@kywi-software/core 0.2.1 → 0.3.0

package/dist/admin/surfaces/webServices/webhooks.js

@@ -0,0 +1,69 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * `webServices.webhooks` surface — outgoing webhook endpoint management, the
+ * third Web Services surface alongside OAuth Clients + API Keys (#57). Follows
+ * the API Keys / OAuth surface pattern exactly: `useAdminContext().fetch` for
+ * all requests, core's `WebhookManager` component, and the shared
+ * `SecretRevealModal` for the one-time signing-secret reveal on create.
+ *
+ * Signing secrets are shown once at creation and redacted from every list/read
+ * afterwards (the server retains them to sign HMAC payloads — they are NOT
+ * hashed, unlike verify-only OAuth client secrets).
+ */
+import { useCallback, useEffect, useState } from 'react';
+import { useAdminContext } from '../../context.js';
+import { LoadingState, ErrorState } from '../../primitives.js';
+import { SecretRevealModal } from './secret-reveal-modal.js';
+import { WebhookManager } from '../../webhook-manager.js';
+import { loadWebhooks, createWebhook, deleteWebhook, loadWebhookDeliveries, } from './web-services-data.js';
+export default function WebServicesWebhooksSurface(_props) {
+    const { fetch: adminFetch } = useAdminContext();
+    const [webhooks, setWebhooks] = useState([]);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState(null);
+    const [revealed, setRevealed] = useState(null);
+    const load = useCallback(async () => {
+        setLoading(true);
+        setError(null);
+        try {
+            const list = await loadWebhooks(adminFetch);
+            list.sort((a, b) => (b.createdAt ?? '').localeCompare(a.createdAt ?? ''));
+            setWebhooks(list);
+        }
+        catch (e) {
+            setError(e instanceof Error ? e.message : 'Failed to load webhooks');
+        }
+        finally {
+            setLoading(false);
+        }
+    }, [adminFetch]);
+    useEffect(() => {
+        load();
+    }, [load]);
+    const handleCreate = useCallback(async (data) => {
+        setError(null);
+        try {
+            const created = await createWebhook(adminFetch, data);
+            // Reveal the signing secret exactly once — it is redacted on every read.
+            setRevealed({ url: created.url, secret: created.secret });
+            await load();
+        }
+        catch (e) {
+            setError(e instanceof Error ? e.message : 'Failed to create webhook');
+        }
+    }, [load, adminFetch]);
+    const handleDelete = useCallback(async (id) => {
+        setError(null);
+        try {
+            await deleteWebhook(adminFetch, id);
+            await load();
+        }
+        catch (e) {
+            setError(e instanceof Error ? e.message : 'Failed to delete webhook');
+        }
+    }, [load, adminFetch]);
+    const handleLoadDeliveries = useCallback((id) => loadWebhookDeliveries(adminFetch, id), [adminFetch]);
+    return (_jsxs(_Fragment, { children: [_jsx("div", { className: "kywi-admin-page-header", children: _jsxs("div", { children: [_jsx("h1", { children: "Webhooks" }), _jsxs("p", { className: "kywi-admin-section-hint", children: ["Register endpoints that Kywi calls when content, comments, or categories change. Each delivery is signed (HMAC-SHA256) with the endpoint\u2019s secret, sent as", ' ', _jsx("code", { children: "X-Kywi-Signature" }), ". Failed deliveries are retried automatically with exponential backoff. The signing secret is shown once at creation and never again."] })] }) }), error && _jsx(ErrorState, { message: error, onRetry: load }), loading ? (_jsx(LoadingState, { label: "Loading webhooks\u2026" })) : (_jsx(WebhookManager, { webhooks: webhooks, onCreateWebhook: data => void handleCreate(data), onDeleteWebhook: id => void handleDelete(id), onLoadDeliveries: handleLoadDeliveries })), revealed && (_jsx(SecretRevealModal, { title: "Webhook signing secret", intro: `Copy the signing secret for “${revealed.url}” now. It is redacted from every later view and will not be shown again.`, label: "Signing secret", value: revealed.secret, onClose: () => setRevealed(null) }))] }));
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/admin/surfaces/webServices/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../../../src/admin/surfaces/webServices/webhooks.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;GAUG;AAEH,OAAc,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,aAAa,EACb,qBAAqB,GAGtB,MAAM,wBAAwB,CAAA;AAE/B,MAAM,CAAC,OAAO,UAAU,0BAA0B,CAAC,MAAoB;IACrE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAAA;IAC/C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAmB,EAAE,CAAC,CAAA;IAC9D,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACvD,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAyC,IAAI,CAAC,CAAA;IAEtF,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,CAAA;YAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAA;YACzE,WAAW,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAA;QACtE,CAAC;gBAAS,CAAC;YACT,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAA;IAEhB,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,EAAE,CAAA;IACR,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IAEV,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,IAAuB,EAAE,EAAE;QAChC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YACrD,yEAAyE;YACzE,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YACzD,MAAM,IAAI,EAAE,CAAA;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;QACvE,CAAC;IACH,CAAC,EACD,CAAC,IAAI,EAAE,UAAU,CAAC,CACnB,CAAA;IAED,MAAM,YAAY,GAAG,WAAW,CAC9B,KAAK,EAAE,EAAU,EAAE,EAAE;QACnB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;YACnC,MAAM,IAAI,EAAE,CAAA;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;QACvE,CAAC;IACH,CAAC,EACD,CAAC,IAAI,EAAE,UAAU,CAAC,CACnB,CAAA;IAED,MAAM,oBAAoB,GAAG,WAAW,CACtC,CAAC,EAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,UAAU,EAAE,EAAE,CAAC,EACrD,CAAC,UAAU,CAAC,CACb,CAAA;IAED,OAAO,CACL,8BACE,cAAK,SAAS,EAAC,wBAAwB,YACrC,0BACE,oCAAiB,EACjB,aAAG,SAAS,EAAC,yBAAyB,gLAEuC,GAAG,EAC9E,8CAA6B,6IAE3B,IACA,GACF,EAEL,KAAK,IAAI,KAAC,UAAU,IAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAI,EAEtD,OAAO,CAAC,CAAC,CAAC,CACT,KAAC,YAAY,IAAC,KAAK,EAAC,wBAAmB,GAAG,CAC3C,CAAC,CAAC,CAAC,CACF,KAAC,cAAc,IACb,QAAQ,EAAE,QAAQ,EAClB,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,YAAY,CAAC,IAAI,CAAC,EAChD,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,YAAY,CAAC,EAAE,CAAC,EAC5C,gBAAgB,EAAE,oBAAoB,GACtC,CACH,EAEA,QAAQ,IAAI,CACX,KAAC,iBAAiB,IAChB,KAAK,EAAC,wBAAwB,EAC9B,KAAK,EAAE,gCAAgC,QAAQ,CAAC,GAAG,0EAA0E,EAC7H,KAAK,EAAC,gBAAgB,EACtB,KAAK,EAAE,QAAQ,CAAC,MAAM,EACtB,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAChC,CACH,IACA,CACJ,CAAA;AACH,CAAC"}

package/dist/admin/webhook-manager.d.ts

@@ -0,0 +1,32 @@
+export interface WebhookSummary {
+    id: string;
+    url: string;
+    events: string[];
+    isActive: boolean;
+    /** True when a signing secret is configured (the secret itself is never listed). */
+    secretSet?: boolean;
+    createdAt: string;
+}
+export interface WebhookCreateData {
+    url: string;
+    secret: string;
+    events: string[];
+}
+export interface WebhookDeliverySummary {
+    id: string;
+    event: string;
+    status: string;
+    attempts: number;
+    httpStatus: number | null;
+    createdAt: string;
+    nextRetryAt: string | null;
+}
+export interface WebhookManagerProps {
+    webhooks: WebhookSummary[];
+    onCreateWebhook?: (data: WebhookCreateData) => void;
+    onDeleteWebhook?: (id: string) => void;
+    /** Load recent deliveries for an endpoint (status / attempts log). */
+    onLoadDeliveries?: (id: string) => Promise<WebhookDeliverySummary[]>;
+}
+export declare function WebhookManager({ webhooks, onCreateWebhook, onDeleteWebhook, onLoadDeliveries, }: WebhookManagerProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=webhook-manager.d.ts.map

package/dist/admin/webhook-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-manager.d.ts","sourceRoot":"","sources":["../../src/admin/webhook-manager.tsx"],"names":[],"mappings":"AAMA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,OAAO,CAAA;IACjB,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAID,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,EAAE,CAAA;IAC1B,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,CAAA;IACnD,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAA;IACtC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAA;CACrE;AAqBD,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,EAAE,mBAAmB,2CA4JrB"}

package/dist/admin/webhook-manager.js

@@ -0,0 +1,62 @@
+'use client';
+import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+import React, { useState } from 'react';
+// ── Available events ────────────────────────────────────────────────────────────
+// Mirrors WEBHOOK_EVENTS in hooks/webhook-dispatch.ts — only events that are
+// actually dispatched are advertised here.
+const AVAILABLE_EVENTS = [
+    'content:afterCreate',
+    'content:afterUpdate',
+    'content:afterPublish',
+    'content:afterDelete',
+    'comment:afterCreate',
+    'comment:afterApprove',
+    'comment:afterDelete',
+    'category:afterCreate',
+    'category:afterUpdate',
+    'category:afterDelete',
+];
+// ── WebhookManager ──────────────────────────────────────────────────────────────
+export function WebhookManager({ webhooks, onCreateWebhook, onDeleteWebhook, onLoadDeliveries, }) {
+    const [showCreateForm, setShowCreateForm] = useState(false);
+    const [deleteConfirmId, setDeleteConfirmId] = useState(null);
+    const [deliveriesFor, setDeliveriesFor] = useState(null);
+    const [deliveries, setDeliveries] = useState([]);
+    const [deliveriesLoading, setDeliveriesLoading] = useState(false);
+    async function toggleDeliveries(id) {
+        if (deliveriesFor === id) {
+            setDeliveriesFor(null);
+            setDeliveries([]);
+            return;
+        }
+        setDeliveriesFor(id);
+        setDeliveries([]);
+        if (!onLoadDeliveries)
+            return;
+        setDeliveriesLoading(true);
+        try {
+            setDeliveries(await onLoadDeliveries(id));
+        }
+        finally {
+            setDeliveriesLoading(false);
+        }
+    }
+    return (_jsxs("div", { className: "kywi-admin-webhook-manager", children: [_jsxs("div", { className: "kywi-admin-webhook-header", children: [_jsxs("h2", { className: "kywi-admin-webhook-title", children: ["Webhook Endpoints ", _jsxs("span", { className: "kywi-admin-webhook-count", children: ["(", webhooks.length, ")"] })] }), _jsx("button", { type: "button", className: "kywi-btn kywi-btn-primary", onClick: () => setShowCreateForm(true), children: "Add Endpoint" })] }), showCreateForm && (_jsx(WebhookCreateForm, { onSubmit: (data) => {
+                    onCreateWebhook?.(data);
+                    setShowCreateForm(false);
+                }, onCancel: () => setShowCreateForm(false) })), webhooks.length === 0 ? (_jsx("p", { className: "kywi-admin-webhook-empty", children: "No webhook endpoints configured." })) : (_jsxs("table", { className: "kywi-admin-webhook-table", role: "table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "URL" }), _jsx("th", { children: "Events" }), _jsx("th", { children: "Status" }), _jsx("th", { children: "Created" }), _jsx("th", { children: "Actions" })] }) }), _jsx("tbody", { children: webhooks.map(hook => (_jsxs(React.Fragment, { children: [_jsxs("tr", { children: [_jsx("td", { children: _jsx("code", { children: hook.url }) }), _jsx("td", { children: (hook.events ?? []).map(ev => (_jsx("span", { className: "kywi-admin-webhook-event-label", children: ev }, ev))) }), _jsx("td", { children: hook.isActive ? 'Active' : 'Inactive' }), _jsx("td", { children: hook.createdAt ? new Date(hook.createdAt).toLocaleDateString() : '—' }), _jsxs("td", { children: [_jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm", onClick: () => void toggleDeliveries(hook.id), "aria-expanded": deliveriesFor === hook.id, "aria-label": `${deliveriesFor === hook.id ? 'Hide' : 'View'} deliveries for ${hook.url}`, children: deliveriesFor === hook.id ? 'Hide Deliveries' : 'View Deliveries' }), deleteConfirmId === hook.id ? (_jsxs(_Fragment, { children: [_jsx("span", { className: "kywi-admin-confirm-text", children: "Delete this endpoint?" }), _jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm kywi-btn-danger", onClick: () => { onDeleteWebhook?.(hook.id); setDeleteConfirmId(null); }, "aria-label": `Confirm delete ${hook.url}`, children: "Yes, Delete" }), _jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm", onClick: () => setDeleteConfirmId(null), children: "Cancel" })] })) : (_jsx("button", { type: "button", className: "kywi-btn kywi-btn-sm kywi-btn-danger", onClick: () => setDeleteConfirmId(hook.id), "aria-label": `Delete ${hook.url}`, children: "Delete" }))] })] }), deliveriesFor === hook.id && (_jsx("tr", { children: _jsx("td", { colSpan: 5, children: deliveriesLoading ? (_jsx("p", { className: "kywi-admin-webhook-empty", children: "Loading deliveries\u2026" })) : deliveries.length === 0 ? (_jsx("p", { className: "kywi-admin-webhook-empty", children: "No deliveries recorded yet." })) : (_jsxs("table", { className: "kywi-admin-webhook-deliveries-table", role: "table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "Event" }), _jsx("th", { children: "Status" }), _jsx("th", { children: "Attempts" }), _jsx("th", { children: "HTTP" }), _jsx("th", { children: "When" })] }) }), _jsx("tbody", { children: deliveries.map(d => (_jsxs("tr", { children: [_jsx("td", { children: d.event }), _jsx("td", { children: d.status }), _jsx("td", { children: d.attempts }), _jsx("td", { children: d.httpStatus ?? '—' }), _jsx("td", { children: d.createdAt ? new Date(d.createdAt).toLocaleString() : '—' })] }, d.id))) })] })) }) }))] }, hook.id))) })] }))] }));
+}
+function WebhookCreateForm({ onSubmit, onCancel }) {
+    const [url, setUrl] = useState('');
+    const [secret, setSecret] = useState('');
+    const [events, setEvents] = useState([]);
+    function handleEventToggle(event, checked) {
+        setEvents(prev => checked ? [...prev, event] : prev.filter(e => e !== event));
+    }
+    function handleSubmit(e) {
+        e.preventDefault();
+        onSubmit({ url, secret, events });
+    }
+    return (_jsxs("form", { className: "kywi-admin-webhook-form", onSubmit: handleSubmit, children: [_jsxs("div", { className: "kywi-form-field", children: [_jsx("label", { htmlFor: "webhook-url", children: "Endpoint URL" }), _jsx("input", { id: "webhook-url", type: "url", className: "kywi-input", value: url, onChange: (e) => setUrl(e.target.value), placeholder: "https://example.com/hooks/kywi", required: true })] }), _jsxs("div", { className: "kywi-form-field", children: [_jsx("label", { htmlFor: "webhook-secret", children: "Signing Secret" }), _jsx("input", { id: "webhook-secret", type: "text", className: "kywi-input", value: secret, onChange: (e) => setSecret(e.target.value), minLength: 16, placeholder: "At least 16 characters", required: true }), _jsxs("p", { className: "kywi-admin-section-hint", children: ["Used to sign each payload (HMAC-SHA256, sent as ", _jsx("code", { children: "X-Kywi-Signature" }), "). Shown once here \u2014 store it now; it is redacted from every later view."] })] }), _jsxs("fieldset", { className: "kywi-form-field", children: [_jsx("legend", { children: "Events" }), AVAILABLE_EVENTS.map(event => (_jsxs("label", { className: "kywi-admin-webhook-event-label", children: [_jsx("input", { type: "checkbox", checked: events.includes(event), onChange: (e) => handleEventToggle(event, e.target.checked) }), event] }, event)))] }), _jsxs("div", { className: "kywi-admin-webhook-form-actions", children: [_jsx("button", { type: "submit", className: "kywi-btn kywi-btn-primary", disabled: events.length === 0, children: "Add Endpoint" }), _jsx("button", { type: "button", className: "kywi-btn", onClick: onCancel, children: "Cancel" })] })] }));
+}
+//# sourceMappingURL=webhook-manager.js.map

package/dist/admin/webhook-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-manager.js","sourceRoot":"","sources":["../../src/admin/webhook-manager.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAwCvC,mFAAmF;AACnF,6EAA6E;AAC7E,2CAA2C;AAE3C,MAAM,gBAAgB,GAAG;IACvB,qBAAqB;IACrB,qBAAqB;IACrB,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,sBAAsB;IACtB,sBAAsB;CACd,CAAA;AAEV,mFAAmF;AAEnF,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,eAAe,EACf,eAAe,EACf,gBAAgB,GACI;IACpB,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3D,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC3E,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACvE,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAA2B,EAAE,CAAC,CAAA;IAC1E,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEjE,KAAK,UAAU,gBAAgB,CAAC,EAAU;QACxC,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;YACzB,gBAAgB,CAAC,IAAI,CAAC,CAAA;YACtB,aAAa,CAAC,EAAE,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QACD,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACpB,aAAa,CAAC,EAAE,CAAC,CAAA;QACjB,IAAI,CAAC,gBAAgB;YAAE,OAAM;QAC7B,oBAAoB,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,CAAC;YACH,aAAa,CAAC,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;gBAAS,CAAC;YACT,oBAAoB,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,4BAA4B,aACzC,eAAK,SAAS,EAAC,2BAA2B,aACxC,cAAI,SAAS,EAAC,0BAA0B,mCACpB,gBAAM,SAAS,EAAC,0BAA0B,kBAAG,QAAQ,CAAC,MAAM,SAAS,IACpF,EACL,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,2BAA2B,EACrC,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,6BAG/B,IACL,EAEL,cAAc,IAAI,CACjB,KAAC,iBAAiB,IAChB,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE;oBACjB,eAAe,EAAE,CAAC,IAAI,CAAC,CAAA;oBACvB,iBAAiB,CAAC,KAAK,CAAC,CAAA;gBAC1B,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,GACxC,CACH,EAEA,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CACvB,YAAG,SAAS,EAAC,0BAA0B,iDAAqC,CAC7E,CAAC,CAAC,CAAC,CACF,iBAAO,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,OAAO,aACtD,0BACE,yBACE,+BAAY,EACZ,kCAAe,EACf,kCAAe,EACf,mCAAgB,EAChB,mCAAgB,IACb,GACC,EACR,0BACG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CACpB,MAAC,KAAK,CAAC,QAAQ,eACb,yBACE,uBAAI,yBAAO,IAAI,CAAC,GAAG,GAAQ,GAAK,EAChC,uBACG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAC7B,eAAe,SAAS,EAAC,gCAAgC,YAAE,EAAE,IAAlD,EAAE,CAAwD,CACtE,CAAC,GACC,EACL,uBAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,GAAM,EAChD,uBAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,GAAG,GAAM,EAC/E,yBACE,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sBAAsB,EAChC,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,mBAC9B,aAAa,KAAK,IAAI,CAAC,EAAE,gBAC5B,GAAG,aAAa,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,mBAAmB,IAAI,CAAC,GAAG,EAAE,YAEtF,aAAa,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,GAC3D,EACR,eAAe,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAC7B,8BACE,eAAM,SAAS,EAAC,yBAAyB,sCAA6B,EACtE,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sCAAsC,EAChD,OAAO,EAAE,GAAG,EAAE,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,gBAC3D,kBAAkB,IAAI,CAAC,GAAG,EAAE,4BAGjC,EACT,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sBAAsB,EAChC,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,uBAGhC,IACR,CACJ,CAAC,CAAC,CAAC,CACF,iBACE,IAAI,EAAC,QAAQ,EACb,SAAS,EAAC,sCAAsC,EAChD,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,gBAC9B,UAAU,IAAI,CAAC,GAAG,EAAE,uBAGzB,CACV,IACE,IACF,EACJ,aAAa,KAAK,IAAI,CAAC,EAAE,IAAI,CAC5B,uBACE,aAAI,OAAO,EAAE,CAAC,YACX,iBAAiB,CAAC,CAAC,CAAC,CACnB,YAAG,SAAS,EAAC,0BAA0B,yCAAwB,CAChE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAC5B,YAAG,SAAS,EAAC,0BAA0B,4CAAgC,CACxE,CAAC,CAAC,CAAC,CACF,iBAAO,SAAS,EAAC,qCAAqC,EAAC,IAAI,EAAC,OAAO,aACjE,0BACE,yBACE,iCAAc,EACd,kCAAe,EACf,oCAAiB,EACjB,gCAAa,EACb,gCAAa,IACV,GACC,EACR,0BACG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACnB,yBACE,uBAAK,CAAC,CAAC,KAAK,GAAM,EAClB,uBAAK,CAAC,CAAC,MAAM,GAAM,EACnB,uBAAK,CAAC,CAAC,QAAQ,GAAM,EACrB,uBAAK,CAAC,CAAC,UAAU,IAAI,GAAG,GAAM,EAC9B,uBAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,GAAG,GAAM,KAL9D,CAAC,CAAC,EAAE,CAMR,CACN,CAAC,GACI,IACF,CACT,GACE,GACF,CACN,KApFkB,IAAI,CAAC,EAAE,CAqFX,CAClB,CAAC,GACI,IACF,CACT,IACG,CACP,CAAA;AACH,CAAC;AASD,SAAS,iBAAiB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAA0B;IACvE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAA;IACxC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAW,EAAE,CAAC,CAAA;IAElD,SAAS,iBAAiB,CAAC,KAAa,EAAE,OAAgB;QACxD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAA;IAC/E,CAAC;IAED,SAAS,YAAY,CAAC,CAAkB;QACtC,CAAC,CAAC,cAAc,EAAE,CAAA;QAClB,QAAQ,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,CACL,gBAAM,SAAS,EAAC,yBAAyB,EAAC,QAAQ,EAAE,YAAY,aAC9D,eAAK,SAAS,EAAC,iBAAiB,aAC9B,gBAAO,OAAO,EAAC,aAAa,6BAAqB,EACjD,gBACE,EAAE,EAAC,aAAa,EAChB,IAAI,EAAC,KAAK,EACV,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,GAAG,EACV,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACvC,WAAW,EAAC,gCAAgC,EAC5C,QAAQ,SACR,IACE,EAEN,eAAK,SAAS,EAAC,iBAAiB,aAC9B,gBAAO,OAAO,EAAC,gBAAgB,+BAAuB,EACtD,gBACE,EAAE,EAAC,gBAAgB,EACnB,IAAI,EAAC,MAAM,EACX,SAAS,EAAC,YAAY,EACtB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC1C,SAAS,EAAE,EAAE,EACb,WAAW,EAAC,wBAAwB,EACpC,QAAQ,SACR,EACF,aAAG,SAAS,EAAC,yBAAyB,iEACY,8CAA6B,qFAE3E,IACA,EAEN,oBAAU,SAAS,EAAC,iBAAiB,aACnC,sCAAuB,EACtB,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAC7B,iBAAmB,SAAS,EAAC,gCAAgC,aAC3D,gBACE,IAAI,EAAC,UAAU,EACf,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC/B,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAC3D,EACD,KAAK,KANI,KAAK,CAOT,CACT,CAAC,IACO,EAEX,eAAK,SAAS,EAAC,iCAAiC,aAC9C,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,2BAA2B,EAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,6BAEhF,EACT,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,UAAU,EAAC,OAAO,EAAE,QAAQ,uBAEnD,IACL,IACD,CACR,CAAA;AACH,CAAC"}

package/dist/api/admin-features-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-features-routes.d.ts","sourceRoot":"","sources":["../../src/api/admin-features-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AA2BpD,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,yBAAyB,GAAG,IAAI,CAiChG"}
+{"version":3,"file":"admin-features-routes.d.ts","sourceRoot":"","sources":["../../src/api/admin-features-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,oBAAoB,CAAA;AA2CzE,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,yBAAyB,GAAG,IAAI,CAqDhG"}

package/dist/api/admin-features-routes.js

@@ -1,9 +1,27 @@
 import { z } from 'zod';
+import { resolveAdminConfig } from '../config/define.js';
 import { jsonOk, jsonError, unauthorized, forbidden, validationError } from './response.js';
 import { resolveAuth } from './auth.js';
 import { hasMinRole } from '../auth/roles.js';
 import { toSiteUuid } from './site-context.js';
 import { getAdminFeatureFlags, setAdminFeatureFlags } from '../db/admin-features-queries.js';
+/**
+ * True when a runtime flag key (an admin area or surface id) is held OFF by the
+ * config ceiling and therefore cannot be re-enabled at runtime. Mirrors the
+ * config-ceiling checks in `isSurfaceEnabled` (surface-matcher.ts): master off,
+ * area denylist, or surface-id denylist. The Admin Features surface is never
+ * config-locked by an area/surface denylist (the escape hatch), so a superAdmin
+ * can always runtime-enable it; only the master switch removes it.
+ */
+function isConfigLocked(ceiling, key) {
+    if (ceiling.enabled === false)
+        return true;
+    if (ceiling.features[key] === false)
+        return true;
+    if (ceiling.disableSurfaces.includes(key))
+        return true;
+    return false;
+}
 /**
  * T16 runtime admin feature-flag routes (plan §4). Thin wrappers over the
  * per-site `admin.features` settings-key queries.
@@ -52,6 +70,18 @@ export function registerAdminFeaturesRoutes(router, ctx) {
         if (!parsed.success) {
             return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
         }
+        // Honest config ceiling (#58): the config hard-ceiling holds at resolution
+        // time regardless, so silently storing `{comments:true}` for a config-disabled
+        // feature was a lie to anyone scripting the API. Reject any attempt to ENABLE a
+        // config-locked feature (nothing is persisted) instead of returning a hollow
+        // 200. Setting a locked feature to `false`, or toggling unlocked features, is
+        // unaffected — so the admin UI's normal area toggles keep working.
+        const ceiling = resolveAdminConfig(config.admin);
+        const lockedKeys = Object.keys(parsed.data).filter(key => parsed.data[key] === true && isConfigLocked(ceiling, key));
+        if (lockedKeys.length > 0) {
+            return jsonError('CONFIG_LOCKED', `Cannot enable feature(s) disabled in kywi.config.ts: ${lockedKeys.join(', ')}. ` +
+                'Config is a hard ceiling over runtime flags — change it in kywi.config.ts.', 409, lockedKeys.map(key => ({ path: key, message: 'Disabled by kywi.config.ts (config-locked)' })));
+        }
         const url = new URL(req.url);
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), config);
         const flags = await setAdminFeatureFlags(db, siteId, parsed.data);

package/dist/api/admin-features-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-features-routes.js","sourceRoot":"","sources":["../../src/api/admin-features-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAE5F;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAQzC,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,GAA8B;IACxF,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAEtC,gFAAgF;IAChF,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QACxG,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACjE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"admin-features-routes.js","sourceRoot":"","sources":["../../src/api/admin-features-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AAE5F;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,OAA4B,EAAE,GAAW;IAC/D,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAK,OAAO,CAAC,QAAoC,CAAC,GAAG,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC7E,IAAI,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAA;AAQzC,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,GAA8B;IACxF,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,GAAG,CAAA;IAEtC,gFAAgF;IAChF,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpD,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QAChF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,EAAE,CAAA;QAEjE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAE9F,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QACxG,CAAC;QAED,2EAA2E;QAC3E,+EAA+E;QAC/E,gFAAgF;QAChF,6EAA6E;QAC7E,8EAA8E;QAC9E,mEAAmE;QACnE,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAChD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CACjE,CAAA;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CACd,eAAe,EACf,wDAAwD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC/E,4EAA4E,EAC9E,GAAG,EACH,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAC9F,CAAA;QACH,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACjE,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/api-key-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key-routes.d.ts","sourceRoot":"","sources":["../../src/api/api-key-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAY7C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAiDzF"}
+{"version":3,"file":"api-key-routes.d.ts","sourceRoot":"","sources":["../../src/api/api-key-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAY7C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAqDzF"}

package/dist/api/api-key-routes.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { jsonOk, jsonError, unauthorized, notFound, validationError } from './response.js';
+import { jsonOk, jsonError, unauthorized, forbidden, notFound, validationError } from './response.js';
 import { createApiKey, listApiKeys, revokeApiKey } from '../db/api-key-queries.js';
 import { resolveAuth } from './auth.js';
 const createApiKeySchema = z.object({
@@ -15,6 +15,11 @@ export function registerApiKeyRoutes(router, db, authSecret) {
         const auth = await authenticate(req);
         if (!auth.user)
             return unauthorized();
+        // #54: an API key must not be able to mint another API key. Otherwise a
+        // read-scoped key could bootstrap a higher-scoped one and escalate past its
+        // own ceiling. Key creation is a session-only (human, admin UI) operation.
+        if (auth.viaApiKey)
+            return forbidden('API keys cannot create API keys');
         let body;
         try {
             body = await req.json();

package/dist/api/api-key-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-key-routes.js","sourceRoot":"","sources":["../../src/api/api-key-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAa,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAoB,MAAM,0BAA0B,CAAA;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAC3D,CAAC,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC;CAC3C,CAAC,CAAA;AAEF,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,EAAU,EAAE,UAAkB;IACjF,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAuB,CAAC,CAAA;QAElF,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,kDAAkD;IAClD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,2DAA2D;IAC3D,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,uCAAuC,CAAC,CAAA;QAEtE,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"api-key-routes.js","sourceRoot":"","sources":["../../src/api/api-key-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACrG,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAoB,MAAM,0BAA0B,CAAA;AACpG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAEvC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,KAAK,CACb,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAC3D,CAAC,GAAG,CAAC,CAAC,EAAE,gCAAgC,CAAC;CAC3C,CAAC,CAAA;AAEF,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,EAAU,EAAE,UAAkB;IACjF,KAAK,UAAU,YAAY,CAAC,GAAY;QACtC,OAAO,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QACrC,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC,iCAAiC,CAAC,CAAA;QAEvE,IAAI,IAAa,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;QACH,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QACpC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAuB,CAAC,CAAA;QAElF,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,kDAAkD;IAClD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,2DAA2D;IAC3D,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,EAAE,CAAA;QAErC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChE,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC,uCAAuC,CAAC,CAAA;QAEtE,OAAO,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/auth.d.ts

@@ -3,6 +3,14 @@ import type { KywiDb } from '../db/client.js';
 export interface AuthResult {
     user: UserContext | null;
     error?: string;
+    /**
+     * True when the request was authenticated by a bearer API key (`kywi_…`)
+     * rather than a session/JWT. Credential-minting routes use this to refuse
+     * bootstrapping — an API key must never be able to create another API key
+     * (a read-scoped key could otherwise mint a higher-scoped one, defeating the
+     * scope model, #54). Session auth leaves this falsy, so it is unaffected.
+     */
+    viaApiKey?: boolean;
 }
 export declare function verifyAuthHeader(authHeader: string | null, secret: string): Promise<AuthResult>;
 export declare function resolveAuth(authHeader: string | null, secret: string, db: KywiDb): Promise<AuthResult>;

package/dist/api/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAI7C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,CAiCrB;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,UAAU,CAAC,CAerB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAK7C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC,CAiCrB;AAED,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,UAAU,CAAC,CAwBrB"}

package/dist/api/auth.js

@@ -1,6 +1,7 @@
 import { jwtVerify } from 'jose';
 import { resolveApiKey } from '../db/api-key-queries.js';
 import { getUserById, getUserGroups, buildUserContext } from '../db/user-queries.js';
+import { effectiveApiKeyRole } from '../auth/roles.js';
 export async function verifyAuthHeader(authHeader, secret) {
     if (!authHeader) {
         return { user: null };
@@ -43,7 +44,16 @@ export async function resolveAuth(authHeader, secret, db) {
         if (!user || !user.isActive)
             return { user: null, error: 'API key owner not found or inactive' };
         const groups = await getUserGroups(db, user.id);
-        return { user: buildUserContext(user, groups) };
+        const ctx = buildUserContext(user, groups);
+        // #54: enforce the key's declared scopes as a ceiling on the owner's role.
+        // The effective permission is intersection(owner role, key scopes) — NOT a
+        // fallback to the owner's role. Otherwise a read-scoped key (the kind handed
+        // to a static frontend or CI job) inherits the owner's full role and can
+        // POST/PUT/DELETE/publish content. Every route authorizes off `user.role`
+        // (canAccessContent / hasMinRole), so capping the role here uniformly gates
+        // all API-key traffic. The session/cookie path never reaches this branch, so
+        // it is unaffected.
+        return { user: { ...ctx, role: effectiveApiKeyRole(ctx.role, result.scopes) }, viaApiKey: true };
     }
     return verifyAuthHeader(authHeader, secret);
 }

package/dist/api/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGhC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAOpF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAyB,EACzB,MAAc;IAEd,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAA;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAA;IAC5F,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAE5C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAE1E,MAAM,IAAI,GAAgB;YACxB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;YAC7B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnC,CAAC,CAAE,OAAO,CAAC,MAAmB;gBAC9B,CAAC,CAAC,EAAE;SACP,CAAA;QAED,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAA;QAChF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IACvC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAyB,EACzB,MAAc,EACd,EAAU;IAEV,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACtC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAA;IAC5F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;QAC5D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAA;QAChG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAA;IACjD,CAAC;IAED,OAAO,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;AAC7C,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGhC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAetD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAyB,EACzB,MAAc;IAEd,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACvB,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAA;IACvD,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAA;IAC5F,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAE5C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAE1E,MAAM,IAAI,GAAgB;YACxB,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;YAC7B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnC,CAAC,CAAE,OAAO,CAAC,MAAmB;gBAC9B,CAAC,CAAC,EAAE;SACP,CAAA;QAED,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAA;QAChF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;IACvC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAyB,EACzB,MAAc,EACd,EAAU;IAEV,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACtC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAA;IAC5F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEjC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;QAC5D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;QACjD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAA;QAChG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC1C,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,yEAAyE;QACzE,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,oBAAoB;QACpB,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAClG,CAAC;IAED,OAAO,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;AAC7C,CAAC"}

package/dist/api/comment-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comment-routes.d.ts","sourceRoot":"","sources":["../../src/api/comment-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAqBxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,UAAU,mBAAmB;IAC3B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,CAAA;IAC1B,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;IACzC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAcD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA6PpF"}
+{"version":3,"file":"comment-routes.d.ts","sourceRoot":"","sources":["../../src/api/comment-routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAsBxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEtD,UAAU,mBAAmB;IAC3B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,YAAY,CAAA;IAC1B,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAA;IACzC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAwBD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA0TpF"}

package/dist/api/comment-routes.js

@@ -6,6 +6,7 @@ import { hasMinRole } from '../auth/roles.js';
 import { listComments, listSiteComments, getCommentById, createComment, updateComment, updateCommentStatus, deleteComment, flagComment, unflagComment, } from '../db/comment-queries.js';
 import { isSpam } from '../comments/spam-filter.js';
 import { getContentById } from '../db/content-queries.js';
+import { checkHoneypot } from './form-routes.js';
 import { jsonOk, jsonError, notFound, unauthorized, forbidden, validationError } from './response.js';
 import { listSubscribers } from '../db/comment-subscription-queries.js';
 import { sendTemplatedEmail, COMMENT_NOTIFICATION_TEMPLATE } from '../email/index.js';
@@ -15,6 +16,12 @@ const createCommentSchema = z.object({
     authorName: z.string().optional(),
     authorEmail: z.string().optional(),
 });
+// Collection-endpoint variant (POST /comments): the content is named in the body
+// rather than the URL path, so the public comment form / Comments layout module
+// can submit without knowing the content's base-type segment.
+const createCommentCollectionSchema = createCommentSchema.extend({
+    contentId: z.string().min(1),
+});
 const updateCommentSchema = z.object({
     body: z.string().min(1).optional(),
     status: z.string().optional(),
@@ -22,37 +29,17 @@ const updateCommentSchema = z.object({
 export function registerCommentRoutes(router, ctx) {
     const { db, authSecret } = ctx;
     const commentHooks = createCommentHookDispatcher(ctx.hookRegistry);
-    // GET /content/:type/:id/comments — list comments on content
-    router.get('/content/:type/:id/comments', async (req, params) => {
-        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
-        const isEditor = auth.user !== null && hasMinRole(auth.user.role, 'editor');
-        const url = new URL(req.url);
-        const statusParam = url.searchParams.get('status') ?? undefined;
-        let status;
-        if (isEditor) {
-            status = statusParam;
-        }
-        else {
-            status = 'approved';
-        }
-        const comments = await listComments(db, params.id, status);
-        return jsonOk(comments);
-    });
-    // POST /content/:type/:id/comments — create comment
-    router.post('/content/:type/:id/comments', async (req, params) => {
-        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
-        let body;
-        try {
-            body = await req.json();
-        }
-        catch {
-            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
-        }
-        const parsed = createCommentSchema.safeParse(body);
-        if (!parsed.success) {
-            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
-        }
-        const content = await getContentById(db, null, params.id);
+    /**
+     * Shared create path for both comment-submission endpoints
+     * (`POST /content/:type/:id/comments` and the collection `POST /comments`).
+     * Validates the target content, honours the content type's `commentable`
+     * flag, screens for spam, persists the comment as `pending` (so every new
+     * comment lands in the moderation queue), fires the afterCreate hook, and
+     * best-effort notifies subscribers. Honeypot + JSON parsing are handled by the
+     * callers, which hold the raw request body.
+     */
+    async function submitComment(auth, contentId, data) {
+        const content = await getContentById(db, null, contentId);
         if (!content)
             return notFound('Content not found');
         // Enforce commentable flag on content type
@@ -61,38 +48,38 @@ export function registerCommentRoutes(router, ctx) {
         if (contentTypeConfig && contentTypeConfig.commentable === false) {
             return jsonError('FORBIDDEN', 'Comments are not allowed on this content type', 403);
         }
-        if (isSpam(parsed.data.body)) {
+        if (isSpam(data.body)) {
             return jsonError('SPAM_REJECTED', 'Comment rejected as spam', 400);
         }
         const commentData = {
             siteId: content.siteId,
-            contentId: params.id,
-            body: parsed.data.body,
+            contentId,
+            body: data.body,
             status: 'pending',
         };
-        if (parsed.data.parentId !== undefined) {
-            commentData.parentId = parsed.data.parentId;
+        if (data.parentId !== undefined) {
+            commentData.parentId = data.parentId;
         }
         if (auth.user !== null) {
             commentData.authorId = auth.user.id;
         }
-        if (parsed.data.authorName !== undefined) {
-            commentData.authorName = parsed.data.authorName;
+        if (data.authorName !== undefined) {
+            commentData.authorName = data.authorName;
         }
-        if (parsed.data.authorEmail !== undefined) {
-            commentData.authorEmail = parsed.data.authorEmail;
+        if (data.authorEmail !== undefined) {
+            commentData.authorEmail = data.authorEmail;
         }
         const comment = await createComment(db, commentData);
         await commentHooks.afterCreate(comment);
         // W6: send email notifications to subscribers
         if (ctx.emailProvider) {
             try {
-                const subscribers = await listSubscribers(db, params.id);
-                const authorEmail = parsed.data.authorEmail ?? (auth.user ? auth.user.id : undefined);
+                const subscribers = await listSubscribers(db, contentId);
+                const authorEmail = data.authorEmail ?? (auth.user ? auth.user.id : undefined);
                 const contentTitle = content.title ?? 'Untitled';
                 const siteName = ctx.config.sites[0]?.name ?? 'Kywi';
                 const baseUrl = ctx.baseUrl ?? 'http://localhost:3000';
-                const contentUrl = `${baseUrl}/content/${params.id}`;
+                const contentUrl = `${baseUrl}/content/${contentId}`;
                 for (const sub of subscribers) {
                     // Skip the comment author
                     if (authorEmail && sub.email === authorEmail)
@@ -103,8 +90,8 @@ export function registerCommentRoutes(router, ctx) {
                         template: COMMENT_NOTIFICATION_TEMPLATE,
                         vars: {
                             contentTitle,
-                            commentAuthor: parsed.data.authorName ?? 'Someone',
-                            commentBody: parsed.data.body,
+                            commentAuthor: data.authorName ?? 'Someone',
+                            commentBody: data.body,
                             siteName,
                             contentUrl,
                         },
@@ -116,15 +103,83 @@ export function registerCommentRoutes(router, ctx) {
             }
         }
         return jsonOk(comment, 201);
+    }
+    // GET /content/:type/:id/comments — list comments on content
+    router.get('/content/:type/:id/comments', async (req, params) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        const isEditor = auth.user !== null && hasMinRole(auth.user.role, 'editor');
+        const url = new URL(req.url);
+        const statusParam = url.searchParams.get('status') ?? undefined;
+        let status;
+        if (isEditor) {
+            status = statusParam;
+        }
+        else {
+            status = 'approved';
+        }
+        const comments = await listComments(db, params.id, status);
+        return jsonOk(comments);
+    });
+    // POST /content/:type/:id/comments — create comment (content named in the path)
+    router.post('/content/:type/:id/comments', async (req, params) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        // Honeypot — a bot that fills the hidden field is silently accepted (so it
+        // can't tell it was blocked) but nothing is persisted (shared with forms).
+        if (checkHoneypot(body)) {
+            return jsonOk({ status: 'received' }, 200);
+        }
+        const parsed = createCommentSchema.safeParse(body);
+        if (!parsed.success) {
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        }
+        return submitComment(auth, params.id, parsed.data);
     });
-    // GET /comments — list all site comments (auth+editor)
+    // POST /comments — public comment submission (content named in the body). This
+    // is the collection endpoint the public comment form / Comments layout module
+    // posts to; without it POST /comments matched the GET-only /comments route and
+    // returned 405, leaving the whole feature inert end-to-end (#29).
+    router.post('/comments', async (req) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        let body;
+        try {
+            body = await req.json();
+        }
+        catch {
+            return jsonError('BAD_REQUEST', 'Invalid JSON body', 400);
+        }
+        if (checkHoneypot(body)) {
+            return jsonOk({ status: 'received' }, 200);
+        }
+        const parsed = createCommentCollectionSchema.safeParse(body);
+        if (!parsed.success) {
+            return validationError(parsed.error.errors.map(e => ({ path: e.path.join('.'), message: e.message })));
+        }
+        const { contentId, ...data } = parsed.data;
+        return submitComment(auth, contentId, data);
+    });
+    // GET /comments — dual-mode collection read.
+    //  • Public: `?contentId=…` returns that content's APPROVED comments only, no
+    //    auth required — this is what the public Comments module renders.
+    //  • Admin: no `contentId` → the editor-only site moderation listing.
     router.get('/comments', async (req) => {
+        const url = new URL(req.url);
+        const contentIdParam = url.searchParams.get('contentId');
+        if (contentIdParam) {
+            const comments = await listComments(db, contentIdParam, 'approved');
+            return jsonOk(comments);
+        }
         const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
         if (!auth.user)
             return unauthorized();
         if (!hasMinRole(auth.user.role, 'editor'))
             return forbidden();
-        const url = new URL(req.url);
         const statusParam = url.searchParams.get('status') ?? undefined;
         const siteId = await toSiteUuid(db, url.searchParams.get('siteId'), ctx.config);
         if (!siteId)