@kywi-software/core 0.1.0

package/dist/api/content-routes.js

@@ -0,0 +1,691 @@
+import { createContentHookDispatcher, createTrashHookDispatcher } from '../hooks/dispatch.js';
+import { KywiValidationError } from '../hooks/errors.js';
+import { jsonOk, jsonError, notFound, unauthorized, forbidden, validationError, paginatedOk } from './response.js';
+import { isContentLocked } from '../db/content-locking.js';
+import { acquireLock, releaseLock, getLock, forceUnlock, renewLock, LockConflictError } from '../db/lock-queries.js';
+import { parsePaginationParams, parseSortParams, parseFilterParams } from './pagination.js';
+import { buildCreateSchema, buildUpdateSchema } from './content-schemas.js';
+import { resolveAuth } from './auth.js';
+import { resolveSiteId } from './site-context.js';
+import { canAccessContent, hasMinRole } from '../auth/roles.js';
+import { checkContentAccess, checkDocumentAccess, checkDocumentMutationAccess, filterFieldsForUser } from '../auth/access-control.js';
+import { listContent, getContentById, getContentBySlug, createContent, updateContent, deleteContent, publishContent, unpublishContent, permanentDeleteContent, } from '../db/content-queries.js';
+import { getChildren, cascadeSlugPath } from '../db/tree-queries.js';
+import { incrementViews, getStats } from '../db/stats-queries.js';
+import { listDeletedContent, listAllDeletedContent, restoreContentWithRecovery, emptyTrashForSite, emptyTrashGlobal, } from '../db/content-restore.js';
+import { syncContentTags } from './tag-usage-wiring.js';
+import { archivePath } from '../db/filename-archive-queries.js';
+async function authenticate(req, authSecret, db) {
+    return resolveAuth(req.headers.get('authorization'), authSecret, db);
+}
+export function registerContentRoutes(router, ctx) {
+    const { db, authSecret, contentTypeMap, customTableMap } = ctx;
+    function getContentType(typeName) {
+        return contentTypeMap.get(typeName) ?? null;
+    }
+    // ── Type-agnostic endpoints (registered first so "by-id" matches before ":type") ──
+    // GET /content/by-id/:id — Get any content by ID with custom fields
+    router.get('/content/by-id/:id', async (req, params) => {
+        const siteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const base = await getContentById(db, null, params.id, siteId);
+        if (!base)
+            return notFound('Content not found');
+        const contentTypeName = base.contentTypeName;
+        const customTable = customTableMap.get(contentTypeName) ?? null;
+        if (customTable) {
+            const result = await getContentById(db, customTable, params.id, siteId);
+            if (!result)
+                return notFound('Content not found');
+            return jsonOk(result);
+        }
+        return jsonOk(base);
+    });
+    // GET /content/by-id/:id/children — Get direct children
+    router.get('/content/by-id/:id/children', async (_req, params) => {
+        const children = await getChildren(db, params.id);
+        return jsonOk(children);
+    });
+    // DELETE /content/by-id/:id — Soft delete (auth required, delete role)
+    router.delete('/content/by-id/:id', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'delete'))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'delete')))
+            return forbidden();
+        // No content-lock gate here: `delete` already requires siteAdmin, and the
+        // lock exception only ever applies to sub-siteAdmin roles, so a lock check
+        // could never block a caller who passed the role gate.
+        //
+        // Scope the soft-delete by the request's resolved site so an id belonging to
+        // another site can't be deleted by id alone (cross-site addressing).
+        const siteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const deleted = await deleteContent(db, params.id, siteId);
+        if (!deleted)
+            return notFound('Content not found');
+        return jsonOk({ deleted: true });
+    });
+    // POST /content/by-id/:id/publish — Publish (auth required, publish role)
+    router.post('/content/by-id/:id/publish', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'publish'))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'publish')))
+            return forbidden();
+        // Scope by the request's resolved site so a foreign-site id → null → 404,
+        // blocking cross-site publish (the id-keyed publishContent alone can't tell
+        // sites apart).
+        const publishSiteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const row = await publishContent(db, params.id, publishSiteId);
+        if (!row)
+            return notFound('Content not found');
+        // Mirror the typed `/content/:type/:id/publish` route: dispatch afterPublish
+        // so content-type hooks + the `content:{type}:afterPublish` /
+        // `content:afterPublish` registry events fire (AX regeneration, cache
+        // invalidation, webhooks all subscribe to the latter). The by-id route only
+        // has the row's `contentTypeName` to resolve the type — if that type isn't
+        // registered in this instance (an orphaned/removed content type), skip the
+        // dispatch rather than 500ing a publish that already succeeded.
+        const contentType = getContentType(row.contentTypeName);
+        if (contentType) {
+            const dispatch = createContentHookDispatcher(contentType, ctx.hookRegistry, ctx.kywiCtx);
+            await dispatch.afterPublish(row);
+        }
+        return jsonOk(row);
+    });
+    // POST /content/by-id/:id/unpublish — Unpublish (auth required, publish role)
+    router.post('/content/by-id/:id/unpublish', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'publish'))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'publish')))
+            return forbidden();
+        // Scope by the request's resolved site so a foreign-site id → null → 404
+        // (cross-site unpublish guard, mirroring the by-id publish route).
+        const unpublishSiteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const row = await unpublishContent(db, params.id, unpublishSiteId);
+        if (!row)
+            return notFound('Content not found');
+        // There is no `afterUnpublish` event, but an unpublish still has to invalidate
+        // the public cache (content/feed/nav + AX projections) — otherwise the site
+        // keeps serving the just-unpublished node from stale cache. Dispatch
+        // `afterUpdate` (an unpublish IS a content mutation) to carry that
+        // invalidation, mirroring the typed unpublish route below. Resolve the type
+        // from the row's `contentTypeName`; skip an orphaned type gracefully.
+        const contentType = getContentType(row.contentTypeName);
+        if (contentType) {
+            const dispatch = createContentHookDispatcher(contentType, ctx.hookRegistry, ctx.kywiCtx);
+            await dispatch.afterUpdate(row);
+        }
+        return jsonOk(row);
+    });
+    // POST /content/by-id/:id/restore
+    router.post('/content/by-id/:id/restore', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'write')))
+            return forbidden();
+        // Fetch the content before restoring so we can pass it to hooks. Both the
+        // fetch and the restore are scoped to the request's resolved site so a
+        // foreign-site id can't be restored by id alone (cross-site guard).
+        const restoreSiteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const existing = await getContentById(db, null, params.id, restoreSiteId);
+        const { restored, movedToRecovered } = await restoreContentWithRecovery(db, params.id, restoreSiteId);
+        if (!restored)
+            return notFound('Content not found or not deleted');
+        // Fire trash hook
+        const trashDispatch = createTrashHookDispatcher(ctx.hookRegistry);
+        if (existing)
+            await trashDispatch.afterRestore(existing);
+        return jsonOk({ restored: true, movedToRecovered });
+    });
+    // DELETE /content/by-id/:id/permanent
+    router.delete('/content/by-id/:id/permanent', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'delete'))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'delete')))
+            return forbidden();
+        // Fetch the content before deleting so we can pass it to hooks. Both the
+        // fetch and the permanent delete are scoped to the request's resolved site so
+        // a foreign-site id can't be purged by id alone (cross-site guard).
+        const permSiteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const existing = await getContentById(db, null, params.id, permSiteId);
+        const deleted = await permanentDeleteContent(db, params.id, permSiteId);
+        if (!deleted)
+            return notFound('Content not found or not in trash');
+        // Fire trash hook
+        const trashDispatch = createTrashHookDispatcher(ctx.hookRegistry);
+        if (existing)
+            await trashDispatch.afterPermanentDelete(existing);
+        return jsonOk({ permanentlyDeleted: true });
+    });
+    // GET /content/trash — List soft-deleted content for a site
+    router.get('/content/trash', async (req, _params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'delete'))
+            return forbidden();
+        const siteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const url = new URL(req.url);
+        const page = Math.max(1, parseInt(url.searchParams.get('page') ?? '1', 10));
+        const pageSize = Math.min(100, Math.max(1, parseInt(url.searchParams.get('pageSize') ?? '20', 10)));
+        const offset = (page - 1) * pageSize;
+        const { rows, total } = await listDeletedContent(db, siteId, { limit: pageSize, offset });
+        return paginatedOk(rows, { total, page, pageSize });
+    });
+    // GET /content/trash/all — List all soft-deleted content (superAdmin only)
+    router.get('/content/trash/all', async (req, _params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'superAdmin'))
+            return forbidden();
+        const url = new URL(req.url);
+        const page = Math.max(1, parseInt(url.searchParams.get('page') ?? '1', 10));
+        const pageSize = Math.min(100, Math.max(1, parseInt(url.searchParams.get('pageSize') ?? '20', 10)));
+        const offset = (page - 1) * pageSize;
+        const { rows, total } = await listAllDeletedContent(db, { limit: pageSize, offset });
+        return paginatedOk(rows, { total, page, pageSize });
+    });
+    // POST /content/trash/empty — Empty trash for a site
+    router.post('/content/trash/empty', async (req, _params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'delete'))
+            return forbidden();
+        const siteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const count = await emptyTrashForSite(db, siteId);
+        return jsonOk({ emptied: true, count });
+    });
+    // POST /content/trash/empty-all — Empty trash globally (superAdmin only)
+    router.post('/content/trash/empty-all', async (req, _params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'superAdmin'))
+            return forbidden();
+        const count = await emptyTrashGlobal(db);
+        return jsonOk({ emptied: true, count });
+    });
+    // ── Type-specific endpoints ───────────────────────────────────────────────
+    // GET /content/:type — List content
+    router.get('/content/:type', async (req, params) => {
+        const contentType = getContentType(params.type);
+        if (!contentType)
+            return notFound(`Content type '${params.type}' not found`);
+        const auth = await authenticate(req, authSecret, db);
+        if (!checkContentAccess(contentType.access, 'read', auth.user)) {
+            return auth.user ? forbidden() : unauthorized();
+        }
+        const url = new URL(req.url);
+        const pagination = parsePaginationParams(url);
+        const sort = parseSortParams(url);
+        const filters = parseFilterParams(url, contentType);
+        const siteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        // siteId is resolved authoritatively above; ensure no query-string siteId leaks through
+        delete filters.siteId;
+        const customTable = customTableMap.get(contentType.name) ?? null;
+        // Content protection: non-editors only see published content
+        const isEditor = auth.user !== null && hasMinRole(auth.user.role, 'editor');
+        const visibleStatuses = isEditor ? undefined : ['published'];
+        const { rows, total } = await listContent(db, contentType, customTable, siteId, pagination, sort, filters, visibleStatuses);
+        // W1: field-level access filtering
+        const filteredRows = rows.map(row => filterFieldsForUser(row, contentType.fields, auth.user, 'read'));
+        return paginatedOk(filteredRows, { total, page: pagination.page, pageSize: pagination.limit });
+    });
+    // GET /content/:type/:id — Get by ID
+    router.get('/content/:type/:id', async (req, params) => {
+        const contentType = getContentType(params.type);
+        if (!contentType)
+            return notFound(`Content type '${params.type}' not found`);
+        const auth = await authenticate(req, authSecret, db);
+        if (!checkContentAccess(contentType.access, 'read', auth.user)) {
+            return auth.user ? forbidden() : unauthorized();
+        }
+        const customTable = customTableMap.get(contentType.name) ?? null;
+        // W4: try cached query first when available
+        let row = null;
+        if (ctx.cachedQueries) {
+            const siteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+            row = await ctx.cachedQueries.getById(siteId, params.id);
+        }
+        if (!row) {
+            const siteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+            row = await getContentById(db, customTable, params.id, siteId);
+        }
+        if (!row)
+            return notFound('Content not found');
+        // Document-level access check
+        const docAccess = await checkDocumentAccess(db, params.id, auth.user, 'read');
+        if (!docAccess)
+            return auth.user ? forbidden() : unauthorized();
+        // Content protection: non-editors cannot view non-published content
+        if (row.status !== 'published') {
+            const isEditor = auth.user !== null && hasMinRole(auth.user.role, 'editor');
+            if (!isEditor)
+                return notFound('Content not found');
+        }
+        // Attach content stats
+        const stats = await getStats(db, params.id);
+        // W1: field-level access filtering
+        const filtered = filterFieldsForUser(row, contentType.fields, auth.user, 'read');
+        return jsonOk({ ...filtered, stats });
+    });
+    // GET /content/slug/:slug (+ catch-all for multi-segment slug paths) — Get by slug.
+    //
+    // Both patterns share one handler. The concrete `:slug` variant is required
+    // because the router ranks a catch-all route by its *fixed* segment count
+    // (here 2: "content"/"slug"), so a bare `/content/slug/*slug` loses to the
+    // 3-segment `/content/:type/:id` for a single-segment slug and the request is
+    // mis-routed as content-type "slug" (404). The concrete route (3 segments,
+    // literal "slug" at index 1) outranks `/content/:type/:id` and restores the
+    // documented `GET /content/slug/:slug` contract the SDK/MCP getBySlug rely on.
+    const getBySlugHandler = async (req, params) => {
+        const siteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const auth = await authenticate(req, authSecret, db);
+        // W4: try cached query first when available
+        if (ctx.cachedQueries) {
+            const cached = await ctx.cachedQueries.getBySlug(siteId, params.slug);
+            if (cached) {
+                // W1: field-level access filtering
+                const typeName = cached.contentTypeName;
+                const ct = typeName ? contentTypeMap.get(typeName) : undefined;
+                const filtered = ct ? filterFieldsForUser(cached, ct.fields, auth.user, 'read') : cached;
+                return jsonOk(filtered);
+            }
+        }
+        for (const [typeName] of contentTypeMap) {
+            const customTable = customTableMap.get(typeName) ?? null;
+            const row = await getContentBySlug(db, customTable, params.slug, siteId);
+            if (row) {
+                // W1: field-level access filtering
+                const ct = contentTypeMap.get(typeName);
+                const filtered = ct ? filterFieldsForUser(row, ct.fields, auth.user, 'read') : row;
+                return jsonOk(filtered);
+            }
+        }
+        const row = await getContentBySlug(db, null, params.slug, siteId);
+        if (row)
+            return jsonOk(row);
+        return notFound('Content not found');
+    };
+    router.get('/content/slug/:slug', getBySlugHandler);
+    router.get('/content/slug/*slug', getBySlugHandler);
+    // POST /content/:type — Create
+    router.post('/content/:type', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        const contentType = getContentType(params.type);
+        if (!contentType)
+            return notFound(`Content type '${params.type}' not found`);
+        if (!checkContentAccess(contentType.access, 'write', auth.user))
+            return forbidden();
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        const schema = buildCreateSchema(contentType);
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        }
+        const siteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const customTable = customTableMap.get(contentType.name) ?? null;
+        const dispatch = createContentHookDispatcher(contentType, ctx.hookRegistry, ctx.kywiCtx);
+        let data;
+        try {
+            data = await dispatch.beforeCreate(parsed.data);
+            // Domain validation (G6): a validate hook throws KywiValidationError to
+            // reject the write; anything else propagates as a 500.
+            await dispatch.validate(data);
+        }
+        catch (err) {
+            if (err instanceof KywiValidationError) {
+                return validationError(err.fields.map(f => ({ path: f.field, message: f.message })));
+            }
+            throw err;
+        }
+        const created = await createContent(db, contentType, customTable, siteId, data, auth.user.id);
+        await dispatch.afterCreate(created);
+        // W5: sync tag usageCount
+        const createdRecord = created;
+        await syncContentTags(db, createdRecord.id, parsed.data.tagIds);
+        return jsonOk(created, 201);
+    });
+    // PUT /content/:type/:id — Full update
+    router.put('/content/:type/:id', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        const contentType = getContentType(params.type);
+        if (!contentType)
+            return notFound(`Content type '${params.type}' not found`);
+        if (!checkContentAccess(contentType.access, 'write', auth.user))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'write')))
+            return forbidden();
+        const locked = await isContentLocked(db, params.id);
+        if (locked && !hasMinRole(auth.user.role, 'siteAdmin')) {
+            return jsonError('LOCKED', 'Content is locked and cannot be modified', 423);
+        }
+        // Check time-based lock by another user
+        const lockInfo = await getLock(db, params.id);
+        if (lockInfo && lockInfo.userId !== auth.user.id) {
+            return jsonError('LOCKED', 'Content is locked', 423, {
+                lockedBy: lockInfo.userId,
+                expiresAt: lockInfo.expiresAt.toISOString(),
+            });
+        }
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        // PUT accepts partial updates, exactly like PATCH: the journey e2e contract
+        // treats them as equivalent, so a `title`-less body (e.g. a lone slug change)
+        // must not 400. Use the update schema (all fields optional). PUT still keeps
+        // its extra time-based lock checks and lock renewal below, which PATCH omits.
+        const schema = buildUpdateSchema(contentType);
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        }
+        const dispatch = createContentHookDispatcher(contentType, ctx.hookRegistry, ctx.kywiCtx);
+        const customTable = customTableMap.get(contentType.name) ?? null;
+        // Scope the existence guard to the request's site so a content id belonging
+        // to another site resolves to null → 404, blocking the mutation below before
+        // updateContent (which is keyed by id alone) can touch a foreign row.
+        const putSiteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const existing = await getContentById(db, customTable, params.id, putSiteId);
+        if (!existing)
+            return notFound('Content not found');
+        let data;
+        try {
+            data = await dispatch.beforeUpdate(parsed.data, existing);
+            // Domain validation (G6): reject via KywiValidationError → 400.
+            await dispatch.validate(data);
+        }
+        catch (err) {
+            if (err instanceof KywiValidationError) {
+                return validationError(err.fields.map(f => ({ path: f.field, message: f.message })));
+            }
+            throw err;
+        }
+        const updated = await updateContent(db, contentType, customTable, params.id, data, auth.user.id);
+        if (!updated)
+            return notFound('Content not found');
+        await dispatch.afterUpdate(updated);
+        // W5: sync tag usageCount on update
+        await syncContentTags(db, params.id, parsed.data.tagIds);
+        // W8 + child-path cascade: when the slug changes, recompute this node's
+        // materialized path, cascade the new prefix to all descendants (TC-02.019),
+        // then archive the old path for redirects.
+        const existingRecord = existing;
+        const updatedRecord = updated;
+        if (existingRecord.slug !== updatedRecord.slug) {
+            const cascade = await cascadeSlugPath(db, params.id, existingRecord.slug, updatedRecord.slug);
+            const siteId = (existingRecord.siteId ?? '');
+            const oldPath = cascade?.oldPath ?? (existingRecord.path ?? `/${existingRecord.slug}`);
+            const newPath = cascade?.newPath ?? (updatedRecord.path ?? `/${updatedRecord.slug}`);
+            if (cascade)
+                updatedRecord.path = cascade.newPath;
+            if (oldPath !== newPath) {
+                await archivePath(db, siteId, oldPath, newPath, params.id);
+            }
+        }
+        // Auto-renew lock if the user has one, or release it
+        if (lockInfo && lockInfo.userId === auth.user.id) {
+            await renewLock(db, params.id, auth.user.id);
+        }
+        return jsonOk(updated);
+    });
+    // PATCH /content/:type/:id — Partial update
+    router.patch('/content/:type/:id', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        const contentType = getContentType(params.type);
+        if (!contentType)
+            return notFound(`Content type '${params.type}' not found`);
+        if (!checkContentAccess(contentType.access, 'write', auth.user))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'write')))
+            return forbidden();
+        const locked = await isContentLocked(db, params.id);
+        if (locked && !hasMinRole(auth.user.role, 'siteAdmin')) {
+            return jsonError('LOCKED', 'Content is locked and cannot be modified', 423);
+        }
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        const schema = buildUpdateSchema(contentType);
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        }
+        const dispatch = createContentHookDispatcher(contentType, ctx.hookRegistry, ctx.kywiCtx);
+        const customTable = customTableMap.get(contentType.name) ?? null;
+        // Site-scoped existence guard (see PUT handler): foreign id → 404 before mutate.
+        const patchSiteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const existing = await getContentById(db, customTable, params.id, patchSiteId);
+        if (!existing)
+            return notFound('Content not found');
+        let data;
+        try {
+            data = await dispatch.beforeUpdate(parsed.data, existing);
+            // Domain validation (G6): reject via KywiValidationError → 400.
+            await dispatch.validate(data);
+        }
+        catch (err) {
+            if (err instanceof KywiValidationError) {
+                return validationError(err.fields.map(f => ({ path: f.field, message: f.message })));
+            }
+            throw err;
+        }
+        const updated = await updateContent(db, contentType, customTable, params.id, data, auth.user.id);
+        if (!updated)
+            return notFound('Content not found');
+        await dispatch.afterUpdate(updated);
+        // W5: sync tag usageCount on patch
+        await syncContentTags(db, params.id, parsed.data.tagIds);
+        // W8 + child-path cascade: when the slug changes, recompute this node's
+        // materialized path, cascade the new prefix to all descendants (TC-02.019),
+        // then archive the old path for redirects.
+        const existingPatch = existing;
+        const updatedPatch = updated;
+        if (existingPatch.slug !== updatedPatch.slug) {
+            const cascade = await cascadeSlugPath(db, params.id, existingPatch.slug, updatedPatch.slug);
+            const siteId = (existingPatch.siteId ?? '');
+            const oldPath = cascade?.oldPath ?? (existingPatch.path ?? `/${existingPatch.slug}`);
+            const newPath = cascade?.newPath ?? (updatedPatch.path ?? `/${updatedPatch.slug}`);
+            if (cascade)
+                updatedPatch.path = cascade.newPath;
+            if (oldPath !== newPath) {
+                await archivePath(db, siteId, oldPath, newPath, params.id);
+            }
+        }
+        return jsonOk(updated);
+    });
+    // DELETE /content/:type/:id — Soft delete
+    router.delete('/content/:type/:id', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'delete'))
+            return forbidden();
+        const contentType = getContentType(params.type);
+        if (!contentType)
+            return notFound(`Content type '${params.type}' not found`);
+        if (!checkContentAccess(contentType.access, 'delete', auth.user))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'delete')))
+            return forbidden();
+        const locked = await isContentLocked(db, params.id);
+        if (locked && !hasMinRole(auth.user.role, 'siteAdmin')) {
+            return jsonError('LOCKED', 'Content is locked and cannot be modified', 423);
+        }
+        const dispatch = createContentHookDispatcher(contentType, ctx.hookRegistry, ctx.kywiCtx);
+        const customTable = customTableMap.get(contentType.name) ?? null;
+        // Site-scoped existence guard: a content id from another site resolves to
+        // null → 404, blocking deleteContent (keyed by id alone) from removing a
+        // foreign row.
+        const delSiteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const existing = await getContentById(db, customTable, params.id, delSiteId);
+        if (!existing)
+            return notFound('Content not found');
+        await dispatch.beforeDelete(existing);
+        const deleted = await deleteContent(db, params.id);
+        if (!deleted)
+            return notFound('Content not found');
+        await dispatch.afterDelete(existing);
+        return jsonOk({ deleted: true });
+    });
+    // POST /content/:type/:id/publish
+    router.post('/content/:type/:id/publish', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'publish'))
+            return forbidden();
+        const contentType = getContentType(params.type);
+        if (!contentType)
+            return notFound(`Content type '${params.type}' not found`);
+        if (!checkContentAccess(contentType.access, 'publish', auth.user))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'publish')))
+            return forbidden();
+        // Scope by the request's resolved site: a foreign-site id → null → 404,
+        // matching the site-scoped existence guard the typed PUT/PATCH/DELETE routes
+        // already apply (publishContent is otherwise keyed by id alone).
+        const publishSiteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const row = await publishContent(db, params.id, publishSiteId);
+        if (!row)
+            return notFound('Content not found');
+        const dispatch = createContentHookDispatcher(contentType, ctx.hookRegistry, ctx.kywiCtx);
+        await dispatch.afterPublish(row);
+        return jsonOk(row);
+    });
+    // POST /content/:type/:id/unpublish
+    router.post('/content/:type/:id/unpublish', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'publish'))
+            return forbidden();
+        const contentType = getContentType(params.type);
+        if (!contentType)
+            return notFound(`Content type '${params.type}' not found`);
+        if (!checkContentAccess(contentType.access, 'publish', auth.user))
+            return forbidden();
+        if (!(await checkDocumentMutationAccess(db, params.id, auth.user, 'publish')))
+            return forbidden();
+        // Scope by the request's resolved site (cross-site unpublish guard).
+        const unpublishSiteId = resolveSiteId(req, ctx.config, ctx.siteIdMap);
+        const row = await unpublishContent(db, params.id, unpublishSiteId);
+        if (!row)
+            return notFound('Content not found');
+        // Invalidate the public cache on unpublish (see the by-id route above): no
+        // dedicated afterUnpublish event exists, so `afterUpdate` carries the
+        // content/feed/nav + AX invalidation for the just-unpublished node.
+        const dispatch = createContentHookDispatcher(contentType, ctx.hookRegistry, ctx.kywiCtx);
+        await dispatch.afterUpdate(row);
+        return jsonOk(row);
+    });
+    // ── Stats / view-tracking endpoints ────────────────────────────────────────
+    // POST /content/:type/:id/view — Record a page view (public, no auth required)
+    router.post('/content/:type/:id/view', async (req, params) => {
+        const contentType = getContentType(params.type);
+        if (!contentType)
+            return notFound(`Content type '${params.type}' not found`);
+        let visitorId;
+        try {
+            const body = await req.json();
+            if (typeof body.visitorId === 'string') {
+                visitorId = body.visitorId;
+            }
+        }
+        catch {
+            // empty body is fine
+        }
+        const stats = await incrementViews(db, params.id, visitorId);
+        if (!stats) {
+            // null means deduped (visitor already viewed within the hour)
+            return jsonOk({ deduped: true });
+        }
+        return jsonOk(stats);
+    });
+    // ── Lock endpoints ────────────────────────────────────────────────────────
+    // POST /content/:type/:id/lock — Acquire a lock for the current user
+    router.post('/content/:type/:id/lock', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        try {
+            const lock = await acquireLock(db, params.id, auth.user.id);
+            return jsonOk(lock);
+        }
+        catch (err) {
+            if (err instanceof LockConflictError) {
+                return jsonError('LOCK_CONFLICT', err.message, 409, {
+                    lockedBy: err.lockHolder,
+                    expiresAt: err.expiresAt.toISOString(),
+                });
+            }
+            throw err;
+        }
+    });
+    // DELETE /content/:type/:id/lock — Release a lock for the current user
+    router.delete('/content/:type/:id/lock', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        const released = await releaseLock(db, params.id, auth.user.id);
+        if (!released)
+            return notFound('Lock not found or not owned by you');
+        return jsonOk({ unlocked: true });
+    });
+    // DELETE /content/:type/:id/lock/force — Force unlock (siteAdmin+ only)
+    router.delete('/content/:type/:id/lock/force', async (req, params) => {
+        const auth = await authenticate(req, authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'siteAdmin'))
+            return forbidden();
+        const removed = await forceUnlock(db, params.id);
+        if (!removed)
+            return notFound('No lock found');
+        return jsonOk({ unlocked: true });
+    });
+}
+//# sourceMappingURL=content-routes.js.map