@itsmrtr/bunkoshelf 1.12.0 → 1.13.0

package/dist/src/actions/books-reading.ts

@@ -3,6 +3,8 @@
 import { verifySession } from "@/lib/auth/verifySession";
 import { findBookVolumeBySlug } from "@/lib/db/books/library";
 import { upsertBookProgress } from "@/lib/db/books/reading";
+import { canAccessBookVolume } from "@/lib/clubs/access";
+import { recordClubProgressActivities } from "@/lib/db/clubs";
 
 function isDate(value: string): boolean {
   return /^\d{4}-\d{2}-\d{2}$/.test(value);
@@ -17,6 +19,7 @@ export async function updateBookReadState({ slug, read, readAt }: { slug: string
 
   const volume = await findBookVolumeBySlug(slug);
   if (!volume) return { success: false as const, error: "Book not found" };
+  if (!(await canAccessBookVolume(user, volume.id))) return { success: false as const, error: "Forbidden" };
 
   await upsertBookProgress(user.id, volume.id, {
     isRead: read,
@@ -24,6 +27,7 @@ export async function updateBookReadState({ slug, read, readAt }: { slug: string
     lastReadAt: read ? new Date() : null,
     readingDate: readAt,
   });
+  await recordClubProgressActivities(user.id, "BOOK_SERIES", volume.series.id);
 
   return { success: true as const };
 }

package/dist/src/actions/clubs.ts

@@ -0,0 +1,238 @@
+"use server";
+
+import bcrypt from "bcryptjs";
+import jwt from "jsonwebtoken";
+import { createHash } from "node:crypto";
+import { cookies } from "next/headers";
+import { revalidatePath } from "next/cache";
+import { createId } from "@paralleldrive/cuid2";
+import { verifySession } from "@/lib/auth/verifySession";
+import { createUserRecord, usernameExists } from "@/lib/db/users";
+import { execute, queryOne } from "@/lib/db/query";
+import {
+  addCandidateRecord,
+  addMilestoneRecord,
+  archiveClubRecord,
+  canAccessClub,
+  canManageClub,
+  castVoteRecord,
+  createClubRecord,
+  createCycleRecord,
+  createInviteRecord,
+  deleteClubRecord,
+  findClubBySlug,
+  findInviteByTokenHash,
+  getMembership,
+  removeCandidateRecord,
+  replaceCycleCandidates,
+  requestMembership,
+  reviewMembership,
+  selectCycleWork,
+  type ClubSourceType,
+} from "@/lib/db/clubs";
+
+type Result = { success: true } | { success: false; error: string };
+
+function slugify(value: string) {
+  return value.toLowerCase().trim().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48);
+}
+
+function inviteHash(token: string) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+async function manager(slug: string) {
+  const user = await verifySession();
+  const club = await findClubBySlug(slug);
+  if (!user || !club || !(await canManageClub(club, user.id, user.isAdmin))) return null;
+  return { user, club };
+}
+
+async function belongsToClub(cycleId: string, clubId: string) {
+  return !!(await queryOne<{ id: string }>("SELECT id FROM reading_club_cycles WHERE id=$1 AND club_id=$2", [cycleId, clubId]));
+}
+
+export async function createClub(input: { name: string; description?: string }): Promise<Result & { slug?: string }> {
+  const user = await verifySession();
+  const name = input.name.trim();
+  if (!user || user.role === "GUEST") return { success: false, error: "Unauthorized" };
+  if (name.length < 2 || name.length > 100) return { success: false, error: "Invalid club name" };
+  const slug = `${slugify(name) || "club"}-${createId().slice(-6)}`;
+  const club = await createClubRecord({ slug, name, description: input.description?.trim(), ownerId: user.id });
+  await requestMembership(club.id, user.id);
+  const membership = await getMembership(club.id, user.id);
+  if (membership) await reviewMembership(membership.id, "APPROVED");
+  revalidatePath("/", "layout");
+  return { success: true, slug };
+}
+
+export async function createClubInvite(slug: string): Promise<Result & { token?: string }> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE") return { success: false, error: "Unauthorized" };
+  const token = crypto.randomUUID().replace(/-/g, "") + crypto.randomUUID().replace(/-/g, "");
+  await createInviteRecord(context.club.id, inviteHash(token), context.user.id);
+  return { success: true, token };
+}
+
+export async function joinClubWithSession(token: string): Promise<Result & { slug?: string }> {
+  const user = await verifySession();
+  const invite = await findInviteByTokenHash(inviteHash(token));
+  if (!user || !invite || invite.club_status !== "ACTIVE") return { success: false, error: "Invalid invitation" };
+  if (user.role === "GUEST") return { success: false, error: "Guest accounts are limited to their club" };
+  await requestMembership(invite.club_id, user.id);
+  return { success: true, slug: invite.club_slug };
+}
+
+export async function joinClubAsGuest(input: { token: string; username: string; password: string }): Promise<Result & { slug?: string }> {
+  const invite = await findInviteByTokenHash(inviteHash(input.token));
+  const username = input.username.trim();
+  if (!invite || invite.club_status !== "ACTIVE") return { success: false, error: "Invalid invitation" };
+  if (!/^[a-zA-Z0-9_-]{3,32}$/.test(username) || input.password.length < 8) return { success: false, error: "Use a name of 3–32 characters and a password of at least 8 characters" };
+  if (await usernameExists(username)) return { success: false, error: "That name is already in use" };
+  const user = await createUserRecord({ username, password: await bcrypt.hash(input.password, 10), role: "GUEST", name: username });
+  await execute("INSERT INTO reading_club_guest_accounts (user_id,club_id) VALUES ($1,$2)", [user.id, invite.club_id]);
+  await requestMembership(invite.club_id, user.id);
+  const token = jwt.sign({ id: user.id, username: user.username, isAdmin: false, role: user.role }, process.env.JWT_SECRET!, { expiresIn: "180d", algorithm: "HS256" });
+  const cookieStore = await cookies();
+  cookieStore.set("yomimono_key", token, { httpOnly: true, secure: process.env.NODE_ENV === "production", sameSite: "lax", path: "/", maxAge: 180 * 24 * 60 * 60 });
+  return { success: true, slug: invite.club_slug };
+}
+
+export async function reviewClubMember(slug: string, memberId: string, status: "APPROVED" | "REJECTED" | "REVOKED"): Promise<Result> {
+  const context = await manager(slug);
+  if (!context) return { success: false, error: "Unauthorized" };
+  const member = await queryOne<{ id: string }>("SELECT id FROM reading_club_members WHERE id=$1 AND club_id=$2", [memberId, context.club.id]);
+  if (!member) return { success: false, error: "Member not found" };
+  await reviewMembership(memberId, status);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function removeClubMember(slug: string, memberId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context) return { success: false, error: "Unauthorized" };
+  const member = await queryOne<{ user_id: string; role: string }>("SELECT m.user_id,u.role FROM reading_club_members m INNER JOIN users u ON u.id=m.user_id WHERE m.id=$1 AND m.club_id=$2", [memberId, context.club.id]);
+  if (!member || member.user_id === context.club.ownerId) return { success: false, error: "Unauthorized" };
+  await reviewMembership(memberId, "REVOKED");
+  if (member.role === "GUEST") await execute("UPDATE users SET disabled_at=NOW() WHERE id=$1", [member.user_id]);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function createClubCycle(slug: string, input: { title: string; voteClosesAt?: string }): Promise<Result & { cycleId?: string }> {
+  const context = await manager(slug);
+  const title = input.title.trim();
+  if (!context || context.club.status !== "ACTIVE" || !title) return { success: false, error: "Invalid cycle" };
+  const pendingCycle = await queryOne<{ id: string }>("SELECT id FROM reading_club_cycles WHERE club_id=$1 AND status IN ('DRAFT','VOTING') LIMIT 1", [context.club.id]);
+  if (pendingCycle) return { success: false, error: "A cycle is already being prepared" };
+  const date = input.voteClosesAt ? new Date(`${input.voteClosesAt}T23:59:59.999`) : null;
+  if (date && (Number.isNaN(date.getTime()) || date <= new Date())) return { success: false, error: "Choose a future voting deadline" };
+  const cycle = await createCycleRecord(context.club.id, title, date);
+  return { success: true, cycleId: cycle.id };
+}
+
+export async function confirmClubCandidates(slug: string, cycleId: string, candidates: Array<{ sourceType: ClubSourceType; sourceId: string }>): Promise<Result> {
+  const context = await manager(slug);
+  const uniqueCandidates = Array.from(new Map(candidates.filter((candidate) => candidate.sourceId && (candidate.sourceType === "LIBRARY_SERIES" || candidate.sourceType === "BOOK_SERIES")).map((candidate) => [`${candidate.sourceType}:${candidate.sourceId}`, candidate])).values());
+  if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id)) || !uniqueCandidates.length) return { success: false, error: "Choose at least one work" };
+  const cycle = await queryOne<{ status: string; vote_closes_at: Date | null }>("SELECT status,vote_closes_at FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (!cycle || cycle.status !== "DRAFT") return { success: false, error: "This cycle cannot be changed" };
+  if (uniqueCandidates.length === 1) {
+    await execute("UPDATE reading_club_cycles SET status='COMPLETED', completed_at=NOW(), updated_at=NOW() WHERE club_id=$1 AND status='READING' AND id<>$2", [context.club.id, cycleId]);
+    await selectCycleWork(cycleId, uniqueCandidates[0].sourceType, uniqueCandidates[0].sourceId);
+  } else {
+    if (!cycle.vote_closes_at || cycle.vote_closes_at <= new Date()) return { success: false, error: "Choose a future voting deadline" };
+    await replaceCycleCandidates(cycleId, uniqueCandidates);
+    await execute("UPDATE reading_club_cycles SET status='VOTING', updated_at=NOW() WHERE id=$1", [cycleId]);
+  }
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function removeClubCandidate(slug: string, cycleId: string, candidateId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
+  const cycle = await queryOne<{ status: string }>("SELECT status FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (!cycle || cycle.status !== "VOTING") return { success: false, error: "Candidates can only be removed from an open vote" };
+  await removeCandidateRecord(candidateId, cycleId);
+  const remaining = await queryOne<{ count: string }>("SELECT COUNT(*)::text AS count FROM reading_club_candidates WHERE cycle_id=$1", [cycleId]);
+  if (Number(remaining?.count ?? 0) < 2) {
+    await replaceCycleCandidates(cycleId, []);
+    await execute("UPDATE reading_club_cycles SET status='DRAFT', updated_at=NOW() WHERE id=$1", [cycleId]);
+  }
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function addClubCandidate(slug: string, cycleId: string, sourceType: ClubSourceType, sourceId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !sourceId || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
+  const cycle = await queryOne<{ status: string; vote_closes_at: Date | null }>("SELECT status,vote_closes_at FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (cycle?.status !== "VOTING" || (cycle.vote_closes_at && cycle.vote_closes_at <= new Date())) return { success: false, error: "Candidates can only be added to an open vote" };
+  await addCandidateRecord(cycleId, sourceType, sourceId);
+  return { success: true };
+}
+
+export async function selectClubWork(slug: string, cycleId: string, sourceType: ClubSourceType, sourceId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !sourceId || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
+  const cycle = await queryOne<{ status: string; vote_closes_at: Date | null }>("SELECT status,vote_closes_at FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (!cycle || (cycle.status === "VOTING" && (!cycle.vote_closes_at || cycle.vote_closes_at > new Date()))) return { success: false, error: "Voting must be closed before choosing a work" };
+  if (cycle.status === "VOTING") {
+    const candidate = await queryOne<{ id: string }>("SELECT id FROM reading_club_candidates WHERE cycle_id=$1 AND source_type=$2 AND source_id=$3", [cycleId, sourceType, sourceId]);
+    if (!candidate) return { success: false, error: "Choose one of the voting candidates" };
+  }
+  await execute("UPDATE reading_club_cycles SET status='COMPLETED', completed_at=NOW(), updated_at=NOW() WHERE club_id=$1 AND status='READING' AND id<>$2", [context.club.id, cycleId]);
+  await selectCycleWork(cycleId, sourceType, sourceId);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function addClubMilestone(slug: string, cycleId: string, input: { label: string; position: number; targetDate: string }): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id)) || !input.label.trim() || input.position < 1 || input.position > 100) return { success: false, error: "Invalid milestone" };
+  await addMilestoneRecord(cycleId, input.position, input.label.trim(), input.targetDate);
+  return { success: true };
+}
+
+export async function completeClubCycle(slug: string, cycleId: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context || context.club.status !== "ACTIVE" || !(await belongsToClub(cycleId, context.club.id))) return { success: false, error: "Unauthorized" };
+  await execute("UPDATE reading_club_cycles SET status='COMPLETED', completed_at=NOW(), updated_at=NOW() WHERE id=$1 AND status='READING'", [cycleId]);
+  revalidatePath(`/es/clubs/${slug}`);
+  revalidatePath(`/en/clubs/${slug}`);
+  return { success: true };
+}
+
+export async function voteForClubCandidate(slug: string, cycleId: string, candidateId: string): Promise<Result> {
+  const user = await verifySession();
+  const club = await findClubBySlug(slug);
+  if (!user || !club || !(await canAccessClub(club, user.id, user.isAdmin))) return { success: false, error: "Unauthorized" };
+  const member = await getMembership(club.id, user.id);
+  if (!member || member.status !== "APPROVED") return { success: false, error: "Membership pending" };
+  const cycle = await queryOne<{ status: string; vote_closes_at: Date | null; club_id: string }>("SELECT status,vote_closes_at,club_id FROM reading_club_cycles WHERE id=$1", [cycleId]);
+  if (!cycle || cycle.club_id !== club.id || cycle.status !== "VOTING" || (cycle.vote_closes_at && cycle.vote_closes_at <= new Date())) return { success: false, error: "Voting is closed" };
+  await castVoteRecord(cycleId, candidateId, member.id);
+  return { success: true };
+}
+
+export async function archiveClub(slug: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context) return { success: false, error: "Unauthorized" };
+  await archiveClubRecord(context.club.id);
+  revalidatePath("/", "layout");
+  return { success: true };
+}
+
+export async function deleteClub(slug: string): Promise<Result> {
+  const context = await manager(slug);
+  if (!context) return { success: false, error: "Unauthorized" };
+  await deleteClubRecord(context.club.id);
+  revalidatePath("/", "layout");
+  return { success: true };
+}

package/dist/src/actions/favorites.ts

@@ -5,6 +5,7 @@ import {
   upsertSeriesFavorite,
   upsertVolumeProgress,
 } from "@/lib/db/reading";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 interface ToggleSeriesFavoriteParams {
   seriesId: string | number | null | undefined;
@@ -31,6 +32,7 @@ export async function toggleSeriesFavorite({ seriesId, favorite }: ToggleSeriesF
         ? ""
         : String(seriesId);
     const normalizedFavorite = favorite === true || String(favorite) === "true";
+    if (user.role === "GUEST") return { error: "Forbidden", status: 403 };
 
     if (
       typeof normalizedSeriesId !== "string" ||
@@ -76,6 +78,7 @@ export async function toggleVolumeFavorite({ volumeId, favorite }: ToggleVolumeF
     ) {
       return { error: "Invalid payload", status: 400 };
     }
+    if (!(await canAccessLibraryVolume(user, normalizedVolumeId))) return { error: "Forbidden", status: 403 };
 
     await upsertVolumeProgress(user.id, normalizedVolumeId, {
       isFavorite: normalizedFavorite,

package/dist/src/actions/progress.ts

@@ -9,6 +9,8 @@ import {
   upsertVolumeProgress,
 } from "@/lib/db/reading";
 import { findVolumeBySlug } from "@/lib/db/library";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
+import { recordClubProgressActivities } from "@/lib/db/clubs";
 
 interface SyncProgressParams {
   volumeSlug: string;
@@ -43,6 +45,7 @@ export async function syncReadingProgress({
     if (!volume) {
       return { error: "Volume not found", status: 404 };
     }
+    if (!(await canAccessLibraryVolume(user, volume.id))) return { error: "Forbidden", status: 403 };
 
     const userId = user.id;
     const volumeId = volume.id;
@@ -55,6 +58,7 @@ export async function syncReadingProgress({
       lastReadAt: new Date(lastReadAt),
       isRead: isNowRead,
     });
+    await recordClubProgressActivities(userId, "LIBRARY_SERIES", volume.seriesId);
 
     if (isNowRead) {
       await createReadingEntryRecord(userId, volumeId, date);

package/dist/src/actions/read.ts

@@ -7,6 +7,9 @@ import {
   upsertVolumeProgress,
 } from "@/lib/db/reading";
 import { syncFirstRead } from "@/actions/readingHistory";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
+import { queryOne } from "@/lib/db/query";
+import { recordClubProgressActivities } from "@/lib/db/clubs";
 
 interface UpdateReadStateParams {
   volumeId: string;
@@ -57,6 +60,7 @@ export async function updateReadState({
       totalPages: normalizedTotalPages,
       lastReadAt: normalizedRead ? new Date(lastReadAt || Date.now()) : null,
     };
+    if (!(await canAccessLibraryVolume(user, normalizedVolumeId))) return { error: "Forbidden", status: 403 };
 
     await upsertVolumeProgress(user.id, normalizedVolumeId, {
       isRead: updatePayload.isRead,
@@ -64,6 +68,8 @@ export async function updateReadState({
       totalPages: updatePayload.totalPages,
       lastReadAt: updatePayload.lastReadAt,
     });
+    const volume = await queryOne<{ series_id: string }>("SELECT series_id FROM library_volumes WHERE id=$1", [normalizedVolumeId]);
+    if (volume) await recordClubProgressActivities(user.id, "LIBRARY_SERIES", volume.series_id);
 
     if (normalizedRead && typeof firstRead === "string") {
       await createReadingEntryRecord(user.id, normalizedVolumeId, firstRead);

package/dist/src/actions/reader.ts

@@ -14,6 +14,7 @@ import { queryOne } from "@/lib/db/query";
 import { extractImagesCbz } from "@/lib/reader/manga/cbz";
 import { extractImagesCbr } from "@/lib/reader/manga/cbr";
 import type { StorageProvider } from "@/lib/types";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 type Extractor = (
   volume: LibraryVolume,
@@ -57,6 +58,7 @@ export async function getMangaImages({ slug }: { slug: string }) {
     if (!volume) {
       return { error: "Volume not found", status: 404 };
     }
+    if (!(await canAccessLibraryVolume(user, volume.id))) return { error: "Forbidden", status: 403 };
 
     const extractor = getExtractorForFile(volume.fullPath);
 
@@ -100,6 +102,7 @@ export async function getReadingProgress({ slug }: { slug: string }) {
     if (!volume) {
       return { error: "Volume not found", status: 404 };
     }
+    if (!(await canAccessLibraryVolume(user, volume.id))) return { error: "Forbidden", status: 403 };
 
     const progress = await findVolumeProgress(user.id, volume.id);
 

package/dist/src/actions/search.ts

@@ -3,6 +3,7 @@
 import MiniSearch from "minisearch";
 import { verifySession } from "@/lib/auth/verifySession";
 import { listSeries, listVolumes } from "@/lib/db/library";
+import { listBookSearchEntries } from "@/lib/db/books/library";
 import { getLibrarySection } from "@/lib/librarySection";
 import type { SearchResult } from "@/lib/types";
 
@@ -15,7 +16,7 @@ interface SeriesDoc {
   title: string;
   slug: string;
   isOneshot: boolean;
-  section: "manga" | "comic" | "others";
+  section: "manga" | "comic" | "others" | "books";
   writer: string;
   series: string;
 }
@@ -27,7 +28,7 @@ interface VolumeDoc {
   series: string;
   slug: string;
   isOneshot: boolean;
-  section: "manga" | "comic" | "others";
+  section: "manga" | "comic" | "others" | "books";
   genres: string;
   tags: string;
 }
@@ -52,10 +53,14 @@ export async function searchManga({ query }: SearchParams) {
     return { success: true, data: [] };
   }
 
-  const volumes = await listVolumes({
-    includeGenres: true,
-    includeTags: true,
-  });
+  const [volumes, seriesList, bookEntries] = await Promise.all([
+    listVolumes({
+      includeGenres: true,
+      includeTags: true,
+    }),
+    listSeries(),
+    listBookSearchEntries(),
+  ]);
 
   const writerBySeriesId = new Map<string, string>();
   const seriesNameById = new Map<string, string>();
@@ -79,9 +84,7 @@ export async function searchManga({ query }: SearchParams) {
     }
   }
 
-  const seriesList = await listSeries();
-
-  const seriesDocs: SeriesDoc[] = seriesList.map((s) => ({
+  const mangaSeriesDocs: SeriesDoc[] = seriesList.map((s) => ({
     id: `series-${s.id}`,
     title: s.title,
     slug: s.slug,
@@ -91,6 +94,32 @@ export async function searchManga({ query }: SearchParams) {
     series: seriesNameById.get(s.id) || s.title,
   }));
 
+  const bookSeries = new Map<string, { entry: typeof bookEntries[number]; writers: Set<string> }>();
+
+  for (const entry of bookEntries) {
+    const current = bookSeries.get(entry.seriesId);
+    if (current) {
+      if (entry.writer) current.writers.add(entry.writer);
+      continue;
+    }
+    bookSeries.set(entry.seriesId, {
+      entry,
+      writers: new Set(entry.writer ? [entry.writer] : []),
+    });
+  }
+
+  const bookSeriesDocs: SeriesDoc[] = Array.from(bookSeries.values()).map(({ entry, writers }) => ({
+    id: `book-series-${entry.seriesId}`,
+    title: entry.seriesTitle,
+    slug: entry.seriesSlug,
+    isOneshot: entry.seriesIsOneshot,
+    section: entry.librarySection === "books" ? "books" : "others",
+    writer: Array.from(writers).join(", "),
+    series: entry.seriesTitle,
+  }));
+
+  const seriesDocs = [...mangaSeriesDocs, ...bookSeriesDocs];
+
   const seriesMap = new Map<string, SeriesDoc>(seriesDocs.map((s) => [s.id, s]));
 
   const seriesSearch = new MiniSearch({
@@ -120,7 +149,7 @@ export async function searchManga({ query }: SearchParams) {
     };
   });
 
-  const volumeDocs: VolumeDoc[] = volumes.map((vol) => {
+  const mangaVolumeDocs: VolumeDoc[] = volumes.map((vol) => {
     const genreNames = vol.genres
       .map((genre) => genre.name?.trim())
       .filter((name): name is string => Boolean(name));
@@ -142,6 +171,20 @@ export async function searchManga({ query }: SearchParams) {
     };
   });
 
+  const bookVolumeDocs: VolumeDoc[] = bookEntries.map((entry) => ({
+    id: `book-volume-${entry.id}`,
+    title: entry.title,
+    writer: entry.writer,
+    series: entry.seriesTitle,
+    slug: entry.slug,
+    isOneshot: entry.seriesIsOneshot,
+    section: entry.librarySection === "books" ? "books" : "others",
+    genres: entry.subjects,
+    tags: "",
+  }));
+
+  const volumeDocs = [...mangaVolumeDocs, ...bookVolumeDocs];
+
   const volumesMap = new Map<string, VolumeDoc>(volumeDocs.map((doc) => [doc.id, doc]));
 
   const volumeSearch = new MiniSearch({

package/dist/src/app/[lang]/clubs/[slug]/page.tsx

@@ -0,0 +1,25 @@
+import { notFound, redirect } from "next/navigation";
+import ClubDashboard from "@/components/clubs/ClubDashboard";
+import { verifySession } from "@/lib/auth/verifySession";
+import { canAccessClub, canManageClub, findClubBySlug, getClubDashboard, listClubWorks, listCycleCandidates, listCycleMilestones, listSelectedCycleVolumes } from "@/lib/db/clubs";
+import { getDictionary } from "@/lib/i18n/Dictionary";
+import type { Locale } from "@/lib/types";
+
+export default async function ClubPage({ params }: { params: Promise<{ lang: string; slug: string }> }) {
+  const { lang, slug } = await params;
+  const user = await verifySession();
+  if (!user) redirect(`/${lang}/login`);
+  const club = await findClubBySlug(slug);
+  if (!club) notFound();
+  if (!(await canAccessClub(club, user.id, user.isAdmin))) redirect(`/${lang}/clubs`);
+  const [dashboard, isManager, intl] = await Promise.all([getClubDashboard(club, user.id), canManageClub(club, user.id, user.isAdmin), getDictionary(lang as Locale)]);
+  const active = dashboard.cycles.find((cycle) => cycle.status === "READING");
+  const voting = dashboard.cycles.find((cycle) => cycle.status === "VOTING");
+  const [works, activeCandidates, milestones, readingVolumes] = await Promise.all([
+    isManager ? listClubWorks() : Promise.resolve([]),
+    voting ? listCycleCandidates(voting.id) : Promise.resolve([]),
+    active ? listCycleMilestones(active.id) : Promise.resolve([]),
+    listSelectedCycleVolumes(active ?? null),
+  ]);
+  return <ClubDashboard club={club} cycles={dashboard.cycles} members={dashboard.members} activities={dashboard.activities} activeCandidates={activeCandidates} milestones={milestones} works={works} readingVolumes={readingVolumes} isManager={isManager} lang={lang} intl={intl} />;
+}

package/dist/src/app/[lang]/clubs/[slug]/read/[kind]/[volume]/page.tsx

@@ -0,0 +1,30 @@
+import { notFound, redirect } from "next/navigation";
+import ClubReader from "@/components/clubs/ClubReader";
+import { verifySession } from "@/lib/auth/verifySession";
+import { canAccessClub, findClubBySlug, getClubDashboard, listSelectedCycleVolumes } from "@/lib/db/clubs";
+import { findVolumeBySlug } from "@/lib/db/library";
+import { findBookVolumeBySlug } from "@/lib/db/books/library";
+import { getDictionary } from "@/lib/i18n/Dictionary";
+import type { Locale } from "@/lib/types";
+
+export default async function ClubReaderPage({ params }: { params: Promise<{ lang: string; slug: string; kind: string; volume: string }> }) {
+  const { lang, slug, kind, volume: volumeSlug } = await params;
+  if (kind !== "manga" && kind !== "books") notFound();
+  const user = await verifySession();
+  if (!user) redirect(`/${lang}/login`);
+  const club = await findClubBySlug(slug);
+  if (!club || !(await canAccessClub(club, user.id, user.isAdmin))) notFound();
+  const dashboard = await getClubDashboard(club, user.id);
+  const active = dashboard.cycles.find((cycle) => cycle.status === "READING");
+  const allowed = await listSelectedCycleVolumes(active ?? null);
+  if (!allowed.some((item) => item.slug === volumeSlug && item.kind === kind)) notFound();
+  const intl = await getDictionary(lang as Locale);
+  if (kind === "manga") {
+    const item = await findVolumeBySlug({ slug: volumeSlug });
+    if (!item) notFound();
+    return <ClubReader kind="manga" volume={{ id: item.id, slug: item.slug, title: item.title, mangaStyle: item.metadataObj?.mangaStyle }} intl={intl} />;
+  }
+  const item = await findBookVolumeBySlug(volumeSlug);
+  if (!item) notFound();
+  return <ClubReader kind="books" volume={{ id: item.id, slug: item.slug, title: item.title, layout: item.metadata.renditionLayout }} intl={intl} />;
+}

package/dist/src/app/[lang]/clubs/join/[token]/page.tsx

@@ -0,0 +1,15 @@
+import { notFound } from "next/navigation";
+import ClubInvite from "@/components/clubs/ClubInvite";
+import { verifySession } from "@/lib/auth/verifySession";
+import { findInviteByTokenHash } from "@/lib/db/clubs";
+import { createHash } from "node:crypto";
+import { getDictionary } from "@/lib/i18n/Dictionary";
+import type { Locale } from "@/lib/types";
+
+export default async function ClubInvitePage({ params }: { params: Promise<{ lang: string; token: string }> }) {
+  const { lang, token } = await params;
+  const invite = await findInviteByTokenHash(createHash("sha256").update(token).digest("hex"));
+  if (!invite || invite.club_status !== "ACTIVE") notFound();
+  const [user, intl] = await Promise.all([verifySession(), getDictionary(lang as Locale)]);
+  return <ClubInvite token={token} clubName={invite.club_name} lang={lang} signedIn={!!user} intl={intl} />;
+}

package/dist/src/app/[lang]/clubs/page.tsx

@@ -0,0 +1,14 @@
+import { redirect } from "next/navigation";
+import ClubList from "@/components/clubs/ClubList";
+import { verifySession } from "@/lib/auth/verifySession";
+import { listClubsForUser } from "@/lib/db/clubs";
+import { getDictionary } from "@/lib/i18n/Dictionary";
+import type { Locale } from "@/lib/types";
+
+export default async function ClubsPage({ params }: { params: Promise<{ lang: string }> }) {
+  const { lang } = await params;
+  const user = await verifySession();
+  if (!user) redirect(`/${lang}/login`);
+  const [clubs, intl] = await Promise.all([listClubsForUser(user.id), getDictionary(lang as Locale)]);
+  return <ClubList clubs={clubs} lang={lang} canCreate={user.role !== "GUEST"} intl={intl} />;
+}

package/dist/src/app/api/library/books/cover/[...slug]/route.ts

@@ -2,6 +2,8 @@ import { NextResponse } from "next/server";
 import { findBookVolumeBySlug } from "@/lib/db/books/library";
 import { getEpubEntry } from "@/lib/books/epubParser";
 import { readBookFile } from "@/lib/books/storage";
+import { verifySession } from "@/lib/auth/verifySession";
+import { canAccessBookVolume } from "@/lib/clubs/access";
 
 export async function GET(_request: Request, { params }: { params: Promise<{ slug: string[] }> }) {
   const { slug: parts } = await params;
@@ -9,6 +11,8 @@ export async function GET(_request: Request, { params }: { params: Promise<{ slu
   if (!slug) return NextResponse.json({ error: "Missing book" }, { status: 400 });
   const volume = await findBookVolumeBySlug(slug);
   if (!volume?.metadata.coverPath) return NextResponse.json({ error: "Cover not found" }, { status: 404 });
+  const user = await verifySession();
+  if (!user || !(await canAccessBookVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   const cover = getEpubEntry(await readBookFile(volume.fullPath), volume.metadata.coverPath);
   if (!cover) return NextResponse.json({ error: "Cover not found" }, { status: 404 });
   const extension = volume.metadata.coverPath.split(".").pop()?.toLowerCase();

package/dist/src/app/api/library/manga/cover/[...slug]/route.ts

@@ -4,6 +4,8 @@ import { GetObjectCommand } from "@aws-sdk/client-s3";
 import r2Client, { R2_BUCKET } from "@/lib/r2";
 import type { NextRequest } from "next/server";
 import { findVolumeBySlugBasic } from "@/lib/db/ingestion";
+import { verifySession } from "@/lib/auth/verifySession";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 const LIB_PROVIDER = process.env.LIB_PROVIDER || "local";
 
@@ -25,6 +27,8 @@ export async function GET(
   if (!volume || !volume.coverImage || !volume.seriesPath) {
     return servePlaceholder();
   }
+  const user = await verifySession();
+  if (!user || !(await canAccessLibraryVolume(user, volume.id))) return new Response("Forbidden", { status: 403 });
 
   try {
     if (LIB_PROVIDER === "cloud") {

package/dist/src/app/api/offline/library/[section]/series/[slug]/route.ts

@@ -4,6 +4,7 @@ import { listVolumeProgressByIds } from "@/lib/db/library";
 import { listVolumes, findSeriesBySlugBasic } from "@/lib/db/library";
 import { getLibrarySection, getLibraryScope, type LibrarySection } from "@/lib/librarySection";
 import { getMangaCoverUrl } from "@/lib/mangaCover";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 export async function GET(
   _request: Request,
@@ -22,6 +23,7 @@ export async function GET(
   if (!volumes.length || getLibrarySection(volumes[0].series.librarySection) !== section) {
     return NextResponse.json({ error: "Series not found" }, { status: 404 });
   }
+  if (!(await canAccessLibraryVolume(user, volumes[0].id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   const progressById = await listVolumeProgressByIds(user.id, volumes.map((volume) => volume.id));
 
   return NextResponse.json({

package/dist/src/app/api/offline/library/[section]/volume/[slug]/route.ts

@@ -4,6 +4,7 @@ import { findVolumeProgress } from "@/lib/db/reading";
 import { findVolumeBySlug } from "@/lib/db/library";
 import { getLibrarySection, type LibrarySection } from "@/lib/librarySection";
 import { getMangaCoverUrl } from "@/lib/mangaCover";
+import { canAccessLibraryVolume } from "@/lib/clubs/access";
 
 function metadata(value: Awaited<ReturnType<typeof findVolumeBySlug>>) {
   const source = value?.metadataObj;
@@ -27,6 +28,7 @@ export async function GET(
   if (!volume || getLibrarySection(volume.series.librarySection) !== section) {
     return NextResponse.json({ error: "Volume not found" }, { status: 404 });
   }
+  if (!(await canAccessLibraryVolume(user, volume.id))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   const progress = await findVolumeProgress(user.id, volume.id);
   const resolvedSection = section as LibrarySection;