@bobbykim/manguito-cms-api 0.9.2 → 0.9.4

package/dist/index.mjs

@@ -1,17 +1,25 @@
 import {
   buildRelationsMap,
+  checkRelationInput,
+  checkRequiredInParagraphItems,
   createFieldKeyMap,
   createFieldKeyMapFromProjection,
   deleteParagraphField,
+  findMissingReferences,
   isColumnBacked,
+  isMissing,
+  isPlainObject,
   junctionOrderBy,
   oneOrMany,
+  ownParagraphRowIds,
   paragraphItems,
+  paragraphItemsIn,
+  paragraphTypeOf,
   persistJunctionField,
   persistParagraphField,
   resolveRelationBareIds,
   resolveRelationField
-} from "./chunk-GUZZQZSN.mjs";
+} from "./chunk-EFTMAG7N.mjs";
 
 // src/paths.ts
 function normalizePrefix(prefix) {
@@ -39,7 +47,7 @@ function createVersionedPaths(prefix, version) {
 
 // src/app.ts
 import { Hono } from "hono";
-import { sql as sql11 } from "drizzle-orm";
+import { sql as sql10 } from "drizzle-orm";
 
 // src/middleware/cors.ts
 function createCorsMiddleware(corsConfig) {
@@ -141,7 +149,7 @@ var ERROR_STATUS_MAP = {
 var errorHandler = (err, c) => {
   console.error(err.stack ?? err.message);
   const raw = err.code;
-  const deliberate = raw !== void 0 && raw !== "INTERNAL_ERROR" && raw in ERROR_STATUS_MAP;
+  const deliberate = raw !== void 0 && raw !== "INTERNAL_ERROR" && Object.hasOwn(ERROR_STATUS_MAP, raw);
   if (!deliberate) {
     return c.json({ ok: false, error: { code: "INTERNAL_ERROR", message: "Internal server error" } }, 500);
   }
@@ -732,16 +740,16 @@ function parseFilters(url, validFields, columnFor) {
 }
 
 // src/routes/content.ts
+function pickProgrammatic(resolved, names) {
+  const out = {};
+  for (const name of names) if (Object.hasOwn(resolved, name)) out[name] = resolved[name];
+  return out;
+}
 function isPublished(item) {
   return item["published"] === true;
 }
 function registerPublicContentRoutes(app, registry, repos, projectors, paths, listRateLimit, resolver, resolverProjectors) {
   const forResolver = resolverProjectors ?? projectors;
-  function pickProgrammatic(resolved, names) {
-    const out = {};
-    for (const name of names) if (name in resolved) out[name] = resolved[name];
-    return out;
-  }
   async function respondItem(row, typeName, programmatic) {
     const data = projectRow(row, typeName, projectors);
     if (!resolver?.hasSchema(typeName)) return data;
@@ -1050,7 +1058,7 @@ function registerPublicMediaRoutes(app, mediaRepo, paths, listRateLimit) {
 }
 
 // src/routes/admin/content.ts
-import { sql as sql4 } from "drizzle-orm";
+import { sql as sql3 } from "drizzle-orm";
 
 // src/references-in-use.ts
 import { sql as sql2 } from "drizzle-orm";
@@ -1062,25 +1070,42 @@ function quoteIdent(name) {
 function isRequiredSingleReferenceTo(f, targetType) {
   return f.field_type === "reference" && f.required && relationCardinality(f) === "one" && f.db_column?.foreign_key !== void 0 && f.ui_component.component === "typeahead-select" && f.ui_component.ref === targetType;
 }
+function requiredReferencesTo(owners, targetType) {
+  return owners.flatMap(
+    (owner) => owner.fields.filter((f) => isRequiredSingleReferenceTo(f, targetType)).map((f) => ({ owner, f }))
+  );
+}
 async function findRequiredReferrers(db, registry, targetType, id) {
-  const owners = [
-    ...Object.values(registry.content_types),
-    ...Object.values(registry.taxonomy_types),
-    ...Object.values(registry.paragraph_types)
-  ];
-  const out = [];
-  for (const owner of owners) {
-    for (const f of owner.fields) {
-      if (!isRequiredSingleReferenceTo(f, targetType)) continue;
-      const notSelf = owner.name === targetType ? sql2` AND id <> ${id}` : sql2``;
-      const r = await db.execute(
-        sql2`SELECT count(*)::int AS n FROM ${sql2.raw(quoteIdent(owner.db.table_name))} WHERE ${sql2.raw(quoteIdent(f.db_column.column_name))} = ${id}${notSelf}`
-      );
-      const n = r.rows[0].n;
-      if (n > 0) out.push({ type_label: owner.label, field_label: f.label, count: n });
-    }
+  const targetFields = registry.content_types[targetType]?.fields ?? registry.taxonomy_types[targetType]?.fields ?? [];
+  const itemOwners = [...Object.values(registry.content_types), ...Object.values(registry.taxonomy_types)];
+  const itemFields = requiredReferencesTo(itemOwners, targetType);
+  const paragraphFields = requiredReferencesTo(Object.values(registry.paragraph_types), targetType);
+  const ownIds = paragraphFields.length > 0 ? await ownParagraphRowIds(db, registry, targetFields, id) : [];
+  const [itemCounts, paragraphCounts] = await Promise.all([
+    Promise.all(
+      itemFields.map(async ({ owner, f }) => {
+        const notSelf = owner.name === targetType ? sql2` AND id <> ${id}` : sql2``;
+        const r = await db.execute(
+          sql2`SELECT count(*)::int AS n FROM ${sql2.raw(quoteIdent(owner.db.table_name))} WHERE ${sql2.raw(quoteIdent(f.db_column.column_name))} = ${id}${notSelf}`
+        );
+        return { owner, f, n: r.rows[0].n, own: 0 };
+      })
+    ),
+    Promise.all(
+      paragraphFields.map(async ({ owner, f }) => {
+        const r = await db.execute(
+          sql2`SELECT count(*)::int AS n, count(*) FILTER (WHERE id = ANY(${sql2.param(ownIds)}::uuid[]))::int AS own FROM ${sql2.raw(quoteIdent(owner.db.table_name))} WHERE ${sql2.raw(quoteIdent(f.db_column.column_name))} = ${id}`
+        );
+        const { n, own } = r.rows[0];
+        return { owner, f, n, own };
+      })
+    )
+  ]);
+  const others = [];
+  for (const { owner, f, n, own } of [...itemCounts, ...paragraphCounts]) {
+    if (n - own > 0) others.push({ type_label: owner.label, field_label: f.label, count: n - own });
   }
-  return out;
+  return { others, fromOwnParagraphs: paragraphCounts.some((c) => c.own > 0) };
 }
 function inUseMessage(referrers) {
   const total = referrers.reduce((sum, r) => sum + r.count, 0);
@@ -1098,7 +1123,7 @@ function isForeignKeyViolation(err) {
 }
 
 // src/routes/admin/content.ts
-import { relationCardinality as relationCardinality3 } from "@bobbykim/manguito-cms-core";
+import { relationCardinality as relationCardinality2 } from "@bobbykim/manguito-cms-core";
 
 // src/media-references.ts
 function extractMediaId(value) {
@@ -1110,7 +1135,7 @@ function topLevelMediaDelta(mediaFields, before, after) {
   for (const f of mediaFields) {
     const key = f.db_column?.column_name;
     if (key === void 0 || key === "") continue;
-    if (after !== null && !(key in after)) continue;
+    if (after !== null && !Object.hasOwn(after, key)) continue;
     const oldId = before ? extractMediaId(before[key]) : null;
     const newId = after ? extractMediaId(after[key]) : null;
     if (newId === oldId) continue;
@@ -1134,131 +1159,6 @@ async function applyMediaReferenceDelta(delta, mediaRepo) {
   if (netRemove.length > 0) await mediaRepo.decrementReferenceCount(netRemove);
 }
 
-// src/relation-input.ts
-import { sql as sql3 } from "drizzle-orm";
-import { relationCardinality as relationCardinality2 } from "@bobbykim/manguito-cms-core";
-var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function isUuid(v) {
-  return typeof v === "string" && UUID_RE.test(v);
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function checkRelationInput(fields, body, registry, path = "") {
-  const errors = [];
-  for (const field of fields) {
-    if (!(field.name in body)) continue;
-    const cardinality = relationCardinality2(field);
-    if (cardinality === null) continue;
-    const value = body[field.name];
-    const name = `${path}${field.name}`;
-    if (field.field_type === "reference") {
-      const ok = cardinality === "one" ? value === null || isUuid(value) : Array.isArray(value) && value.every(isUuid);
-      if (!ok) {
-        errors.push({
-          field: name,
-          message: cardinality === "one" ? `${name} holds one item: send a UUID string or null.` : `${name} holds a list: send an array of UUID strings.`
-        });
-      }
-      continue;
-    }
-    const items = cardinality === "one" ? value === null ? [] : isPlainObject(value) ? [value] : void 0 : Array.isArray(value) && value.every(isPlainObject) ? value : void 0;
-    if (items === void 0) {
-      errors.push({
-        field: name,
-        message: cardinality === "one" ? `${name} holds one item: send an object or null.` : `${name} holds a list: send an array of objects.`
-      });
-      continue;
-    }
-    const pType = paragraphTypeOf(field, registry);
-    if (!pType) continue;
-    items.forEach((item, i) => {
-      const prefix = cardinality === "one" ? `${name}.` : `${name}[${i}].`;
-      errors.push(...checkRelationInput(pType.fields, item, registry, prefix));
-    });
-  }
-  return errors;
-}
-function paragraphTypeOf(field, registry) {
-  const comp = field.ui_component;
-  return comp.component === "paragraph-embed" ? registry.paragraph_types[comp.ref] : void 0;
-}
-function paragraphItemsIn(fields, body, registry, path) {
-  const out = [];
-  for (const field of fields) {
-    if (field.field_type !== "paragraph" || !(field.name in body)) continue;
-    const pType = paragraphTypeOf(field, registry);
-    if (!pType) continue;
-    const value = body[field.name];
-    const name = `${path}${field.name}`;
-    if (relationCardinality2(field) === "one") {
-      if (isPlainObject(value)) out.push({ item: value, fields: pType.fields, prefix: `${name}.` });
-    } else if (Array.isArray(value)) {
-      value.forEach((item, i) => {
-        if (isPlainObject(item)) out.push({ item, fields: pType.fields, prefix: `${name}[${i}].` });
-      });
-    }
-  }
-  return out;
-}
-function isMissing(value) {
-  if (value === null || value === void 0) return true;
-  if (typeof value === "string" && value.trim() === "") return true;
-  if (Array.isArray(value) && value.length === 0) return true;
-  return false;
-}
-function checkRequiredInParagraphItems(fields, body, registry, path = "") {
-  const errors = [];
-  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry, path)) {
-    for (const f of itemFields) {
-      if (!f.required || f.removed === true || !f.db_column || f.db_column.junction) continue;
-      if (isMissing(item[f.name])) {
-        errors.push({ field: `${prefix}${f.name}`, message: `${prefix}${f.name} is required.` });
-      }
-    }
-    errors.push(...checkRequiredInParagraphItems(itemFields, item, registry, prefix));
-  }
-  return errors;
-}
-function quoteIdent2(name) {
-  if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
-  return `"${name}"`;
-}
-function collectReferences(fields, body, registry, path, out) {
-  for (const f of fields) {
-    if (!(f.name in body) || !f.db_column) continue;
-    const table = f.db_column.junction ? f.db_column.junction.right_table : f.db_column.foreign_key?.table;
-    if (!table) continue;
-    const value = body[f.name];
-    const name = `${path}${f.name}`;
-    if (typeof value === "string") {
-      out.push({ table, id: value, field: name });
-    } else if (Array.isArray(value)) {
-      value.forEach((v, i) => {
-        if (typeof v === "string") out.push({ table, id: v, field: `${name}[${i}]` });
-      });
-    }
-  }
-  for (const { item, fields: itemFields, prefix } of paragraphItemsIn(fields, body, registry, path)) {
-    collectReferences(itemFields, item, registry, prefix, out);
-  }
-}
-async function findMissingReferences(db, fields, body, registry) {
-  const uses = [];
-  collectReferences(fields, body, registry, "", uses);
-  if (uses.length === 0) return [];
-  const lookups = [...new Set(uses.map((u) => u.table))].map(async (table) => {
-    const ids = [...new Set(uses.filter((u) => u.table === table && isUuid(u.id)).map((u) => u.id.toLowerCase()))];
-    if (ids.length === 0) return [table, /* @__PURE__ */ new Set()];
-    const result = await db.execute(
-      sql3`SELECT id FROM ${sql3.raw(quoteIdent2(table))} WHERE id IN (${sql3.join(ids.map((id) => sql3`${id}`), sql3`, `)})`
-    );
-    return [table, new Set(result.rows.map((r) => String(r.id).toLowerCase()))];
-  });
-  const found = new Map(await Promise.all(lookups));
-  return uses.filter((u) => !found.get(u.table).has(u.id.toLowerCase())).map((u) => ({ field: u.field, message: `${u.field} refers to an item that does not exist.` }));
-}
-
 // src/field-values.ts
 var VARCHAR_DEFAULT_LIMIT = 255;
 var INTEGER_MIN = -2147483648;
@@ -1270,7 +1170,7 @@ var EMPTY_MEANS_NULL = /* @__PURE__ */ new Set(["date", "integer", "float", "enu
 function emptyValuesToNull(fields, body, registry) {
   const out = { ...body };
   for (const f of fields) {
-    if (!(f.name in out)) continue;
+    if (!Object.hasOwn(out, f.name)) continue;
     const value = out[f.name];
     if (value === "" && EMPTY_MEANS_NULL.has(f.field_type)) {
       out[f.name] = null;
@@ -1375,7 +1275,7 @@ function rangeError(name, value, min, max) {
 function checkFieldValues(fields, body, registry, path = "") {
   const errors = [];
   for (const f of fields) {
-    if (!(f.name in body) || f.removed === true) continue;
+    if (!Object.hasOwn(body, f.name) || f.removed === true) continue;
     const name = `${path}${f.name}`;
     const message = valueError(f, body[f.name], name);
     if (message) errors.push({ field: name, message });
@@ -1387,24 +1287,22 @@ function checkFieldValues(fields, body, registry, path = "") {
 }
 
 // src/routes/admin/content.ts
-function quoteIdent3(name) {
+function quoteIdent2(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Unsafe identifier: ${name}`);
   return `"${name}"`;
 }
 async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   const result = await db.execute(
-    sql4`SELECT * FROM ${sql4.raw(quoteIdent3(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC`
+    sql3`SELECT * FROM ${sql3.raw(quoteIdent2(pType.db.table_name))} WHERE parent_id = ${parentId} AND parent_field = ${fieldName} ORDER BY "order" ASC, id ASC`
   );
   const rows = result.rows;
   for (const nf of pType.fields) {
     if (nf.db_column !== null) continue;
-    const comp = nf.ui_component;
-    if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-    const nType = registry.paragraph_types[comp.ref];
+    const nType = paragraphTypeOf(nf, registry);
     if (!nType) continue;
     for (const row of rows) {
       row[nf.name] = oneOrMany(
-        relationCardinality3(nf) ?? "many",
+        relationCardinality2(nf) ?? "many",
         await loadParagraphRows(db, registry, nType, row["id"], nf.name)
       );
     }
@@ -1412,35 +1310,36 @@ async function loadParagraphRows(db, registry, pType, parentId, fieldName) {
   return rows;
 }
 async function loadRelationsForEdit(db, registry, fields, id, row) {
-  for (const f of fields) {
-    if (f.db_column === null) {
-      const comp = f.ui_component;
-      if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-      const pType = registry.paragraph_types[comp.ref];
-      if (!pType) continue;
-      row[f.name] = oneOrMany(relationCardinality3(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name));
-    } else if (f.db_column.junction) {
-      const j = f.db_column.junction;
-      const r = await db.execute(
-        sql4`SELECT ${sql4.raw(quoteIdent3(j.right_column))} FROM ${sql4.raw(quoteIdent3(j.table_name))} WHERE ${sql4.raw(quoteIdent3(j.left_column))} = ${id}${junctionOrderBy(j)}`
-      );
-      row[f.name] = r.rows.map((linked) => linked[j.right_column]);
-    }
-  }
+  const loaded = await Promise.all(
+    fields.map(async (f) => {
+      if (f.db_column === null) {
+        const pType = paragraphTypeOf(f, registry);
+        if (!pType) return null;
+        return [f.name, oneOrMany(relationCardinality2(f) ?? "many", await loadParagraphRows(db, registry, pType, id, f.name))];
+      }
+      if (f.db_column.junction) {
+        const j = f.db_column.junction;
+        const r = await db.execute(
+          sql3`SELECT ${sql3.raw(quoteIdent2(j.right_column))} FROM ${sql3.raw(quoteIdent2(j.table_name))} WHERE ${sql3.raw(quoteIdent2(j.left_column))} = ${id}${junctionOrderBy(j)}`
+        );
+        return [f.name, [...new Set(r.rows.map((linked) => linked[j.right_column]))]];
+      }
+      return null;
+    })
+  );
+  for (const entry of loaded) if (entry) row[entry[0]] = entry[1];
 }
 async function valuesForPublishCheck(db, registry, requiredFields, id, storedLabels, body) {
   const stored = { ...storedLabels };
-  if (db) await loadRelationsForEdit(db, registry, requiredFields.filter((f) => !(f.name in body)), id, stored);
+  if (db) await loadRelationsForEdit(db, registry, requiredFields.filter((f) => !Object.hasOwn(body, f.name)), id, stored);
   return { ...stored, ...body };
 }
 async function persistRelationFields(db, registry, fields, body, itemId, ownerTable) {
   const deltas = [];
   for (const f of fields) {
-    if (!(f.name in body)) continue;
+    if (!Object.hasOwn(body, f.name)) continue;
     if (f.db_column === null) {
-      const comp = f.ui_component;
-      if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-      const pType = registry.paragraph_types[comp.ref];
+      const pType = paragraphTypeOf(f, registry);
       if (!pType) continue;
       deltas.push(await persistParagraphField(db, itemId, ownerTable, f.name, pType, paragraphItems(f, body[f.name]), registry));
     } else if (f.db_column.junction) {
@@ -1451,9 +1350,49 @@ async function persistRelationFields(db, registry, fields, body, itemId, ownerTa
   }
   return deltas;
 }
+async function deleteOwnParagraphs(db, registry, fields, itemId) {
+  const deltas = [];
+  for (const f of fields) {
+    const pType = paragraphTypeOf(f, registry);
+    if (!pType) continue;
+    deltas.push(await deleteParagraphField(db, itemId, f.name, pType, registry));
+  }
+  return deltas;
+}
+function releasedFromParagraphsOnly(paragraphDeltas, topLevel) {
+  const stillHeld = new Set(topLevel.removed);
+  return { added: [], removed: mergeMediaDeltas(...paragraphDeltas).removed.filter((mediaId) => !stillHeld.has(mediaId)) };
+}
+async function deleteItemCascade(db, registry, mediaRepo, target) {
+  const { typeName, fields, mediaFields, repo, id, row } = target;
+  const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : { others: [], fromOwnParagraphs: false };
+  if (referrers.others.length > 0) return { ok: false, message: inUseMessage(referrers.others) };
+  const topLevel = topLevelMediaDelta(mediaFields, row, null);
+  if (!db || !referrers.fromOwnParagraphs) {
+    try {
+      await repo.delete(id);
+    } catch (err) {
+      if (isForeignKeyViolation(err)) return { ok: false, message: IN_USE_RACE_MESSAGE };
+      throw err;
+    }
+    const paragraphDeltas2 = db ? await deleteOwnParagraphs(db, registry, fields, id) : [];
+    await applyMediaReferenceDelta(mergeMediaDeltas(topLevel, ...paragraphDeltas2), mediaRepo);
+    return { ok: true };
+  }
+  const paragraphDeltas = await deleteOwnParagraphs(db, registry, fields, id);
+  try {
+    await repo.delete(id);
+  } catch (err) {
+    await applyMediaReferenceDelta(releasedFromParagraphsOnly(paragraphDeltas, topLevel), mediaRepo);
+    if (isForeignKeyViolation(err)) return { ok: false, message: IN_USE_RACE_MESSAGE };
+    throw err;
+  }
+  await applyMediaReferenceDelta(mergeMediaDeltas(topLevel, ...paragraphDeltas), mediaRepo);
+  return { ok: true };
+}
 async function lookupBasePathId(db, pathOrName) {
   const r = await db.execute(
-    sql4`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
+    sql3`SELECT id FROM base_paths WHERE path = ${pathOrName} OR name = ${pathOrName} LIMIT 1`
   );
   return r.rows[0]?.id ?? null;
 }
@@ -1560,7 +1499,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
     const mediaFields = contentType.fields.filter(
       (f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file"
     );
-    const paragraphFieldDefs = contentType.fields.filter((f) => f.db_column === null);
     const searchableColumns = [
       ...contentType.fields.filter((f) => f.field_type === "text/plain" && f.db_column !== null).map((f) => f.db_column.column_name),
       ...contentType.system_fields.some((f) => f.name === "slug") ? ["slug"] : []
@@ -1710,7 +1648,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
       for (const f of columnBackedFields) {
         const key = f.db_column.column_name;
-        if (!(key in storageBody)) continue;
+        if (!Object.hasOwn(storageBody, key)) continue;
         columnData[key] = storageBody[key];
       }
       if (db) {
@@ -1752,7 +1690,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        if (!contentType.only_one && "slug" in body) {
+        if (!contentType.only_one && Object.hasOwn(body, "slug")) {
           const slug = body["slug"];
           if (typeof slug !== "string" || slug.trim() === "") {
             return c.json(
@@ -1822,11 +1760,11 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
       }
       const patchColumnBackedFields = contentType.fields.filter(isColumnBacked);
       const patchData = {};
-      if (!contentType.only_one && "slug" in body) patchData["slug"] = body["slug"];
-      if ("published" in body) patchData["published"] = body["published"];
+      if (!contentType.only_one && Object.hasOwn(body, "slug")) patchData["slug"] = body["slug"];
+      if (Object.hasOwn(body, "published")) patchData["published"] = body["published"];
       for (const f of patchColumnBackedFields) {
         const key = f.db_column.column_name;
-        if (!(key in storageBody)) continue;
+        if (!Object.hasOwn(storageBody, key)) continue;
         patchData[key] = storageBody[key];
       }
       const updated = await repo.update(id, patchData);
@@ -1876,31 +1814,17 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
-        if (referrers.length > 0) {
-          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
-        }
-        try {
-          await repo.delete(id);
-        } catch (err) {
-          if (isForeignKeyViolation(err)) {
-            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
-          }
-          throw err;
-        }
-        const mediaDeltas = [
-          topLevelMediaDelta(mediaFields, item, null)
-        ];
-        if (db) {
-          for (const f of paragraphFieldDefs) {
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType, registry));
-          }
+        const outcome = await deleteItemCascade(db, registry, mediaRepo, {
+          typeName,
+          fields: contentType.fields,
+          mediaFields,
+          repo,
+          id,
+          row: item
+        });
+        if (!outcome.ok) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: outcome.message } }, 409);
         }
-        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
         return c.json({ ok: true });
       }
     );
@@ -1921,7 +1845,6 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
     const mediaFields = taxonomyType.fields.filter(
       (f) => f.field_type === "image" || f.field_type === "video" || f.field_type === "file"
     );
-    const paragraphFieldDefs = taxonomyType.fields.filter((f) => f.db_column === null);
     const searchableColumns = [
       ...taxonomyType.fields.filter((f) => f.field_type === "text/plain" && f.db_column !== null).map((f) => f.db_column.column_name),
       ...taxonomyType.system_fields.some((f) => f.name === "slug") ? ["slug"] : []
@@ -2007,7 +1930,7 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         };
         for (const f of taxColumnBackedFields) {
           const key = f.db_column.column_name;
-          if (!(key in storageBody)) continue;
+          if (!Object.hasOwn(storageBody, key)) continue;
           taxColumnData[key] = storageBody[key];
         }
         const item = await repo.create(taxColumnData);
@@ -2059,10 +1982,10 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
         }
         const taxPatchColumnBackedFields = taxonomyType.fields.filter(isColumnBacked);
         const taxPatchData = {};
-        if ("published" in body) taxPatchData["published"] = body["published"];
+        if (Object.hasOwn(body, "published")) taxPatchData["published"] = body["published"];
         for (const f of taxPatchColumnBackedFields) {
           const key = f.db_column.column_name;
-          if (!(key in storageBody)) continue;
+          if (!Object.hasOwn(storageBody, key)) continue;
           taxPatchData[key] = storageBody[key];
         }
         const updated = await repo.update(id, taxPatchData);
@@ -2095,31 +2018,17 @@ function registerAdminContentRoutes(app, registry, repos, projectors, mediaRepo,
             404
           );
         }
-        const referrers = db ? await findRequiredReferrers(db, registry, typeName, id) : [];
-        if (referrers.length > 0) {
-          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: inUseMessage(referrers) } }, 409);
-        }
-        try {
-          await repo.delete(id);
-        } catch (err) {
-          if (isForeignKeyViolation(err)) {
-            return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: IN_USE_RACE_MESSAGE } }, 409);
-          }
-          throw err;
-        }
-        const mediaDeltas = [
-          topLevelMediaDelta(mediaFields, item, null)
-        ];
-        if (db) {
-          for (const f of paragraphFieldDefs) {
-            const comp = f.ui_component;
-            if (comp.component !== "paragraph-embed" || !comp.ref) continue;
-            const pType = registry.paragraph_types[comp.ref];
-            if (!pType) continue;
-            mediaDeltas.push(await deleteParagraphField(db, id, f.name, pType, registry));
-          }
+        const outcome = await deleteItemCascade(db, registry, mediaRepo, {
+          typeName,
+          fields: taxonomyType.fields,
+          mediaFields,
+          repo,
+          id,
+          row: item
+        });
+        if (!outcome.ok) {
+          return c.json({ ok: false, error: { code: "ITEM_IN_USE", message: outcome.message } }, 409);
         }
-        await applyMediaReferenceDelta(mergeMediaDeltas(...mediaDeltas), mediaRepo);
         return c.json({ ok: true });
       }
     );
@@ -2581,7 +2490,7 @@ function registerAdminMediaRoutes(app, mediaRepo, storage, requirePermission, ma
 
 // src/routes/admin/auth.ts
 import { getCookie as getCookie2 } from "hono/cookie";
-import { sql as sql5 } from "drizzle-orm";
+import { sql as sql4 } from "drizzle-orm";
 
 // src/auth/password.ts
 import { hashPassword, verifyPassword } from "@bobbykim/manguito-cms-core";
@@ -2647,7 +2556,7 @@ function registerAuthRoutes(app, db) {
       );
     }
     const userResult = await db.execute(
-      sql5`SELECT id, email, password_hash, role_id, token_version
+      sql4`SELECT id, email, password_hash, role_id, token_version
           FROM users WHERE email = ${email} LIMIT 1`
     );
     const user = userResult.rows[0];
@@ -2660,7 +2569,7 @@ function registerAuthRoutes(app, db) {
       return c.json(invalidCredentials, 401);
     }
     const roleResult = await db.execute(
-      sql5`SELECT r.name AS name, u.must_change_password
+      sql4`SELECT r.name AS name, u.must_change_password
           FROM roles r
           JOIN users u ON u.role_id = r.id
           WHERE r.id = ${user.role_id} AND u.id = ${user.id}
@@ -2720,7 +2629,7 @@ function registerAuthRoutes(app, db) {
       );
     }
     const rowResult = await db.execute(
-      sql5`SELECT u.token_version, r.name AS role
+      sql4`SELECT u.token_version, r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${payload.user_id}
@@ -2744,7 +2653,7 @@ function registerAuthRoutes(app, db) {
   app.post("/admin/api/auth/logout", authMiddleware, async (c) => {
     const user = c.get("user");
     await db.execute(
-      sql5`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
+      sql4`UPDATE users SET token_version = token_version + 1 WHERE id = ${user.id}`
     );
     clearAuthCookie(c, "auth_token");
     clearAuthCookie(c, "refresh_token", "/admin/api/auth");
@@ -2753,7 +2662,7 @@ function registerAuthRoutes(app, db) {
 }
 
 // src/routes/admin/users.ts
-import { sql as sql6 } from "drizzle-orm";
+import { sql as sql5 } from "drizzle-orm";
 import { randomBytes } from "crypto";
 function getActingUser(c) {
   return c.get("user");
@@ -2788,7 +2697,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       );
     }
     const hashResult = await db.execute(
-      sql6`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      sql5`SELECT password_hash FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const hashRow = hashResult.rows[0];
     if (!hashRow || !await verifyPassword(currentPassword, hashRow.password_hash)) {
@@ -2799,7 +2708,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
     }
     const newHash = await hashPassword(newPassword);
     await db.execute(
-      sql6`UPDATE users
+      sql5`UPDATE users
           SET password_hash       = ${newHash},
               must_change_password = false,
               token_version        = token_version + 1,
@@ -2810,7 +2719,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   });
   app.get("/admin/api/users", requirePermission("users:read"), async (c) => {
     const result = await db.execute(
-      sql6`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -2821,7 +2730,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
   app.get("/admin/api/users/:id", requirePermission("users:read"), async (c) => {
     const id = c.req.param("id");
     const result = await db.execute(
-      sql6`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+      sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                  u.created_at, u.updated_at
           FROM users u
           JOIN roles r ON r.id = u.role_id
@@ -2866,7 +2775,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const roleResult = await db.execute(
-        sql6`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
+        sql5`SELECT id FROM roles WHERE name = ${roleName} LIMIT 1`
       );
       const roleRow = roleResult.rows[0];
       if (!roleRow) {
@@ -2881,7 +2790,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       const tempPassword = generateTempPassword();
       const passwordHash = await hashPassword(tempPassword);
       const insertResult = await db.execute(
-        sql6`INSERT INTO users
+        sql5`INSERT INTO users
               (id, email, password_hash, role_id, must_change_password, token_version,
                created_at, updated_at)
             VALUES
@@ -2936,7 +2845,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        sql6`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
+        sql5`SELECT id, email, role_id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -2950,7 +2859,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       let changeRole = false;
       if (typeof body.role === "string" && body.role) {
         const roleResult = await db.execute(
-          sql6`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
+          sql5`SELECT id FROM roles WHERE name = ${body.role} LIMIT 1`
         );
         const roleRow = roleResult.rows[0];
         if (!roleRow) {
@@ -2970,7 +2879,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       }
       if (changeRole) {
         await db.execute(
-          sql6`UPDATE users
+          sql5`UPDATE users
               SET email         = ${newEmail},
                   role_id       = ${newRoleId},
                   token_version = token_version + 1,
@@ -2979,7 +2888,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       } else {
         await db.execute(
-          sql6`UPDATE users
+          sql5`UPDATE users
               SET email      = ${newEmail},
                   role_id    = ${newRoleId},
                   updated_at = NOW()
@@ -2987,7 +2896,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const updatedResult = await db.execute(
-        sql6`SELECT u.id, u.email, r.name AS role, u.must_change_password,
+        sql5`SELECT u.id, u.email, r.name AS role, u.must_change_password,
                    u.created_at, u.updated_at
             FROM users u
             JOIN roles r ON r.id = u.role_id
@@ -3024,7 +2933,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const result = await db.execute(
-        sql6`DELETE FROM users WHERE id = ${id} RETURNING id`
+        sql5`DELETE FROM users WHERE id = ${id} RETURNING id`
       );
       if (result.rows.length === 0) {
         return c.json(
@@ -3055,7 +2964,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
         );
       }
       const existingResult = await db.execute(
-        sql6`SELECT id FROM users WHERE id = ${id} LIMIT 1`
+        sql5`SELECT id FROM users WHERE id = ${id} LIMIT 1`
       );
       const existing = existingResult.rows[0];
       if (!existing) {
@@ -3067,7 +2976,7 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
       const tempPassword = generateTempPassword();
       const passwordHash = await hashPassword(tempPassword);
       await db.execute(
-        sql6`UPDATE users
+        sql5`UPDATE users
             SET password_hash        = ${passwordHash},
                 must_change_password = true,
                 token_version        = token_version + 1,
@@ -3080,10 +2989,10 @@ function registerUserRoutes(app, db, requirePermission, requireHierarchy) {
 }
 
 // src/routes/admin/config.ts
-import { sql as sql7 } from "drizzle-orm";
+import { sql as sql6 } from "drizzle-orm";
 var API_VERSION = (() => {
   try {
-    return "0.9.2";
+    return "0.9.4";
   } catch {
     return "0.0.0";
   }
@@ -3102,7 +3011,7 @@ function registerConfigRoute(app, config, registry, db) {
       permissions: r.permissions
     }));
     const userResult = await db.execute(
-      sql7`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
+      sql6`SELECT email, must_change_password FROM users WHERE id = ${actingUser.id} LIMIT 1`
     );
     const userRow = userResult.rows[0];
     return c.json({
@@ -3128,7 +3037,7 @@ function registerConfigRoute(app, config, registry, db) {
 }
 
 // src/routes/admin/schema.ts
-import { sql as sql8 } from "drizzle-orm";
+import { sql as sql7 } from "drizzle-orm";
 function liveFields(fields) {
   return fields.filter((f) => f.removed !== true);
 }
@@ -3168,7 +3077,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.content_types).map(async (ct) => {
         const result = await db.execute(
-          sql8`SELECT COUNT(*)::int AS count FROM ${sql8.raw(`"${ct.db.table_name}"`)}`
+          sql7`SELECT COUNT(*)::int AS count FROM ${sql7.raw(`"${ct.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: ct.name, label: ct.label, only_one: ct.only_one, count };
@@ -3180,7 +3089,7 @@ function registerSchemaRoute(app, registry, db) {
     const data = await Promise.all(
       Object.values(registry.taxonomy_types).map(async (tt) => {
         const result = await db.execute(
-          sql8`SELECT COUNT(*)::int AS count FROM ${sql8.raw(`"${tt.db.table_name}"`)}`
+          sql7`SELECT COUNT(*)::int AS count FROM ${sql7.raw(`"${tt.db.table_name}"`)}`
         );
         const count = Number(result.rows[0].count);
         return { name: tt.name, label: tt.label, count };
@@ -3192,14 +3101,14 @@ function registerSchemaRoute(app, registry, db) {
 
 // src/repositories/content.ts
 import crypto from "crypto";
-import { sql as sql9 } from "drizzle-orm";
+import { sql as sql8 } from "drizzle-orm";
 var SORTABLE_FIELDS2 = /* @__PURE__ */ new Set(["title", "created_at", "updated_at"]);
 function codeError(code, message) {
   const err = new Error(message);
   err.code = code;
   return err;
 }
-function quoteIdent4(name) {
+function quoteIdent3(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Unsafe SQL identifier: ${name}`);
   }
@@ -3214,43 +3123,43 @@ function quoteField(name) {
 function buildConditions(published_only, filters, search) {
   const conds = [];
   if (published_only) {
-    conds.push(sql9`published = true`);
+    conds.push(sql8`published = true`);
   }
   if (search && search.term.trim() !== "" && search.columns.length > 0) {
     const pattern = `%${search.term.trim()}%`;
-    const orConds = search.columns.map((col) => sql9`${sql9.raw(quoteField(col))} ILIKE ${pattern}`);
-    conds.push(sql9`(${sql9.join(orConds, sql9` OR `)})`);
+    const orConds = search.columns.map((col) => sql8`${sql8.raw(quoteField(col))} ILIKE ${pattern}`);
+    conds.push(sql8`(${sql8.join(orConds, sql8` OR `)})`);
   }
   if (filters) {
     for (const [field, value] of Object.entries(filters)) {
-      const col = sql9.raw(quoteField(field));
+      const col = sql8.raw(quoteField(field));
       if (Array.isArray(value)) {
         if (value.length === 0) continue;
-        const inList = sql9.join(
-          value.map((v) => sql9`${v}`),
-          sql9`, `
+        const inList = sql8.join(
+          value.map((v) => sql8`${v}`),
+          sql8`, `
         );
-        conds.push(sql9`${col} IN (${inList})`);
+        conds.push(sql8`${col} IN (${inList})`);
       } else if (typeof value === "object" && value !== null) {
         const op = value;
-        if (op.gt !== void 0) conds.push(sql9`${col} > ${op.gt}`);
-        if (op.gte !== void 0) conds.push(sql9`${col} >= ${op.gte}`);
-        if (op.lt !== void 0) conds.push(sql9`${col} < ${op.lt}`);
-        if (op.lte !== void 0) conds.push(sql9`${col} <= ${op.lte}`);
+        if (op.gt !== void 0) conds.push(sql8`${col} > ${op.gt}`);
+        if (op.gte !== void 0) conds.push(sql8`${col} >= ${op.gte}`);
+        if (op.lt !== void 0) conds.push(sql8`${col} < ${op.lt}`);
+        if (op.lte !== void 0) conds.push(sql8`${col} <= ${op.lte}`);
       } else {
-        conds.push(sql9`${col} = ${value}`);
+        conds.push(sql8`${col} = ${value}`);
       }
     }
   }
   return conds;
 }
 function whereFragment(conds) {
-  return conds.length > 0 ? sql9` WHERE ${sql9.join(conds, sql9` AND `)}` : sql9``;
+  return conds.length > 0 ? sql8` WHERE ${sql8.join(conds, sql8` AND `)}` : sql8``;
 }
 function createDrizzleContentRepository(db, tableName, options = {}) {
   const { relations = {}, publishedRelations = false, sortableColumns } = options;
   function tableRaw() {
-    return sql9.raw(quoteIdent4(tableName));
+    return sql8.raw(quoteIdent3(tableName));
   }
   async function resolveRows(rows, include, cache) {
     if (rows.length === 0) return rows;
@@ -3293,14 +3202,14 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       const offset = (page - 1) * per_page;
       const conds = buildConditions(published_only, filters, search);
       const where = whereFragment(conds);
-      const sortCol = sql9.raw(quoteIdent4(sort_by));
-      const sortDir = sql9.raw(sort_order === "desc" ? "DESC" : "ASC");
+      const sortCol = sql8.raw(quoteIdent3(sort_by));
+      const sortDir = sql8.raw(sort_order === "desc" ? "DESC" : "ASC");
       const countResult = await db.execute(
-        sql9`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
+        sql8`SELECT COUNT(*) AS total FROM ${tableRaw()}${where}`
       );
       const total = Number(countResult.rows[0]?.["total"] ?? 0);
       const dataResult = await db.execute(
-        sql9`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
+        sql8`SELECT * FROM ${tableRaw()}${where} ORDER BY ${sortCol} ${sortDir} LIMIT ${per_page} OFFSET ${offset}`
       );
       const rows = dataResult.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -3321,7 +3230,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findOne(id, include = []) {
       const result = await db.execute(
-        sql9`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
+        sql8`SELECT * FROM ${tableRaw()} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -3331,7 +3240,7 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
     },
     async findBySlug(slug, include = []) {
       const result = await db.execute(
-        sql9`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
+        sql8`SELECT * FROM ${tableRaw()} WHERE slug = ${slug} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       const rows = result.rows;
@@ -3347,10 +3256,10 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = sql9.join(entries.map(([k]) => sql9.raw(quoteIdent4(k))), sql9`, `);
-      const valsSql = sql9.join(entries.map(([, v]) => sql9`${v}`), sql9`, `);
+      const colsSql = sql8.join(entries.map(([k]) => sql8.raw(quoteIdent3(k))), sql8`, `);
+      const valsSql = sql8.join(entries.map(([, v]) => sql8`${v}`), sql8`, `);
       const result = await db.execute(
-        sql9`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        sql8`INSERT INTO ${tableRaw()} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -3363,25 +3272,25 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
       if (entries.length === 0) {
         return this.findOne(id);
       }
-      const setClauses = sql9.join(
-        entries.map(([k, v]) => sql9`${sql9.raw(quoteIdent4(k))} = ${v}`),
-        sql9`, `
+      const setClauses = sql8.join(
+        entries.map(([k, v]) => sql8`${sql8.raw(quoteIdent3(k))} = ${v}`),
+        sql8`, `
       );
       const result = await db.execute(
-        sql9`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        sql8`UPDATE ${tableRaw()} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(sql9`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
+      await db.execute(sql8`DELETE FROM ${tableRaw()} WHERE id = ${id}`);
     },
     async findAll(opts = {}) {
       const { include = [], published_only } = opts;
       const conds = buildConditions(published_only, void 0, void 0);
       const where = whereFragment(conds);
       const result = await db.execute(
-        sql9`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
+        sql8`SELECT * FROM ${tableRaw()}${where} ORDER BY created_at ASC`
       );
       const rows = result.rows;
       const cache = /* @__PURE__ */ new Map();
@@ -3393,23 +3302,23 @@ function createDrizzleContentRepository(db, tableName, options = {}) {
 
 // src/repositories/media.ts
 import crypto2 from "crypto";
-import { sql as sql10 } from "drizzle-orm";
+import { sql as sql9 } from "drizzle-orm";
 function createMediaRepository(db) {
-  const TABLE = sql10.raw('"media"');
+  const TABLE = sql9.raw('"media"');
   return {
     async findMany(opts = {}) {
       const { page = 1, per_page = 10, type, orphaned } = opts;
       const offset = (page - 1) * per_page;
       const conds = [];
-      if (type) conds.push(sql10`type = ${type}`);
-      if (orphaned) conds.push(sql10`reference_count = 0`);
-      const where = conds.length > 0 ? sql10` WHERE ${sql10.join(conds, sql10` AND `)}` : sql10``;
-      const countResult = await db.execute(sql10`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
+      if (type) conds.push(sql9`type = ${type}`);
+      if (orphaned) conds.push(sql9`reference_count = 0`);
+      const where = conds.length > 0 ? sql9` WHERE ${sql9.join(conds, sql9` AND `)}` : sql9``;
+      const countResult = await db.execute(sql9`SELECT COUNT(*) AS total FROM ${TABLE}${where}`);
       const total = Number(
         countResult.rows[0]?.["total"] ?? 0
       );
       const dataResult = await db.execute(
-        sql10`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
+        sql9`SELECT * FROM ${TABLE}${where} ORDER BY created_at DESC LIMIT ${per_page} OFFSET ${offset}`
       );
       const total_pages = Math.ceil(total / per_page);
       return {
@@ -3427,7 +3336,7 @@ function createMediaRepository(db) {
     },
     async findOne(id) {
       const result = await db.execute(
-        sql10`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
+        sql9`SELECT * FROM ${TABLE} WHERE id = ${id} LIMIT 1`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
@@ -3441,10 +3350,10 @@ function createMediaRepository(db) {
         updated_at: /* @__PURE__ */ new Date()
       };
       const entries = Object.entries(record).filter(([, v]) => v !== void 0);
-      const colsSql = sql10.join(entries.map(([k]) => sql10.raw(`"${k}"`)), sql10`, `);
-      const valsSql = sql10.join(entries.map(([, v]) => sql10`${v}`), sql10`, `);
+      const colsSql = sql9.join(entries.map(([k]) => sql9.raw(`"${k}"`)), sql9`, `);
+      const valsSql = sql9.join(entries.map(([, v]) => sql9`${v}`), sql9`, `);
       const result = await db.execute(
-        sql10`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
+        sql9`INSERT INTO ${TABLE} (${colsSql}) VALUES (${valsSql}) RETURNING *`
       );
       return result.rows[0];
     },
@@ -3454,31 +3363,31 @@ function createMediaRepository(db) {
         ([k, v]) => k !== "id" && v !== void 0
       );
       if (entries.length === 0) return this.findOne(id);
-      const setClauses = sql10.join(
-        entries.map(([k, v]) => sql10`${sql10.raw(`"${k}"`)} = ${v}`),
-        sql10`, `
+      const setClauses = sql9.join(
+        entries.map(([k, v]) => sql9`${sql9.raw(`"${k}"`)} = ${v}`),
+        sql9`, `
       );
       const result = await db.execute(
-        sql10`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
+        sql9`UPDATE ${TABLE} SET ${setClauses} WHERE id = ${id} RETURNING *`
       );
       if (result.rows.length === 0) return null;
       return result.rows[0];
     },
     async delete(id) {
-      await db.execute(sql10`DELETE FROM ${TABLE} WHERE id = ${id}`);
+      await db.execute(sql9`DELETE FROM ${TABLE} WHERE id = ${id}`);
     },
     async incrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = sql10.join(ids.map((id) => sql10`${id}`), sql10`, `);
+      const inList = sql9.join(ids.map((id) => sql9`${id}`), sql9`, `);
       await db.execute(
-        sql10`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
+        sql9`UPDATE ${TABLE} SET reference_count = reference_count + 1, updated_at = NOW() WHERE id IN (${inList})`
       );
     },
     async decrementReferenceCount(ids) {
       if (ids.length === 0) return;
-      const inList = sql10.join(ids.map((id) => sql10`${id}`), sql10`, `);
+      const inList = sql9.join(ids.map((id) => sql9`${id}`), sql9`, `);
       await db.execute(
-        sql10`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
+        sql9`UPDATE ${TABLE} SET reference_count = GREATEST(reference_count - 1, 0), updated_at = NOW() WHERE id IN (${inList})`
       );
     }
   };
@@ -3611,7 +3520,7 @@ function createCmsApp(options) {
   const requirePermission = createPermissionMiddleware(rolesRegistry);
   const getUserRole = async (userId) => {
     const result = await db.execute(
-      sql11`SELECT r.name AS role
+      sql10`SELECT r.name AS role
           FROM users u
           JOIN roles r ON r.id = u.role_id
           WHERE u.id = ${userId}
@@ -3781,7 +3690,7 @@ function createCmsApp(options) {
       handler: null,
       error: null
     }));
-    const ready = import("./handler-MFF32JB4.mjs").then(({ createGraphQLHandler }) => {
+    const ready = import("./handler-5OTVPIAF.mjs").then(({ createGraphQLHandler }) => {
       gqlPasses.forEach((pass, i) => {
         const mount = mounts[i];
         try {