql`, `
         );
-        conds.push(import_drizzle_orm9.sql`${col} IN (${inList})`);
+        conds.push(import_drizzle_orm10.sql`${col} IN (${inList})`);
       } else if (typeof value === "object" && value !== null) {
         const op = value;
-        if (op.gt !== void 0) conds.push(import_drizzle_orm9.sql`${col} > ${op.gt}`);
-        if (op.gte !== void 0) conds.push(import_drizzle_orm9.sql`${col} >= ${op.gte}`);
-        if (op.lt !== void 0) conds.push(import_drizzle_orm9.sql`${col} < ${op.lt}`);
-        if (op.lte !== void 0) conds.push(import_drizzle_orm9.sql`${col} <= ${op.lte}`);
+        if (op.gt !== void 0) conds.push(import_drizzle_orm10.sql`${col} > ${op.gt}`);
+        if (op.gte !== void 0) conds.push(import_drizzle_orm10.sql`${col} >= ${op.gte}`);
+        if (op.lt !== void 0) conds.push(import_drizzle_orm10.sql`${col} < ${op.lt}`);
+        if (op.lte !== void 0) conds.push(import_drizzle_orm10.sql`${col} <= ${op.lte}`);
       } else {
-        conds.push(import_drizzle_orm9.sql`${col} = ${value}`);
+        conds.push(import_drizzle_orm10.sql`${col} = ${value}`);
       }
     }
   }
   return conds;
 }
 function whereFragment(conds) {
-  return conds.length > 0 ? import_drizzle_orm9.sql` WHERE ${import_drizzle_orm9.sql.join(conds, import_drizzle_orm9.sql` AND `)}` : import_drizzle_orm9.sql``;
+  return conds.length > 0 ? import_drizzle_orm10.sql` WHERE ${import_drizzle_orm10.sql.join(conds, import_drizzle_orm10.sql` AND `)}` : import_drizzle_orm10.sql``;
 }
 function createDrizzleContentRepository(db, tableName, options = {}) {
   const { relations = {}, publishedRelations = false, sortableColumns } = options;
   function tableRaw() {
-    return import_drizzle_orm9.sql.raw(quoteIdent4(tableName));
+    return import_drizzle_orm10.sql.raw(quoteIdent5(tableName));
   }
   async function resolveRows(rows, include, cache) {
     if (rows.length === 0) return rows;
@@ -4341,14 +4387,14 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       const offset = (page - 1) * per_page;
       const conds = buildConditions(published_only, filters, search);
       const where = whereFragment(conds);
-      const sortCol = import_drizzle_orm9.sql.raw(quoteIdent4(sort_by));
-      const sortDir = import_drizzle_orm9.sql.raw(sort_order === "desc" ? "DESC" : "ASC");
+      const sortCol = import_drizzle_orm10.sql.raw(quoteIdent5(sort_by));
+      const sortDir = import_drizzle_orm10.sql.raw(sort_order === "desc" ? "DESC" : "ASC");
       const countResult = await db.execute(
-        import_drizzle_orm9.sql`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
+        import_drizzle_orm10.sql`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
       );
       const total = Number(countResult.rows[0]?.["total"] ?? 0);
       const dataResult = await db.execute(
-        import_drizzle_orm9.sql`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
+        import_drizzle_orm10.sql`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
       );
       const rows = dataResult.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -4369,7 +4415,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findOne(id, include = []) {
       const result = await db.execute(
-        import_drizzle_orm9.sql`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
+        import_drizzle_orm10.sql`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -4379,7 +4425,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findBySlug(slug, include = []) {
       const result = await db.execute(
-        import_drizzle_orm9.sql`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
+        import_drizzle_orm10.sql`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -4395,10 +4441,10 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = import_drizzle_orm9.sql.join(entries.map(([k]) => import_drizzle_orm9.sql.raw(quoteIdent4(k))), import_drizzle_orm9.sql`, `);
-      const valsSql = import_drizzle_orm9.sql.join(entries.map(([, v]) => import_drizzle_orm9.sql`${v}`), import_drizzle_orm9.sql`, `);
+      const colsSql = import_drizzle_orm10.sql.join(entries.map(([k]) => import_drizzle_orm10.sql.raw(quoteIdent5(k))), import_drizzle_orm10.sql`, `);
+      const valsSql = import_drizzle_orm10.sql.join(entries.map(([, v]) => import_drizzle_orm10.sql`${v}`), import_drizzle_orm10.sql`, `);
       const result = await db.execute(
-        import_drizzle_orm9.sql`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        import_drizzle_orm10.sql`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -4411,25 +4457,25 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       if (entries.length === 0) {
         return this.findOne(id);
       }
-      const setClauses = import_drizzle_orm9.sql.join(
-        entries.map(([k, v]) => import_drizzle_orm9.sql`${import_drizzle_orm9.sql.raw(quoteIdent4(k))} = ${v}`),
-        import_drizzle_orm9.sql`, `
+      const setClauses = import_drizzle_orm10.sql.join(
+        entries.map(([k, v]) => import_drizzle_orm10.sql`${import_drizzle_orm10.sql.raw(quoteIdent5(k))} = ${v}`),
+        import_drizzle_orm10.sql`, `
       );
       const result = await db.execute(
-        import_drizzle_orm9.sql`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        import_drizzle_orm10.sql`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(import_drizzle_orm9.sql`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
+      await db.execute(import_drizzle_orm10.sql`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
     },
     async findAll(opts = {}) {
       const { include = [], published_only } = opts;
       const conds = buildConditions(published_only, void 0, void 0);
       const where = whereFragment(conds);
       const result = await db.execute(
-        import_drizzle_orm9.sql`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
+        import_drizzle_orm10.sql`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
       );
       const rows = result.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -4444,23 +4490,23 @@ init_relations();
 
 // src/repositories/media.ts
 var import_node_crypto4 = __toESM(require("crypto"));
-var import_drizzle_orm10 = require("drizzle-orm");
+var import_drizzle_orm11 = require("drizzle-orm");
 function createMediaRepository(db) {
-  const TABLE = import_drizzle_orm10.sql.raw('"media"');
+  const TABLE = import_drizzle_orm11.sql.raw('"media"');
   return {
     async findMany(opts = {}) {
       const { page = 1, per_page = 10, type, orphaned } = opts;
       const offset = (page - 1) * per_page;
       const conds = [];
-      if (type) conds.push(import_drizzle_orm10.sql`type = ${type}`);
-      if (orphaned) conds.push(import_drizzle_orm10.sql`reference_count = 0`);
-      const where = conds.length > 0 ? import_drizzle_orm10.sql` WHERE ${import_drizzle_orm10.sql.join(conds, import_drizzle_orm10.sql` AND `)}` : import_drizzle_orm10.sql``;
-      const countResult = await db.execute(import_drizzle_orm10.sql`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
+      if (type) conds.push(import_drizzle_orm11.sql`type = ${type}`);
+      if (orphaned) conds.push(import_drizzle_orm11.sql`reference_count = 0`);
+      const where = conds.length > 0 ? import_drizzle_orm11.sql` WHERE ${import_drizzle_orm11.sql.join(conds, import_drizzle_orm11.sql` AND `)}` : import_drizzle_orm11.sql``;
+      const countResult = await db.execute(import_drizzle_orm11.sql`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
       const total = Number(
         countResult.rows[0]?.["total"] ?? 0
       );
       const dataResult = await db.execute(
-        import_drizzle_orm10.sql`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
+        import_drizzle_orm11.sql`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
       );
       const total_pages = Math.ceil(total / per_page);
       return {
@@ -4478,7 +4524,7 @@ function createMediaRepository(db) {
     },
     async findOne(id) {
       const result = await db.execute(
-        import_drizzle_orm10.sql`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
+        import_drizzle_orm11.sql`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
@@ -4492,10 +4538,10 @@ function createMediaRepository(db) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = import_drizzle_orm10.sql.join(entries.map(([k]) => import_drizzle_orm10.sql.raw(`"${k}"`)), import_drizzle_orm10.sql`, `);
-      const valsSql = import_drizzle_orm10.sql.join(entries.map(([, v]) => import_drizzle_orm10.sql`${v}`), import_drizzle_orm10.sql`, `);
+      const colsSql = import_drizzle_orm11.sql.join(entries.map(([k]) => import_drizzle_orm11.sql.raw(`"${k}"`)), import_drizzle_orm11.sql`, `);
+      const valsSql = import_drizzle_orm11.sql.join(entries.map(([, v]) => import_drizzle_orm11.sql`${v}`), import_drizzle_orm11.sql`, `);
       const result = await db.execute(
-        import_drizzle_orm10.sql`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        import_drizzle_orm11.sql`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -4505,31 +4551,31 @@ function createMediaRepository(db) {
         ([k, v]) => k !== "id" && v !== void 0
       );
       if (entries.length === 0) return this.findOne(id);
-      const setClauses = import_drizzle_orm10.sql.join(
-        entries.map(([k, v]) => import_drizzle_orm10.sql`${import_drizzle_orm10.sql.raw(`"${k}"`)} = ${v}`),
-        import_drizzle_orm10.sql`, `
+      const setClauses = import_drizzle_orm11.sql.join(
+        entries.map(([k, v]) => import_drizzle_orm11.sql`${import_drizzle_orm11.sql.raw(`"${k}"`)} = ${v}`),
+        import_drizzle_orm11.sql`, `
       );
       const result = await db.execute(
-        import_drizzle_orm10.sql`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        import_drizzle_orm11.sql`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(import_drizzle_orm10.sql`DELETE FROM ${TABLE} WHERE id = ${id}`);
+      await db.execute(import_drizzle_orm11.sql`DELETE FROM ${TABLE} WHERE id = ${id}`);
     },
     async incrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = import_drizzle_orm10.sql.join(ids.map((id) => import_drizzle_orm10.sql`${id}`), import_drizzle_orm10.sql`, `);
+      const inList = import_drizzle_orm11.sql.join(ids.map((id) => import_drizzle_orm11.sql`${id}`), import_drizzle_orm11.sql`, `);
       await db.execute(
-        import_drizzle_orm10.sql`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
+        import_drizzle_orm11.sql`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
       );
     },
     async decrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = import_drizzle_orm10.sql.join(ids.map((id) => import_drizzle_orm10.sql`${id}`), import_drizzle_orm10.sql`, `);
+      const inList = import_drizzle_orm11.sql.join(ids.map((id) => import_drizzle_orm11.sql`${id}`), import_drizzle_orm11.sql`, `);
       await db.execute(
-        import_drizzle_orm10.sql`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
+        import_drizzle_orm11.sql`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
       );
     }
   };
@@ -4666,7 +4712,7 @@ function createCmsApp(options) {
   const requirePermission = createPermissionMiddleware(rolesRegistry);
   const getUserRole = async (userId) => {
     const result = await db.execute(
-      import_drizzle_orm11.sql`SELECT r.name AS role
+      import_drizzle_orm12.sql`SELECT r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${userId}