@kernhq/module-quire 0.12.0 → 0.13.0

package/src/client/components/PublishDialog.svelte

@@ -36,12 +36,11 @@ import { quireKeys } from '../query.js'
 interface Props {
   open?: boolean
   workspaceId: string
-  workspaceSlug: string
   spaceId: string
   /** the page the site would be rooted at — its own published version is the front page */
   page: Pick<Page, 'id' | 'title' | 'publishedVersionId'>
 }
-let { open = $bindable(false), workspaceId, workspaceSlug, spaceId, page }: Props = $props()
+let { open = $bindable(false), workspaceId, spaceId, page }: Props = $props()
 
 const api = getQuireApi()
 const client = useQueryClient()
@@ -163,6 +162,16 @@ $effect(() => {
 
 const slugValid = $derived(slug.length >= 2 && slug.length <= 64 && SLUG_PATTERN.test(slug))
 
+/**
+ * A site that exists and serves nothing, which is a third state and used to be told as the first.
+ *
+ * The publication row and the root page's published version are independent: making the one does
+ * not publish the other, so "there is a publication" is not "this page is public". Every sentence
+ * in this dialog that used to branch on `publication` alone said the wrong thing for as long as
+ * somebody had made a site out of a page they had not published.
+ */
+const emptySite = $derived(publication !== null && page.publishedVersionId === null)
+
 /**
  * The address that is **actually serving**, not the one in the box.
  *
@@ -172,11 +181,11 @@ const slugValid = $derived(slug.length >= 2 && slug.length <= 64 && SLUG_PATTERN
  * be wrong about, so it follows the field — that is the whole point of showing it then.
  */
 const url = $derived(
-  publicSiteUrl({ workspaceSlug, slug: publication?.slug ?? (slugValid ? slug : 'your-page') }),
+  publicSiteUrl({ workspaceId, slug: publication?.slug ?? (slugValid ? slug : 'your-page') }),
 )
 /** The address it becomes on save — shown as a sentence, so there are never two links on screen. */
 const pendingUrl = $derived(
-  publication && slugValid && slug !== publication.slug ? publicSiteUrl({ workspaceSlug, slug }) : null,
+  publication && slugValid && slug !== publication.slug ? publicSiteUrl({ workspaceId, slug }) : null,
 )
 
 /**
@@ -266,6 +275,33 @@ function reasonFor(row: Descendant): string | null {
 let busy = false
 let rowsBusy = $state<string[]>([])
 
+/**
+ * Where focus goes when the confirmation arms and disarms.
+ *
+ * Pressing "Unpublish" destroys the button being pressed and draws two others in its place, so the
+ * browser has nothing to keep focus on and the dialog's own trap hands it to the **Close** button —
+ * eight Tab stops away from the confirmation, and one Enter away from dismissing the whole dialog.
+ * A keyboard user pressing Enter twice, which is what confirming feels like, closes the dialog and
+ * leaves the site published with nothing said. Same family as disabling a focused control, and it
+ * has the same fix: put focus somewhere deliberate rather than letting it fall.
+ *
+ * It lands on **Cancel**, not on the confirming button: a repeated Enter must not be able to take a
+ * site down, and Cancel is one Tab from the answer either way. Disarming sends it back to the
+ * control that armed it, so the round trip leaves the keyboard where it started.
+ */
+let confirmRef = $state<HTMLElement | null>(null)
+let unpublishRef = $state<HTMLElement | null>(null)
+/* A plain `let`, like `busy`: it records what the last run saw and must not be a dependency of the
+   effect that writes it. Equal values mean this run is a re-render rather than a change, and the
+   first run is always equal — so opening the dialog never steals focus from the address field. */
+let confirmWas = false
+$effect(() => {
+  const asking = confirmingUnpublish
+  if (confirmWas === asking) return
+  confirmWas = asking
+  ;(asking ? confirmRef : unpublishRef)?.focus()
+})
+
 const message = (err: unknown) => (err instanceof Error ? err.message : String(err))
 
 async function refresh() {
@@ -287,7 +323,9 @@ async function publish() {
     password = ''
     dropPassword = false
     await refresh()
-    toast.success(t('share_published_toast'))
+    toast.success(
+      page.publishedVersionId === null ? t('share_published_empty_toast') : t('share_published_toast'),
+    )
   } catch (err) {
     error = message(err)
   } finally {
@@ -377,10 +415,14 @@ async function copyLink() {
       It is not a warning that appears when something is wrong — it is a description of what the
       button does, and it stays true after the button has been pressed.
     -->
-    <section class="tell" class:live={publication !== null}>
-      <Icon name={publication ? 'globe' : 'triangle-alert'} size={17} />
+    <section class="tell" class:live={publication !== null && !emptySite}>
+      <Icon name={publication && !emptySite ? 'globe' : 'triangle-alert'} size={17} />
       <div class="tell-body">
-        <p class="tell-title">{publication ? t('share_published') : t('share_warn_title')}</p>
+        <p class="tell-title">
+          {#if emptySite}{t('share_published_empty')}
+          {:else if publication}{t('share_published')}
+          {:else}{t('share_warn_title')}{/if}
+        </p>
         <p>{t('share_warn_body')}</p>
         <p>{t('share_warn_version')}</p>
         <p>{t('share_warn_unpublished')}</p>
@@ -388,7 +430,15 @@ async function copyLink() {
       </div>
     </section>
 
-    {#if !publication && page.publishedVersionId === null}
+    <!--
+      Not gated on there being no publication yet, which is what made this dialog say three things
+      at once and mean two of them. Publishing a page that has never been published put "This page
+      is public" at the top and a success toast over it, while the measured line forty pixels below
+      read "A signed-out visitor cannot open this address yet" — the loudest affordances asserting
+      what only the quietest one had checked. The site being made does not make the page published,
+      so the sentence that says so belongs on screen for exactly as long as it is true.
+    -->
+    {#if page.publishedVersionId === null}
       <p class="caution" role="status">{t('share_needs_publish')}</p>
     {/if}
 
@@ -612,15 +662,28 @@ async function copyLink() {
         <Button variant="secondary" onclick={() => (open = false)}>{t('cancel')}</Button>
       {:else if publication}
         {#if confirmingUnpublish}
-          <p class="ask">{t('share_unpublish_ask')}</p>
-          <Button variant="secondary" size="sm" onclick={() => (confirmingUnpublish = false)}>
+          <!-- `alert`, because the question is drawn where nobody is looking: it appears at the
+               foot of a long dialog, and a reader who is not watching that corner is given no other
+               sign that pressing the button asked something rather than doing it. -->
+          <p class="ask" role="alert">{t('share_unpublish_ask')}</p>
+          <Button
+            bind:ref={confirmRef}
+            variant="secondary"
+            size="sm"
+            onclick={() => (confirmingUnpublish = false)}
+          >
             {t('cancel')}
           </Button>
           <Button variant="danger" size="sm" onclick={() => void unpublish()}>
             {t('share_unpublish')}
           </Button>
         {:else}
-          <Button variant="danger" size="sm" onclick={() => (confirmingUnpublish = true)}>
+          <Button
+            bind:ref={unpublishRef}
+            variant="danger"
+            size="sm"
+            onclick={() => (confirmingUnpublish = true)}
+          >
             {t('share_unpublish')}
           </Button>
           <span class="spacer"></span>

package/src/client/components/SidebarRecents.svelte

@@ -67,7 +67,9 @@ function open(entry: RecentEntry) {
               A relative time, not a date: this list is only ever read as "how long ago", and
               `relativeTime` renders it in the interface language rather than as a raw number.
             -->
-            <span class="when">{relativeTime(entry.viewedAt)}</span>
+            <span class="when" class:on-active={activePageId === entry.pageId}>
+              {relativeTime(entry.viewedAt)}
+            </span>
           {/snippet}
         </SidebarItem>
       {/each}
@@ -87,6 +89,17 @@ function open(entry: RecentEntry) {
 /*
  * Muted with a colour, never with `opacity` — and never smaller than 11.5px, which is where this
  * pane's ink stops being legible against its own background.
+ *
+ * **"Its own background" is two backgrounds, and the second one is the row you are standing on.**
+ * `SidebarItem` paints an active row `--kern-ink-900` and switches its text to
+ * `--kern-ink-inverse`; a timestamp that kept its own muted ink through that landed at **2.83:1 in
+ * light and 2.50:1 in dark** — mid-grey on near-black, on the row of the page the reader currently
+ * has open, in every locale. Off the active row the same colour is 4.88:1 or better against every
+ * ground this pane uses, which is why the token was never the thing that was wrong.
+ *
+ * So the active row inherits instead of overriding: `--kern-ink-inverse` on `--kern-ink-900` is
+ * 16.63:1 light and 15.52:1 dark. Inheriting rather than naming a second colour is also what keeps
+ * the two in step if the active row is ever repainted.
  */
 .when {
   flex: none;
@@ -95,4 +108,7 @@ function open(entry: RecentEntry) {
   color: var(--kern-ink-350);
   letter-spacing: -0.01em;
 }
+.when.on-active {
+  color: inherit;
+}
 </style>

package/src/client/i18n.ts

@@ -474,6 +474,9 @@ export const en: Record<string, Message> = {
   'quire.share_published': 'This page is public',
   'quire.share_published_when': 'Published {when}',
   'quire.share_published_toast': 'This page is public. Anyone with the link can read it.',
+  'quire.share_published_empty': 'The site is made, and it has nothing to show',
+  'quire.share_published_empty_toast':
+    'The address works, but this page has never been published, so there is nothing at it yet.',
   'quire.share_check_running': 'Checking what a signed-out visitor sees…',
   'quire.share_check_ok': {
     one: 'A signed-out visitor sees {n} page.',
@@ -1002,6 +1005,8 @@ const ar: Record<string, Message> = {
   'quire.share_published': 'هذه الصفحة عامة',
   'quire.share_published_when': 'نُشرت {when}',
   'quire.share_published_toast': 'هذه الصفحة عامة الآن. كل من يملك الرابط يقرؤها.',
+  'quire.share_published_empty': 'أُنشئ الموقع، ولا شيء لديه ليعرضه',
+  'quire.share_published_empty_toast': 'العنوان يعمل، لكن هذه الصفحة لم تُنشر قط، فلا يوجد عندها شيء بعد.',
   'quire.share_check_running': 'جارٍ التحقّق ممّا يراه زائر غير مسجّل…',
   'quire.share_check_ok': {
     zero: 'الزائر غير المسجّل لا يرى أي صفحة.',
@@ -1501,6 +1506,9 @@ const de: Record<string, Message> = {
   'quire.share_published': 'Diese Seite ist öffentlich',
   'quire.share_published_when': 'Veröffentlicht {when}',
   'quire.share_published_toast': 'Diese Seite ist öffentlich. Wer den Link hat, kann sie lesen.',
+  'quire.share_published_empty': 'Die Website steht, und sie hat nichts zu zeigen',
+  'quire.share_published_empty_toast':
+    'Die Adresse funktioniert, aber diese Seite wurde nie veröffentlicht — dort ist also noch nichts.',
   'quire.share_check_running': 'Wird geprüft, was ein abgemeldeter Besuch sieht …',
   'quire.share_check_ok': {
     one: 'Ein abgemeldeter Besuch sieht {n} Seite.',
@@ -1986,6 +1994,9 @@ const fa: Record<string, Message> = {
   'quire.share_published': 'این صفحه عمومی است',
   'quire.share_published_when': '{when} منتشر شد',
   'quire.share_published_toast': 'این صفحه عمومی شد. هر کس پیوند را داشته باشد می‌خواند.',
+  'quire.share_published_empty': 'سایت ساخته شد و چیزی برای نشان‌دادن ندارد',
+  'quire.share_published_empty_toast':
+    'نشانی کار می‌کند، اما این صفحه هرگز منتشر نشده است، پس هنوز چیزی در آن نیست.',
   'quire.share_check_running': 'بررسی آنچه بازدیدکنندهٔ واردنشده می‌بیند…',
   'quire.share_check_ok': {
     one: 'بازدیدکنندهٔ واردنشده {n} صفحه می‌بیند.',
@@ -2473,6 +2484,9 @@ const tr: Record<string, Message> = {
   'quire.share_published': 'Bu sayfa herkese açık',
   'quire.share_published_when': '{when} yayımlandı',
   'quire.share_published_toast': 'Bu sayfa herkese açık. Bağlantısı olan herkes okuyabilir.',
+  'quire.share_published_empty': 'Site kuruldu ve gösterecek bir şeyi yok',
+  'quire.share_published_empty_toast':
+    'Adres çalışıyor, ama bu sayfa hiç yayımlanmadı; dolayısıyla orada henüz bir şey yok.',
   'quire.share_check_running': 'Oturum açmamış bir ziyaretçinin ne gördüğü denetleniyor…',
   'quire.share_check_ok': {
     one: 'Oturum açmamış bir ziyaretçi {n} sayfa görüyor.',

package/src/client/mock.ts

@@ -1631,6 +1631,16 @@ export function createMockQuireApi() {
         return { indexable: true, sitemapPath: 'sitemap.xml' }
       },
 
+      /*
+       * There are no files behind the mock, so nothing resolves — and that is the honest answer
+       * rather than a gap. `publicHtmlOf` draws a version's preview as one paragraph and never
+       * emits an `<img>`, so no page here carries a reference to resolve; a demo that invented
+       * bytes would be showing a picture the real surface would have refused.
+       */
+      asset: async () => {
+        throw notFound('Asset')
+      },
+
       unlock: async ({ slug, password }: { slug: string; password: string }) => {
         const pub = publicationBySlug(slug)
         // A site with no password has no door, and saying so would confirm the slug exists.

package/src/client/pages/PageView.svelte

@@ -314,7 +314,7 @@ const publicVia = $derived.by((): { slug: string; root: boolean } | null => {
   return null
 })
 
-const publicUrl = $derived(publicVia ? publicSiteUrl({ workspaceSlug, slug: publicVia.slug }) : '')
+const publicUrl = $derived(publicVia ? publicSiteUrl({ workspaceId, slug: publicVia.slug }) : '')
 
 // -----------------------------------------------------------------------------------------------
 // Watching, recording, and the way this page is deleted
@@ -755,13 +755,7 @@ async function undoTrash(workspace: string, id: string, spaceId: string, title:
     publishedVersionId={doc.publishedVersionId}
   />
 
-  <PublishDialog
-    bind:open={shareOpen}
-    {workspaceId}
-    {workspaceSlug}
-    spaceId={doc.spaceId}
-    page={doc}
-  />
+  <PublishDialog bind:open={shareOpen} {workspaceId} spaceId={doc.spaceId} page={doc} />
 
   <!--
     The body says nothing about numbers until it knows them. Naming a count before the tree has
@@ -835,8 +829,14 @@ async function undoTrash(workspace: string, id: string, spaceId: string, title:
 }
 /*
  * The one chip that is a control, so it is the one that reads as one — a tinted pill with a hit
- * area a finger can find. `--kern-accent-text` rather than `--kern-accent`: the flat accent is a
- * fill colour and does not clear 4.5:1 as text on its own tint in either theme.
+ * area a finger can find.
+ *
+ * `--kern-accent-deep`, and the arithmetic rather than the impression. On `--kern-accent-tint` the
+ * flat accent is a fill colour and nowhere near readable; `--kern-accent-text` looks like the
+ * answer and measures **4.22:1 in the light palette** (#a85a18 on #f3e9da) against the 4.5:1 this
+ * text needs at 13px/500 — it only passes in the dark one, which is how it shipped. The deep tone
+ * is 5.94:1 light and 5.95:1 dark, and 6.01/5.69 on the hover tint. Computed against the surface
+ * this actually sits on, in both palettes, because a colour pair is arithmetic and not taste.
  */
 .chip.public {
   gap: 5px;
@@ -844,7 +844,7 @@ async function undoTrash(workspace: string, id: string, spaceId: string, title:
   padding-inline: 8px;
   border-radius: var(--kern-r-full);
   background: var(--kern-accent-tint);
-  color: var(--kern-accent-text);
+  color: var(--kern-accent-deep);
   font-weight: 500;
   text-decoration: none;
 }

package/src/client/public-url.ts

@@ -16,16 +16,25 @@
  * a workspace. The cost is that a workspace whose slug is exactly `p` would collide, which is why
  * the segment is here as a constant rather than typed out at three call sites.
  *
- * The workspace is named by **slug, not id**. Both are equally public — the id is already in the
- * API path this resolves to — but one of them is a uuid, and a customer publishing a handbook is
- * publishing a URL they will print. Resolving the slug is one lookup the route layer already does
- * for every other page in the product.
+ * **The workspace is named by id, and it was named by slug until that address stopped resolving.**
+ * A slug is the nicer half of the trade — a customer publishing a handbook is publishing a URL they
+ * will print — and it is only nicer if it works. Turning a slug into the workspace id the public
+ * procedures require is a lookup nothing can do signed out: every workspace read in `core` is
+ * behind a membership check, and a published site has no member reading it. So the route layer
+ * accepts the id form and refuses everything else, and this dialog was handing customers an address
+ * that answered 404 in every deployment that is not the mock — measured by copying the link out of
+ * the share dialog and fetching it.
+ *
+ * The id is not a secret: it is already the first segment of the API path the address resolves to,
+ * and it names a tenant rather than anything inside one. When `core` grows a signed-out
+ * `workspaces.publicBySlug`, the slug form becomes correct as well and this is the one function
+ * that has to change.
  */
 export const PUBLIC_SITE_PREFIX = 'p'
 
 export interface PublicSiteAddress {
-  /** the workspace's slug, as it appears in every other Kern URL */
-  workspaceSlug: string
+  /** the workspace's id, which is what the public procedures resolve a tenant by */
+  workspaceId: string
   /** the publication's slug */
   slug: string
   /**
@@ -36,14 +45,16 @@ export interface PublicSiteAddress {
 }
 
 /**
- * The `basePath` argument `public.page` validates and builds its inter-page links from.
+ * `/p/<workspace>/<publication>` — **no trailing slash**, both segments already encoded.
+ *
+ * The route serves the canonical form without one and answers the trailing-slash form with a 308,
+ * so a base that ended in `/` put an extra hop into every link a customer printed or pasted.
  *
- * Starts and ends with `/`, unreserved segments only — the contract refuses anything else, and the
- * refusal is the point: `//evil.example/` is a protocol-relative URL wearing the costume of a local
- * path, and a caller who could set it would repoint every link on somebody's published site.
+ * This is not the `basePath` argument `public.page` takes: that one has to start *and* end with a
+ * slash, and the route layer builds it from this by adding one.
  */
-export function publicSiteBasePath({ workspaceSlug, slug }: PublicSiteAddress): string {
-  return `/${PUBLIC_SITE_PREFIX}/${encodeURIComponent(workspaceSlug)}/${encodeURIComponent(slug)}/`
+export function publicSiteBasePath({ workspaceId, slug }: PublicSiteAddress): string {
+  return `/${PUBLIC_SITE_PREFIX}/${encodeURIComponent(workspaceId)}/${encodeURIComponent(slug)}`
 }
 
 /**
@@ -60,5 +71,6 @@ export function publicSiteUrl(address: PublicSiteAddress, origin?: string): stri
     .filter((segment) => segment.length > 0)
     .map(encodeURIComponent)
     .join('/')
-  return `${root}${publicSiteBasePath(address)}${trail}`
+  const base = `${root}${publicSiteBasePath(address)}`
+  return trail ? `${base}/${trail}` : base
 }

package/src/contract/permissions.ts

@@ -242,5 +242,6 @@ export const quireProcedureAuthz: Record<string, ProcedureAuthz> = {
   'public.search': { check: 'public', permission: 'quire.page.publish' },
   'public.sitemap': { check: 'public', permission: 'quire.page.publish' },
   'public.robots': { check: 'public', permission: 'quire.page.publish' },
+  'public.asset': { check: 'public', permission: 'quire.page.publish' },
   'public.unlock': { check: 'public', permission: 'quire.page.publish' },
 }

package/src/contract/router.ts

@@ -168,6 +168,44 @@ export type PublicSearchHit = z.infer<typeof PublicSearchHit>
 
 export const PublicSitemapEntry = z.object({ path: z.string(), lastModified: Timestamp })
 
+/**
+ * One picture from a published page, **as bytes rather than as an address**.
+ *
+ * A published page used to carry its pictures as presigned storage URLs, written into the stored
+ * HTML at publish time. That was wrong twice over, and both halves were measured rather than
+ * argued. The URL is the storage key — `ws/<workspaceId>/<module>/<yyyy>/<mm>/<fileId>/<name>` —
+ * so every published page with a picture on it handed a stranger the tenant's workspace uuid and a
+ * file uuid, on the one surface whose whole rule is that no response carries an id; and a presigned
+ * GET expires in an hour while the HTML it was baked into is rendered once and stored for ever, so
+ * every image on every published site broke sixty minutes after it was published.
+ *
+ * So the HTML carries an opaque, workspace-sealed reference and the bytes come through here. The
+ * route layer fetches this from **its own server** and streams the body back under a URL of its
+ * own; nothing in the answer may reach a browser as-is, which is why it is bytes and not a link —
+ * there is no address in it to leak, and none to expire.
+ *
+ * Capped rather than streamed on purpose: a published handbook's illustration is tens of kilobytes,
+ * this path is anonymous, and an unbounded body on an unauthenticated endpoint is a way to spend
+ * somebody else's memory. Over the cap answers the same 404 as a picture that is not there.
+ */
+export const PublicAsset = z.object({
+  /**
+   * The stored content type, narrowed to an image type before it is answered.
+   *
+   * The route layer serves these from the application's own origin, so the two things it owes back
+   * are `X-Content-Type-Options: nosniff` and, because `image/svg+xml` is a document that can carry
+   * script, a `Content-Security-Policy: default-src 'none'` on the response. Anything the server
+   * could not narrow to an image is refused here rather than sent for the route layer to be careful
+   * with.
+   */
+  contentType: z.string(),
+  /** base64 of the whole object */
+  bytes: z.string(),
+  /** how long the route layer may cache it; a version is immutable, so this is long */
+  maxAge: z.number().int().min(0),
+})
+export type PublicAsset = z.infer<typeof PublicAsset>
+
 /**
  * The URL prefix the route layer serves this site under, so a link between two published pages is a
  * link and not a dead mention.
@@ -185,6 +223,21 @@ export const PublicBasePath = z
   .regex(/^\/(?:[A-Za-z0-9._~-]+\/)*$/, 'an absolute path ending in a slash')
   .default('/')
 
+/**
+ * The one thing the module does ask of whatever serves a published site: a place for its pictures.
+ *
+ * `public.page` writes every `<img src>` as `<basePath><segment>/<reference>`, so the route layer
+ * has to answer that address by calling `public.asset` and streaming the bytes back. It is a
+ * constant rather than a convention because two sides have to agree on it and only one of them can
+ * be wrong quietly — a route layer that does not serve it renders a published page with no
+ * pictures, which looks like a rendering bug and is a missing route.
+ *
+ * The leading `__` is what keeps it out of the way: a page's own path segment is `slugifyTitle`'s
+ * output, which is Unicode letters and digits separated by hyphens, so no title can ever produce a
+ * segment starting with an underscore and no published page can be shadowed by this one.
+ */
+export const PUBLIC_ASSET_SEGMENT = '__media'
+
 export const quireContract = {
   spaces: {
     list: baseContract
@@ -808,6 +861,31 @@ export const quireContract = {
       .route({ method: 'GET', path: '/public/{workspaceId}/{slug}/robots', ...t('public') })
       .input(z.object({ workspaceId: WorkspaceId, slug: Publication.shape.slug }))
       .output(z.object({ indexable: z.boolean(), sitemapPath: z.string().nullable() })),
+    /**
+     * The bytes of one picture on a published page.
+     *
+     * `asset` is the opaque reference the page's own HTML carries — an AES-GCM envelope sealed with
+     * the instance secret and bound by its associated data to this workspace, so it names nothing
+     * on its own and cannot be carried to another instance. Resolving it is not enough on its own:
+     * the file has to be referenced by a version that is *currently* public in this publication, so
+     * opting a page out stops its pictures resolving in the same breath as its prose.
+     *
+     * Everything unresolvable is the same 404 as everything else here — a reference that will not
+     * decrypt, one for a file nothing public uses, a file that has been deleted, an object over the
+     * cap. And a locked publication answers the door first: the pictures are behind the password
+     * along with the pages they are on.
+     */
+    asset: baseContract
+      .route({ method: 'GET', path: '/public/{workspaceId}/{slug}/asset', ...t('public') })
+      .input(
+        z.object({
+          workspaceId: WorkspaceId,
+          slug: Publication.shape.slug,
+          asset: z.string().min(1).max(2048),
+          token: z.string().max(4096).nullable().default(null),
+        }),
+      )
+      .output(PublicAsset),
     /** Present the password, get a token. A site with no password has no door, and answers 404. */
     unlock: baseContract
       .route({ method: 'POST', path: '/public/{workspaceId}/{slug}/unlock', ...t('public') })