@kywi-software/core 0.1.0

package/dist/api/section-template-routes.js

@@ -0,0 +1,165 @@
+import { z } from 'zod';
+import { resolveAuth } from './auth.js';
+import { toSiteUuid } from './site-context.js';
+import { canAccessContent, hasMinRole } from '../auth/roles.js';
+import { jsonOk, jsonError, unauthorized, forbidden, notFound, validationError } from './response.js';
+import { validateLayoutDocument } from '../layout/types.js';
+import { newlyIntroducedAdminOnlyTypes } from '../layout/module-permissions.js';
+import { createSectionTemplate, updateSectionTemplate, deleteSectionTemplate, getSectionTemplateById, listSectionTemplates, } from '../db/component-queries.js';
+/**
+ * Standalone saved layouts ("section templates").
+ *
+ * The `kywi_section_templates.definition` column is untyped jsonb. This surface
+ * stores a full {@link LayoutDocument} there (regions → sections → columns →
+ * modules) so the shipped LayoutEditor round-trips a whole reusable page layout
+ * with no lossy transform. Validation reuses `validateLayoutDocument`, exactly
+ * like the per-content `/content/:type/:id/layout` routes.
+ */
+const createSchema = z.object({
+    name: z.string().min(1),
+    category: z.string().optional(),
+    definition: z.record(z.unknown()),
+    siteId: z.string().uuid().optional(),
+});
+const updateSchema = z.object({
+    name: z.string().min(1).optional(),
+    category: z.string().optional(),
+    definition: z.record(z.unknown()).optional(),
+});
+export function registerSectionTemplateRoutes(router, ctx) {
+    const { db, authSecret, config } = ctx;
+    async function authenticate(req) {
+        return resolveAuth(req.headers.get('authorization'), authSecret, db);
+    }
+    // GET /section-templates — list saved layouts for a site
+    router.get('/section-templates', async (req) => {
+        const auth = await authenticate(req);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        const url = new URL(req.url);
+        const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
+        const category = url.searchParams.get('category') ?? undefined;
+        const templates = await listSectionTemplates(db, siteId, category);
+        return jsonOk(templates);
+    });
+    // GET /section-templates/:id — get a single saved layout
+    router.get('/section-templates/:id', async (req, params) => {
+        const auth = await authenticate(req);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        const url = new URL(req.url);
+        const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
+        const template = await getSectionTemplateById(db, params.id, siteId);
+        if (!template)
+            return notFound('Section template not found');
+        return jsonOk(template);
+    });
+    // POST /section-templates — create a saved layout
+    router.post('/section-templates', async (req) => {
+        const auth = await authenticate(req);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        const parsed = createSchema.safeParse(body);
+        if (!parsed.success) {
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        }
+        const validation = validateLayoutDocument(parsed.data.definition);
+        if (!validation.success) {
+            return jsonError('VALIDATION_ERROR', validation.error, 400);
+        }
+        // Admin-only module gate (defense in depth): a new section template has no
+        // prior document, so a below-siteAdmin caller may not include an admin-only
+        // module (e.g. an `html` block) at all — same source of truth as the palette.
+        if (!hasMinRole(auth.user.role, 'siteAdmin')) {
+            const offending = newlyIntroducedAdminOnlyTypes(validation.data, null);
+            if (offending.length) {
+                return jsonError('FORBIDDEN_MODULE', `Your role may not add these module types: ${offending.join(', ')}`, 403);
+            }
+        }
+        const siteId = await toSiteUuid(db, parsed.data.siteId, config);
+        const template = await createSectionTemplate(db, {
+            siteId,
+            name: parsed.data.name,
+            ...(parsed.data.category !== undefined ? { category: parsed.data.category } : {}),
+            definition: validation.data,
+            createdBy: auth.user.id,
+        });
+        return jsonOk(template, 201);
+    });
+    // PUT /section-templates/:id — update a saved layout
+    router.put('/section-templates/:id', async (req, params) => {
+        const auth = await authenticate(req);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        const parsed = updateSchema.safeParse(body);
+        if (!parsed.success) {
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        }
+        const url = new URL(req.url);
+        const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
+        const patch = {};
+        if (parsed.data.name !== undefined)
+            patch.name = parsed.data.name;
+        if (parsed.data.category !== undefined)
+            patch.category = parsed.data.category;
+        if (parsed.data.definition !== undefined) {
+            const validation = validateLayoutDocument(parsed.data.definition);
+            if (!validation.success) {
+                return jsonError('VALIDATION_ERROR', validation.error, 400);
+            }
+            // Admin-only module gate: diff the incoming definition against the stored
+            // one by module id, so a below-siteAdmin caller may re-save a template that
+            // already contains an admin-placed module but may not introduce a new one.
+            if (!hasMinRole(auth.user.role, 'siteAdmin')) {
+                const stored = await getSectionTemplateById(db, params.id, siteId);
+                const storedDef = (stored?.definition ?? null);
+                const offending = newlyIntroducedAdminOnlyTypes(validation.data, storedDef);
+                if (offending.length) {
+                    return jsonError('FORBIDDEN_MODULE', `Your role may not add these module types: ${offending.join(', ')}`, 403);
+                }
+            }
+            patch.definition = validation.data;
+        }
+        const updated = await updateSectionTemplate(db, params.id, patch, siteId);
+        if (!updated)
+            return notFound('Section template not found');
+        return jsonOk(updated);
+    });
+    // DELETE /section-templates/:id — delete a saved layout
+    router.delete('/section-templates/:id', async (req, params) => {
+        const auth = await authenticate(req);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        const url = new URL(req.url);
+        const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
+        const deleted = await deleteSectionTemplate(db, params.id, siteId);
+        if (!deleted)
+            return notFound('Section template not found');
+        return jsonOk({ deleted: true });
+    });
+}
+//# sourceMappingURL=section-template-routes.js.map

package/dist/api/section-template-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"section-template-routes.js","sourceRoot":"","sources":["../../src/api/section-template-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAE3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAA;AAQnC;;;;;;;;GAQG;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAA;AAEF,MAAM,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAgC;IAC5F,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAA;QAE9D,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,yDAAyD;IACzD,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACrE,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,kDAAkD;IAClD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QAC7D,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,6BAA6B,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACtE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,OAAO,SAAS,CAAC,kBAAkB,EAAE,6CAA6C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;YAChH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE;YAC/C,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,UAAU,EAAE,UAAU,CAAC,IAA0C;YACjE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;SACxB,CAAC,CAAA;QAEF,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,qDAAqD;IACrD,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAE3E,MAAM,KAAK,GAAgD,EAAE,CAAA;QAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACjE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAA;QAC7E,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACjE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7D,CAAC;YACD,0EAA0E;YAC1E,4EAA4E;YAC5E,2EAA2E;YAC3E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;gBACnE,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,UAAU,IAAI,IAAI,CAA0B,CAAA;gBACvE,MAAM,SAAS,GAAG,6BAA6B,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC3E,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;oBACrB,OAAO,SAAS,CAAC,kBAAkB,EAAE,6CAA6C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBAChH,CAAC;YACH,CAAC;YACD,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC,IAA0C,CAAA;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,wDAAwD;IACxD,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAE3E,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAA;QAC3D,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/site-admin-routes.d.ts

@@ -0,0 +1,5 @@
+import type { Router } from './router.js';
+import type { KywiDb } from '../db/client.js';
+import type { HookRegistry } from '../hooks/registry.js';
+export declare function registerSiteAdminRoutes(router: Router, db: KywiDb, authSecret: string, hookRegistry?: HookRegistry): void;
+//# sourceMappingURL=site-admin-routes.d.ts.map

package/dist/api/site-admin-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-admin-routes.d.ts","sourceRoot":"","sources":["../../src/api/site-admin-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAsBxD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI,CAyFzH"}

package/dist/api/site-admin-routes.js

@@ -0,0 +1,129 @@
+import { z } from 'zod';
+import { createSiteHookDispatcher } from '../hooks/dispatch.js';
+import { jsonOk, jsonError, notFound, unauthorized, forbidden, validationError } from './response.js';
+import { resolveAuth } from './auth.js';
+import { hasMinRole } from '../auth/roles.js';
+import { createSite, updateSite, deleteSite } from '../db/site-admin-queries.js';
+import { getAllSiteSettings, bulkSetSiteSettings } from '../db/site-settings-queries.js';
+const createSiteSchema = z.object({
+    name: z.string().min(1),
+    domain: z.string().min(1),
+    defaultLocale: z.string().optional(),
+    theme: z.string().optional(),
+}).strict();
+const updateSiteSchema = z.object({
+    name: z.string().min(1).optional(),
+    domain: z.string().min(1).optional(),
+    defaultLocale: z.string().optional(),
+    theme: z.string().optional(),
+}).strict();
+export function registerSiteAdminRoutes(router, db, authSecret, hookRegistry) {
+    const siteHooks = hookRegistry ? createSiteHookDispatcher(hookRegistry) : null;
+    // POST /sites — Create site (superAdmin only)
+    router.post('/sites', async (req) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'superAdmin'))
+            return forbidden();
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON', 400);
+        }
+        const parsed = createSiteSchema.safeParse(body);
+        if (!parsed.success)
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        const { name, domain, defaultLocale, theme } = parsed.data;
+        const site = await createSite(db, {
+            name,
+            domain,
+            ...(defaultLocale !== undefined ? { defaultLocale } : {}),
+            ...(theme !== undefined ? { theme } : {}),
+        });
+        if (siteHooks)
+            await siteHooks.afterCreate(site);
+        return jsonOk(site, 201);
+    });
+    // PUT /sites/:siteId — Update site (superAdmin only)
+    router.put('/sites/:siteId', async (req, params) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'superAdmin'))
+            return forbidden();
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON', 400);
+        }
+        const parsed = updateSiteSchema.safeParse(body);
+        if (!parsed.success)
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        const updateData = {};
+        if (parsed.data.name !== undefined)
+            updateData.name = parsed.data.name;
+        if (parsed.data.domain !== undefined)
+            updateData.domain = parsed.data.domain;
+        if (parsed.data.defaultLocale !== undefined)
+            updateData.defaultLocale = parsed.data.defaultLocale;
+        if (parsed.data.theme !== undefined)
+            updateData.theme = parsed.data.theme;
+        const site = await updateSite(db, params.siteId, updateData);
+        if (!site)
+            return notFound('Site not found');
+        if (siteHooks)
+            await siteHooks.afterUpdate(site);
+        return jsonOk(site);
+    });
+    // DELETE /sites/:siteId — Delete site (superAdmin only)
+    router.delete('/sites/:siteId', async (req, params) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'superAdmin'))
+            return forbidden();
+        const deleted = await deleteSite(db, params.siteId);
+        if (!deleted)
+            return notFound('Site not found');
+        if (siteHooks)
+            await siteHooks.afterDelete({ id: params.siteId });
+        return jsonOk({ deleted: true });
+    });
+    // GET /sites/:siteId/settings — Retrieve all settings for a site (siteAdmin+)
+    router.get('/sites/:siteId/settings', async (req, params) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'siteAdmin'))
+            return forbidden();
+        const settings = await getAllSiteSettings(db, params.siteId);
+        return jsonOk(settings);
+    });
+    // PUT /sites/:siteId/settings — Bulk upsert settings for a site (siteAdmin+)
+    router.put('/sites/:siteId/settings', async (req, params) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'siteAdmin'))
+            return forbidden();
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON', 400);
+        }
+        if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+            return jsonError('BAD_REQUEST', 'Body must be a JSON object', 400);
+        }
+        await bulkSetSiteSettings(db, params.siteId, body);
+        const updated = await getAllSiteSettings(db, params.siteId);
+        return jsonOk(updated);
+    });
+}
+//# sourceMappingURL=site-admin-routes.js.map

package/dist/api/site-admin-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-admin-routes.js","sourceRoot":"","sources":["../../src/api/site-admin-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAA;AAExF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAA;AAEX,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC,MAAM,EAAE,CAAA;AAEX,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,EAAU,EAAE,UAAkB,EAAE,YAA2B;IACjH,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAE9E,8CAA8C;IAC9C,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QAE3H,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAC1D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE;YAChC,IAAI;YACJ,MAAM;YACN,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAA;QACF,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,qDAAqD;IACrD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QAE3H,MAAM,UAAU,GAAoF,EAAE,CAAA;QACtG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAA;QAC5E,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;YAAE,UAAU,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAA;QACjG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA;QAEzE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,EAAE,UAAU,CAAC,CAAA;QAC7D,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,wDAAwD;IACxD,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAC/C,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAO,EAAE,CAAC,CAAA;QAClE,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,8EAA8E;IAC9E,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QAC7D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,MAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,SAAS,CAAC,aAAa,EAAE,4BAA4B,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;QAED,MAAM,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,EAAE,IAA+B,CAAC,CAAA;QAC9E,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QAC5D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/site-context.d.ts

@@ -0,0 +1,28 @@
+import type { KywiConfig } from '../config/types.js';
+import type { KywiDb } from '../db/client.js';
+/**
+ * Resolve the active siteId from a request.
+ * Priority: explicit ?siteId param (if valid) > domain match > first configured site.
+ *
+ * siteIdMap: optional pre-resolved mapping of config site IDs (slugs) to DB UUIDs.
+ * When provided, the returned value will be the DB UUID rather than the config ID.
+ */
+export declare function resolveSiteId(req: Request, config: KywiConfig, siteIdMap?: Record<string, string>): string;
+/**
+ * Resolve a site identifier (config slug OR DB UUID) to a DB UUID, awaiting a
+ * DB lookup for slugs. Falls back to the site-scoped default when the supplied
+ * value is null/undefined, and to the raw value when the DB has no matching
+ * site (mirrors the user/group/media house style).
+ *
+ * The third argument is the default site: pass the `KywiConfig` (its first
+ * site's id is used) or a pre-computed default slug/uuid string.
+ *
+ * This is the durable guard for the "config slug leaked into a UUID column"
+ * bug class: every route that scopes a query by site should derive its siteId
+ * through this helper (or the request-based `resolveSiteId` above) so a
+ * human-readable slug like "default" can never reach a `uuid` column.
+ *
+ * A UUID is returned untouched (no DB round-trip); only slugs are looked up.
+ */
+export declare function toSiteUuid(db: KywiDb, idOrSlug: string | null | undefined, fallbackOrConfig: string | KywiConfig): Promise<string>;
+//# sourceMappingURL=site-context.d.ts.map

package/dist/api/site-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-context.d.ts","sourceRoot":"","sources":["../../src/api/site-context.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CA0B1G;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACnC,gBAAgB,EAAE,MAAM,GAAG,UAAU,GACpC,OAAO,CAAC,MAAM,CAAC,CAQjB"}

package/dist/api/site-context.js

@@ -0,0 +1,60 @@
+import { resolveSiteFromRequest } from '../multisite/resolve.js';
+import { resolveSiteId as resolveSiteIdFromDb } from '../db/site-queries.js';
+/**
+ * Resolve the active siteId from a request.
+ * Priority: explicit ?siteId param (if valid) > domain match > first configured site.
+ *
+ * siteIdMap: optional pre-resolved mapping of config site IDs (slugs) to DB UUIDs.
+ * When provided, the returned value will be the DB UUID rather than the config ID.
+ */
+export function resolveSiteId(req, config, siteIdMap) {
+    const url = new URL(req.url);
+    const toUuid = (configId) => siteIdMap?.[configId] ?? configId;
+    // Allow explicit override via query param. Accept either a config site id
+    // (slug, e.g. "default") OR an already-resolved DB site UUID that belongs to a
+    // configured site (a value in siteIdMap). The admin site switcher sends the DB
+    // UUID it got from GET /sites, so honouring known UUIDs is what lets the
+    // dashboard/content routes repaint for the switched-to site rather than
+    // silently falling back to sites[0].
+    const explicitSiteId = url.searchParams.get('siteId');
+    if (explicitSiteId) {
+        if (config.sites.some(s => s.id === explicitSiteId)) {
+            return toUuid(explicitSiteId);
+        }
+        if (siteIdMap && Object.values(siteIdMap).includes(explicitSiteId)) {
+            return explicitSiteId;
+        }
+    }
+    // Resolve from request domain
+    const resolved = resolveSiteFromRequest(config.sites, url);
+    if (resolved)
+        return toUuid(resolved.id);
+    // Fallback to first configured site
+    return toUuid(config.sites[0].id);
+}
+/**
+ * Resolve a site identifier (config slug OR DB UUID) to a DB UUID, awaiting a
+ * DB lookup for slugs. Falls back to the site-scoped default when the supplied
+ * value is null/undefined, and to the raw value when the DB has no matching
+ * site (mirrors the user/group/media house style).
+ *
+ * The third argument is the default site: pass the `KywiConfig` (its first
+ * site's id is used) or a pre-computed default slug/uuid string.
+ *
+ * This is the durable guard for the "config slug leaked into a UUID column"
+ * bug class: every route that scopes a query by site should derive its siteId
+ * through this helper (or the request-based `resolveSiteId` above) so a
+ * human-readable slug like "default" can never reach a `uuid` column.
+ *
+ * A UUID is returned untouched (no DB round-trip); only slugs are looked up.
+ */
+export async function toSiteUuid(db, idOrSlug, fallbackOrConfig) {
+    const fallback = typeof fallbackOrConfig === 'string'
+        ? fallbackOrConfig
+        : fallbackOrConfig.sites[0]?.id ?? '';
+    const raw = idOrSlug ?? fallback;
+    if (!raw)
+        return raw;
+    return (await resolveSiteIdFromDb(db, raw)) ?? raw;
+}
+//# sourceMappingURL=site-context.js.map

package/dist/api/site-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-context.js","sourceRoot":"","sources":["../../src/api/site-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAI5E;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY,EAAE,MAAkB,EAAE,SAAkC;IAChG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAA;IAEtE,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,qCAAqC;IACrC,MAAM,cAAc,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IACrD,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC;YACpD,OAAO,MAAM,CAAC,cAAc,CAAC,CAAA;QAC/B,CAAC;QACD,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnE,OAAO,cAAc,CAAA;QACvB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC1D,IAAI,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAExC,oCAAoC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,QAAmC,EACnC,gBAAqC;IAErC,MAAM,QAAQ,GACZ,OAAO,gBAAgB,KAAK,QAAQ;QAClC,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;IACzC,MAAM,GAAG,GAAG,QAAQ,IAAI,QAAQ,CAAA;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAA;IACpB,OAAO,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAA;AACpD,CAAC"}

package/dist/api/site-routes.d.ts

@@ -0,0 +1,4 @@
+import type { Router } from './router.js';
+import type { KywiDb } from '../db/client.js';
+export declare function registerSiteRoutes(router: Router, db: KywiDb): void;
+//# sourceMappingURL=site-routes.d.ts.map

package/dist/api/site-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-routes.d.ts","sourceRoot":"","sources":["../../src/api/site-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAWnE"}

package/dist/api/site-routes.js

@@ -0,0 +1,15 @@
+import { jsonOk, notFound } from './response.js';
+import { listSites, getSiteById } from '../db/site-queries.js';
+export function registerSiteRoutes(router, db) {
+    router.get('/sites', async () => {
+        const sites = await listSites(db);
+        return jsonOk(sites);
+    });
+    router.get('/sites/:siteId', async (_req, params) => {
+        const site = await getSiteById(db, params.siteId);
+        if (!site)
+            return notFound('Site not found');
+        return jsonOk(site);
+    });
+}
+//# sourceMappingURL=site-routes.js.map

package/dist/api/site-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-routes.js","sourceRoot":"","sources":["../../src/api/site-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAE9D,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,EAAU;IAC3D,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,CAAA;QACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAO,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/tag-routes.d.ts

@@ -0,0 +1,10 @@
+import type { Router } from './router.js';
+import type { KywiDb } from '../db/client.js';
+import type { KywiConfig } from '../config/types.js';
+export interface TagRouteContext {
+    config: KywiConfig;
+    db: KywiDb;
+    authSecret: string;
+}
+export declare function registerTagRoutes(router: Router, ctx: TagRouteContext): void;
+//# sourceMappingURL=tag-routes.d.ts.map

package/dist/api/tag-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag-routes.d.ts","sourceRoot":"","sources":["../../src/api/tag-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAoBpD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAeD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,eAAe,GAAG,IAAI,CA0H5E"}

package/dist/api/tag-routes.js

@@ -0,0 +1,125 @@
+import { z } from 'zod';
+import { resolveAuth } from './auth.js';
+import { toSiteUuid } from './site-context.js';
+import { hasMinRole, canAccessContent } from '../auth/roles.js';
+import { listTags, getTagById, createTag, updateTag, deleteTag, } from '../db/tag-queries.js';
+import { jsonOk, jsonError, notFound, unauthorized, forbidden, validationError, } from './response.js';
+const createTagSchema = z.object({
+    label: z.string(),
+    slug: z.string(),
+    siteId: z.string().optional(),
+    groupName: z.string().optional(),
+});
+const updateTagSchema = z.object({
+    label: z.string().optional(),
+    slug: z.string().optional(),
+    groupName: z.string().optional(),
+});
+export function registerTagRoutes(router, ctx) {
+    const { db, authSecret, config } = ctx;
+    // GET /tags — list tags (public)
+    router.get('/tags', async (req) => {
+        const url = new URL(req.url);
+        const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
+        if (!siteId)
+            return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const groupName = url.searchParams.get('groupName') ?? undefined;
+        const limitParam = url.searchParams.get('limit');
+        const limit = limitParam !== null ? parseInt(limitParam, 10) : undefined;
+        const tags = await listTags(db, siteId, groupName, limit !== undefined && !isNaN(limit) ? limit : undefined);
+        return jsonOk(tags);
+    });
+    // GET /tags/:id — get tag by ID (public, site-scoped)
+    router.get('/tags/:id', async (req, params) => {
+        const url = new URL(req.url);
+        const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
+        if (!siteId)
+            return notFound('Tag not found');
+        const tag = await getTagById(db, params.id, siteId);
+        if (!tag)
+            return notFound('Tag not found');
+        return jsonOk(tag);
+    });
+    // POST /tags — create tag (auth + write)
+    router.post('/tags', async (req) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        const parsed = createTagSchema.safeParse(body);
+        if (!parsed.success) {
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        }
+        const siteId = await toSiteUuid(db, parsed.data.siteId, config);
+        if (!siteId)
+            return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const createData = {
+            siteId,
+            slug: parsed.data.slug,
+            label: parsed.data.label,
+        };
+        if (parsed.data.groupName !== undefined)
+            createData.groupName = parsed.data.groupName;
+        const tag = await createTag(db, createData);
+        return jsonOk(tag, 201);
+    });
+    // PUT /tags/:id — update tag (auth + write)
+    router.put('/tags/:id', async (req, params) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!canAccessContent(auth.user.role, 'write'))
+            return forbidden();
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        const parsed = updateTagSchema.safeParse(body);
+        if (!parsed.success) {
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        }
+        const url = new URL(req.url);
+        const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
+        if (!siteId)
+            return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const updateData = {};
+        if (parsed.data.slug !== undefined)
+            updateData.slug = parsed.data.slug;
+        if (parsed.data.label !== undefined)
+            updateData.label = parsed.data.label;
+        if (parsed.data.groupName !== undefined)
+            updateData.groupName = parsed.data.groupName;
+        const updated = await updateTag(db, params.id, updateData, siteId);
+        if (!updated)
+            return notFound('Tag not found');
+        return jsonOk(updated);
+    });
+    // DELETE /tags/:id — delete tag (auth + siteAdmin)
+    router.delete('/tags/:id', async (req, params) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        if (!auth.user)
+            return unauthorized();
+        if (!hasMinRole(auth.user.role, 'siteAdmin'))
+            return forbidden();
+        const url = new URL(req.url);
+        const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
+        if (!siteId)
+            return jsonError('BAD_REQUEST', 'No site ID available', 400);
+        const deleted = await deleteTag(db, params.id, siteId);
+        if (!deleted)
+            return notFound('Tag not found');
+        return jsonOk({ deleted: true });
+    });
+}
+//# sourceMappingURL=tag-routes.js.map

package/dist/api/tag-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag-routes.js","sourceRoot":"","sources":["../../src/api/tag-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,QAAQ,EACR,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,GACV,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,MAAM,EACN,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,SAAS,EACT,eAAe,GAChB,MAAM,eAAe,CAAA;AAQtB,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,GAAoB;IACpE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAA;IAEtC,iCAAiC;IACjC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;QAChE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,KAAK,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAExE,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,EAAE,EACF,MAAM,EACN,SAAS,EACT,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACzD,CAAA;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,sDAAsD;IACtD,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,yCAAyC;IACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,UAAU,GAKZ;YACF,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;SACzB,CAAA;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QAC3C,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,4CAA4C;IAC5C,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAElE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,UAAU,GAAuE,EAAE,CAAA;QACzF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,UAAU,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA;QACzE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAA;QAErF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAEzE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAA;QAE9C,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/tag-usage-wiring.d.ts

@@ -0,0 +1,12 @@
+import type { KywiDb } from '../db/client.js';
+/**
+ * Sync the content_tags join table with the requested tagIds.
+ * Computes the diff between current tags and new tags, then
+ * assigns new ones (incrementing usageCount) and removes old
+ * ones (decrementing usageCount).
+ *
+ * If tagIds is undefined, no sync is performed (the caller
+ * did not include tagIds in the request body).
+ */
+export declare function syncContentTags(db: KywiDb, contentId: string, tagIds: string[] | undefined): Promise<void>;
+//# sourceMappingURL=tag-usage-wiring.d.ts.map

package/dist/api/tag-usage-wiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tag-usage-wiring.d.ts","sourceRoot":"","sources":["../../src/api/tag-usage-wiring.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAG7C;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CAoBf"}