@kywi-software/core 0.1.0

package/dist/api/router.js

@@ -0,0 +1,128 @@
+function parsePattern(pattern) {
+    const raw = pattern.startsWith('/') ? pattern.slice(1) : pattern;
+    const parts = raw.split('/');
+    const catchAllIndex = parts.findIndex(p => p.startsWith('*'));
+    if (catchAllIndex >= 0) {
+        const catchAllParam = parts[catchAllIndex].slice(1);
+        return {
+            segments: parts.slice(0, catchAllIndex),
+            catchAllParam,
+        };
+    }
+    return { segments: parts };
+}
+function matchRoute(route, pathSegments) {
+    const params = {};
+    if (route.catchAllParam) {
+        if (pathSegments.length < route.segments.length)
+            return null;
+        for (let i = 0; i < route.segments.length; i++) {
+            const routeSeg = route.segments[i];
+            const pathSeg = pathSegments[i];
+            if (routeSeg.startsWith(':')) {
+                params[routeSeg.slice(1)] = pathSeg;
+            }
+            else if (routeSeg !== pathSeg) {
+                return null;
+            }
+        }
+        params[route.catchAllParam] = pathSegments.slice(route.segments.length).join('/');
+        return params;
+    }
+    if (route.segments.length !== pathSegments.length)
+        return null;
+    for (let i = 0; i < route.segments.length; i++) {
+        const routeSeg = route.segments[i];
+        const pathSeg = pathSegments[i];
+        if (routeSeg.startsWith(':')) {
+            params[routeSeg.slice(1)] = pathSeg;
+        }
+        else if (routeSeg !== pathSeg) {
+            return null;
+        }
+    }
+    return params;
+}
+/**
+ * Order two routes from most-specific to least-specific so that
+ * `router.handle` matches the tightest pattern regardless of registration order.
+ *
+ * Precedence rules (each decides before falling through to the next):
+ *  1. More fixed segments first — a longer concrete pattern outranks a shorter
+ *     one (and any catch-all, whose fixed prefix is shorter than its matches).
+ *  2. At equal length, a literal segment beats a `:param` at the same position,
+ *     compared left-to-right (earlier positions dominate). This is what makes
+ *     `/content/:type/bulk/publish` win over `/content/:type/:id/publish` so the
+ *     literal "bulk" is never swallowed as an `:id`.
+ *  3. A non-catch-all route beats an otherwise-equal catch-all route.
+ */
+function compareRouteSpecificity(a, b) {
+    if (a.segments.length !== b.segments.length) {
+        return b.segments.length - a.segments.length;
+    }
+    for (let i = 0; i < a.segments.length; i++) {
+        const aParam = a.segments[i].startsWith(':');
+        const bParam = b.segments[i].startsWith(':');
+        if (aParam !== bParam)
+            return aParam ? 1 : -1; // literal (non-param) first
+    }
+    const aCatch = a.catchAllParam ? 1 : 0;
+    const bCatch = b.catchAllParam ? 1 : 0;
+    return aCatch - bCatch;
+}
+export class Router {
+    routes = [];
+    // Cache of routes ordered by specificity; rebuilt lazily when routes change.
+    sortedRoutes = null;
+    addRoute(method, pattern, handler) {
+        const { segments, catchAllParam } = parsePattern(pattern);
+        const route = { method, segments, handler };
+        if (catchAllParam !== undefined)
+            route.catchAllParam = catchAllParam;
+        this.routes.push(route);
+        this.sortedRoutes = null;
+    }
+    get(pattern, handler) {
+        this.addRoute('GET', pattern, handler);
+    }
+    post(pattern, handler) {
+        this.addRoute('POST', pattern, handler);
+    }
+    put(pattern, handler) {
+        this.addRoute('PUT', pattern, handler);
+    }
+    patch(pattern, handler) {
+        this.addRoute('PATCH', pattern, handler);
+    }
+    delete(pattern, handler) {
+        this.addRoute('DELETE', pattern, handler);
+    }
+    async handle(req, pathSegments) {
+        const method = req.method.toUpperCase();
+        if (this.sortedRoutes === null) {
+            this.sortedRoutes = [...this.routes].sort(compareRouteSpecificity);
+        }
+        const sortedRoutes = this.sortedRoutes;
+        let pathMatched = false;
+        for (const route of sortedRoutes) {
+            const params = matchRoute(route, pathSegments);
+            if (params !== null) {
+                pathMatched = true;
+                if (route.method === method) {
+                    return route.handler(req, params);
+                }
+            }
+        }
+        if (pathMatched) {
+            return new Response(JSON.stringify({ error: { code: 'METHOD_NOT_ALLOWED', message: 'Method not allowed' } }), {
+                status: 405,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        return new Response(JSON.stringify({ error: { code: 'NOT_FOUND', message: 'Route not found' } }), {
+            status: 404,
+            headers: { 'Content-Type': 'application/json' },
+        });
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/api/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/api/router.ts"],"names":[],"mappings":"AAYA,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAChE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAE7D,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACpD,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;YACvC,aAAa;SACd,CAAA;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,UAAU,CACjB,KAAY,EACZ,YAAsB;IAEtB,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,IAAI,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAA;YACnC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAE,CAAA;YAChC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;YACrC,CAAC;iBAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjF,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAE9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAA;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAE,CAAA;QAChC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;QACrC,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,uBAAuB,CAAC,CAAQ,EAAE,CAAQ;IACjD,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC5C,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAA;IAC9C,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,4BAA4B;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtC,OAAO,MAAM,GAAG,MAAM,CAAA;AACxB,CAAC;AAED,MAAM,OAAO,MAAM;IACT,MAAM,GAAY,EAAE,CAAA;IAC5B,6EAA6E;IACrE,YAAY,GAAmB,IAAI,CAAA;IAEnC,QAAQ,CAAC,MAAc,EAAE,OAAe,EAAE,OAAqB;QACrE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QACzD,MAAM,KAAK,GAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;QAClD,IAAI,aAAa,KAAK,SAAS;YAAE,KAAK,CAAC,aAAa,GAAG,aAAa,CAAA;QACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;IAC1B,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,OAAqB;QACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACxC,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,OAAqB;QACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,OAAqB;QACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACxC,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,OAAqB;QAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,CAAC,OAAe,EAAE,OAAqB;QAC3C,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAY,EAAE,YAAsB;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;QAEvC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QAEtC,IAAI,WAAW,GAAG,KAAK,CAAA;QAEvB,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;YAC9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,WAAW,GAAG,IAAI,CAAA;gBAClB,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC,EAAE;gBAC5G,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE;YAChG,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/api/scheduler-routes.d.ts

@@ -0,0 +1,21 @@
+import type { Router } from './router.js';
+import type { KywiDb } from '../db/client.js';
+interface SchedulerRouteContext {
+    db: KywiDb;
+    authSecret: string;
+}
+/**
+ * Admin trigger for the background scheduler sweep (GAP-12-E).
+ *
+ * The scheduler logic (publishScheduledContent, unpublishExpiredContent,
+ * publishScheduledChangesets, resetExpiredFeatured) was verified-correct but had
+ * no callers. This exposes it over HTTP for an external cron ("every minute,
+ * POST /api/v1/scheduler/run with a siteAdmin API key"), independent of any
+ * in-process interval runner an app may also start at boot.
+ *
+ * siteAdmin-gated: the sweep publishes/expires content site-wide, so it sits at
+ * the same privilege level as trash-empty and other site-administration actions.
+ */
+export declare function registerSchedulerRoutes(router: Router, ctx: SchedulerRouteContext): void;
+export {};
+//# sourceMappingURL=scheduler-routes.d.ts.map

package/dist/api/scheduler-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler-routes.d.ts","sourceRoot":"","sources":["../../src/api/scheduler-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAM7C,UAAU,qBAAqB;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG,IAAI,CAYxF"}

package/dist/api/scheduler-routes.js

@@ -0,0 +1,30 @@
+import { resolveAuth } from './auth.js';
+import { hasMinRole } from '../auth/roles.js';
+import { jsonOk, unauthorized, forbidden } from './response.js';
+import { runScheduler } from '../versioning/scheduler.js';
+/**
+ * Admin trigger for the background scheduler sweep (GAP-12-E).
+ *
+ * The scheduler logic (publishScheduledContent, unpublishExpiredContent,
+ * publishScheduledChangesets, resetExpiredFeatured) was verified-correct but had
+ * no callers. This exposes it over HTTP for an external cron ("every minute,
+ * POST /api/v1/scheduler/run with a siteAdmin API key"), independent of any
+ * in-process interval runner an app may also start at boot.
+ *
+ * siteAdmin-gated: the sweep publishes/expires content site-wide, so it sits at
+ * the same privilege level as trash-empty and other site-administration actions.
+ */
+export function registerSchedulerRoutes(router, ctx) {
+    const { db, authSecret } = ctx;
+    // POST /scheduler/run — run one scheduler sweep now; returns the action counts.
+    router.post('/scheduler/run', async (req) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'siteAdmin'))
+            return forbidden();
+        const result = await runScheduler(db);
+        return jsonOk(result);
+    });
+}
+//# sourceMappingURL=scheduler-routes.js.map

package/dist/api/scheduler-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler-routes.js","sourceRoot":"","sources":["../../src/api/scheduler-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAOzD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,GAA0B;IAChF,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAE9B,gFAAgF;IAChF,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,CAAC,CAAA;QACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/schema-routes.d.ts

@@ -0,0 +1,14 @@
+import type { Router } from './router.js';
+import type { KywiDb } from '../db/client.js';
+import type { KywiConfig, ContentTypeConfig } from '../config/types.js';
+import type { PgTableWithColumns } from 'drizzle-orm/pg-core';
+export interface SchemaRouteContext {
+    config: KywiConfig;
+    db: KywiDb;
+    authSecret: string;
+    getContentTypeMap: () => Map<string, ContentTypeConfig>;
+    getCustomTableMap: () => Map<string, PgTableWithColumns<any>>;
+    reloadMaps: () => Promise<void>;
+}
+export declare function registerSchemaRoutes(router: Router, ctx: SchemaRouteContext): void;
+//# sourceMappingURL=schema-routes.d.ts.map

package/dist/api/schema-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-routes.d.ts","sourceRoot":"","sources":["../../src/api/schema-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAmB,MAAM,oBAAoB,CAAA;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAO7D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IACvD,iBAAiB,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7D,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC;AA0BD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAgJlF"}

package/dist/api/schema-routes.js

@@ -0,0 +1,168 @@
+import { z } from 'zod';
+import { resolveAuth } from './auth.js';
+import { hasMinRole } from '../auth/roles.js';
+import { jsonOk, jsonError, notFound, unauthorized, forbidden } from './response.js';
+import { saveAdminField, deleteAdminField } from '../db/schema-field-queries.js';
+import { applySchemaForType } from '../db/schema-apply.js';
+const BUILT_IN_TYPES = new Set(['page', 'folder', 'link']);
+const FIELD_TYPES = [
+    'text', 'richText', 'textarea', 'select', 'multiSelect',
+    'relationship', 'image', 'file', 'date', 'boolean', 'number',
+    'json', 'color', 'slug', 'group',
+];
+const addFieldSchema = z.object({
+    name: z.string().min(1).regex(/^[a-zA-Z][a-zA-Z0-9]*$/, 'Field name must be camelCase alphanumeric, starting with a letter'),
+    type: z.enum(FIELD_TYPES),
+    label: z.string().min(1),
+    options: z.array(z.string()).optional(),
+    required: z.boolean().optional(),
+    sortOrder: z.number().int().optional(),
+});
+async function requireSiteAdmin(req, authSecret, db) {
+    const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+    if (!auth.user)
+        return null;
+    if (!hasMinRole(auth.user.role, 'siteAdmin'))
+        return null;
+    return auth.user;
+}
+export function registerSchemaRoutes(router, ctx) {
+    const { db, authSecret } = ctx;
+    // GET /schema/types — list all non-built-in content types with merged fields
+    router.get('/schema/types', async (req) => {
+        const user = await requireSiteAdmin(req, authSecret, db);
+        if (!user)
+            return unauthorized();
+        const types = Array.from(ctx.getContentTypeMap().values())
+            .filter(ct => !BUILT_IN_TYPES.has(ct.name))
+            .map(ct => ({
+            name: ct.name,
+            label: ct.label,
+            baseType: ct.baseType,
+            fields: ct.fields.map(f => ({ ...f, source: f.source ?? 'config' })),
+        }));
+        return jsonOk(types);
+    });
+    // GET /schema/types/:type/fields — fields for one type
+    router.get('/schema/types/:type/fields', async (req, params) => {
+        const user = await requireSiteAdmin(req, authSecret, db);
+        if (!user)
+            return unauthorized();
+        const ct = ctx.getContentTypeMap().get(params.type);
+        if (!ct)
+            return notFound(`Content type '${params.type}' not found`);
+        return jsonOk(ct.fields.map(f => ({ ...f, source: f.source ?? 'config' })));
+    });
+    // POST /schema/types/:type/fields — add an admin field
+    router.post('/schema/types/:type/fields', async (req, params) => {
+        const user = await requireSiteAdmin(req, authSecret, db);
+        if (!user)
+            return unauthorized();
+        const ct = ctx.getContentTypeMap().get(params.type);
+        if (!ct)
+            return notFound(`Content type '${params.type}' not found`);
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        const parsed = addFieldSchema.safeParse(body);
+        if (!parsed.success) {
+            return jsonError('VALIDATION_ERROR', 'Validation failed', 400, parsed.error.flatten());
+        }
+        // Block overriding config-sourced fields
+        const existingConfigField = ct.fields.find(f => f.name === parsed.data.name && (f.source === 'config' || !f.source));
+        if (existingConfigField) {
+            return jsonError('CONFLICT', `Field '${parsed.data.name}' is defined in kywi.config.ts and cannot be overridden via the UI`, 409);
+        }
+        await saveAdminField(db, { contentTypeName: params.type, ...parsed.data });
+        await ctx.reloadMaps();
+        return jsonOk({ saved: true }, 201);
+    });
+    // PUT /schema/types/:type/fields/:field — update an admin field
+    router.put('/schema/types/:type/fields/:field', async (req, params) => {
+        const user = await requireSiteAdmin(req, authSecret, db);
+        if (!user)
+            return unauthorized();
+        const ct = ctx.getContentTypeMap().get(params.type);
+        if (!ct)
+            return notFound(`Content type '${params.type}' not found`);
+        const existingField = ct.fields.find(f => f.name === params.field);
+        if (!existingField)
+            return notFound(`Field '${params.field}' not found`);
+        if (!existingField.source || existingField.source === 'config')
+            return forbidden();
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        const parsed = addFieldSchema.partial().safeParse(body);
+        if (!parsed.success) {
+            return jsonError('VALIDATION_ERROR', 'Validation failed', 400, parsed.error.flatten());
+        }
+        await saveAdminField(db, {
+            contentTypeName: params.type,
+            name: params.field,
+            type: parsed.data.type ?? existingField.type,
+            label: parsed.data.label ?? existingField.label,
+            options: parsed.data.options ?? existingField.options,
+            required: parsed.data.required ?? existingField.required,
+            sortOrder: parsed.data.sortOrder,
+        });
+        await ctx.reloadMaps();
+        return jsonOk({ saved: true });
+    });
+    // DELETE /schema/types/:type/fields/:field — delete an admin field
+    router.delete('/schema/types/:type/fields/:field', async (req, params) => {
+        const user = await requireSiteAdmin(req, authSecret, db);
+        if (!user)
+            return unauthorized();
+        const ct = ctx.getContentTypeMap().get(params.type);
+        if (!ct)
+            return notFound(`Content type '${params.type}' not found`);
+        const field = ct.fields.find(f => f.name === params.field);
+        if (!field)
+            return notFound(`Field '${params.field}' not found`);
+        if (!field.source || field.source === 'config')
+            return forbidden();
+        await deleteAdminField(db, params.type, params.field);
+        await ctx.reloadMaps();
+        return jsonOk({ deleted: true });
+    });
+    // POST /schema/apply — diff + ALTER TABLE for all types with pending changes
+    router.post('/schema/apply', async (req) => {
+        const user = await requireSiteAdmin(req, authSecret, db);
+        if (!user)
+            return unauthorized();
+        const results = {};
+        for (const [typeName, ct] of ctx.getContentTypeMap()) {
+            if (BUILT_IN_TYPES.has(typeName))
+                continue;
+            if (ct.fields.length === 0)
+                continue;
+            try {
+                const { added, diff } = await applySchemaForType(db, typeName, ct.fields);
+                results[typeName] = { added, unknown: diff.unknown };
+            }
+            catch (err) {
+                results[typeName] = { added: [], unknown: [], error: err.message };
+            }
+        }
+        await ctx.reloadMaps();
+        return jsonOk({ applied: true, results });
+    });
+    // POST /schema/reload — rebuild in-memory Maps from DB without ALTER TABLE
+    router.post('/schema/reload', async (req) => {
+        const user = await requireSiteAdmin(req, authSecret, db);
+        if (!user)
+            return unauthorized();
+        await ctx.reloadMaps();
+        return jsonOk({ reloaded: true });
+    });
+}
+//# sourceMappingURL=schema-routes.js.map

package/dist/api/schema-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-routes.js","sourceRoot":"","sources":["../../src/api/schema-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAmB,cAAc,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AACjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAW1D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAA;AAE1D,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa;IACvD,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ;IAC5D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;CACxB,CAAA;AAEV,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,EAAE,mEAAmE,CAAC;IAC5H,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAA;AAEF,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAE,UAAkB,EAAE,EAAU;IAC1E,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IAChF,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IACzD,OAAO,IAAI,CAAC,IAAI,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,GAAuB;IAC1E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAE9B,6EAA6E;IAC7E,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,CAAC;aACvD,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;aAC1C,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACV,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;SACrE,CAAC,CAAC,CAAA;QAEL,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,uDAAuD;IACvD,MAAM,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC,CAAA;QACpD,IAAI,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,iBAAiB,MAAM,CAAC,IAAI,aAAa,CAAC,CAAA;QAEnE,OAAO,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,uDAAuD;IACvD,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC,CAAA;QACpD,IAAI,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,iBAAiB,MAAM,CAAC,IAAI,aAAa,CAAC,CAAA;QAEnE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAEnG,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACxF,CAAC;QAED,yCAAyC;QACzC,MAAM,mBAAmB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CACzE,CAAA;QACD,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC,UAAU,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,oEAAoE,EAAE,GAAG,CAAC,CAAA;QACnI,CAAC;QAED,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,IAAK,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3E,MAAM,GAAG,CAAC,UAAU,EAAE,CAAA;QAEtB,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,gEAAgE;IAChE,MAAM,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACpE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC,CAAA;QACpD,IAAI,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,iBAAiB,MAAM,CAAC,IAAI,aAAa,CAAC,CAAA;QAEnE,MAAM,aAAa,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;QAClE,IAAI,CAAC,aAAa;YAAE,OAAO,QAAQ,CAAC,UAAU,MAAM,CAAC,KAAK,aAAa,CAAC,CAAA;QACxE,IAAI,CAAC,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,EAAE,CAAA;QAElF,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAEnG,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QACxF,CAAC;QAED,MAAM,cAAc,CAAC,EAAE,EAAE;YACvB,eAAe,EAAE,MAAM,CAAC,IAAK;YAC7B,IAAI,EAAE,MAAM,CAAC,KAAM;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC,IAAI;YAC5C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,KAAK;YAC/C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,OAAO;YACrD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ;YACxD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;SACjC,CAAC,CAAA;QACF,MAAM,GAAG,CAAC,UAAU,EAAE,CAAA;QAEtB,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,mEAAmE;IACnE,MAAM,CAAC,MAAM,CAAC,mCAAmC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,EAAE,GAAG,GAAG,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAK,CAAC,CAAA;QACpD,IAAI,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,iBAAiB,MAAM,CAAC,IAAI,aAAa,CAAC,CAAA;QAEnE,MAAM,KAAK,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC,UAAU,MAAM,CAAC,KAAK,aAAa,CAAC,CAAA;QAChE,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,IAAK,EAAE,MAAM,CAAC,KAAM,CAAC,CAAA;QACvD,MAAM,GAAG,CAAC,UAAU,EAAE,CAAA;QAEtB,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,OAAO,GAA2E,EAAE,CAAA;QAE1F,KAAK,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC;YACrD,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAQ;YAC1C,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YAEpC,IAAI,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;gBACzE,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;YACtD,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;YACpE,CAAC;QACH,CAAC;QAED,MAAM,GAAG,CAAC,UAAU,EAAE,CAAA;QACtB,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAEhC,MAAM,GAAG,CAAC,UAAU,EAAE,CAAA;QACtB,OAAO,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/search-routes.d.ts

@@ -0,0 +1,10 @@
+import type { Router } from './router.js';
+import type { KywiDb } from '../db/client.js';
+import type { KywiConfig } from '../config/types.js';
+export interface SearchRouteContext {
+    config: KywiConfig;
+    db: KywiDb;
+    authSecret: string;
+}
+export declare function registerSearchRoutes(router: Router, ctx: SearchRouteContext): void;
+//# sourceMappingURL=search-routes.d.ts.map

package/dist/api/search-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-routes.d.ts","sourceRoot":"","sources":["../../src/api/search-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAMpD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAgDlF"}

package/dist/api/search-routes.js

@@ -0,0 +1,49 @@
+import { resolveAuth } from './auth.js';
+import { toSiteUuid } from './site-context.js';
+import { paginatedOk, jsonError, unauthorized } from './response.js';
+import { searchContent } from '../db/search-queries.js';
+export function registerSearchRoutes(router, ctx) {
+    const { db, authSecret } = ctx;
+    // GET /search?q=term&siteId=...&contentType=...&status=...&locale=...&limit=20&offset=0
+    router.get('/search', async (req) => {
+        const url = new URL(req.url);
+        const q = url.searchParams.get('q');
+        if (!q) {
+            return jsonError('BAD_REQUEST', 'Query parameter "q" is required', 400);
+        }
+        const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), ctx.config);
+        if (!siteId) {
+            return jsonError('BAD_REQUEST', 'Query parameter "siteId" is required', 400);
+        }
+        const status = url.searchParams.get('status') ?? undefined;
+        const contentType = url.searchParams.get('contentType') ?? undefined;
+        const locale = url.searchParams.get('locale') ?? undefined;
+        const limit = url.searchParams.has('limit') ? parseInt(url.searchParams.get('limit'), 10) : 20;
+        const offset = url.searchParams.has('offset') ? parseInt(url.searchParams.get('offset'), 10) : 0;
+        // Public access for status=published; auth required for other statuses
+        if (status !== 'published' && status !== undefined) {
+            const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+            if (!auth.user)
+                return unauthorized();
+        }
+        else if (status === undefined) {
+            // No status filter — require auth since could expose draft content
+            const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+            if (!auth.user)
+                return unauthorized();
+        }
+        const effectiveLimit = isNaN(limit) ? 20 : limit;
+        const effectiveOffset = isNaN(offset) ? 0 : offset;
+        const page = effectiveLimit > 0 ? Math.floor(effectiveOffset / effectiveLimit) + 1 : 1;
+        const { results, total } = await searchContent(db, q, {
+            siteId,
+            contentType,
+            status,
+            locale,
+            limit: effectiveLimit,
+            offset: effectiveOffset,
+        });
+        return paginatedOk(results, { total, page, pageSize: effectiveLimit });
+    });
+}
+//# sourceMappingURL=search-routes.js.map

package/dist/api/search-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-routes.js","sourceRoot":"","sources":["../../src/api/search-routes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAQvD,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,GAAuB;IAC1E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAE9B,wFAAwF;IACxF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEnC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,iCAAiC,EAAE,GAAG,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC,aAAa,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;QAC9E,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAA;QAC1D,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAA;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAA;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/F,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEjG,uEAAuE;QACvE,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,EAAE,CAAA;QACvC,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,mEAAmE;YACnE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;YAChF,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,EAAE,CAAA;QACvC,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;QAChD,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAClD,MAAM,IAAI,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEtF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE;YACpD,MAAM;YACN,WAAW;YACX,MAAM;YACN,MAAM;YACN,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,eAAe;SACxB,CAAC,CAAA;QAEF,OAAO,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/section-template-routes.d.ts

@@ -0,0 +1,11 @@
+import type { Router } from './router.js';
+import type { KywiDb } from '../db/client.js';
+import type { KywiConfig } from '../config/types.js';
+interface SectionTemplateRouteContext {
+    config: KywiConfig;
+    db: KywiDb;
+    authSecret: string;
+}
+export declare function registerSectionTemplateRoutes(router: Router, ctx: SectionTemplateRouteContext): void;
+export {};
+//# sourceMappingURL=section-template-routes.d.ts.map

package/dist/api/section-template-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"section-template-routes.d.ts","sourceRoot":"","sources":["../../src/api/section-template-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAgBpD,UAAU,2BAA2B;IACnC,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAyBD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,2BAA2B,GAAG,IAAI,CAgJpG"}