@deskwork/studio 0.14.1 → 0.16.0

package/dist/routes/scrapbook-file.js

@@ -1,20 +1,29 @@
 /**
  * Read-only binary endpoint for scrapbook files.
  *
- * `GET /api/dev/scrapbook-file?site=<slug>&path=<scrapbook path>&name=<filename>[&secret=1]`
+ * Two addressing modes:
  *
- * Returns the raw bytes of a single scrapbook file with a sensible
- * Content-Type header. Read-only — no write/rename/delete here. The
- * shared scrapbook-item renderer uses this for image thumbnails,
- * PDF iframes, and download links on the review-drawer + content-view
- * surfaces.
+ *   `GET /api/dev/scrapbook-file?site=<slug>&path=<scrapbook path>&name=<filename>[&secret=1]`
+ *     — slug-shape addressing. `path` is the directory under `contentDir`
+ *     whose `scrapbook/` subdir holds the file. Validated through
+ *     `assertSlug` (kebab-case-only); rejects paths with dots / uppercase
+ *     / non-slug characters.
  *
- * Validation runs through `@deskwork/core/scrapbook`'s own
- * `assertSlug` / `assertFilename` (via `readScrapbookFile`), so path
- * traversal attempts are caught at the core boundary, not here.
+ *   `GET /api/dev/scrapbook-file?site=<slug>&entryId=<uuid>&name=<filename>[&secret=1]`
+ *     — entry-id addressing. The route reads the entry's sidecar to find
+ *     its on-disk artifactPath, derives the scrapbook dir from the
+ *     artifact's parent directory, and serves the file. No slug-shape
+ *     validation — works for projects whose feature-doc layout doesn't
+ *     match the kebab-case slug template (e.g. `docs/<version>/<status>/<feature>/`).
+ *
+ * Both modes return the raw bytes of a single scrapbook file with a
+ * sensible Content-Type header. Filename + path-traversal guards apply
+ * in both modes (via `assertFilename` + the containment check in
+ * `scrapbookFilePathAtDir`).
  */
 import { extname } from 'node:path';
-import { readScrapbookFile } from '@deskwork/core/scrapbook';
+import { readScrapbookFile, readScrapbookFileForEntry, } from '@deskwork/core/scrapbook';
+import { readSidecar } from '@deskwork/core/sidecar';
 const MIME_TYPES = {
     '.png': 'image/png',
     '.jpg': 'image/jpeg',
@@ -38,19 +47,43 @@ function contentTypeFor(filename) {
 export async function serveScrapbookFile(c, ctx) {
     const site = c.req.query('site');
     const path = c.req.query('path');
+    const entryId = c.req.query('entryId');
     const name = c.req.query('name');
     const secret = c.req.query('secret') === '1';
-    if (!site || !path || !name) {
-        return c.json({ error: 'site, path, and name query params are required' }, 400);
+    if (!site || !name) {
+        return c.json({ error: 'site and name query params are required' }, 400);
+    }
+    if (!path && !entryId) {
+        return c.json({ error: 'either path or entryId query param is required' }, 400);
     }
     if (!(site in ctx.config.sites)) {
         return c.json({ error: `unknown site: ${site}` }, 404);
     }
+    // Reject malformed entryId before it reaches the filesystem. `readSidecar`
+    // composes the path as `<projectRoot>/.deskwork/entries/<entryId>.json` —
+    // `node:path`'s join collapses `..` segments, so an unvalidated entryId
+    // can probe arbitrary on-disk locations even though no data is leaked
+    // (ENOENT becomes 404). Match the UUID schema enforced on entry creation.
+    if (entryId && !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(entryId)) {
+        return c.json({ error: 'invalid entryId' }, 400);
+    }
     let result;
     try {
-        result = readScrapbookFile(ctx.projectRoot, ctx.config, site, path, name, {
-            secret,
-        });
+        if (entryId) {
+            // Entry-id mode: resolve the scrapbook dir via the entry's sidecar.
+            // Bypasses slug-shape validation so projects with non-kebab-case
+            // content layouts (dots, uppercase, etc.) can still serve assets.
+            const entry = await readSidecar(ctx.projectRoot, entryId);
+            result = readScrapbookFileForEntry(ctx.projectRoot, ctx.config, site, { id: entry.uuid, slug: entry.slug }, name, { secret });
+        }
+        else {
+            // Slug-shape mode: backwards-compatible with existing scrapbook-viewer
+            // callers. `path!` is non-null here because the early-return covered
+            // the both-missing case.
+            result = readScrapbookFile(ctx.projectRoot, ctx.config, site, path, name, {
+                secret,
+            });
+        }
     }
     catch (err) {
         const reason = err instanceof Error ? err.message : String(err);

package/dist/routes/scrapbook-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"scrapbook-file.js","sourceRoot":"","sources":["../../src/routes/scrapbook-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,MAAM,UAAU,GAA2B;IACzC,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,iCAAiC;IAC1C,QAAQ,EAAE,kCAAkC;IAC5C,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,2BAA2B;IACnC,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,8BAA8B;IAC3C,MAAM,EAAE,8BAA8B;CACvC,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAU,EACV,GAAkB;IAElB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;IAE7C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAC3D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;YACxE,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,mEAAmE;QACnE,gEAAgE;QAChE,4DAA4D;QAC5D,iDAAiD;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,4DAA4D;IAC5D,kEAAkE;IAClE,+DAA+D;IAC/D,kEAAkE;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,eAAe,EAAE,qBAAqB;KACvC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"scrapbook-file.js","sourceRoot":"","sources":["../../src/routes/scrapbook-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,MAAM,UAAU,GAA2B;IACzC,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,iCAAiC;IAC1C,QAAQ,EAAE,kCAAkC;IAC5C,MAAM,EAAE,2BAA2B;IACnC,MAAM,EAAE,2BAA2B;IACnC,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,8BAA8B;IAC3C,MAAM,EAAE,8BAA8B;CACvC,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,CAAU,EACV,GAAkB;IAElB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;IAE7C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,yCAAyC,EAAE,EACpD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAC3D,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,sEAAsE;IACtE,0EAA0E;IAC1E,IAAI,OAAO,IAAI,CAAC,iEAAiE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,IAAI,OAAO,EAAE,CAAC;YACZ,oEAAoE;YACpE,iEAAiE;YACjE,kEAAkE;YAClE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,GAAG,yBAAyB,CAChC,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,MAAM,EACV,IAAI,EACJ,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EACpC,IAAI,EACJ,EAAE,MAAM,EAAE,CACX,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,qEAAqE;YACrE,yBAAyB;YACzB,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAK,EAAE,IAAI,EAAE;gBACzE,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,mEAAmE;QACnE,gEAAgE;QAChE,4DAA4D;QAC5D,iDAAiD;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,gEAAgE;IAChE,4DAA4D;IAC5D,kEAAkE;IAClE,+DAA+D;IAC/D,kEAAkE;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;QACvB,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;QAC3C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACrC,eAAe,EAAE,qBAAqB;KACvC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/scrapbook-mutation-dispatch.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Per-mode dispatch helpers for the studio scrapbook mutation routes.
+ *
+ * Post-#192: both modes (`entry` and `slug`) route through the entry-
+ * aware `*AtDir` family after `resolveScrapbookDir` produces an absolute
+ * scrapbook directory. The slug-mode resolution still goes through
+ * `scrapbookDirForEntry` — passing `{ slug }` without an id triggers
+ * the internal slug-template fallback inside the resolver — but the
+ * public CRUD surface is unified on the `*AtDir` helpers. The route
+ * handler stays thin: read JSON, parse envelope, validate route-
+ * specific args, dispatch.
+ *
+ * Extracted from `scrapbook-mutations.ts` (#191) to keep the route file
+ * under the project's 300–500 line cap.
+ */
+import { type ScrapbookItem } from '@deskwork/core/scrapbook';
+import type { StudioContext } from './api.ts';
+import { type ParsedEnvelope } from './scrapbook-mutation-envelope.ts';
+export declare function saveDispatch(ctx: StudioContext, env: ParsedEnvelope, filename: string, bodyText: string): Promise<ScrapbookItem>;
+export declare function renameInPlace(ctx: StudioContext, env: ParsedEnvelope, oldName: string, newName: string): Promise<ScrapbookItem>;
+export interface CrossSectionPaths {
+    srcAbs: string;
+    dstAbs: string;
+}
+export declare function resolveCrossSectionPaths(ctx: StudioContext, env: ParsedEnvelope, oldName: string, newName: string, toSecret: boolean): Promise<CrossSectionPaths>;
+export declare function deleteDispatch(ctx: StudioContext, env: ParsedEnvelope, filename: string): Promise<void>;
+export declare function createDispatch(ctx: StudioContext, env: ParsedEnvelope, filename: string, bodyText: string): Promise<ScrapbookItem>;
+export declare function uploadDispatch(ctx: StudioContext, env: ParsedEnvelope, filename: string, buf: Buffer): Promise<ScrapbookItem>;
+//# sourceMappingURL=scrapbook-mutation-dispatch.d.ts.map

package/dist/routes/scrapbook-mutation-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrapbook-mutation-dispatch.d.ts","sourceRoot":"","sources":["../../src/routes/scrapbook-mutation-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAOL,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,kCAAkC,CAAC;AAE1C,wBAAsB,YAAY,CAChC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAmBxB;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC,CAKxB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,cAAc,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,iBAAiB,CAAC,CAM5B;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAKxB;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,aAAa,CAAC,CAKxB"}

package/dist/routes/scrapbook-mutation-dispatch.js

@@ -0,0 +1,63 @@
+/**
+ * Per-mode dispatch helpers for the studio scrapbook mutation routes.
+ *
+ * Post-#192: both modes (`entry` and `slug`) route through the entry-
+ * aware `*AtDir` family after `resolveScrapbookDir` produces an absolute
+ * scrapbook directory. The slug-mode resolution still goes through
+ * `scrapbookDirForEntry` — passing `{ slug }` without an id triggers
+ * the internal slug-template fallback inside the resolver — but the
+ * public CRUD surface is unified on the `*AtDir` helpers. The route
+ * handler stays thin: read JSON, parse envelope, validate route-
+ * specific args, dispatch.
+ *
+ * Extracted from `scrapbook-mutations.ts` (#191) to keep the route file
+ * under the project's 300–500 line cap.
+ */
+import { createScrapbookMarkdownAtDir, deleteScrapbookFileAtDir, renameScrapbookFileAtDir, saveScrapbookFileAtDir, scrapbookFilePathAtDir, writeScrapbookUploadAtDir, } from '@deskwork/core/scrapbook';
+import { existsSync } from 'node:fs';
+import { resolveScrapbookDir, } from "./scrapbook-mutation-envelope.js";
+export async function saveDispatch(ctx, env, filename, bodyText) {
+    const dir = await resolveScrapbookDir(ctx, env);
+    const abs = scrapbookFilePathAtDir(dir, filename, { secret: env.secret });
+    if (!existsSync(abs)) {
+        if (filename.endsWith('.md')) {
+            return createScrapbookMarkdownAtDir(dir, filename, bodyText, {
+                secret: env.secret,
+            });
+        }
+        return writeScrapbookUploadAtDir(dir, filename, Buffer.from(bodyText, 'utf-8'), { secret: env.secret });
+    }
+    return saveScrapbookFileAtDir(dir, filename, bodyText, {
+        secret: env.secret,
+    });
+}
+export async function renameInPlace(ctx, env, oldName, newName) {
+    const dir = await resolveScrapbookDir(ctx, env);
+    return renameScrapbookFileAtDir(dir, oldName, newName, {
+        secret: env.secret,
+    });
+}
+export async function resolveCrossSectionPaths(ctx, env, oldName, newName, toSecret) {
+    const dir = await resolveScrapbookDir(ctx, env);
+    return {
+        srcAbs: scrapbookFilePathAtDir(dir, oldName, { secret: env.secret }),
+        dstAbs: scrapbookFilePathAtDir(dir, newName, { secret: toSecret }),
+    };
+}
+export async function deleteDispatch(ctx, env, filename) {
+    const dir = await resolveScrapbookDir(ctx, env);
+    deleteScrapbookFileAtDir(dir, filename, { secret: env.secret });
+}
+export async function createDispatch(ctx, env, filename, bodyText) {
+    const dir = await resolveScrapbookDir(ctx, env);
+    return createScrapbookMarkdownAtDir(dir, filename, bodyText, {
+        secret: env.secret,
+    });
+}
+export async function uploadDispatch(ctx, env, filename, buf) {
+    const dir = await resolveScrapbookDir(ctx, env);
+    return writeScrapbookUploadAtDir(dir, filename, buf, {
+        secret: env.secret,
+    });
+}
+//# sourceMappingURL=scrapbook-mutation-dispatch.js.map

package/dist/routes/scrapbook-mutation-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrapbook-mutation-dispatch.js","sourceRoot":"","sources":["../../src/routes/scrapbook-mutation-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,yBAAyB,GAE1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,kCAAkC,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,GAAmB,EACnB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE;gBAC3D,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,yBAAyB,CAC9B,GAAG,EACH,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAC9B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACrD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAkB,EAClB,GAAmB,EACnB,OAAe,EACf,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE;QACrD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;AACL,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAkB,EAClB,GAAmB,EACnB,OAAe,EACf,OAAe,EACf,QAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO;QACL,MAAM,EAAE,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QACpE,MAAM,EAAE,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,GAAmB,EACnB,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,wBAAwB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,GAAmB,EACnB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,4BAA4B,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE;QAC3D,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAkB,EAClB,GAAmB,EACnB,QAAgB,EAChB,GAAW;IAEX,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,yBAAyB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;QACnD,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/scrapbook-mutation-envelope.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Mutation-envelope parsing for the studio scrapbook routes.
+ *
+ * Lives next to `scrapbook-mutations.ts`; extracted (#191) to keep the
+ * route file under the project's 300–500 line cap. The single
+ * responsibility is:
+ *
+ *   1. Validate the request envelope (`site`, `entryId | slug`, `secret?`).
+ *   2. Validate `entryId` against the UUID regex BEFORE filesystem access
+ *      (the scrapbook-file route's same pattern, landed in v0.15.0
+ *      commit `14ffbe7`).
+ *   3. Resolve the absolute scrapbook directory for whichever addressing
+ *      mode the request used. Both modes route through
+ *      `scrapbookDirForEntry`: entry-id mode reads the sidecar to get
+ *      the bound `{ uuid, slug }`; slug mode synthesizes `{ slug }`
+ *      (no id) and lets the entry-aware resolver fall back to its
+ *      internal slug-template path. Post-#192 this is a single code
+ *      path with no public slug-template entry point.
+ *
+ * The envelope is a discriminated union (`mode: 'entry' | 'slug'`); call
+ * sites narrow without `as` casts.
+ */
+import type { StudioContext } from './api.ts';
+/**
+ * Mirrors the UUID regex enforced on entry creation and used by the
+ * scrapbook-file route. Rejects malformed `entryId` before it reaches
+ * the filesystem — `readSidecar` composes its path as
+ * `<projectRoot>/.deskwork/entries/<entryId>.json`, and `node:path`'s
+ * join collapses `..` segments, so an unvalidated `entryId` could probe
+ * arbitrary on-disk locations.
+ */
+export declare const UUID_RE: RegExp;
+/**
+ * Successfully-parsed mutation envelope.
+ *
+ * Exactly one of `mode === 'entry'` or `mode === 'slug'` is set per
+ * request — the discriminant tells the dispatch which addressing mode to
+ * use without `as` casts at the call site.
+ */
+export type ParsedEnvelope = {
+    mode: 'entry';
+    site: string;
+    entryId: string;
+    secret: boolean;
+} | {
+    mode: 'slug';
+    site: string;
+    slug: string;
+    secret: boolean;
+};
+export interface EnvelopeError {
+    error: string;
+    status: 400 | 404;
+}
+export declare function isEnvelopeError(v: ParsedEnvelope | EnvelopeError): v is EnvelopeError;
+/**
+ * Validate the common `{ site, entryId? | slug?, secret? }` envelope for
+ * JSON-body routes. Returns a typed object or an `EnvelopeError` that
+ * the caller propagates directly. The site existence check is here so
+ * every mutation 404s on unknown sites the same way the read endpoint
+ * does.
+ *
+ * `entryId` is preferred when both are present. UUID validation runs
+ * BEFORE filesystem access for the same reason as the scrapbook-file
+ * route — see the UUID_RE comment above.
+ */
+export declare function checkJsonEnvelope(ctx: StudioContext, body: Record<string, unknown>): ParsedEnvelope | EnvelopeError;
+/**
+ * Same shape as `checkJsonEnvelope` but reads from a `FormData` instance.
+ * Used by the upload route, which speaks multipart for binary file
+ * payloads. The semantics match — `entryId` preferred, `slug` is the
+ * deprecation-window fallback, UUID validation up-front.
+ *
+ * Note: the multipart `secret` field arrives as the literal string
+ * `"true"` (form fields are always strings); we normalize it here so
+ * the rest of the pipeline doesn't have to special-case form-vs-json.
+ */
+export declare function checkFormEnvelope(ctx: StudioContext, form: FormData): ParsedEnvelope | EnvelopeError;
+/**
+ * Resolve the absolute scrapbook directory for a parsed envelope. Both
+ * modes go through `scrapbookDirForEntry`:
+ *   - entry-id mode reads the sidecar and passes `{ id, slug }` so the
+ *     resolver hits the index lookup (refactor-proof binding).
+ *   - slug mode passes `{ slug }` only; the resolver still goes through
+ *     `findEntryFile`, which falls back to its private slug-template
+ *     path when no id binding exists. Post-#192 this is the only code
+ *     path; the public `scrapbookDir(slug)` was retired.
+ *
+ * Throws on lookup / resolution failure; the caller maps the error
+ * message onto the right HTTP status via `statusForError`.
+ */
+export declare function resolveScrapbookDir(ctx: StudioContext, env: ParsedEnvelope): Promise<string>;
+//# sourceMappingURL=scrapbook-mutation-envelope.d.ts.map

package/dist/routes/scrapbook-mutation-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrapbook-mutation-envelope.d.ts","sourceRoot":"","sources":["../../src/routes/scrapbook-mutation-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAM9C;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,QAC+C,CAAC;AAMpE;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GACtB;IACE,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEN,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;CACnB;AAED,wBAAgB,eAAe,CAC7B,CAAC,EAAE,cAAc,GAAG,aAAa,GAChC,CAAC,IAAI,aAAa,CAEpB;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,cAAc,GAAG,aAAa,CAmChC;AAMD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,aAAa,EAClB,IAAI,EAAE,QAAQ,GACb,cAAc,GAAG,aAAa,CAwBhC;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,MAAM,CAAC,CAgBjB"}

package/dist/routes/scrapbook-mutation-envelope.js

@@ -0,0 +1,147 @@
+/**
+ * Mutation-envelope parsing for the studio scrapbook routes.
+ *
+ * Lives next to `scrapbook-mutations.ts`; extracted (#191) to keep the
+ * route file under the project's 300–500 line cap. The single
+ * responsibility is:
+ *
+ *   1. Validate the request envelope (`site`, `entryId | slug`, `secret?`).
+ *   2. Validate `entryId` against the UUID regex BEFORE filesystem access
+ *      (the scrapbook-file route's same pattern, landed in v0.15.0
+ *      commit `14ffbe7`).
+ *   3. Resolve the absolute scrapbook directory for whichever addressing
+ *      mode the request used. Both modes route through
+ *      `scrapbookDirForEntry`: entry-id mode reads the sidecar to get
+ *      the bound `{ uuid, slug }`; slug mode synthesizes `{ slug }`
+ *      (no id) and lets the entry-aware resolver fall back to its
+ *      internal slug-template path. Post-#192 this is a single code
+ *      path with no public slug-template entry point.
+ *
+ * The envelope is a discriminated union (`mode: 'entry' | 'slug'`); call
+ * sites narrow without `as` casts.
+ */
+import { scrapbookDirForEntry } from '@deskwork/core/scrapbook';
+import { readSidecar } from '@deskwork/core/sidecar';
+// ---------------------------------------------------------------------------
+// UUID validation
+// ---------------------------------------------------------------------------
+/**
+ * Mirrors the UUID regex enforced on entry creation and used by the
+ * scrapbook-file route. Rejects malformed `entryId` before it reaches
+ * the filesystem — `readSidecar` composes its path as
+ * `<projectRoot>/.deskwork/entries/<entryId>.json`, and `node:path`'s
+ * join collapses `..` segments, so an unvalidated `entryId` could probe
+ * arbitrary on-disk locations.
+ */
+export const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function isEnvelopeError(v) {
+    return 'error' in v;
+}
+// ---------------------------------------------------------------------------
+// JSON envelope check
+// ---------------------------------------------------------------------------
+/**
+ * Validate the common `{ site, entryId? | slug?, secret? }` envelope for
+ * JSON-body routes. Returns a typed object or an `EnvelopeError` that
+ * the caller propagates directly. The site existence check is here so
+ * every mutation 404s on unknown sites the same way the read endpoint
+ * does.
+ *
+ * `entryId` is preferred when both are present. UUID validation runs
+ * BEFORE filesystem access for the same reason as the scrapbook-file
+ * route — see the UUID_RE comment above.
+ */
+export function checkJsonEnvelope(ctx, body) {
+    const site = body.site;
+    if (typeof site !== 'string' || site.length === 0) {
+        return { error: 'site is required', status: 400 };
+    }
+    if (!(site in ctx.config.sites)) {
+        return { error: `unknown site: ${site}`, status: 404 };
+    }
+    const secretRaw = body.secret;
+    if (secretRaw !== undefined && typeof secretRaw !== 'boolean') {
+        return { error: 'secret must be a boolean when provided', status: 400 };
+    }
+    const secret = secretRaw === true;
+    const entryId = body.entryId;
+    if (entryId !== undefined) {
+        if (typeof entryId !== 'string' || entryId.length === 0) {
+            return {
+                error: 'entryId must be a non-empty string when provided',
+                status: 400,
+            };
+        }
+        if (!UUID_RE.test(entryId)) {
+            return { error: 'invalid entryId', status: 400 };
+        }
+        return { mode: 'entry', site, entryId, secret };
+    }
+    // Back-compat slug-template fallback. To be removed in #192 once all
+    // callers send entryId.
+    const slug = body.slug;
+    if (typeof slug !== 'string' || slug.length === 0) {
+        return { error: 'entryId or slug is required', status: 400 };
+    }
+    return { mode: 'slug', site, slug, secret };
+}
+// ---------------------------------------------------------------------------
+// Multipart envelope check
+// ---------------------------------------------------------------------------
+/**
+ * Same shape as `checkJsonEnvelope` but reads from a `FormData` instance.
+ * Used by the upload route, which speaks multipart for binary file
+ * payloads. The semantics match — `entryId` preferred, `slug` is the
+ * deprecation-window fallback, UUID validation up-front.
+ *
+ * Note: the multipart `secret` field arrives as the literal string
+ * `"true"` (form fields are always strings); we normalize it here so
+ * the rest of the pipeline doesn't have to special-case form-vs-json.
+ */
+export function checkFormEnvelope(ctx, form) {
+    const site = form.get('site');
+    if (typeof site !== 'string' || site.length === 0) {
+        return { error: 'site is required', status: 400 };
+    }
+    if (!(site in ctx.config.sites)) {
+        return { error: `unknown site: ${site}`, status: 404 };
+    }
+    const secretField = form.get('secret');
+    const secret = typeof secretField === 'string' && secretField === 'true';
+    const entryIdField = form.get('entryId');
+    if (typeof entryIdField === 'string' && entryIdField.length > 0) {
+        if (!UUID_RE.test(entryIdField)) {
+            return { error: 'invalid entryId', status: 400 };
+        }
+        return { mode: 'entry', site, entryId: entryIdField, secret };
+    }
+    const slug = form.get('slug');
+    if (typeof slug !== 'string' || slug.length === 0) {
+        return { error: 'entryId or slug is required', status: 400 };
+    }
+    return { mode: 'slug', site, slug, secret };
+}
+// ---------------------------------------------------------------------------
+// Directory resolution
+// ---------------------------------------------------------------------------
+/**
+ * Resolve the absolute scrapbook directory for a parsed envelope. Both
+ * modes go through `scrapbookDirForEntry`:
+ *   - entry-id mode reads the sidecar and passes `{ id, slug }` so the
+ *     resolver hits the index lookup (refactor-proof binding).
+ *   - slug mode passes `{ slug }` only; the resolver still goes through
+ *     `findEntryFile`, which falls back to its private slug-template
+ *     path when no id binding exists. Post-#192 this is the only code
+ *     path; the public `scrapbookDir(slug)` was retired.
+ *
+ * Throws on lookup / resolution failure; the caller maps the error
+ * message onto the right HTTP status via `statusForError`.
+ */
+export async function resolveScrapbookDir(ctx, env) {
+    if (env.mode === 'entry') {
+        const entry = await readSidecar(ctx.projectRoot, env.entryId);
+        return scrapbookDirForEntry(ctx.projectRoot, ctx.config, env.site, { id: entry.uuid, slug: entry.slug });
+    }
+    return scrapbookDirForEntry(ctx.projectRoot, ctx.config, env.site, { slug: env.slug });
+}
+//# sourceMappingURL=scrapbook-mutation-envelope.js.map

package/dist/routes/scrapbook-mutation-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrapbook-mutation-envelope.js","sourceRoot":"","sources":["../../src/routes/scrapbook-mutation-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAClB,iEAAiE,CAAC;AAgCpE,MAAM,UAAU,eAAe,CAC7B,CAAiC;IAEjC,OAAO,OAAO,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAkB,EAClB,IAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;IAC9B,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,KAAK,EAAE,kDAAkD;gBACzD,MAAM,EAAE,GAAG;aACZ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,qEAAqE;IACrE,wBAAwB;IACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAkB,EAClB,IAAc;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,MAAM,CAAC;IAEzE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAkB,EAClB,GAAmB;IAEnB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,oBAAoB,CACzB,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,IAAI,EACR,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CACzB,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,IAAI,EACR,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CACnB,CAAC;AACJ,CAAC"}

package/dist/routes/scrapbook-mutations.d.ts

@@ -10,15 +10,33 @@
  * Phase 16d retrofitted only the read path. v0.4.1 closes the gap
  * (issue #21).
  *
+ * Two addressing modes (#191, unified post-#192):
+ *   - **Entry-id mode** (preferred): `{ site, entryId, ... }` — looks up
+ *     the entry's sidecar, derives the scrapbook dir from the artifact's
+ *     parent directory via `scrapbookDirForEntry`, mutates there. Same
+ *     code path the read endpoints use; refactor-proof for projects whose
+ *     feature-doc layout doesn't match the kebab-case slug template.
+ *   - **Slug mode** (back-compat fallback): `{ site, slug, ... }` —
+ *     accepted for back-compat with older clients. Post-#192, slug mode
+ *     also routes through `scrapbookDirForEntry`: passing `{ slug }`
+ *     without an id triggers the resolver's internal slug-template
+ *     fallback, so the public mutation surface is unified on the
+ *     entry-aware code path. The legacy `scrapbookDir(slug)` and the
+ *     slug-template CRUD primitives are no longer exported from
+ *     `@deskwork/core/scrapbook`.
+ *
+ * Companion modules (#191 split, to keep this file under the project's
+ * 300–500 line cap):
+ *   - `scrapbook-mutation-envelope.ts` — JSON / form envelope parsing,
+ *     UUID validation, dir resolution.
+ *   - `scrapbook-mutation-dispatch.ts` — per-mode dispatch helpers
+ *     (entry-aware vs. slug-template), one per route verb.
+ *
  * Design notes:
  *   - Path resolution + traversal protection runs through
- *     `@deskwork/core/scrapbook` helpers (`scrapbookFilePath` etc.).
- *     Those throw on `..` sequences, absolute paths, and any filename
- *     that escapes the scrapbook dir; we surface those as 400.
- *   - The client speaks `{ site, slug, filename, body }` for save/create,
- *     `{ site, slug, oldName, newName }` for rename, `{ site, slug,
- *     filename }` for delete, multipart `{ site, slug, file }` for
- *     upload. Endpoints accept those exact field names.
+ *     `@deskwork/core/scrapbook` helpers. Those throw on `..` sequences,
+ *     absolute paths, and any filename that escapes the scrapbook dir;
+ *     we surface those as 400.
  *   - We never log file contents on save / upload (privacy). Logging
  *     filename + slug is fine but kept silent here — the studio's
  *     console is the operator's, not a server log.

package/dist/routes/scrapbook-mutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scrapbook-mutations.d.ts","sourceRoot":"","sources":["../../src/routes/scrapbook-mutations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAc5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AA0F9C,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAqSvE"}
+{"version":3,"file":"scrapbook-mutations.d.ts","sourceRoot":"","sources":["../../src/routes/scrapbook-mutations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAgE9C,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAyMvE"}