@kywi-software/core 0.1.0

package/dist/db/lock-queries.js

@@ -0,0 +1,133 @@
+import { eq, or, lte } from 'drizzle-orm';
+import { kywiContentLocks } from '../schema/base.js';
+/**
+ * Error thrown when a lock acquisition conflicts with an existing lock.
+ */
+export class LockConflictError extends Error {
+    lockHolder;
+    expiresAt;
+    constructor(lockHolder, expiresAt) {
+        super(`Content is locked by user ${lockHolder} until ${expiresAt.toISOString()}`);
+        this.name = 'LockConflictError';
+        this.lockHolder = lockHolder;
+        this.expiresAt = expiresAt;
+    }
+}
+/**
+ * Acquire a lock on a content item.
+ * - If no lock exists, creates one.
+ * - If lock exists and is expired, overwrites it.
+ * - If lock exists, is NOT expired, and belongs to the same user, refreshes it.
+ * - If lock exists, is NOT expired, and belongs to a different user, throws LockConflictError.
+ */
+export async function acquireLock(db, contentId, userId, ttlMinutes = 30) {
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + ttlMinutes * 60_000);
+    // Atomic upsert on the contentId primary key. A plain check-then-insert races:
+    // two concurrent acquisitions (e.g. React StrictMode's dev double-mount, or two
+    // tabs) both read "no lock" and both INSERT, and the loser 500s on the pkey
+    // duplicate. ON CONFLICT DO UPDATE makes acquisition idempotent and race-safe;
+    // the `setWhere` guard only lets us overwrite a lock that is expired or already
+    // ours, preserving the "someone else holds it" conflict semantics.
+    const [row] = await db
+        .insert(kywiContentLocks)
+        .values({ contentId, userId, lockedAt: now, expiresAt })
+        .onConflictDoUpdate({
+        target: kywiContentLocks.contentId,
+        set: { userId, lockedAt: now, expiresAt },
+        // Non-null: both operands are always defined, so `or` never returns
+        // undefined here (its union type only allows it when every arg is absent).
+        setWhere: or(eq(kywiContentLocks.userId, userId), lte(kywiContentLocks.expiresAt, now)),
+    })
+        .returning();
+    if (row)
+        return row;
+    // No row returned -> the conflict target is a live lock held by another user
+    // (the setWhere guard rejected the overwrite). Surface who holds it.
+    const [holder] = await db
+        .select()
+        .from(kywiContentLocks)
+        .where(eq(kywiContentLocks.contentId, contentId))
+        .limit(1);
+    if (holder)
+        throw new LockConflictError(holder.userId, holder.expiresAt);
+    throw new Error('Failed to acquire content lock');
+}
+/**
+ * Release a lock only if owned by the given user.
+ * Returns true if a lock was deleted.
+ */
+export async function releaseLock(db, contentId, userId) {
+    // First check ownership
+    const [existing] = await db
+        .select()
+        .from(kywiContentLocks)
+        .where(eq(kywiContentLocks.contentId, contentId))
+        .limit(1);
+    if (!existing || existing.userId !== userId) {
+        return false;
+    }
+    await db.delete(kywiContentLocks).where(eq(kywiContentLocks.contentId, contentId));
+    return true;
+}
+/**
+ * Get the active lock on a content item.
+ * Returns null if no lock exists or if the lock is expired.
+ */
+export async function getLock(db, contentId) {
+    const [row] = await db
+        .select()
+        .from(kywiContentLocks)
+        .where(eq(kywiContentLocks.contentId, contentId))
+        .limit(1);
+    if (!row)
+        return null;
+    if (row.expiresAt <= new Date())
+        return null;
+    return row;
+}
+/**
+ * Check whether content is locked by someone other than `excludeUserId`.
+ * Returns true if locked by another user (or any user if excludeUserId is not provided).
+ */
+export async function isLocked(db, contentId, excludeUserId) {
+    const lock = await getLock(db, contentId);
+    if (!lock)
+        return false;
+    if (excludeUserId && lock.userId === excludeUserId)
+        return false;
+    return true;
+}
+/**
+ * Force-unlock a content item regardless of owner (admin use).
+ * Returns true if a lock was removed.
+ */
+export async function forceUnlock(db, contentId) {
+    const [deleted] = await db
+        .delete(kywiContentLocks)
+        .where(eq(kywiContentLocks.contentId, contentId))
+        .returning();
+    return deleted !== undefined;
+}
+/**
+ * Extend the lock expiration time.
+ * Only succeeds if the lock is owned by the given user.
+ * Returns the updated lock or null if not owned or not found.
+ */
+export async function renewLock(db, contentId, userId, ttlMinutes = 30) {
+    const [existing] = await db
+        .select()
+        .from(kywiContentLocks)
+        .where(eq(kywiContentLocks.contentId, contentId))
+        .limit(1);
+    if (!existing || existing.userId !== userId)
+        return null;
+    const expiresAt = new Date(Date.now() + ttlMinutes * 60_000);
+    const [updated] = await db
+        .update(kywiContentLocks)
+        .set({ expiresAt })
+        .where(eq(kywiContentLocks.contentId, contentId))
+        .returning();
+    return updated ?? null;
+}
+//# sourceMappingURL=lock-queries.js.map

package/dist/db/lock-queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-queries.js","sourceRoot":"","sources":["../../src/db/lock-queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAIpD;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1B,UAAU,CAAQ;IAClB,SAAS,CAAM;IAE/B,YAAY,UAAkB,EAAE,SAAe;QAC7C,KAAK,CAAC,6BAA6B,UAAU,UAAU,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAU,EACV,SAAiB,EACjB,MAAc,EACd,UAAU,GAAG,EAAE;IAEf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC,CAAA;IAE/D,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,+EAA+E;IAC/E,gFAAgF;IAChF,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,gBAAgB,CAAC;SACxB,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SACvD,kBAAkB,CAAC;QAClB,MAAM,EAAE,gBAAgB,CAAC,SAAS;QAClC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;QACzC,oEAAoE;QACpE,2EAA2E;QAC3E,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAE;KACzF,CAAC;SACD,SAAS,EAAE,CAAA;IAEd,IAAI,GAAG;QAAE,OAAO,GAAG,CAAA;IAEnB,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SAChD,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,IAAI,MAAM;QAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACxE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAU,EACV,SAAiB,EACjB,MAAc;IAEd,wBAAwB;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SAChD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;IAClF,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAU,EACV,SAAiB;IAEjB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SAChD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IAC5C,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,EAAU,EACV,SAAiB,EACjB,aAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,aAAa,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IAChE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAU,EACV,SAAiB;IAEjB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,gBAAgB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SAChD,SAAS,EAAE,CAAA;IACd,OAAO,OAAO,KAAK,SAAS,CAAA;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAU,EACV,SAAiB,EACjB,MAAc,EACd,UAAU,GAAG,EAAE;IAEf,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SAChD,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAExD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,MAAM,CAAC,CAAA;IAC5D,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;SAChD,SAAS,EAAE,CAAA;IAEd,OAAO,OAAO,IAAI,IAAI,CAAA;AACxB,CAAC"}

package/dist/db/media-queries.d.ts

@@ -0,0 +1,97 @@
+import type { KywiDb } from './client.js';
+export declare function listMedia(db: KywiDb, siteId: string): Promise<{
+    id: string;
+    siteId: string;
+    updatedAt: Date;
+    createdAt: Date;
+    deletedAt: Date | null;
+    filename: string;
+    mimeType: string;
+    fileSize: number;
+    width: number | null;
+    height: number | null;
+    duration: number | null;
+    originalFilename: string;
+    altText: string | null;
+    caption: string | null;
+    tags: unknown;
+    uploadedBy: string | null;
+    storageKey: string;
+}[]>;
+export declare function getMediaById(db: KywiDb, id: string, siteId?: string): Promise<{
+    id: string;
+    siteId: string;
+    updatedAt: Date;
+    createdAt: Date;
+    deletedAt: Date | null;
+    filename: string;
+    mimeType: string;
+    fileSize: number;
+    width: number | null;
+    height: number | null;
+    duration: number | null;
+    originalFilename: string;
+    altText: string | null;
+    caption: string | null;
+    tags: unknown;
+    uploadedBy: string | null;
+    storageKey: string;
+} | null>;
+export declare function createMediaRecord(db: KywiDb, data: {
+    siteId: string;
+    filename: string;
+    originalFilename: string;
+    mimeType: string;
+    fileSize: number;
+    width?: number | undefined;
+    height?: number | undefined;
+    storageKey: string;
+    uploadedBy?: string | undefined;
+}): Promise<{
+    id: string;
+    siteId: string;
+    updatedAt: Date;
+    createdAt: Date;
+    deletedAt: Date | null;
+    filename: string;
+    mimeType: string;
+    fileSize: number;
+    width: number | null;
+    height: number | null;
+    duration: number | null;
+    originalFilename: string;
+    altText: string | null;
+    caption: string | null;
+    tags: unknown;
+    uploadedBy: string | null;
+    storageKey: string;
+}>;
+export declare function softDeleteMedia(db: KywiDb, id: string, siteId?: string): Promise<boolean>;
+export declare function restoreMedia(db: KywiDb, id: string, siteId?: string): Promise<boolean>;
+export declare function updateMediaMetadata(db: KywiDb, id: string, data: {
+    altText?: string;
+    caption?: string;
+    tags?: string[];
+}, siteId?: string): Promise<{
+    id: string;
+    siteId: string;
+    filename: string;
+    originalFilename: string;
+    mimeType: string;
+    fileSize: number;
+    width: number | null;
+    height: number | null;
+    duration: number | null;
+    altText: string | null;
+    caption: string | null;
+    tags: unknown;
+    uploadedBy: string | null;
+    storageKey: string;
+    deletedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+} | null>;
+export declare function permanentDeleteMedia(db: KywiDb, id: string, siteId?: string): Promise<{
+    storageKey: string;
+} | null>;
+//# sourceMappingURL=media-queries.d.ts.map

package/dist/db/media-queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-queries.d.ts","sourceRoot":"","sources":["../../src/db/media-queries.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,wBAAsB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;;;;;;;;;;;;;;;KAEzD;AAOD,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;UAMzE;AAED,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAC7E,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChI;;;;;;;;;;;;;;;;;;GAGA;AAED,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM/F;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO5F;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAC7D,MAAM,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;;;UAUhB;AAED,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAO1H"}

package/dist/db/media-queries.js

@@ -0,0 +1,55 @@
+import { eq, and, sql } from 'drizzle-orm';
+import { kywiMedia } from '../schema/base.js';
+export async function listMedia(db, siteId) {
+    return db.select().from(kywiMedia).where(and(eq(kywiMedia.siteId, siteId), sql `${kywiMedia.deletedAt} IS NULL`));
+}
+// Item-level queries take an OPTIONAL siteId scope. Callers with a site context
+// (every API route) MUST pass it: kywi_media rows are addressable by UUID, so a
+// query with no siteId predicate lets an admin scoped to one site fetch/mutate
+// another site's media by id (cross-site addressing). When siteId is provided the
+// predicate is ANDed in, so an id belonging to a different site resolves to null.
+export async function getMediaById(db, id, siteId) {
+    const where = siteId === undefined
+        ? eq(kywiMedia.id, id)
+        : and(eq(kywiMedia.id, id), eq(kywiMedia.siteId, siteId));
+    const [row] = await db.select().from(kywiMedia).where(where).limit(1);
+    return row ?? null;
+}
+export async function createMediaRecord(db, data) {
+    const [row] = await db.insert(kywiMedia).values(data).returning();
+    return row;
+}
+export async function softDeleteMedia(db, id, siteId) {
+    const scope = siteId === undefined ? [] : [eq(kywiMedia.siteId, siteId)];
+    const [row] = await db.update(kywiMedia).set({ deletedAt: new Date() })
+        .where(and(eq(kywiMedia.id, id), sql `${kywiMedia.deletedAt} IS NULL`, ...scope))
+        .returning({ id: kywiMedia.id });
+    return row !== undefined;
+}
+export async function restoreMedia(db, id, siteId) {
+    const where = siteId === undefined
+        ? eq(kywiMedia.id, id)
+        : and(eq(kywiMedia.id, id), eq(kywiMedia.siteId, siteId));
+    const [row] = await db.update(kywiMedia).set({ deletedAt: null })
+        .where(where).returning({ id: kywiMedia.id });
+    return row !== undefined;
+}
+export async function updateMediaMetadata(db, id, data, siteId) {
+    const where = siteId === undefined
+        ? eq(kywiMedia.id, id)
+        : and(eq(kywiMedia.id, id), eq(kywiMedia.siteId, siteId));
+    const [row] = await db.update(kywiMedia)
+        .set({ ...data, updatedAt: new Date() })
+        .where(where)
+        .returning();
+    return row ?? null;
+}
+export async function permanentDeleteMedia(db, id, siteId) {
+    const where = siteId === undefined
+        ? eq(kywiMedia.id, id)
+        : and(eq(kywiMedia.id, id), eq(kywiMedia.siteId, siteId));
+    const [row] = await db.delete(kywiMedia).where(where)
+        .returning({ storageKey: kywiMedia.storageKey });
+    return row ?? null;
+}
+//# sourceMappingURL=media-queries.js.map

package/dist/db/media-queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-queries.js","sourceRoot":"","sources":["../../src/db/media-queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAG7C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAU,EAAE,MAAc;IACxD,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,CAAA,GAAG,SAAS,CAAC,SAAS,UAAU,CAAC,CAAC,CAAA;AAClH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,EAAU,EAAE,MAAe;IACxE,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS;QAChC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACrE,OAAO,GAAG,IAAI,IAAI,CAAA;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU,EAAE,IAGnD;IACC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAW,CAAC,CAAC,SAAS,EAAE,CAAA;IACxE,OAAO,GAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAU,EAAE,EAAU,EAAE,MAAe;IAC3E,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACxE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAS,CAAC;SAC3E,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,GAAG,CAAA,GAAG,SAAS,CAAC,SAAS,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC;SAC/E,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IAClC,OAAO,GAAG,KAAK,SAAS,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,EAAU,EAAE,MAAe;IACxE,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS;QAChC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAS,CAAC;SACrE,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/C,OAAO,GAAG,KAAK,SAAS,CAAA;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAU,EACV,EAAU,EACV,IAA6D,EAC7D,MAAe;IAEf,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS;QAChC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;SACrC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAS,CAAC;SAC9C,KAAK,CAAC,KAAK,CAAC;SACZ,SAAS,EAAE,CAAA;IACd,OAAO,GAAG,IAAI,IAAI,CAAA;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAU,EAAE,EAAU,EAAE,MAAe;IAChF,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS;QAChC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;SAClD,SAAS,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;IAClD,OAAO,GAAG,IAAI,IAAI,CAAA;AACpB,CAAC"}

package/dist/db/media-reference-queries.d.ts

@@ -0,0 +1,20 @@
+import type { KywiDb } from './client.js';
+/** One content node that references a media item, and how it references it. */
+export interface MediaReference {
+    contentId: string;
+    title: string | null;
+    slug: string | null;
+    /** Which surfaces point at the media: 'featuredImage' and/or 'layout'. */
+    references: Array<'featuredImage' | 'layout'>;
+}
+/**
+ * Find all non-deleted content that references a media item (GAP-08-F).
+ *
+ * Two reference surfaces are detected:
+ *  - `featuredImage` — content.featuredImageId equals the media id.
+ *  - `layout` — the media id appears in the layout JSON (an image module's
+ *    src/poster/background/etc. prop). Media ids are UUIDs, so a text match on
+ *    the serialized layout is precise enough to flag a real reference.
+ */
+export declare function findMediaReferences(db: KywiDb, mediaId: string): Promise<MediaReference[]>;
+//# sourceMappingURL=media-reference-queries.d.ts.map

package/dist/db/media-reference-queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-reference-queries.d.ts","sourceRoot":"","sources":["../../src/db/media-reference-queries.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,0EAA0E;IAC1E,UAAU,EAAE,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAC,CAAA;CAC9C;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkChG"}

package/dist/db/media-reference-queries.js

@@ -0,0 +1,38 @@
+import { and, eq, isNull, sql } from 'drizzle-orm';
+import { kywiContent } from '../schema/base.js';
+/**
+ * Find all non-deleted content that references a media item (GAP-08-F).
+ *
+ * Two reference surfaces are detected:
+ *  - `featuredImage` — content.featuredImageId equals the media id.
+ *  - `layout` — the media id appears in the layout JSON (an image module's
+ *    src/poster/background/etc. prop). Media ids are UUIDs, so a text match on
+ *    the serialized layout is precise enough to flag a real reference.
+ */
+export async function findMediaReferences(db, mediaId) {
+    const byId = new Map();
+    const add = (row, kind) => {
+        const existing = byId.get(row.id);
+        if (existing) {
+            if (!existing.references.includes(kind))
+                existing.references.push(kind);
+        }
+        else {
+            byId.set(row.id, { contentId: row.id, title: row.title, slug: row.slug, references: [kind] });
+        }
+    };
+    const featured = await db
+        .select({ id: kywiContent.id, title: kywiContent.title, slug: kywiContent.slug })
+        .from(kywiContent)
+        .where(and(eq(kywiContent.featuredImageId, mediaId), isNull(kywiContent.deletedAt)));
+    for (const row of featured)
+        add(row, 'featuredImage');
+    const inLayout = await db
+        .select({ id: kywiContent.id, title: kywiContent.title, slug: kywiContent.slug })
+        .from(kywiContent)
+        .where(and(sql `${kywiContent.layout} IS NOT NULL`, sql `${kywiContent.layout}::text LIKE ${'%' + mediaId + '%'}`, isNull(kywiContent.deletedAt)));
+    for (const row of inLayout)
+        add(row, 'layout');
+    return [...byId.values()];
+}
+//# sourceMappingURL=media-reference-queries.js.map

package/dist/db/media-reference-queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-reference-queries.js","sourceRoot":"","sources":["../../src/db/media-reference-queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAY/C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAU,EAAE,OAAe;IACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAA;IAE9C,MAAM,GAAG,GAAG,CACV,GAA8D,EAC9D,IAAgC,EAChC,EAAE;QACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/F,CAAC;IACH,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;SAChF,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IACtF,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAU,EAAE,eAAe,CAAC,CAAA;IAE5D,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;SAChF,IAAI,CAAC,WAAW,CAAC;SACjB,KAAK,CACJ,GAAG,CACD,GAAG,CAAA,GAAG,WAAW,CAAC,MAAM,cAAc,EACtC,GAAG,CAAA,GAAG,WAAW,CAAC,MAAM,eAAe,GAAG,GAAG,OAAO,GAAG,GAAG,EAAE,EAC5D,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAC9B,CACF,CAAA;IACH,KAAK,MAAM,GAAG,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAU,EAAE,QAAQ,CAAC,CAAA;IAErD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;AAC3B,CAAC"}

package/dist/db/oauth-client-queries.d.ts

@@ -0,0 +1,43 @@
+import type { KywiOAuthClientRow } from '../schema/base.js';
+import type { KywiDb } from './client.js';
+export type OAuthScope = 'read' | 'write' | 'publish' | 'admin' | 'developer';
+/**
+ * Public-safe representation of an OAuth client — excludes the hashed secret.
+ */
+export type OAuthClientSafe = Omit<KywiOAuthClientRow, 'clientSecret'>;
+/**
+ * Create a new OAuth client.
+ * Returns the plaintext clientSecret (shown once) along with the stored row.
+ */
+export declare function createOAuthClient(db: KywiDb, data: {
+    name: string;
+    scopes: OAuthScope[];
+    redirectUris: string[];
+    rateLimitPerMinute?: number | undefined;
+    createdBy?: string | undefined;
+}): Promise<{
+    clientSecret: string;
+    client: OAuthClientSafe;
+}>;
+/**
+ * List all OAuth clients (without secret hashes).
+ */
+export declare function listOAuthClients(db: KywiDb): Promise<OAuthClientSafe[]>;
+/**
+ * Get a single OAuth client by its database id (without secret hash).
+ */
+export declare function getOAuthClient(db: KywiDb, id: string): Promise<OAuthClientSafe | null>;
+/**
+ * Update an OAuth client's mutable fields.
+ */
+export declare function updateOAuthClient(db: KywiDb, id: string, data: {
+    name?: string | undefined;
+    scopes?: OAuthScope[] | undefined;
+    redirectUris?: string[] | undefined;
+    rateLimitPerMinute?: number | undefined;
+}): Promise<OAuthClientSafe | null>;
+/**
+ * Delete an OAuth client.
+ */
+export declare function deleteOAuthClient(db: KywiDb, id: string): Promise<boolean>;
+//# sourceMappingURL=oauth-client-queries.d.ts.map

package/dist/db/oauth-client-queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-queries.d.ts","sourceRoot":"","sources":["../../src/db/oauth-client-queries.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,CAAA;AAc7E;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;AAEtE;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/B,GACA,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAsB5D;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAe7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAiB5F;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,MAAM,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAA;IACjC,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IACnC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACxC,GACA,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAgBjC;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMhF"}

package/dist/db/oauth-client-queries.js

@@ -0,0 +1,111 @@
+import { eq } from 'drizzle-orm';
+import { randomBytes, createHash } from 'node:crypto';
+import { kywiOAuthClients } from '../schema/base.js';
+function hashSecret(secret) {
+    return createHash('sha256').update(secret).digest('hex');
+}
+function generateClientId() {
+    return `kywi_cl_${randomBytes(16).toString('hex')}`;
+}
+function generateClientSecret() {
+    return `kywi_cs_${randomBytes(32).toString('base64url')}`;
+}
+/**
+ * Create a new OAuth client.
+ * Returns the plaintext clientSecret (shown once) along with the stored row.
+ */
+export async function createOAuthClient(db, data) {
+    const clientId = generateClientId();
+    const rawSecret = generateClientSecret();
+    const hashedSecret = hashSecret(rawSecret);
+    const [row] = await db
+        .insert(kywiOAuthClients)
+        .values({
+        clientId,
+        clientSecret: hashedSecret,
+        name: data.name,
+        scopes: data.scopes,
+        redirectUris: data.redirectUris,
+        rateLimitPerMinute: data.rateLimitPerMinute ?? 60,
+        createdBy: data.createdBy,
+    })
+        .returning();
+    if (!row)
+        throw new Error('Failed to create OAuth client');
+    const { clientSecret: _hash, ...safe } = row;
+    return { clientSecret: rawSecret, client: safe };
+}
+/**
+ * List all OAuth clients (without secret hashes).
+ */
+export async function listOAuthClients(db) {
+    const rows = await db
+        .select({
+        id: kywiOAuthClients.id,
+        clientId: kywiOAuthClients.clientId,
+        name: kywiOAuthClients.name,
+        scopes: kywiOAuthClients.scopes,
+        redirectUris: kywiOAuthClients.redirectUris,
+        rateLimitPerMinute: kywiOAuthClients.rateLimitPerMinute,
+        createdBy: kywiOAuthClients.createdBy,
+        createdAt: kywiOAuthClients.createdAt,
+        updatedAt: kywiOAuthClients.updatedAt,
+    })
+        .from(kywiOAuthClients);
+    return rows;
+}
+/**
+ * Get a single OAuth client by its database id (without secret hash).
+ */
+export async function getOAuthClient(db, id) {
+    const [row] = await db
+        .select({
+        id: kywiOAuthClients.id,
+        clientId: kywiOAuthClients.clientId,
+        name: kywiOAuthClients.name,
+        scopes: kywiOAuthClients.scopes,
+        redirectUris: kywiOAuthClients.redirectUris,
+        rateLimitPerMinute: kywiOAuthClients.rateLimitPerMinute,
+        createdBy: kywiOAuthClients.createdBy,
+        createdAt: kywiOAuthClients.createdAt,
+        updatedAt: kywiOAuthClients.updatedAt,
+    })
+        .from(kywiOAuthClients)
+        .where(eq(kywiOAuthClients.id, id))
+        .limit(1);
+    return row ?? null;
+}
+/**
+ * Update an OAuth client's mutable fields.
+ */
+export async function updateOAuthClient(db, id, data) {
+    const setClause = { updatedAt: new Date() };
+    if (data.name !== undefined)
+        setClause.name = data.name;
+    if (data.scopes !== undefined)
+        setClause.scopes = data.scopes;
+    if (data.redirectUris !== undefined)
+        setClause.redirectUris = data.redirectUris;
+    if (data.rateLimitPerMinute !== undefined)
+        setClause.rateLimitPerMinute = data.rateLimitPerMinute;
+    const [row] = await db
+        .update(kywiOAuthClients)
+        .set(setClause)
+        .where(eq(kywiOAuthClients.id, id))
+        .returning();
+    if (!row)
+        return null;
+    const { clientSecret: _hash, ...safe } = row;
+    return safe;
+}
+/**
+ * Delete an OAuth client.
+ */
+export async function deleteOAuthClient(db, id) {
+    const [row] = await db
+        .delete(kywiOAuthClients)
+        .where(eq(kywiOAuthClients.id, id))
+        .returning({ id: kywiOAuthClients.id });
+    return row !== undefined;
+}
+//# sourceMappingURL=oauth-client-queries.js.map

package/dist/db/oauth-client-queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-queries.js","sourceRoot":"","sources":["../../src/db/oauth-client-queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAMpD,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AACrD,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,WAAW,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;AAC3D,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAU,EACV,IAMC;IAED,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IACnC,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAA;IACxC,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IAE1C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAO,EAAU;SAC5B,MAAM,CAAC,gBAAgB,CAAC;SACxB,MAAM,CAAC;QACN,QAAQ;QACR,YAAY,EAAE,YAAY;QAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,EAAE;QACjD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;SACD,SAAS,EAAE,CAAA;IAEd,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAE1D,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAyB,CAAA;IAClE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU;IAC/C,MAAM,IAAI,GAAG,MAAO,EAAU;SAC3B,MAAM,CAAC;QACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;QACvB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;QACnC,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,MAAM,EAAE,gBAAgB,CAAC,MAAM;QAC/B,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;QACvD,SAAS,EAAE,gBAAgB,CAAC,SAAS;QACrC,SAAS,EAAE,gBAAgB,CAAC,SAAS;QACrC,SAAS,EAAE,gBAAgB,CAAC,SAAS;KACtC,CAAC;SACD,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACzB,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,EAAU;IACzD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAO,EAAU;SAC5B,MAAM,CAAC;QACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;QACvB,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;QACnC,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,MAAM,EAAE,gBAAgB,CAAC,MAAM;QAC/B,YAAY,EAAE,gBAAgB,CAAC,YAAY;QAC3C,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;QACvD,SAAS,EAAE,gBAAgB,CAAC,SAAS;QACrC,SAAS,EAAE,gBAAgB,CAAC,SAAS;QACrC,SAAS,EAAE,gBAAgB,CAAC,SAAS;KACtC,CAAC;SACD,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SAClC,KAAK,CAAC,CAAC,CAAC,CAAA;IACX,OAAO,GAAG,IAAI,IAAI,CAAA;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAU,EACV,EAAU,EACV,IAKC;IAED,MAAM,SAAS,GAA4B,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAA;IACpE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC7D,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;QAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;IAC/E,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS;QAAE,SAAS,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAA;IAEjG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAO,EAAU;SAC5B,MAAM,CAAC,gBAAgB,CAAC;SACxB,GAAG,CAAC,SAAS,CAAC;SACd,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SAClC,SAAS,EAAE,CAAA;IAEd,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAyB,CAAA;IAClE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU,EAAE,EAAU;IAC5D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAO,EAAU;SAC5B,MAAM,CAAC,gBAAgB,CAAC;SACxB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SAClC,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAA;IACzC,OAAO,GAAG,KAAK,SAAS,CAAA;AAC1B,CAAC"}

package/dist/db/password-reset-queries.d.ts

@@ -0,0 +1,23 @@
+import type { KywiPasswordResetTokenRow } from '../schema/password-reset-tokens.js';
+import type { KywiDb } from './client.js';
+/**
+ * Insert a new password reset token row and return it.
+ * Only the SHA-256 hash of the raw token is stored.
+ */
+export declare function createResetToken(db: KywiDb, userId: string, tokenHash: string, expiresAt: Date): Promise<KywiPasswordResetTokenRow>;
+/**
+ * Find all unexpired, unused reset tokens for a user.
+ * Filters: usedAt IS NULL AND expiresAt > NOW()
+ */
+export declare function findValidToken(db: KywiDb, userId: string): Promise<KywiPasswordResetTokenRow[]>;
+/**
+ * Mark a token as used by setting usedAt to now().
+ * Returns true if the row was found and updated, false otherwise.
+ */
+export declare function markTokenUsed(db: KywiDb, tokenId: string): Promise<boolean>;
+/**
+ * Delete all rows where expiresAt <= NOW().
+ * Call this periodically to keep the table tidy.
+ */
+export declare function deleteExpiredTokens(db: KywiDb): Promise<void>;
+//# sourceMappingURL=password-reset-queries.d.ts.map

package/dist/db/password-reset-queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-queries.d.ts","sourceRoot":"","sources":["../../src/db/password-reset-queries.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAA6B,MAAM,oCAAoC,CAAA;AAC9G,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,IAAI,GACd,OAAO,CAAC,yBAAyB,CAAC,CAOpC;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAWtC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAInE"}

package/dist/db/password-reset-queries.js

@@ -0,0 +1,47 @@
+import { eq, and, sql, isNull } from 'drizzle-orm';
+import { kywiPasswordResetTokens } from '../schema/password-reset-tokens.js';
+/**
+ * Insert a new password reset token row and return it.
+ * Only the SHA-256 hash of the raw token is stored.
+ */
+export async function createResetToken(db, userId, tokenHash, expiresAt) {
+    const [row] = await db
+        .insert(kywiPasswordResetTokens)
+        .values({ userId, tokenHash, expiresAt })
+        .returning();
+    if (!row)
+        throw new Error('Failed to create reset token');
+    return row;
+}
+/**
+ * Find all unexpired, unused reset tokens for a user.
+ * Filters: usedAt IS NULL AND expiresAt > NOW()
+ */
+export async function findValidToken(db, userId) {
+    return db
+        .select()
+        .from(kywiPasswordResetTokens)
+        .where(and(eq(kywiPasswordResetTokens.userId, userId), isNull(kywiPasswordResetTokens.usedAt), sql `${kywiPasswordResetTokens.expiresAt} > NOW()`));
+}
+/**
+ * Mark a token as used by setting usedAt to now().
+ * Returns true if the row was found and updated, false otherwise.
+ */
+export async function markTokenUsed(db, tokenId) {
+    const [row] = await db
+        .update(kywiPasswordResetTokens)
+        .set({ usedAt: new Date() })
+        .where(eq(kywiPasswordResetTokens.id, tokenId))
+        .returning({ id: kywiPasswordResetTokens.id });
+    return row !== undefined;
+}
+/**
+ * Delete all rows where expiresAt <= NOW().
+ * Call this periodically to keep the table tidy.
+ */
+export async function deleteExpiredTokens(db) {
+    await db
+        .delete(kywiPasswordResetTokens)
+        .where(sql `${kywiPasswordResetTokens.expiresAt} <= NOW()`);
+}
+//# sourceMappingURL=password-reset-queries.js.map

package/dist/db/password-reset-queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset-queries.js","sourceRoot":"","sources":["../../src/db/password-reset-queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AAI5E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,MAAc,EACd,SAAiB,EACjB,SAAe;IAEf,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,uBAAuB,CAAC;SAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAA2E,CAAC;SACjH,SAAS,EAAE,CAAA;IACd,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACzD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,MAAc;IAEd,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1C,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,EACtC,GAAG,CAAA,GAAG,uBAAuB,CAAC,SAAS,UAAU,CAClD,CACF,CAAA;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAU,EACV,OAAe;IAEf,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC,uBAAuB,CAAC;SAC/B,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC3B,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;SAC9C,SAAS,CAAC,EAAE,EAAE,EAAE,uBAAuB,CAAC,EAAE,EAAE,CAAC,CAAA;IAChD,OAAO,GAAG,KAAK,SAAS,CAAA;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAU;IAClD,MAAM,EAAE;SACL,MAAM,CAAC,uBAAuB,CAAC;SAC/B,KAAK,CAAC,GAAG,CAAA,GAAG,uBAAuB,CAAC,SAAS,WAAW,CAAC,CAAA;AAC9D,CAAC"}