@acms-subir/core 0.0.1

package/src/lib/repo/sql.ts

@@ -0,0 +1,721 @@
+import type { ContentRepository, Stats } from './types';
+import { Page, Post, Link, Media, NavItem, Redirect, Settings, Tag, User, normalizeRedirectPath, slugify, type WidgetInstance } from '../schema';
+import { MIGRATIONS, MIGRATIONS_TABLE } from './migrations';
+import { rankByQuery } from './search';
+import { SEED } from '../brand';
+import { CONTENT, postsIndexUrl } from '../content';
+
+// Shared SQL implementation of ContentRepository. Cloudflare D1 and libSQL
+// are both SQLite, so every statement, mapper and behavior lives here once;
+// the adapters (d1.ts / sqlite.ts) only supply a thin SqlDriver over their
+// respective client APIs.
+
+type Row = Record<string, unknown>;
+
+export interface SqlStatement {
+  sql: string;
+  args?: unknown[];
+}
+
+export interface SqlDriver {
+  all(sql: string, args?: unknown[]): Promise<Row[]>;
+  run(sql: string, args?: unknown[]): Promise<void>;
+  // atomic where the backend supports it (D1 batch / libSQL write batch)
+  batch(stmts: SqlStatement[]): Promise<void>;
+}
+
+function rowToPage(r: Row): Page {
+  return Page.parse({
+    id: r.id, slug: r.slug, title: r.title, status: r.status,
+    isHome: Boolean(r.is_home), locale: r.locale ?? '',
+    blocks: JSON.parse(String(r.blocks ?? '[]')),
+    bodyJson: r.body_json ?? '', bodyHtml: r.body_html ?? '',
+    seoTitle: r.seo_title ?? '', seoDesc: r.seo_desc ?? '',
+    template: r.template ?? '',
+    createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
+  });
+}
+function rowToPost(r: Row, authorIds?: string[]): Post {
+  return Post.parse({
+    id: r.id, collection: r.collection ?? 'posts', slug: r.slug, title: r.title, body: r.body ?? '',
+    bodyJson: r.body_json ?? '', bodyHtml: r.body_html ?? '', excerpt: r.excerpt ?? '',
+    tags: JSON.parse(String(r.tags ?? '[]')), cover: r.cover ?? '', coverAlt: r.cover_alt ?? '',
+    seoTitle: r.seo_title ?? '', seoDesc: r.seo_desc ?? '', status: r.status,
+    featured: Boolean(r.featured), authorId: r.author_id ?? null,
+    authorIds: authorIds ?? (r.author_id ? [String(r.author_id)] : []),
+    template: r.template ?? '',
+    publishedAt: r.published_at === null ? null : Number(r.published_at),
+    scheduledAt: r.scheduled_at === null ? null : Number(r.scheduled_at),
+    createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
+  });
+}
+function rowToTag(r: Row): Tag {
+  return Tag.parse({ id: r.id, name: r.name, slug: r.slug, description: r.description ?? '' });
+}
+function rowToUser(r: Row): User {
+  return User.parse({
+    id: r.id, name: r.name, email: r.email, role: r.role,
+    bio: r.bio ?? '', avatar: r.avatar ?? '', slug: r.slug ?? '',
+    createdAt: Number(r.created_at),
+  });
+}
+function rowToMedia(r: Row): Media {
+  return Media.parse({
+    id: r.id, key: r.key, filename: r.filename, mime: r.mime,
+    width: Number(r.width), height: Number(r.height), size: Number(r.size),
+    alt: r.alt ?? '', variants: JSON.parse(String(r.variants ?? '[]')),
+    createdAt: Number(r.created_at),
+  });
+}
+function rowToLink(r: Row): Link {
+  return Link.parse({
+    id: r.id, kind: r.kind ?? 'link', label: r.label, url: r.url, icon: r.icon ?? '',
+    html: r.html ?? '', meta: JSON.parse(String(r.meta ?? '{}')),
+    order: Number(r.ord), clicks: Number(r.clicks),
+  });
+}
+
+export class SqlRepository implements ContentRepository {
+  private driver!: SqlDriver;
+  private ready: Promise<void>;
+
+  constructor(driver: SqlDriver | (() => Promise<SqlDriver>)) {
+    this.ready = this.init(driver);
+  }
+
+  private async init(driver: SqlDriver | (() => Promise<SqlDriver>)) {
+    this.driver = typeof driver === 'function' ? await driver() : driver;
+    await this.migrate();
+    await this.seed();
+  }
+
+  private async first(sql: string, args?: unknown[]): Promise<Row | null> {
+    const rows = await this.driver.all(sql, args);
+    return rows[0] ?? null;
+  }
+
+  private async migrate() {
+    await this.driver.run(MIGRATIONS_TABLE);
+    const r = await this.first('SELECT MAX(version) AS v FROM migrations');
+    let applied = Number(r?.v ?? 0);
+    if (applied === 0) {
+      // Pre-migrations DB: the baseline tables already exist, mark v1 applied.
+      const baseline = await this.first("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'pages'");
+      if (baseline) {
+        await this.driver.run('INSERT INTO migrations (version, applied_at) VALUES (1, ?)', [Date.now()]);
+        applied = 1;
+      }
+    }
+    for (const m of MIGRATIONS.filter((m) => m.version > applied)) {
+      await this.driver.batch([
+        ...m.statements.map((sql) => ({ sql })),
+        { sql: 'INSERT INTO migrations (version, applied_at) VALUES (?, ?)', args: [m.version, Date.now()] },
+      ]);
+    }
+  }
+
+  private async seed() {
+    const existing = await this.first('SELECT id FROM settings WHERE id = 1');
+    if (existing) return;
+    const now = Date.now();
+    const uuid = () => crypto.randomUUID();
+    const homeBlocks: WidgetInstance[] = [
+      { id: uuid(), type: 'hero', config: { heading: SEED.heroHeading, sub: SEED.heroSub, ctaLabel: `Read the ${CONTENT.posts.plural.toLowerCase()}`, ctaHref: postsIndexUrl(), align: 'center' } },
+      { id: uuid(), type: 'text', config: { markdown: 'This home page was built in the **widget editor** — open `/admin` to change it.' } },
+    ];
+    await this.driver.batch([
+      { sql: 'INSERT INTO settings (id, site_title, tagline) VALUES (1, ?, ?)', args: [SEED.siteTitle, SEED.tagline] },
+      {
+        sql: 'INSERT INTO pages (id, slug, title, status, is_home, blocks, created_at, updated_at) VALUES (?, ?, ?, ?, 1, ?, ?, ?)',
+        args: [uuid(), 'home', 'Home', 'published', JSON.stringify(homeBlocks), now, now],
+      },
+      {
+        sql: 'INSERT INTO posts (id, slug, title, body, status, published_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [uuid(), 'hello-world', 'Hello, world', `This is your first ${CONTENT.posts.singular.toLowerCase()}. Edit or delete it in the [admin](/admin).`, 'published', now, now, now],
+      },
+      { sql: 'INSERT INTO links (id, label, url, ord) VALUES (?, ?, ?, 0)', args: [uuid(), 'GitHub', 'https://github.com'] },
+      { sql: 'INSERT INTO links (id, label, url, ord) VALUES (?, ?, ?, 1)', args: [uuid(), 'Astro docs', 'https://docs.astro.build'] },
+    ]);
+  }
+
+  // ---- pages ----
+  async listPages() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM pages ORDER BY updated_at DESC');
+    return rows.map(rowToPage);
+  }
+  async getPage(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM pages WHERE id = ?', [id]);
+    return r ? rowToPage(r) : null;
+  }
+  async getPageBySlug(slug: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM pages WHERE slug = ?', [slug]);
+    return r ? rowToPage(r) : null;
+  }
+  // omitted/'' = the default locale's home ('' is how default-locale rows
+  // store their locale, so pre-i18n databases keep working unchanged)
+  async getHomePage(locale?: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM pages WHERE is_home = 1 AND locale = ? LIMIT 1', [locale ?? '']);
+    return r ? rowToPage(r) : null;
+  }
+  async createPage({ title, slug }: { title: string; slug: string }) {
+    await this.ready;
+    const now = Date.now();
+    const id = crypto.randomUUID();
+    await this.driver.run(
+      'INSERT INTO pages (id, slug, title, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)',
+      [id, slug, title, 'draft', now, now]
+    );
+    return (await this.getPage(id))!;
+  }
+  async updatePage(id: string, data: Parameters<ContentRepository['updatePage']>[1]) {
+    await this.ready;
+    const sets: string[] = ['updated_at = ?'];
+    const args: unknown[] = [Date.now()];
+    if (data.title !== undefined) { sets.push('title = ?'); args.push(data.title); }
+    if (data.slug !== undefined) { sets.push('slug = ?'); args.push(data.slug); }
+    if (data.status !== undefined) { sets.push('status = ?'); args.push(data.status); }
+    if (data.seoTitle !== undefined) { sets.push('seo_title = ?'); args.push(data.seoTitle); }
+    if (data.seoDesc !== undefined) { sets.push('seo_desc = ?'); args.push(data.seoDesc); }
+    if (data.template !== undefined) { sets.push('template = ?'); args.push(data.template); }
+    if (data.blocks !== undefined) { sets.push('blocks = ?'); args.push(JSON.stringify(data.blocks)); }
+    if (data.bodyJson !== undefined) { sets.push('body_json = ?'); args.push(data.bodyJson); }
+    if (data.bodyHtml !== undefined) { sets.push('body_html = ?'); args.push(data.bodyHtml); }
+    if (data.locale !== undefined) { sets.push('locale = ?'); args.push(data.locale); }
+    if (data.isHome !== undefined) {
+      if (data.isHome) {
+        // "is home" is per-locale: only displace the home of the locale this
+        // page is in (or is being moved to in this same save)
+        const locale =
+          data.locale !== undefined
+            ? data.locale
+            : String((await this.first('SELECT locale FROM pages WHERE id = ?', [id]))?.locale ?? '');
+        await this.driver.run('UPDATE pages SET is_home = 0 WHERE locale = ?', [locale]);
+      }
+      sets.push('is_home = ?'); args.push(data.isHome ? 1 : 0);
+    }
+    args.push(id);
+    await this.driver.run(`UPDATE pages SET ${sets.join(', ')} WHERE id = ?`, args);
+  }
+  async deletePage(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM pages WHERE id = ?', [id]);
+  }
+
+  // ---- posts ----
+  // one query loads every post↔author pair; callers merge per post id
+  private async authorMap(): Promise<Map<string, string[]>> {
+    const rows = await this.driver.all('SELECT post_id, author_id FROM post_authors ORDER BY ord ASC');
+    const map = new Map<string, string[]>();
+    for (const r of rows) {
+      const list = map.get(String(r.post_id)) ?? [];
+      list.push(String(r.author_id));
+      map.set(String(r.post_id), list);
+    }
+    return map;
+  }
+  private async postAuthors(id: string): Promise<string[]> {
+    const rows = await this.driver.all('SELECT author_id FROM post_authors WHERE post_id = ? ORDER BY ord ASC', [id]);
+    return rows.map((r) => String(r.author_id));
+  }
+  async listPosts(collection?: string) {
+    await this.ready;
+    const [rows, authors] = await Promise.all([
+      collection
+        ? this.driver.all('SELECT * FROM posts WHERE collection = ? ORDER BY updated_at DESC', [collection])
+        : this.driver.all('SELECT * FROM posts ORDER BY updated_at DESC'),
+      this.authorMap(),
+    ]);
+    return rows.map((r) => rowToPost(r, authors.get(String(r.id))));
+  }
+  async listPublishedPosts(collection?: string) {
+    await this.ready;
+    const [rows, authors] = await Promise.all([
+      collection
+        ? this.driver.all("SELECT * FROM posts WHERE status = 'published' AND collection = ? ORDER BY published_at DESC", [collection])
+        : this.driver.all("SELECT * FROM posts WHERE status = 'published' ORDER BY published_at DESC"),
+      this.authorMap(),
+    ]);
+    return rows.map((r) => rowToPost(r, authors.get(String(r.id))));
+  }
+  async getPost(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM posts WHERE id = ?', [id]);
+    return r ? rowToPost(r, await this.postAuthors(id)) : null;
+  }
+  async getPostBySlug(slug: string, collection?: string) {
+    await this.ready;
+    const r = collection
+      ? await this.first('SELECT * FROM posts WHERE slug = ? AND collection = ?', [slug, collection])
+      : await this.first('SELECT * FROM posts WHERE slug = ?', [slug]);
+    return r ? rowToPost(r, await this.postAuthors(String(r.id))) : null;
+  }
+  async createPost({ title, slug, collection = 'posts' }: { title: string; slug: string; collection?: string }) {
+    await this.ready;
+    const now = Date.now();
+    const id = crypto.randomUUID();
+    await this.driver.run(
+      'INSERT INTO posts (id, slug, title, collection, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?)',
+      [id, slug, title, collection, 'draft', now, now]
+    );
+    return (await this.getPost(id))!;
+  }
+  async updatePost(id: string, data: Parameters<ContentRepository['updatePost']>[1]) {
+    await this.ready;
+    const current = await this.getPost(id);
+    if (!current) return;
+    const sets: string[] = ['updated_at = ?'];
+    const args: unknown[] = [Date.now()];
+    if (data.title !== undefined) { sets.push('title = ?'); args.push(data.title); }
+    if (data.slug !== undefined) { sets.push('slug = ?'); args.push(data.slug); }
+    if (data.collection !== undefined) { sets.push('collection = ?'); args.push(data.collection); }
+    if (data.body !== undefined) { sets.push('body = ?'); args.push(data.body); }
+    if (data.bodyJson !== undefined) { sets.push('body_json = ?'); args.push(data.bodyJson); }
+    if (data.bodyHtml !== undefined) { sets.push('body_html = ?'); args.push(data.bodyHtml); }
+    if (data.excerpt !== undefined) { sets.push('excerpt = ?'); args.push(data.excerpt); }
+    if (data.tags !== undefined) { sets.push('tags = ?'); args.push(JSON.stringify(data.tags)); }
+    if (data.cover !== undefined) { sets.push('cover = ?'); args.push(data.cover); }
+    if (data.coverAlt !== undefined) { sets.push('cover_alt = ?'); args.push(data.coverAlt); }
+    if (data.seoTitle !== undefined) { sets.push('seo_title = ?'); args.push(data.seoTitle); }
+    if (data.seoDesc !== undefined) { sets.push('seo_desc = ?'); args.push(data.seoDesc); }
+    if (data.featured !== undefined) { sets.push('featured = ?'); args.push(data.featured ? 1 : 0); }
+    if (data.template !== undefined) { sets.push('template = ?'); args.push(data.template); }
+    // authorIds is the source of truth; author_id mirrors the first entry.
+    // The join rows are written AFTER the main UPDATE succeeds, so a failed
+    // update (e.g. duplicate slug) can't leave the two out of sync.
+    let authorJoin: string[] | null = null;
+    if (data.authorIds !== undefined) {
+      authorJoin = data.authorIds;
+      sets.push('author_id = ?'); args.push(data.authorIds[0] ?? null);
+    } else if (data.authorId !== undefined) {
+      authorJoin = data.authorId ? [data.authorId] : [];
+      sets.push('author_id = ?'); args.push(data.authorId);
+    }
+    if (data.publishedAt !== undefined) { sets.push('published_at = ?'); args.push(data.publishedAt); }
+    if (data.scheduledAt !== undefined) { sets.push('scheduled_at = ?'); args.push(data.scheduledAt); }
+    if (data.status !== undefined) {
+      sets.push('status = ?'); args.push(data.status);
+      if (data.status === 'published' && current.publishedAt === null && data.publishedAt === undefined) {
+        sets.push('published_at = ?'); args.push(Date.now());
+      }
+    }
+    args.push(id);
+    await this.driver.run(`UPDATE posts SET ${sets.join(', ')} WHERE id = ?`, args);
+    if (authorJoin !== null) {
+      await this.driver.batch([
+        { sql: 'DELETE FROM post_authors WHERE post_id = ?', args: [id] },
+        ...authorJoin.map((aid, i) => ({
+          sql: 'INSERT INTO post_authors (post_id, author_id, ord) VALUES (?, ?, ?)',
+          args: [id, aid, i],
+        })),
+      ]);
+    }
+  }
+  async deletePost(id: string) {
+    await this.ready;
+    await this.driver.batch([
+      { sql: 'DELETE FROM posts WHERE id = ?', args: [id] },
+      { sql: 'DELETE FROM post_authors WHERE post_id = ?', args: [id] },
+    ]);
+  }
+  async publishDuePosts(now: number) {
+    await this.ready;
+    const due = await this.first(
+      "SELECT COUNT(*) AS n FROM posts WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
+      [now]
+    );
+    const n = Number(due?.n ?? 0);
+    if (!n) return 0;
+    await this.driver.run(
+      "UPDATE posts SET status = 'published', published_at = COALESCE(published_at, scheduled_at), scheduled_at = NULL, updated_at = ? WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
+      [now, now]
+    );
+    return n;
+  }
+
+  // ---- media ----
+  async listMedia() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM media ORDER BY created_at DESC');
+    return rows.map(rowToMedia);
+  }
+  async getMedia(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM media WHERE id = ?', [id]);
+    return r ? rowToMedia(r) : null;
+  }
+  async createMedia(data: Parameters<ContentRepository['createMedia']>[0]) {
+    await this.ready;
+    await this.driver.run(
+      'INSERT INTO media (id, key, filename, mime, width, height, size, alt, variants, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+      [data.id, data.key, data.filename, data.mime, data.width, data.height, data.size, data.alt, JSON.stringify(data.variants), Date.now()]
+    );
+    return (await this.getMedia(data.id))!;
+  }
+  async updateMedia(id: string, data: Parameters<ContentRepository['updateMedia']>[1]) {
+    await this.ready;
+    if (data.alt === undefined) return;
+    await this.driver.run('UPDATE media SET alt = ? WHERE id = ?', [data.alt, id]);
+  }
+  async deleteMedia(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM media WHERE id = ?', [id]);
+  }
+
+  // ---- links ----
+  async listLinks() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM links ORDER BY ord ASC');
+    return rows.map(rowToLink);
+  }
+  async createLink({ label, url, icon = '', kind = 'link', html = '', meta = {} }: Parameters<ContentRepository['createLink']>[0]) {
+    await this.ready;
+    const next = await this.first('SELECT COALESCE(MAX(ord), -1) + 1 AS next FROM links');
+    const id = crypto.randomUUID();
+    await this.driver.run(
+      'INSERT INTO links (id, kind, label, url, icon, html, meta, ord) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
+      [id, kind, label, url, icon, html, JSON.stringify(meta), Number(next?.next ?? 0)]
+    );
+    const links = await this.listLinks();
+    return links.find((l) => l.id === id)!;
+  }
+  async updateLink(id: string, data: Parameters<ContentRepository['updateLink']>[1]) {
+    await this.ready;
+    const sets: string[] = [];
+    const args: unknown[] = [];
+    if (data.label !== undefined) { sets.push('label = ?'); args.push(data.label); }
+    if (data.url !== undefined) { sets.push('url = ?'); args.push(data.url); }
+    if (data.icon !== undefined) { sets.push('icon = ?'); args.push(data.icon); }
+    if (data.html !== undefined) { sets.push('html = ?'); args.push(data.html); }
+    if (data.meta !== undefined) { sets.push('meta = ?'); args.push(JSON.stringify(data.meta)); }
+    if (!sets.length) return;
+    args.push(id);
+    await this.driver.run(`UPDATE links SET ${sets.join(', ')} WHERE id = ?`, args);
+  }
+  async moveLink(id: string, dir: 'up' | 'down') {
+    await this.ready;
+    const links = await this.listLinks();
+    const i = links.findIndex((l) => l.id === id);
+    const j = dir === 'up' ? i - 1 : i + 1;
+    if (i < 0 || j < 0 || j >= links.length) return;
+    await this.driver.batch([
+      { sql: 'UPDATE links SET ord = ? WHERE id = ?', args: [links[j].order, links[i].id] },
+      { sql: 'UPDATE links SET ord = ? WHERE id = ?', args: [links[i].order, links[j].id] },
+    ]);
+  }
+  async reorderLinks(ids: string[]) {
+    await this.ready;
+    if (!ids.length) return;
+    await this.driver.batch(ids.map((id, i) => ({ sql: 'UPDATE links SET ord = ? WHERE id = ?', args: [i, id] })));
+  }
+  async deleteLink(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM links WHERE id = ?', [id]);
+  }
+  async trackClick(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT url FROM links WHERE id = ?', [id]);
+    if (!r) return null;
+    await this.driver.run('UPDATE links SET clicks = clicks + 1 WHERE id = ?', [id]);
+    return String(r.url);
+  }
+
+  // ---- tags ----
+  async listTags() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM tags ORDER BY name COLLATE NOCASE ASC');
+    return rows.map(rowToTag);
+  }
+  async getTagBySlug(slug: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM tags WHERE slug = ?', [slug]);
+    return r ? rowToTag(r) : null;
+  }
+  async createTag({ name, slug, description = '' }: { name: string; slug: string; description?: string }) {
+    await this.ready;
+    const id = crypto.randomUUID();
+    await this.driver.run('INSERT INTO tags (id, name, slug, description) VALUES (?, ?, ?, ?)', [id, name, slug, description]);
+    const r = await this.first('SELECT * FROM tags WHERE id = ?', [id]);
+    return rowToTag(r!);
+  }
+  async updateTag(id: string, data: Parameters<ContentRepository['updateTag']>[1]) {
+    await this.ready;
+    const sets: string[] = [];
+    const args: unknown[] = [];
+    if (data.name !== undefined) { sets.push('name = ?'); args.push(data.name); }
+    if (data.slug !== undefined) { sets.push('slug = ?'); args.push(data.slug); }
+    if (data.description !== undefined) { sets.push('description = ?'); args.push(data.description); }
+    if (!sets.length) return;
+    args.push(id);
+    await this.driver.run(`UPDATE tags SET ${sets.join(', ')} WHERE id = ?`, args);
+  }
+  async deleteTag(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM tags WHERE id = ?', [id]);
+  }
+  async ensureTags(names: string[]) {
+    await this.ready;
+    if (!names.length) return;
+    const tags = await this.listTags();
+    const existing = new Set(tags.map((t) => t.name.toLowerCase()));
+    const slugs = new Set(tags.map((t) => t.slug));
+    for (const name of names) {
+      if (existing.has(name.toLowerCase())) continue;
+      let slug = slugify(name);
+      let n = 1;
+      while (slugs.has(slug)) slug = `${slugify(name)}-${++n}`;
+      await this.driver.run('INSERT INTO tags (id, name, slug) VALUES (?, ?, ?)', [crypto.randomUUID(), name, slug]);
+      existing.add(name.toLowerCase());
+      slugs.add(slug);
+    }
+  }
+
+  // ---- users ----
+  async listUsers() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM users ORDER BY created_at ASC');
+    return rows.map(rowToUser);
+  }
+  async getUser(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM users WHERE id = ?', [id]);
+    return r ? rowToUser(r) : null;
+  }
+  async createUser({ name, email, role, passHash }: Parameters<ContentRepository['createUser']>[0]) {
+    await this.ready;
+    const id = crypto.randomUUID();
+    await this.driver.run(
+      'INSERT INTO users (id, name, email, role, pass_hash, created_at) VALUES (?, ?, ?, ?, ?, ?)',
+      [id, name, email.toLowerCase(), role, passHash, Date.now()]
+    );
+    return (await this.getUser(id))!;
+  }
+  async updateUser(id: string, data: Parameters<ContentRepository['updateUser']>[1]) {
+    await this.ready;
+    const sets: string[] = [];
+    const args: unknown[] = [];
+    if (data.name !== undefined) { sets.push('name = ?'); args.push(data.name); }
+    if (data.email !== undefined) { sets.push('email = ?'); args.push(data.email.toLowerCase()); }
+    if (data.role !== undefined) { sets.push('role = ?'); args.push(data.role); }
+    if (data.passHash !== undefined) { sets.push('pass_hash = ?'); args.push(data.passHash); }
+    if (data.bio !== undefined) { sets.push('bio = ?'); args.push(data.bio); }
+    if (data.avatar !== undefined) { sets.push('avatar = ?'); args.push(data.avatar); }
+    if (data.slug !== undefined) { sets.push('slug = ?'); args.push(data.slug); }
+    if (!sets.length) return;
+    args.push(id);
+    await this.driver.run(`UPDATE users SET ${sets.join(', ')} WHERE id = ?`, args);
+  }
+  async deleteUser(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM users WHERE id = ?', [id]);
+  }
+  async getUserAuth(email: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM users WHERE email = ?', [email.toLowerCase()]);
+    return r ? { user: rowToUser(r), passHash: String(r.pass_hash) } : null;
+  }
+
+  // ---- navigation ----
+  async listNavItems() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM nav_items ORDER BY ord ASC');
+    return rows.map((r) => NavItem.parse({ id: r.id, label: r.label, url: r.url, area: r.area, order: Number(r.ord) }));
+  }
+  async createNavItem({ label, url, area }: { label: string; url: string; area: NavItem['area'] }) {
+    await this.ready;
+    const next = await this.first('SELECT COALESCE(MAX(ord), -1) + 1 AS next FROM nav_items');
+    const id = crypto.randomUUID();
+    await this.driver.run(
+      'INSERT INTO nav_items (id, label, url, area, ord) VALUES (?, ?, ?, ?, ?)',
+      [id, label, url, area, Number(next?.next ?? 0)]
+    );
+    return (await this.listNavItems()).find((n) => n.id === id)!;
+  }
+  async updateNavItem(id: string, data: Partial<Pick<NavItem, 'label' | 'url' | 'area'>>) {
+    await this.ready;
+    const sets: string[] = [];
+    const args: unknown[] = [];
+    if (data.label !== undefined) { sets.push('label = ?'); args.push(data.label); }
+    if (data.url !== undefined) { sets.push('url = ?'); args.push(data.url); }
+    if (data.area !== undefined) { sets.push('area = ?'); args.push(data.area); }
+    if (!sets.length) return;
+    args.push(id);
+    await this.driver.run(`UPDATE nav_items SET ${sets.join(', ')} WHERE id = ?`, args);
+  }
+  async reorderNavItems(ids: string[]) {
+    await this.ready;
+    if (!ids.length) return;
+    await this.driver.batch(ids.map((id, i) => ({ sql: 'UPDATE nav_items SET ord = ? WHERE id = ?', args: [i, id] })));
+  }
+  async deleteNavItem(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM nav_items WHERE id = ?', [id]);
+  }
+
+  // ---- search ----
+  async searchPublished(query: string) {
+    await this.ready;
+    const q = `%${query.replace(/[%_]/g, ' ').trim()}%`;
+    if (q === '%%') return { posts: [], pages: [] };
+    const [posts, pages, authors] = await Promise.all([
+      this.driver.all(
+        "SELECT * FROM posts WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ? OR body LIKE ?) ORDER BY published_at DESC LIMIT 50",
+        [q, q, q, q]
+      ),
+      this.driver.all(
+        "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY updated_at DESC LIMIT 50",
+        [q, q]
+      ),
+      this.authorMap(),
+    ]);
+    return {
+      posts: rankByQuery(posts.map((r) => rowToPost(r, authors.get(String(r.id)))), query),
+      pages: pages.map(rowToPage),
+    };
+  }
+
+  // ---- restore ----
+  async restoreAll(content: Parameters<ContentRepository['restoreAll']>[0]) {
+    await this.ready;
+    const stmts: SqlStatement[] = [
+      ...['posts', 'pages', 'media', 'links', 'tags', 'nav_items', 'users', 'post_authors', 'redirects'].map((t) => ({
+        sql: `DELETE FROM ${t}`,
+      })),
+      ...content.pages.map((p) => ({
+        sql: 'INSERT INTO pages (id, slug, title, status, is_home, blocks, body_json, body_html, seo_title, seo_desc, template, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [p.id, p.slug, p.title, p.status, p.isHome ? 1 : 0, JSON.stringify(p.blocks), p.bodyJson, p.bodyHtml, p.seoTitle, p.seoDesc, p.template, p.createdAt, p.updatedAt],
+      })),
+      // p.collection defaults to 'posts' via the zod schema, so pre-v19
+      // backups restore cleanly into the built-in collection
+      ...content.posts.map((p) => ({
+        sql: 'INSERT INTO posts (id, collection, slug, title, body, body_json, body_html, excerpt, tags, cover, cover_alt, seo_title, seo_desc, status, featured, author_id, template, published_at, scheduled_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [p.id, p.collection, p.slug, p.title, p.body, p.bodyJson, p.bodyHtml, p.excerpt, JSON.stringify(p.tags), p.cover, p.coverAlt, p.seoTitle, p.seoDesc, p.status, p.featured ? 1 : 0, p.authorIds[0] ?? p.authorId, p.template, p.publishedAt, p.scheduledAt, p.createdAt, p.updatedAt],
+      })),
+      ...content.posts.flatMap((p) =>
+        (p.authorIds.length ? p.authorIds : p.authorId ? [p.authorId] : []).map((aid, i) => ({
+          sql: 'INSERT INTO post_authors (post_id, author_id, ord) VALUES (?, ?, ?)',
+          args: [p.id, aid, i] as unknown[],
+        }))
+      ),
+      ...content.media.map((m) => ({
+        sql: 'INSERT INTO media (id, key, filename, mime, width, height, size, alt, variants, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [m.id, m.key, m.filename, m.mime, m.width, m.height, m.size, m.alt, JSON.stringify(m.variants), m.createdAt],
+      })),
+      ...content.links.map((l) => ({
+        sql: 'INSERT INTO links (id, kind, label, url, icon, html, meta, ord, clicks) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [l.id, l.kind, l.label, l.url, l.icon, l.html, JSON.stringify(l.meta), l.order, l.clicks],
+      })),
+      ...content.tags.map((t) => ({
+        sql: 'INSERT INTO tags (id, name, slug, description) VALUES (?, ?, ?, ?)',
+        args: [t.id, t.name, t.slug, t.description],
+      })),
+      ...content.navItems.map((n) => ({
+        sql: 'INSERT INTO nav_items (id, label, url, area, ord) VALUES (?, ?, ?, ?, ?)',
+        args: [n.id, n.label, n.url, n.area, n.order],
+      })),
+      // accounts restore without hashes — sign in via ADMIN_PASSWORD and reset
+      ...content.users.map((u) => ({
+        sql: 'INSERT INTO users (id, name, email, role, pass_hash, bio, avatar, slug, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [u.id, u.name, u.email, u.role, '', u.bio, u.avatar, u.slug, u.createdAt],
+      })),
+      ...content.redirects.map((r) => ({
+        sql: 'INSERT INTO redirects (id, from_path, to_path, code, created_at) VALUES (?, ?, ?, ?, ?)',
+        args: [r.id, r.fromPath, r.toPath, r.code, r.createdAt],
+      })),
+    ];
+    await this.driver.batch(stmts);
+    await this.updateSettings(content.settings);
+  }
+
+  // ---- redirects ----
+  async listRedirects() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM redirects ORDER BY created_at DESC');
+    return rows.map((r) =>
+      Redirect.parse({ id: r.id, fromPath: r.from_path, toPath: r.to_path, code: Number(r.code), createdAt: Number(r.created_at) })
+    );
+  }
+  async createRedirect({ fromPath, toPath, code = 301 }: Parameters<ContentRepository['createRedirect']>[0]) {
+    await this.ready;
+    const from = normalizeRedirectPath(fromPath);
+    const to = normalizeRedirectPath(toPath);
+    if (!from || !to || from === to) throw new Error('Invalid redirect.');
+    await this.driver.batch([
+      // retarget chains (a→old becomes a→new) and drop any rule that would
+      // shadow the destination, then upsert on from_path
+      { sql: 'UPDATE redirects SET to_path = ? WHERE to_path = ?', args: [to, from] },
+      { sql: 'DELETE FROM redirects WHERE from_path = ?', args: [to] },
+      {
+        sql: 'INSERT INTO redirects (id, from_path, to_path, code, created_at) VALUES (?, ?, ?, ?, ?) ON CONFLICT(from_path) DO UPDATE SET to_path = excluded.to_path, code = excluded.code',
+        args: [crypto.randomUUID(), from, to, code, Date.now()],
+      },
+      { sql: 'DELETE FROM redirects WHERE from_path = to_path' },
+    ]);
+    return (await this.listRedirects()).find((r) => r.fromPath === from)!;
+  }
+  async deleteRedirect(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM redirects WHERE id = ?', [id]);
+  }
+
+  // ---- settings & stats ----
+  async getSettings() {
+    await this.ready;
+    const r = await this.first('SELECT * FROM settings WHERE id = 1');
+    return Settings.parse({
+      siteTitle: r?.site_title ?? 'My Site', tagline: r?.tagline ?? '', footerText: r?.footer_text ?? '',
+      linksName: r?.links_name ?? '', linksBio: r?.links_bio ?? '', linksAvatar: r?.links_avatar ?? '',
+      activeTheme: r?.active_theme ?? '', designOverrides: JSON.parse(String(r?.design_overrides ?? '{}')),
+      siteLogo: r?.site_logo ?? '',
+      siteUrl: r?.site_url ?? '', siteFavicon: r?.site_favicon ?? '', siteCover: r?.site_cover ?? '',
+      announcement: JSON.parse(String(r?.announcement ?? '{}')),
+      headCode: r?.head_code ?? '', footerCode: r?.footer_code ?? '',
+      timezone: r?.timezone ?? '', locale: r?.locale ?? '',
+      draftsApiKey: r?.drafts_api_key ?? '',
+      draftsAllowedOrigins: JSON.parse(String(r?.drafts_allowed_origins ?? '[]')),
+    });
+  }
+  async updateSettings(data: Partial<Settings>) {
+    await this.ready;
+    const current = await this.getSettings();
+    await this.driver.run(
+      'UPDATE settings SET site_title = ?, tagline = ?, footer_text = ?, links_name = ?, links_bio = ?, links_avatar = ?, active_theme = ?, design_overrides = ?, site_logo = ?, site_url = ?, site_favicon = ?, site_cover = ?, announcement = ?, head_code = ?, footer_code = ?, timezone = ?, locale = ?, drafts_api_key = ?, drafts_allowed_origins = ? WHERE id = 1',
+      [
+        data.siteTitle ?? current.siteTitle, data.tagline ?? current.tagline,
+        data.footerText ?? current.footerText,
+        data.linksName ?? current.linksName, data.linksBio ?? current.linksBio,
+        data.linksAvatar ?? current.linksAvatar,
+        data.activeTheme ?? current.activeTheme,
+        JSON.stringify(data.designOverrides ?? current.designOverrides),
+        data.siteLogo ?? current.siteLogo,
+        data.siteUrl ?? current.siteUrl,
+        data.siteFavicon ?? current.siteFavicon,
+        data.siteCover ?? current.siteCover,
+        JSON.stringify(data.announcement ?? current.announcement),
+        data.headCode ?? current.headCode,
+        data.footerCode ?? current.footerCode,
+        data.timezone ?? current.timezone,
+        data.locale ?? current.locale,
+        data.draftsApiKey ?? current.draftsApiKey,
+        JSON.stringify(data.draftsAllowedOrigins ?? current.draftsAllowedOrigins),
+      ]
+    );
+  }
+  async getStats(): Promise<Stats> {
+    await this.ready;
+    const r = await this.first(`SELECT
+      (SELECT COUNT(*) FROM pages WHERE status = 'published') AS pub_pages,
+      (SELECT COUNT(*) FROM posts) AS posts,
+      (SELECT COUNT(*) FROM posts WHERE status = 'draft') + (SELECT COUNT(*) FROM pages WHERE status = 'draft') AS drafts,
+      (SELECT COALESCE(SUM(clicks), 0) FROM links) AS clicks`);
+    return {
+      publishedPages: Number(r?.pub_pages ?? 0),
+      posts: Number(r?.posts ?? 0),
+      drafts: Number(r?.drafts ?? 0),
+      linkClicks: Number(r?.clicks ?? 0),
+    };
+  }
+}