@kywi-software/core 0.6.0 → 0.6.1

package/README.md

@@ -70,6 +70,50 @@ export { handler as GET, handler as POST, handler as PATCH, handler as DELETE }
 Then `kywi migrate --push && kywi seed` (via `@kywi-software/cli`) applies
 the schema and creates a superadmin user.
 
+## GraphQL API (read-only)
+
+The same `[...kywi]` catch-all route also mounts a read-only GraphQL
+endpoint at **`POST /api/v1/graphql`** — no separate wiring required. It
+exposes `content(id)`, `contentBySlug(slug, siteId)`,
+`contentList(contentType, siteId, limit, page, status)`,
+`search(query, siteId, contentType, limit)`, `categories(siteId)`,
+`nav(siteId)`, and `media(id)`. There is no mutation type.
+
+**Auth.** The endpoint reads the same `Authorization: Bearer <token>` header
+as the REST API. A missing/invalid header resolves to an anonymous caller
+rather than a 401 — anonymous access to published content is legal, matching
+`GET /search?status=published`. Requesting elevated (draft-visible) content —
+an explicit non-published `status`, or omitting `status` on `contentList`,
+`contentBySlug`, or `search` — requires an authenticated caller who is a
+member of the query's `siteId`; otherwise the field returns a GraphQL error
+**before** any row is fetched. `contentBySlug` exposes no `status` arg, so
+every call implicitly requests elevated access and is checked against
+`siteId` membership up front — an authenticated non-member is rejected with
+an error regardless of the row's actual status, since the membership check
+runs before the row is even looked up. Only `content(id)` differs, because
+it takes no `siteId` argument to check membership against up front — it
+fetches the row first and then post-filters: a non-published row resolves
+to `null` for a caller without draft access, rather than erroring.
+
+**Per-content-type opt-in (default-deny).** A content type is only
+queryable through GraphQL when its config sets `graphql: true`:
+
+```ts
+contentTypes: [
+  { name: 'article', label: 'Article', baseType: 'content', fields: [...], graphql: true },
+  { name: 'internalNote', label: 'Internal Note', baseType: 'content', fields: [...] }, // graphql omitted → denied
+]
+```
+
+Omitting the flag (or setting it `false`) denies GraphQL access to that
+type — this is default-deny, not default-allow. `contentList` for a
+non-opted-in type returns a GraphQL error. `content`/`contentBySlug`
+return `null` when the resolved row's content type isn't opted in.
+`search` rejects an explicit `contentType` argument naming a non-opted-in
+type, and otherwise silently filters results down to opted-in types only.
+`categories`, `nav`, and `media` aren't content-type-scoped, so this flag
+doesn't apply to them.
+
 ## What's in the package
 
 - `.` — DB schema generation, REST API handler, hooks, media, forms,

package/dist/admin/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/admin/app.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAA4B,MAAM,OAAO,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,eAAe,CAAA;AAI/D,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAA;AAK7D,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,OAAO,EAAE,kBAAkB,CAAA;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;KAAE,CAAC,CAAA;IAChF;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;CACtC;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,4CAU9B;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,CAAC,EAAE,YAAY,CAAA;CAAE,2CAavE;AAsDD,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,iBAAiB,2CA6B3G;AAKD,OAAO,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/admin/app.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAA4B,MAAM,OAAO,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,eAAe,CAAA;AAI/D,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAA;AAK7D,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,OAAO,EAAE,kBAAkB,CAAA;IAC3B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;KAAE,CAAC,CAAA;IAChF;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,kBAAkB,CAAA;CACtC;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,4CAU9B;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,CAAC,EAAE,YAAY,CAAA;CAAE,2CAavE;AAmDD,wBAAgB,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,iBAAiB,2CA6B3G;AAKD,OAAO,EAAE,aAAa,EAAE,CAAA"}

package/dist/admin/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/admin/app.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAIhD,OAAO,EAAE,UAAU,EAAiB,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,YAAY,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAiCzC,6EAA6E;AAC7E,MAAM,UAAU,eAAe;IAC7B,OAAO,CACL,eAAK,SAAS,EAAC,4BAA4B,aACzC,qCAAkB,EAClB,yEAAqD,EACrD,sBACE,YAAG,IAAI,EAAC,QAAQ,8BAAkB,GAChC,IACA,CACP,CAAA;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,EAAE,OAAO,EAA8B;IACtE,OAAO,CACL,eAAK,SAAS,EAAC,4BAA4B,aACzC,iDAAmC,EACnC,+DAEG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,EAAE,SACxD,EACJ,sBACE,YAAG,IAAI,EAAC,QAAQ,8BAAkB,GAChC,IACA,CACP,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,EACnB,OAAO,EACP,MAAM,EACN,OAAO,GAKR;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,EAAE,CAAA;IAEzC,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,gBAAgB;IAChB,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAqE,CAAC,EAC/F,CAAC,OAAO,CAAC,EAAE,CAAC,CACb,CAAA;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,OAAO,CAAC,EAAE,KAAK,yBAAyB,CAAA;IAEhE,yEAAyE;IACzE,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACvF,OAAO,KAAC,eAAe,KAAG,CAAA;IAC5B,CAAC;IAED,wEAAwE;IACxE,sCAAsC;IACtC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,OAAO,KAAC,gBAAgB,IAAC,OAAO,EAAE,OAAO,GAAI,CAAA;IAC/C,CAAC;IAED,OAAO,CACL,KAAC,QAAQ,IAAC,QAAQ,EAAE,KAAC,OAAO,KAAG,YAC7B,KAAC,IAAI,IAAC,MAAM,EAAE,MAAM,GAAI,GACf,CACZ,CAAA;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAqB;IAC1G,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACrD,OAAO,KAAC,YAAY,IAAC,IAAI,EAAE,SAAS,IAAI,IAAI,GAAI,CAAA;IAClD,CAAC;IAED,8EAA8E;IAC9E,MAAM,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAA;IAC1E,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAElD,8EAA8E;IAC9E,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAErD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CACtB,KAAC,WAAW,IAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,GAAI,CAChF,CAAC,CAAC,CAAC,CACF,KAAC,eAAe,KAAG,CACpB,CAAA;IAED,OAAO,CACL,KAAC,WAAW,IACV,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,EAAE,KACR,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YAEjD,OAAO,GACI,CACf,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,yCAAyC;AACzC,OAAO,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/admin/app.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAIhD,OAAO,EAAE,UAAU,EAAiB,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,YAAY,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAiCzC,6EAA6E;AAC7E,MAAM,UAAU,eAAe;IAC7B,OAAO,CACL,eAAK,SAAS,EAAC,4BAA4B,aACzC,qCAAkB,EAClB,yEAAqD,EACrD,sBACE,YAAG,IAAI,EAAC,QAAQ,8BAAkB,GAChC,IACA,CACP,CAAA;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,EAAE,OAAO,EAA8B;IACtE,OAAO,CACL,eAAK,SAAS,EAAC,4BAA4B,aACzC,iDAAmC,EACnC,+DAEG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,EAAE,SACxD,EACJ,sBACE,YAAG,IAAI,EAAC,QAAQ,8BAAkB,GAChC,IACA,CACP,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,EACnB,OAAO,EACP,MAAM,EACN,OAAO,GAKR;IACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,eAAe,EAAE,CAAA;IAEzC,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,gBAAgB;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAA;IAElE,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,eAAe,GAAG,OAAO,CAAC,EAAE,KAAK,yBAAyB,CAAA;IAEhE,yEAAyE;IACzE,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QACvF,OAAO,KAAC,eAAe,KAAG,CAAA;IAC5B,CAAC;IAED,wEAAwE;IACxE,sCAAsC;IACtC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,OAAO,KAAC,gBAAgB,IAAC,OAAO,EAAE,OAAO,GAAI,CAAA;IAC/C,CAAC;IAED,OAAO,CACL,KAAC,QAAQ,IAAC,QAAQ,EAAE,KAAC,OAAO,KAAG,YAC7B,KAAC,IAAI,IAAC,MAAM,EAAE,MAAM,GAAI,GACf,CACZ,CAAA;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAqB;IAC1G,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACrD,OAAO,KAAC,YAAY,IAAC,IAAI,EAAE,SAAS,IAAI,IAAI,GAAI,CAAA;IAClD,CAAC;IAED,8EAA8E;IAC9E,MAAM,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAA,CAAC,CAAC,CAAC,CAAA;IAC1E,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAElD,8EAA8E;IAC9E,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAErD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CACtB,KAAC,WAAW,IAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,GAAI,CAChF,CAAC,CAAC,CAAC,CACF,KAAC,eAAe,KAAG,CACpB,CAAA;IAED,OAAO,CACL,KAAC,WAAW,IACV,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,EAAE,KACR,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YAEjD,OAAO,GACI,CACf,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,yCAAyC;AACzC,OAAO,EAAE,aAAa,EAAE,CAAA"}

package/dist/admin/registry.d.ts

@@ -70,13 +70,13 @@ export interface AdminSurface {
     /**
      * Lazy loader for the surface component.
      *
-     * T1 DEFERRAL: intentionally OPTIONAL and UNPOPULATED in T1. Phase 1 (T5–T13)
-     * populates each entry with a **static-literal** `import('./surfaces/<area>/<x>.js')`
-     * thunk — the T0 spike proved this literal form is what lets webpack/tsc emit
-     * one chunk per surface (a dynamically-built path defeats splitting). The
-     * matcher and nav derivation deliberately do NOT depend on `load` being set.
+     * Every surface carries a **static-literal** `import('./surfaces/<area>/<x>.js')`
+     * thunk — the literal form (not a dynamically-built path) is what lets
+     * webpack/tsc emit one chunk per surface, so each surface's code only loads
+     * when that surface is navigated to. The matcher and nav derivation do not
+     * depend on `load`; it exists solely to be handed to `React.lazy`.
      */
-    load?: () => Promise<{
+    load: () => Promise<{
         default: ComponentType<SurfaceProps>;
     }>;
 }

package/dist/admin/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/admin/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAEhD;;;;;;;;GAQG;AAIH;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB,WAAW,GACX,aAAa,GACb,SAAS,GACT,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,OAAO,GACP,OAAO,GACP,OAAO,GACP,UAAU,GACV,OAAO,GACP,UAAU,GACV,cAAc,GACd,OAAO,GACP,WAAW,GACX,aAAa,GACb,SAAS,GACT,YAAY,GACZ,SAAS,GACT,aAAa,GACb,UAAU,GACV,cAAc,CAAA;AAElB,kEAAkE;AAClE,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAuBlC,CAAA;AAIV;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAA;IACV,oDAAoD;IACpD,IAAI,EAAE,SAAS,CAAA;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,+FAA+F;IAC/F,GAAG,CAAC,EAAE,eAAe,CAAA;IACrB,gFAAgF;IAChF,OAAO,EAAE,QAAQ,CAAA;IACjB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;KAAE,CAAC,CAAA;CAC/D;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAA;IACV,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAC9C,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAIvD,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAQ3C,CAAA;AAQV,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAwbxC,CAAA;AAEV;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,oBAAoB,CAAA"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/admin/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAEhD;;;;;;;;GAQG;AAIH;;;;GAIG;AACH,MAAM,MAAM,SAAS,GACjB,WAAW,GACX,aAAa,GACb,SAAS,GACT,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,OAAO,GACP,OAAO,GACP,OAAO,GACP,UAAU,GACV,OAAO,GACP,UAAU,GACV,cAAc,GACd,OAAO,GACP,WAAW,GACX,aAAa,GACb,SAAS,GACT,YAAY,GACZ,SAAS,GACT,aAAa,GACb,UAAU,GACV,cAAc,CAAA;AAElB,kEAAkE;AAClE,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAuBlC,CAAA;AAIV;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAA;IACV,oDAAoD;IACpD,IAAI,EAAE,SAAS,CAAA;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAA;IACb,+FAA+F;IAC/F,GAAG,CAAC,EAAE,eAAe,CAAA;IACrB,gFAAgF;IAChF,OAAO,EAAE,QAAQ,CAAA;IACjB;;;;;;;;OAQG;IACH,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;KAAE,CAAC,CAAA;CAC9D;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAA;IACV,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAC9C,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAIvD,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAQ3C,CAAA;AAQV,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAwbxC,CAAA;AAEV;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,oBAAoB,CAAA"}

package/dist/api/audience-runtime-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audience-runtime-routes.d.ts","sourceRoot":"","sources":["../../src/api/audience-runtime-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAM7C,UAAU,mBAAmB;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAEnE,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAyC5F"}
+{"version":3,"file":"audience-runtime-routes.d.ts","sourceRoot":"","sources":["../../src/api/audience-runtime-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAM7C,UAAU,mBAAmB;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAEnE,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,CA6C5F"}

package/dist/api/audience-runtime-routes.js

@@ -1,7 +1,7 @@
 import { jsonOk, jsonError, unauthorized } from './response.js';
 import { getAudienceById, upsertAdapterIdentity, deleteAdapterIdentity } from '../audiences/queries.js';
 import { verifyHmacSignature } from '../audiences/hmac.js';
-import { COOKIE_NAMES, buildSetCookieHeader } from '../audiences/cookies.js';
+import { COOKIE_NAMES, COOKIE_MAX_AGE, buildSetCookieHeader } from '../audiences/cookies.js';
 export function registerAudienceRuntimeRoutes(router, ctx) {
     const { db, webhookSecret } = ctx;
     // POST /kywi/audience — update kywi_audience cookie
@@ -12,7 +12,11 @@ export function registerAudienceRuntimeRoutes(router, ctx) {
         const audience = await getAudienceById(db, body.audienceId);
         if (!audience || audience.status !== 'active')
             return jsonError('INVALID_AUDIENCE', 'Audience not found or not active', 400);
-        const cookie = buildSetCookieHeader(COOKIE_NAMES.AUDIENCE, body.audienceId, -1, { httpOnly: false });
+        // Persist (not a session cookie) so server-side resolution can read it back
+        // on the next render (#85). Non-httpOnly is deliberate: client JS reads and
+        // deletes it (opt-out, badge). The read validates the id against the active
+        // audiences, so this client-writable value can never force a stale segment.
+        const cookie = buildSetCookieHeader(COOKIE_NAMES.AUDIENCE, body.audienceId, COOKIE_MAX_AGE.AUDIENCE, { httpOnly: false });
         return new Response(JSON.stringify({ data: { audienceId: body.audienceId } }), {
             status: 200, headers: { 'Content-Type': 'application/json', 'Set-Cookie': cookie },
         });

package/dist/api/audience-runtime-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"audience-runtime-routes.js","sourceRoot":"","sources":["../../src/api/audience-runtime-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AACvG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAkB,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAI5F,MAAM,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAwB;IACpF,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,GAAG,CAAA;IAEjC,oDAAoD;IACpD,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA6B,CAAA;QACxD,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAA;QACtF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC3D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,kBAAkB,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;QAC5H,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACpG,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE;SACnF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;QACrD,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,CAAC,iCAAiC,CAAC,CAAA;QACtE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC,mBAAmB,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA2C,CAAA;QAC3E,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAA;QACpF,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,SAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAA+B,IAAI,EAAE,CAAC,CAAA;QAC9G,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,iDAAiD;IACjD,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC/D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;QACrD,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,CAAC,iCAAiC,CAAC,CAAA;QACtE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC,mBAAmB,CAAC,CAAA;QACpD,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,SAAU,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAC9D,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;YAC/D,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE;SACnF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"audience-runtime-routes.js","sourceRoot":"","sources":["../../src/api/audience-runtime-routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AACvG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAI5F,MAAM,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAwB;IACpF,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,GAAG,CAAA;IAEjC,oDAAoD;IACpD,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA6B,CAAA;QACxD,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC,kBAAkB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAA;QACtF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;QAC3D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC,kBAAkB,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;QAC5H,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;QACzH,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE;YAC7E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE;SACnF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;QACrD,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,CAAC,iCAAiC,CAAC,CAAA;QACtE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC,mBAAmB,CAAC,CAAA;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA2C,CAAA;QAC3E,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAA;QACpF,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,SAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAA+B,IAAI,EAAE,CAAC,CAAA;QAC9G,OAAO,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,iDAAiD;IACjD,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC/D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;QACrD,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,CAAC,iCAAiC,CAAC,CAAA;QACtE,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC,mBAAmB,CAAC,CAAA;QACpD,MAAM,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,SAAU,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAC9D,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE;YAC/D,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,EAAE;SACnF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/graphql/handler.d.ts

@@ -1,3 +1,3 @@
 import type { GraphQLSchema } from 'graphql';
-export declare function handleGraphQLRequest(schema: GraphQLSchema, resolvers: Record<string, Function>, req: Request): Promise<Response>;
+export declare function handleGraphQLRequest(schema: GraphQLSchema, resolvers: Record<string, Function>, req: Request, context?: unknown): Promise<Response>;
 //# sourceMappingURL=handler.d.ts.map

package/dist/api/graphql/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/graphql/handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EACnC,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,QAAQ,CAAC,CA4CnB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/api/graphql/handler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EACnC,GAAG,EAAE,OAAO,EAMZ,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,QAAQ,CAAC,CA6CnB"}

package/dist/api/graphql/handler.js

@@ -1,5 +1,11 @@
 import { graphql, defaultFieldResolver } from 'graphql';
-export async function handleGraphQLRequest(schema, resolvers, req) {
+export async function handleGraphQLRequest(schema, resolvers, req, 
+// Per-request context (the resolved auth user) passed to graphql-js as
+// `contextValue`, reaching every resolver as its third parameter. The route
+// populates it from `resolveAuth`; a missing/invalid Authorization header
+// yields `{ user: null }` (anonymous). Optional so existing callers that pass
+// no context are treated as anonymous — resolvers fail closed on `undefined`.
+context) {
     let body;
     try {
         body = await req.json();
@@ -15,6 +21,7 @@ export async function handleGraphQLRequest(schema, resolvers, req) {
         source: body.query,
         variableValues: body.variables,
         rootValue: resolvers,
+        contextValue: context,
         // The Query resolvers live on `rootValue`, keyed by field name, and are
         // written with the standard `(source, args, context, info)` field-resolver
         // signature. graphql-js's default field resolver would instead invoke a

package/dist/api/graphql/handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/api/graphql/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAGvD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAqB,EACrB,SAAmC,EACnC,GAAY;IAEZ,IAAI,IAA6D,CAAA;IACjE,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA6D,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC3B,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,SAAS,EAAE,SAAS;QACpB,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,aAAa,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC7C,MAAM,IAAI,GAAI,MAAqD,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACrF,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,OAAQ,IAAqC,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;YAC5E,CAAC;YACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QAC1D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QACjC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../../src/api/graphql/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAGvD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAqB,EACrB,SAAmC,EACnC,GAAY;AACZ,uEAAuE;AACvE,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,OAAiB;IAEjB,IAAI,IAA6D,CAAA;IACjE,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAA6D,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,EAC9D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC3B,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,cAAc,EAAE,IAAI,CAAC,SAAS;QAC9B,SAAS,EAAE,SAAS;QACpB,YAAY,EAAE,OAAO;QACrB,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,aAAa,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC7C,MAAM,IAAI,GAAI,MAAqD,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACrF,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,OAAQ,IAAqC,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;YAC5E,CAAC;YACD,OAAO,oBAAoB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QAC1D,CAAC;KACF,CAAC,CAAA;IAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;QAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;QACjC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC"}

package/dist/api/graphql/resolvers.d.ts

@@ -1,26 +1,35 @@
 import type { KywiDb } from '../../db/client.js';
-import type { KywiConfig } from '../../config/types.js';
+import type { KywiConfig, UserContext } from '../../config/types.js';
+/**
+ * Per-request GraphQL context, passed to graphql-js as `contextValue` and
+ * reaching resolvers as their third parameter. `user` is the caller resolved
+ * from the Authorization header (null = anonymous). Task 2 (#84) builds on this
+ * shape — keep it stable.
+ */
+export interface GraphQLContext {
+    user: UserContext | null;
+}
 export declare function createResolvers(db: KywiDb, config: KywiConfig): {
     content: (_: unknown, args: {
         id: string;
-    }) => Promise<import("../../db/content-queries.js").ContentWithCustomFields | null>;
+    }, ctx: GraphQLContext) => Promise<import("../../db/content-queries.js").ContentWithCustomFields | null>;
     contentBySlug: (_: unknown, args: {
         slug: string;
         siteId: string;
-    }) => Promise<import("../../db/content-queries.js").ContentWithCustomFields | null>;
+    }, ctx: GraphQLContext) => Promise<import("../../db/content-queries.js").ContentWithCustomFields | null>;
     contentList: (_: unknown, args: {
         contentType: string;
         siteId: string;
         limit?: number;
         page?: number;
         status?: string;
-    }) => Promise<import("../../db/content-queries.js").ContentWithCustomFields[]>;
+    }, ctx: GraphQLContext) => Promise<import("../../db/content-queries.js").ContentWithCustomFields[]>;
     search: (_: unknown, args: {
         query: string;
         siteId: string;
         contentType?: string;
         limit?: number;
-    }) => Promise<import("../../db/search-queries.js").SearchResult[]>;
+    }, ctx: GraphQLContext) => Promise<import("../../db/search-queries.js").SearchResult[]>;
     categories: (_: unknown, args: {
         siteId: string;
     }) => Promise<{
@@ -39,7 +48,7 @@ export declare function createResolvers(db: KywiDb, config: KywiConfig): {
     }[]>;
     nav: (_: unknown, args: {
         siteId: string;
-    }) => Promise<import("../../db/tree-queries.js").NavContentRow[]>;
+    }, ctx: GraphQLContext) => Promise<import("../../db/tree-queries.js").NavContentRow[]>;
     media: (_: unknown, args: {
         id: string;
     }) => Promise<{

package/dist/api/graphql/resolvers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../../../src/api/graphql/resolvers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAMvD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;iBAEvC,OAAO,QAAQ;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE;uBAGvB,OAAO,QAAQ;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;qBAInE,OAAO,QACJ;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;gBAmB1F,OAAO,QACJ;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;oBAUzD,OAAO,QAAQ;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;aAGxC,OAAO,QAAQ;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;eAG/B,OAAO,QAAQ;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;EAOjD"}
+{"version":3,"file":"resolvers.d.ts","sourceRoot":"","sources":["../../../src/api/graphql/resolvers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAOpE;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;CACzB;AAqDD,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU;iBAEvC,OAAO,QAAQ;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,OAAO,cAAc;uBAYhE,OAAO,QACJ;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,OACjC,cAAc;qBAUhB,OAAO,QACJ;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,OACxF,cAAc;gBA0BhB,OAAO,QACJ;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,OACxE,cAAc;oBA8BC,OAAO,QAAQ;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;aAGxC,OAAO,QAAQ;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,OAAO,cAAc;eAUpD,OAAO,QAAQ;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;;;;;;;EASjD"}

package/dist/api/graphql/resolvers.js

@@ -1,31 +1,130 @@
+import { GraphQLError } from 'graphql';
 import { getContentById, getContentBySlug, listContent } from '../../db/content-queries.js';
 import { searchContent } from '../../db/search-queries.js';
 import { listCategories } from '../../db/category-queries.js';
 import { getNavContentForSite } from '../../db/tree-queries.js';
+import { hasSiteAccess } from '../site-context.js';
+/** True when the caller may see this site's non-published (draft) content. */
+function canSeeDrafts(ctx, siteId) {
+    return !!ctx?.user && hasSiteAccess(ctx.user, siteId);
+}
+/**
+ * A content type is queryable through GraphQL only when its config explicitly
+ * sets `graphql: true` (#84). Absent flag, or `graphql: false`, both mean
+ * denied — this is a default-deny gate, not a passthrough.
+ */
+function isGraphQLEnabled(config, contentTypeName) {
+    const ct = config.contentTypes.find(c => c.name === contentTypeName);
+    return ct?.graphql === true;
+}
+/**
+ * Decide the effective status filter for a site-scoped query, mirroring the
+ * anonymous-caller rules in `search-routes.ts`:
+ *   - `status: 'published'` (or any published-only request) is fully public.
+ *   - Anonymous callers: an absent status silently narrows to 'published'; an
+ *     EXPLICIT non-published status is a hard denial (GraphQL error), never a
+ *     silently-swapped result.
+ *   - Authenticated callers: any elevated (non-published or absent) status is
+ *     additionally gated on membership of the query's `siteId`.
+ *
+ * Returns the status to filter by, or `undefined` for "no status filter" (all
+ * statuses visible — only reachable by a member requesting elevated access).
+ */
+function resolveStatusFilter(ctx, siteId, requested) {
+    // Published-only access is public — no auth required.
+    if (requested === 'published')
+        return 'published';
+    // Elevated (draft-visible) access requested from here on.
+    if (!ctx?.user) {
+        // Anonymous: an explicit non-published status is unauthorized; an absent
+        // status is narrowed to published rather than rejected.
+        if (requested !== undefined)
+            throw new GraphQLError('Unauthorized');
+        return 'published';
+    }
+    // Authenticated: elevated access requires membership of the target site.
+    if (!hasSiteAccess(ctx.user, siteId))
+        throw new GraphQLError('Unauthorized');
+    // Member: honour the request. `undefined` means no status filter (all rows).
+    return requested;
+}
 export function createResolvers(db, config) {
     return {
-        content: async (_, args) => getContentById(db, null, args.id),
-        contentBySlug: async (_, args) => getContentBySlug(db, null, args.slug, args.siteId),
-        contentList: async (_, args) => {
+        content: async (_, args, ctx) => {
+            // No siteId arg to pre-check against, so fetch then post-check: a
+            // non-published row is only visible to a caller with draft access for the
+            // row's own site.
+            const row = await getContentById(db, null, args.id);
+            if (!row)
+                return null;
+            if (!isGraphQLEnabled(config, row.contentTypeName))
+                return null;
+            if (row.status === 'published')
+                return row;
+            return canSeeDrafts(ctx, row.siteId) ? row : null;
+        },
+        contentBySlug: async (_, args, ctx) => {
+            const status = resolveStatusFilter(ctx, args.siteId, undefined);
+            const row = await getContentBySlug(db, null, args.slug, args.siteId, status ? { status } : undefined);
+            if (!row)
+                return null;
+            if (!isGraphQLEnabled(config, row.contentTypeName))
+                return null;
+            return row;
+        },
+        contentList: async (_, args, ctx) => {
             const ct = config.contentTypes.find(c => c.name === args.contentType);
-            if (!ct)
-                return [];
+            if (!ct || !isGraphQLEnabled(config, args.contentType)) {
+                // Default-deny (#84): a missing/false `graphql` flag is a hard error,
+                // not silent emptiness — that silent-empty behavior was the bug.
+                throw new GraphQLError(`Content type "${args.contentType}" is not available via GraphQL`);
+            }
+            const status = resolveStatusFilter(ctx, args.siteId, args.status);
             const page = args.page ?? 1;
             const limit = args.limit ?? 10;
-            const { rows } = await listContent(db, ct, null, args.siteId, { page, limit, offset: (page - 1) * limit }, { sortField: 'createdAt', sortDir: 'desc' }, { customFields: {}, ...(args.status ? { status: args.status } : {}) });
+            const { rows } = await listContent(db, ct, null, args.siteId, { page, limit, offset: (page - 1) * limit }, { sortField: 'createdAt', sortDir: 'desc' }, { customFields: {}, ...(status ? { status } : {}) });
             return rows;
         },
-        search: async (_, args) => {
+        search: async (_, args, ctx) => {
+            // #84: an explicit contentType arg naming a non-opted-in type is a hard
+            // error; with no arg, results are silently filtered to opted-in types
+            // rather than leaking every type's rows.
+            if (args.contentType && !isGraphQLEnabled(config, args.contentType)) {
+                throw new GraphQLError(`Content type "${args.contentType}" is not available via GraphQL`);
+            }
+            // The search schema exposes no `status` arg, so elevated access is always
+            // implicit — anonymous callers are confined to published, members may see
+            // drafts, non-members of the site are denied.
+            const status = resolveStatusFilter(ctx, args.siteId, undefined);
+            // Mirrors search-routes.ts (#82): an elevated (draft-visible) caller is
+            // an admin searching for content to edit, so it also sees rows marked
+            // excludeFromSearch; anonymous/public search never does.
+            const includeExcluded = canSeeDrafts(ctx, args.siteId);
             const { results } = await searchContent(db, args.query, {
                 siteId: args.siteId,
                 contentType: args.contentType,
                 limit: args.limit,
+                status,
+                includeExcluded,
             });
-            return results;
+            return results.filter(r => isGraphQLEnabled(config, r.contentTypeName));
         },
+        // Categories are site taxonomy with no publication status column, so there
+        // is no draft/unpublished state to leak (audited for #79).
         categories: async (_, args) => listCategories(db, args.siteId),
-        nav: async (_, args) => getNavContentForSite(db, args.siteId),
+        nav: async (_, args, ctx) => {
+            // `getNavContentForSite` returns every row regardless of status, which
+            // leaks draft titles/slugs/paths (#79). There is no status arg to reject,
+            // so post-filter: a caller without draft access for this site sees only
+            // published nodes.
+            const rows = await getNavContentForSite(db, args.siteId);
+            if (canSeeDrafts(ctx, args.siteId))
+                return rows;
+            return rows.filter(r => r.status === 'published');
+        },
         media: async (_, args) => {
+            // Media rows carry no publication status column, so there is no draft
+            // state to leak here (audited for #79).
             const { kywiMedia } = await import('../../schema/base.js');
             const { eq } = await import('drizzle-orm');
             const [row] = await db.select().from(kywiMedia).where(eq(kywiMedia.id, args.id)).limit(1);

package/dist/api/graphql/resolvers.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvers.js","sourceRoot":"","sources":["../../../src/api/graphql/resolvers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAE/D,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,MAAkB;IAC5D,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,CAAU,EAAE,IAAoB,EAAE,EAAE,CAClD,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAEnC,aAAa,EAAE,KAAK,EAAE,CAAU,EAAE,IAAsC,EAAE,EAAE,CAC1E,gBAAgB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;QAEpD,WAAW,EAAE,KAAK,EAChB,CAAU,EACV,IAA6F,EAC7F,EAAE;YACF,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,CAAA;YACrE,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,CAAA;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAA;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;YAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAChC,EAAE,EACF,EAAE,EACF,IAAI,EACJ,IAAI,CAAC,MAAM,EACX,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,EAC3C,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAC3C,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACtE,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,EAAE,KAAK,EACX,CAAU,EACV,IAA6E,EAC7E,EAAE;YACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAA;YACF,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,CAAU,EAAE,IAAwB,EAAE,EAAE,CACzD,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC;QAEjC,GAAG,EAAE,KAAK,EAAE,CAAU,EAAE,IAAwB,EAAE,EAAE,CAClD,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC;QAEvC,KAAK,EAAE,KAAK,EAAE,CAAU,EAAE,IAAoB,EAAE,EAAE;YAChD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAA;YAC1D,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;YAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACzF,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"resolvers.js","sourceRoot":"","sources":["../../../src/api/graphql/resolvers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAGtC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAYlD,8EAA8E;AAC9E,SAAS,YAAY,CAAC,GAA+B,EAAE,MAAc;IACnE,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAkB,EAAE,eAAuB;IACnE,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAA;IACpE,OAAO,EAAE,EAAE,OAAO,KAAK,IAAI,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,mBAAmB,CAC1B,GAA+B,EAC/B,MAAc,EACd,SAA6B;IAE7B,sDAAsD;IACtD,IAAI,SAAS,KAAK,WAAW;QAAE,OAAO,WAAW,CAAA;IAEjD,0DAA0D;IAC1D,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACf,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,YAAY,CAAC,cAAc,CAAC,CAAA;QACnE,OAAO,WAAW,CAAA;IACpB,CAAC;IAED,yEAAyE;IACzE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,cAAc,CAAC,CAAA;IAE5E,6EAA6E;IAC7E,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,MAAkB;IAC5D,OAAO;QACL,OAAO,EAAE,KAAK,EAAE,CAAU,EAAE,IAAoB,EAAE,GAAmB,EAAE,EAAE;YACvE,kEAAkE;YAClE,0EAA0E;YAC1E,kBAAkB;YAClB,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;YACnD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,eAAyB,CAAC;gBAAE,OAAO,IAAI,CAAA;YACzE,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;gBAAE,OAAO,GAAG,CAAA;YAC1C,OAAO,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;QAC7D,CAAC;QAED,aAAa,EAAE,KAAK,EAClB,CAAU,EACV,IAAsC,EACtC,GAAmB,EACnB,EAAE;YACF,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YAC/D,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YACrG,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,eAAyB,CAAC;gBAAE,OAAO,IAAI,CAAA;YACzE,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,WAAW,EAAE,KAAK,EAChB,CAAU,EACV,IAA6F,EAC7F,GAAmB,EACnB,EAAE;YACF,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC,CAAA;YACrE,IAAI,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,sEAAsE;gBACtE,iEAAiE;gBACjE,MAAM,IAAI,YAAY,CACpB,iBAAiB,IAAI,CAAC,WAAW,gCAAgC,CAClE,CAAA;YACH,CAAC;YACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAA;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAA;YAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,WAAW,CAChC,EAAE,EACF,EAAE,EACF,IAAI,EACJ,IAAI,CAAC,MAAM,EACX,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,EAC3C,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAC3C,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACpD,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,EAAE,KAAK,EACX,CAAU,EACV,IAA6E,EAC7E,GAAmB,EACnB,EAAE;YACF,wEAAwE;YACxE,sEAAsE;YACtE,yCAAyC;YACzC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,YAAY,CACpB,iBAAiB,IAAI,CAAC,WAAW,gCAAgC,CAClE,CAAA;YACH,CAAC;YACD,0EAA0E;YAC1E,0EAA0E;YAC1E,8CAA8C;YAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;YAC/D,wEAAwE;YACxE,sEAAsE;YACtE,yDAAyD;YACzD,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YACtD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;gBACN,eAAe;aAChB,CAAC,CAAA;YACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAA;QACzE,CAAC;QAED,2EAA2E;QAC3E,2DAA2D;QAC3D,UAAU,EAAE,KAAK,EAAE,CAAU,EAAE,IAAwB,EAAE,EAAE,CACzD,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC;QAEjC,GAAG,EAAE,KAAK,EAAE,CAAU,EAAE,IAAwB,EAAE,GAAmB,EAAE,EAAE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,mBAAmB;YACnB,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YACxD,IAAI,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAA;QACnD,CAAC;QAED,KAAK,EAAE,KAAK,EAAE,CAAU,EAAE,IAAoB,EAAE,EAAE;YAChD,sEAAsE;YACtE,wCAAwC;YACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAA;YAC1D,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;YAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;YACzF,OAAO,GAAG,IAAI,IAAI,CAAA;QACpB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/api/graphql/schema.d.ts

@@ -1,4 +1,4 @@
 import { GraphQLSchema } from 'graphql';
 import type { KywiConfig } from '../../config/types.js';
-export declare function createGraphQLSchema(_config: KywiConfig): GraphQLSchema;
+export declare function createGraphQLSchema(config: KywiConfig): GraphQLSchema;
 //# sourceMappingURL=schema.d.ts.map

package/dist/api/graphql/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/api/graphql/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAMd,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAgEvD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,GAAG,aAAa,CAkDtE"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/api/graphql/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAMd,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAgEvD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,CA8DrE"}

package/dist/api/graphql/schema.js

@@ -56,7 +56,18 @@ const SearchResultType = new GraphQLObjectType({
         contentTypeName: { type: GraphQLString },
     },
 });
-export function createGraphQLSchema(_config) {
+export function createGraphQLSchema(config) {
+    // Content types opted into GraphQL (#84 — `graphql: true`, default-deny).
+    // Resolver-level enforcement is what actually denies a non-opted type
+    // (`resolvers.ts`); this only documents the opted-in set on the schema
+    // itself so introspection tells callers what's queryable instead of them
+    // discovering the allow-list by trial and error.
+    const enabledTypeNames = config.contentTypes
+        .filter(ct => ct.graphql === true)
+        .map(ct => ct.name);
+    const contentTypeArgDescription = enabledTypeNames.length > 0
+        ? `Content type name. Available via GraphQL: ${enabledTypeNames.join(', ')}.`
+        : 'Content type name. No content types are currently opted into GraphQL (graphql: true).';
     const queryType = new GraphQLObjectType({
         name: 'Query',
         fields: {
@@ -74,7 +85,7 @@ export function createGraphQLSchema(_config) {
             contentList: {
                 type: new GraphQLList(ContentType),
                 args: {
-                    contentType: { type: new GraphQLNonNull(GraphQLString) },
+                    contentType: { type: new GraphQLNonNull(GraphQLString), description: contentTypeArgDescription },
                     siteId: { type: new GraphQLNonNull(GraphQLString) },
                     limit: { type: GraphQLInt },
                     page: { type: GraphQLInt },
@@ -86,7 +97,7 @@ export function createGraphQLSchema(_config) {
                 args: {
                     query: { type: new GraphQLNonNull(GraphQLString) },
                     siteId: { type: new GraphQLNonNull(GraphQLString) },
-                    contentType: { type: GraphQLString },
+                    contentType: { type: GraphQLString, description: contentTypeArgDescription },
                     limit: { type: GraphQLInt },
                 },
             },

package/dist/api/graphql/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/api/graphql/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,UAAU,EACV,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,yCAAyC;AACzC,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC;IACxC,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACb,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QAC/C,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QAClD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QACjD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QACrD,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QAC5D,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAChC,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QACpC,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAClC,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;KACnC,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,IAAI,iBAAiB,CAAC;IACzC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE;QACN,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;KAClC;CACF,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC;IACxC,IAAI,EAAE,SAAS;IACf,MAAM,EAAE;QACN,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;KAC5B;CACF,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC;IACtC,IAAI,EAAE,OAAO;IACb,MAAM,EAAE;QACN,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QACjC,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QACjC,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAChC,UAAU,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;KACpC;CACF,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,IAAI,iBAAiB,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE;QACN,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,eAAe,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;KACzC;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,mBAAmB,CAAC,OAAmB;IACrD,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC;QACtC,IAAI,EAAE,OAAO;QACb,MAAM,EAAE;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE;aAC1D;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE;oBACJ,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;oBACjD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;iBACpD;aACF;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,IAAI,WAAW,CAAC,WAAW,CAAC;gBAClC,IAAI,EAAE;oBACJ,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;oBACxD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;oBACnD,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;oBAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;oBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;iBAChC;aACF;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,IAAI,WAAW,CAAC,gBAAgB,CAAC;gBACvC,IAAI,EAAE;oBACJ,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;oBAClD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;oBACnD,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;oBACpC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;iBAC5B;aACF;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,IAAI,WAAW,CAAC,YAAY,CAAC;gBACnC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE;aAC9D;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI,WAAW,CAAC,WAAW,CAAC;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE;aAC9D;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE;aAC1D;SACF;KACF,CAAC,CAAA;IAEF,OAAO,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;AAChD,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/api/graphql/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,UAAU,EACV,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,yCAAyC;AACzC,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC;IACxC,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACb,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QAC/C,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QAClD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QACjD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QACrD,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;QAC5D,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAChC,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QACpC,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAClC,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;KACnC,CAAC;CACH,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,IAAI,iBAAiB,CAAC;IACzC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE;QACN,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;KAClC;CACF,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC;IACxC,IAAI,EAAE,SAAS;IACf,MAAM,EAAE;QACN,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;KAC5B;CACF,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC;IACtC,IAAI,EAAE,OAAO;IACb,MAAM,EAAE;QACN,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QACjC,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QACjC,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAChC,UAAU,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;KACpC;CACF,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,IAAI,iBAAiB,CAAC;IAC7C,IAAI,EAAE,cAAc;IACpB,MAAM,EAAE;QACN,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;QAC7B,eAAe,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;KACzC;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,mBAAmB,CAAC,MAAkB;IACpD,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY;SACzC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC;SACjC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;IACrB,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAC3D,CAAC,CAAC,6CAA6C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC7E,CAAC,CAAC,uFAAuF,CAAA;IAE3F,MAAM,SAAS,GAAG,IAAI,iBAAiB,CAAC;QACtC,IAAI,EAAE,OAAO;QACb,MAAM,EAAE;YACN,OAAO,EAAE;gBACP,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE;aAC1D;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE;oBACJ,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;oBACjD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;iBACpD;aACF;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,IAAI,WAAW,CAAC,WAAW,CAAC;gBAClC,IAAI,EAAE;oBACJ,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE;oBAChG,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;oBACnD,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;oBAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;oBAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;iBAChC;aACF;YACD,MAAM,EAAE;gBACN,IAAI,EAAE,IAAI,WAAW,CAAC,gBAAgB,CAAC;gBACvC,IAAI,EAAE;oBACJ,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;oBAClD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE;oBACnD,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE;oBAC5E,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;iBAC5B;aACF;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,IAAI,WAAW,CAAC,YAAY,CAAC;gBACnC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE;aAC9D;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI,WAAW,CAAC,WAAW,CAAC;gBAClC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE;aAC9D;YACD,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,EAAE;aAC1D;SACF;KACF,CAAC,CAAA;IAEF,OAAO,IAAI,aAAa,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;AAChD,CAAC"}

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AA4BvD,OAAO,EAA8B,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAClG,OAAO,KAAK,EAAE,UAAU,EAAmD,MAAM,oBAAoB,CAAA;AACrG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,sBAAsB,CAAA;AACpC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,8BAA8B,CAAA;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAA;AAChF,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AACtE,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,0BAA0B,CAAA;AACxC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,aAAa,CAAC,EAAE,iBAAiB,CAAA;IACjC,mFAAmF;IACnF,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/D;;;;;;OAMG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;CAC3C;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CA0c3F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AA4BvD,OAAO,EAA8B,KAAK,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAClG,OAAO,KAAK,EAAE,UAAU,EAAmD,MAAM,oBAAoB,CAAA;AACrG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAE7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,sBAAsB,CAAA;AACpC,cAAc,WAAW,CAAA;AACzB,cAAc,kBAAkB,CAAA;AAChC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,sBAAsB,CAAA;AACpC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,8BAA8B,CAAA;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACjE,OAAO,EAAE,+BAA+B,EAAE,MAAM,gCAAgC,CAAA;AAChF,cAAc,oBAAoB,CAAA;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAA;AACtE,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,0BAA0B,CAAA;AACxC,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,aAAa,CAAC,EAAE,iBAAiB,CAAA;IACjC,mFAAmF;IACnF,eAAe,CAAC,EAAE,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/D;;;;;;OAMG;IACH,oBAAoB,EAAE,oBAAoB,CAAA;CAC3C;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAid3F"}

package/dist/api/index.js

@@ -1,4 +1,5 @@
 import { Router } from './router.js';
+import { resolveAuth } from './auth.js';
 import { registerContentRoutes } from './content-routes.js';
 import { registerSiteRoutes } from './site-routes.js';
 import { registerAuthRoutes } from './auth-routes.js';
@@ -486,10 +487,17 @@ export async function createKywiApiHandler(options) {
     if (emailProvider) {
         registerPasswordResetRoutes(router, { config, db, emailProvider });
     }
-    // GraphQL read-only endpoint
+    // GraphQL read-only endpoint. Resolve auth from the Authorization header and
+    // hand the resolvers a per-request context (#79). A missing/invalid header
+    // yields an anonymous context (user: null) rather than a 401 — anonymous
+    // access to published content stays legal, matching GET /search?status=published;
+    // the resolvers default-deny draft content per caller.
     const gqlSchema = createGraphQLSchema(config);
     const gqlResolvers = createResolvers(db, config);
-    router.post('/graphql', async (req) => handleGraphQLRequest(gqlSchema, gqlResolvers, req));
+    router.post('/graphql', async (req) => {
+        const auth = await resolveAuth(req.headers.get('authorization'), authSecret, db);
+        return handleGraphQLRequest(gqlSchema, gqlResolvers, req, { user: auth.user });
+    });
     // Use the resolved site UUID (kywi_webhook_endpoints.siteId is a UUID FK) so
     // webhook delivery matches endpoints correctly — a config slug would never match.
     const webhookDispatchSiteId = config.sites[0]