@tiddlywiki/mws 0.2.6 → 0.2.7

package/dist/mws.js

@@ -46800,9 +46800,6 @@ function zodSession(path12, zodRequest, preflight, inner) {
   };
 }
 __name(zodSession, "zodSession");
-serverEvents.on("mws.routes", (root, config3) => {
-  SessionManager.defineRoutes(root);
-});
 var RateLimiter = class {
   constructor(minIntervalMs) {
     this.minIntervalMs = minIntervalMs;
@@ -46841,6 +46838,14 @@ var SessionManager = class _SessionManager {
     const route = new _SessionManager();
     const keys = Object.keys(route).filter((e) => route[e] instanceof zodRoute);
     registerZodRoutes(root, route, keys);
+    root.defineRoute({
+      method: ["GET", "HEAD", "OPTIONS", "PUT"],
+      path: /^\/(?<item>login|profile)$/,
+      bodyFormat: "stream"
+    }, async (state) => {
+      await state.sendAdmin();
+      return STREAM_ENDED;
+    });
   }
   static AdminRoleName = "ADMIN";
   static UserRoleName = "USER";
@@ -46887,7 +46892,7 @@ var SessionManager = class _SessionManager {
     username: z3.prismaField("Users", "username", "string"),
     startLoginRequest: z3.string()
   }), async (state) => {
-    state.assertReferer(["/login"]);
+    state.assertReferer(["/login", "/profile"]);
   }, async (state, prisma) => {
     const { username, startLoginRequest } = state.data;
     const user = await prisma.users.findUnique({
@@ -46911,7 +46916,7 @@ var SessionManager = class _SessionManager {
     loginSession: z3.string(),
     skipCookie: z3.boolean().optional().default(false)
   }), async (state) => {
-    state.assertReferer(["/login"]);
+    state.assertReferer(["/login", "/profile"]);
   }, async (state, prisma) => {
     const { finishLoginRequest, skipCookie, loginSession } = state.data;
     if (!loginSession) throw "Login session not found.";
@@ -47139,6 +47144,218 @@ import { stat as stat2, writeFile } from "fs/promises";
 // packages/mws/src/utils/index.ts
 init_esm_shims();
 import { Readable as Readable5 } from "stream";
+
+// packages/mws/src/utils/shared.ts
+init_esm_shims();
+
+// packages/mws/browser.ts
+init_esm_shims();
+
+// packages/mws/src/new-managers/TabDataTypes.ts
+init_esm_shims();
+
+// packages/mws/src/new-managers/TabDataZod.ts
+init_esm_shims();
+var bagPermissionLevelSchema = v4_exports.union([v4_exports.literal("A_read"), v4_exports.literal("B_write"), v4_exports.literal("C_admin")]);
+var pageIdSchema = v4_exports.union([v4_exports.literal("wikis"), v4_exports.literal("templates"), v4_exports.literal("bags"), v4_exports.literal("roles"), v4_exports.literal("users")]);
+var writablePrefixRowSchema = v4_exports.object({
+  prefix: v4_exports.string(),
+  bagName: v4_exports.string()
+});
+var bagPermissionRowSchema = v4_exports.object({
+  role: v4_exports.string(),
+  level: bagPermissionLevelSchema
+});
+var templateTypesSchema = v4_exports.literal("simpleV1");
+var extraServerStuffSchema = v4_exports.object({
+  availablePlugins: v4_exports.array(v4_exports.object({
+    name: v4_exports.string(),
+    description: v4_exports.string()
+  }))
+});
+var templateSharedDefinitionSchema = v4_exports.object({
+  description: v4_exports.string(),
+  readonlyBags: v4_exports.array(v4_exports.string()),
+  plugins: v4_exports.array(v4_exports.string()),
+  writablePrefixBags: v4_exports.array(writablePrefixRowSchema)
+});
+var templateDefinitionSchema = templateSharedDefinitionSchema.extend({
+  type: templateTypesSchema,
+  requiredPluginsEnabled: v4_exports.boolean(),
+  externalStore: v4_exports.boolean(),
+  externalPlugins: v4_exports.boolean(),
+  twVersion: v4_exports.string().nullable(),
+  customHtmlEnabled: v4_exports.boolean(),
+  htmlContent: v4_exports.string(),
+  injectionFunction: v4_exports.string(),
+  injectionLocation: v4_exports.string()
+});
+var recipeDefinitionSchema = templateSharedDefinitionSchema.extend({
+  displayName: v4_exports.string()
+});
+var idStringSchema = v4_exports.any();
+var iWikiSaveSchema = recipeDefinitionSchema.extend({
+  id: idStringSchema,
+  slug: v4_exports.string(),
+  templateName: v4_exports.string(),
+  recipeUsers: v4_exports.array(v4_exports.string()),
+  recipeAdmins: v4_exports.array(v4_exports.string())
+});
+var iTemplateSaveSchema = templateDefinitionSchema.extend({
+  id: idStringSchema,
+  name: v4_exports.string(),
+  templateUsers: v4_exports.array(v4_exports.string()),
+  templateAdmins: v4_exports.array(v4_exports.string())
+});
+var iBagSaveSchema = v4_exports.object({
+  id: idStringSchema,
+  description: v4_exports.string(),
+  name: v4_exports.string(),
+  bagPermissions: v4_exports.array(bagPermissionRowSchema)
+});
+var iUserSaveSchema = v4_exports.object({
+  id: idStringSchema,
+  username: v4_exports.string(),
+  email: v4_exports.string(),
+  userRoles: v4_exports.array(v4_exports.string()),
+  resetCode: v4_exports.string()
+});
+var iRoleSaveSchema = v4_exports.object({
+  id: idStringSchema,
+  description: v4_exports.string(),
+  name: v4_exports.string()
+});
+var iWikiLoadSchema = iWikiSaveSchema.extend({
+  lastCompiledAt: v4_exports.string(),
+  effectiveWritableBags: v4_exports.array(writablePrefixRowSchema),
+  effectiveReadonlyBags: v4_exports.array(v4_exports.string()),
+  effectivePluginSet: v4_exports.array(v4_exports.string())
+});
+var iTemplateLoadSchema = iTemplateSaveSchema.extend({
+  lastUpdatedAt: v4_exports.string()
+});
+var iBagLoadSchema = iBagSaveSchema;
+var iUserLoadSchema = iUserSaveSchema;
+var iRoleLoadSchema = iRoleSaveSchema;
+var dataSaveSchema = v4_exports.object({
+  wikis: v4_exports.array(iWikiSaveSchema),
+  templates: v4_exports.array(iTemplateSaveSchema),
+  bags: v4_exports.array(iBagSaveSchema),
+  users: v4_exports.array(iUserSaveSchema),
+  roles: v4_exports.array(iRoleSaveSchema)
+});
+var dataStoreSchema = extraServerStuffSchema.extend({
+  wikis: v4_exports.array(iWikiLoadSchema),
+  templates: v4_exports.array(iTemplateLoadSchema),
+  bags: v4_exports.array(iBagLoadSchema),
+  users: v4_exports.array(iUserLoadSchema),
+  roles: v4_exports.array(iRoleLoadSchema)
+});
+
+// packages/mws/src/new-managers/TabDataTypes.ts
+var checkUniquePrefixes = /* @__PURE__ */ __name((data, context) => {
+  const prefixes = /* @__PURE__ */ new Set();
+  data.writablePrefixBags.forEach((row, index) => {
+    if (!row.bagName.trim()) return;
+    if (prefixes.has(row.prefix)) {
+      context.addIssue({
+        code: "custom",
+        message: "Writable prefixes must be unique, including the default prefix.",
+        path: ["writablePrefixBags", index, "prefix"]
+      });
+    }
+    prefixes.add(row.prefix);
+  });
+}, "checkUniquePrefixes");
+var zodWikiDataSaveSchema = iWikiSaveSchema.superRefine(checkUniquePrefixes).refine((data) => data.templateName.trim().length > 0, {
+  message: "Template name is required.",
+  path: ["templateName"]
+}).refine((data) => data.slug.trim().length > 0, {
+  message: "Slug is required.",
+  path: ["slug"]
+}).refine((data) => !data.slug.startsWith("/") && !data.slug.endsWith("/"), {
+  message: "Slug must not start or end with a forward slash.",
+  path: ["slug"]
+}).refine((data) => data.displayName.trim().length > 0, {
+  message: "Display name is required.",
+  path: ["displayName"]
+});
+var zodTemplateDataSaveSchema = iTemplateSaveSchema.superRefine(checkUniquePrefixes).refine((data) => data.name.trim().length > 0, {
+  message: "Template name is required.",
+  path: ["templateName"]
+}).superRefine((data, context) => {
+  if (!data.customHtmlEnabled) return;
+  const trimmedContent = data.htmlContent.trim();
+  if (!trimmedContent.length) {
+    context.addIssue({
+      code: "custom",
+      message: "HTML Content is required.",
+      path: ["htmlContent"]
+    });
+  }
+  if (!data.injectionFunction.trim().length) {
+    context.addIssue({
+      code: "custom",
+      message: "Injection function is required.",
+      path: ["injectionFunction"]
+    });
+  }
+  const trimmedLocation = data.injectionLocation.trim();
+  if (!trimmedLocation.length) {
+    context.addIssue({
+      code: "custom",
+      message: "Injection marker is required.",
+      path: ["injectionLocation"]
+    });
+  }
+  if (trimmedLocation && trimmedContent && trimmedContent.indexOf(trimmedLocation) === -1) {
+    context.addIssue({
+      code: "custom",
+      message: "HTML content does not contain injection marker.",
+      path: ["htmlContent"]
+    });
+    context.addIssue({
+      code: "custom",
+      message: "HTML content does not contain injection marker.",
+      path: ["injectionLocation"]
+    });
+  }
+});
+var zodBagDataSaveSchema = iBagSaveSchema.refine((data) => data.name.trim().length > 0, {
+  message: "Bag name is required.",
+  path: ["name"]
+});
+var zodRoleDataSaveSchema = iRoleSaveSchema.refine((data) => data.name.trim().length > 0, {
+  message: "Role name is required.",
+  path: ["name"]
+});
+var zodUserDataSaveSchema = iUserSaveSchema.refine((data) => data.username.trim().length > 0, {
+  message: "Username is required.",
+  path: ["username"]
+});
+
+// packages/mws/src/utils/shared.ts
+var IdString = class _IdString extends String {
+  static {
+    __name(this, "IdString");
+  }
+  static cast(val) {
+    return val.toString();
+  }
+  static prefix = "IdString____";
+  name = "IdString";
+  constructor(value) {
+    super(value);
+  }
+  toJSON() {
+    return _IdString.prefix + this.valueOf();
+  }
+};
+SendError.errorString = (error48) => {
+  return error48 instanceof SendError ? error48.reason === "INVALID_REQUEST_BODY" || error48.reason === "INVALID_REQUEST_QUERY" || error48.reason === "INVALID_REQUEST_PATH" ? error48.details.prettyErrors : error48.reason : error48 instanceof Error ? error48.message : String(error48);
+};
+
+// packages/mws/src/utils/index.ts
 function readableBuffers(sources) {
   return Readable5.from((async function* () {
     for (const src of sources) {
@@ -50949,544 +51166,6 @@ __name(startupCache, "startupCache");
 // packages/mws/src/new-managers/RecipeResolver.ts
 init_esm_shims();
 import { createHash as createHash4 } from "crypto";
-
-// packages/admin-vanilla/src/definition/tabs.ts
-init_esm_shims();
-var halfWidth = "half";
-var fullWidth = "full";
-var stackLayout = "stack";
-var IdString = class _IdString extends String {
-  static {
-    __name(this, "IdString");
-  }
-  static cast(val) {
-    return val.toString();
-  }
-  static prefix = "IdString____";
-  name = "IdString";
-  constructor(value) {
-    super(value);
-  }
-  toJSON() {
-    return _IdString.prefix + this.valueOf();
-  }
-};
-var stringLikeFieldShape = v4_exports.union([v4_exports.string(), v4_exports.instanceof(IdString)]);
-var fieldTypeZodShapes = {
-  "template-type": v4_exports.enum(["simpleV1"]),
-  "string": v4_exports.string(),
-  "text": v4_exports.string(),
-  "enter-password": v4_exports.string(),
-  "confirm-password": v4_exports.string(),
-  "search": v4_exports.string(),
-  "structured-preview": v4_exports.string(),
-  "table": v4_exports.string().array(),
-  "permission-table": v4_exports.array(v4_exports.object({
-    role: v4_exports.string(),
-    level: v4_exports.string()
-  })),
-  "validation-report": v4_exports.string(),
-  "resolver-preview": v4_exports.string(),
-  "search-multiselect": v4_exports.string().array(),
-  "search-optional": v4_exports.string().nullable(),
-  "prefix-table": v4_exports.array(v4_exports.object({
-    prefix: v4_exports.string(),
-    bagName: v4_exports.string()
-  })),
-  "parameter-list": v4_exports.string().array(),
-  "relationship-table": v4_exports.string().array(),
-  "summary-list": v4_exports.string().array(),
-  "number": v4_exports.string(),
-  "activity-feed": v4_exports.string().array(),
-  "version": v4_exports.string(),
-  "select": v4_exports.string(),
-  "switch": v4_exports.boolean(),
-  "metadata-table": v4_exports.string().array()
-};
-var writableRoutingDescription = "Set the title prefix for each bag you want to write to. Tiddlers are only read from the bag matching the prefix.";
-var tabs = {
-  wikis: {
-    id: "wikis",
-    label: "Wikis",
-    createLabel: "Create wiki",
-    eyebrow: "Your thoughts",
-    description: "Final wiki instances built from a template plus per-wiki customizations.",
-    columns: [
-      { key: "slug", label: "Slug", width: 2 },
-      { key: "displayName", label: "Display name", width: 2 },
-      { key: "templateName", label: "Template" },
-      { key: "defaultWritableBag", label: "Default bag" },
-      { key: "prefixRuleCount", label: "Prefix rules" },
-      { key: "readonlyBagCount", label: "Readonly bags" },
-      { key: "pluginCount", label: "Plugins" }
-      // { key: "edit", label: "" }
-      // { key: "lastCompiledAt", label: "Compiled" },
-      // { key: "statusFlags", label: "Status" },
-      // { key: "compileValidation", label: "Validation" }
-    ],
-    fields: [
-      { key: "slug", label: "Slug", type: "string", section: "authored", mode: "create edit" },
-      { key: "displayName", label: "Display name", type: "string", section: "authored", mode: "create edit" },
-      { key: "description", label: "Description", type: "text", section: "authored", mode: "create edit" },
-      { key: "templateName", label: "Template", type: "search", section: "authored", mode: "create" },
-      { key: "readonlyBags", label: "Bag name", type: "search-multiselect", section: "authored", mode: "create edit" },
-      { key: "plugins", label: "Plugin name", type: "search-multiselect", section: "authored", mode: "create edit" },
-      { key: "lastCompiledAt", label: "Compiled", type: "string", section: "runtime", mode: "server" },
-      {
-        key: "writablePrefixBags",
-        label: "Writable prefix bags",
-        type: "prefix-table",
-        section: "authored",
-        mode: "create edit",
-        architecture: "Edits the wiki-level prefix-to-bag routing table that drives write target selection. Longest prefix wins, and the empty string row is the fallback write target. A tiddler will only be read from the single write target it matches, after that the readonly bags are used, other write targets are ignored."
-      },
-      {
-        key: "effectiveWritableBags",
-        label: "Current writable bags",
-        type: "prefix-table",
-        section: "runtime",
-        mode: "server",
-        architecture: "Read-only projection of compiled recipe-bag rows in the same slice of the pie order the resolver uses for writes."
-      },
-      {
-        key: "effectiveReadonlyBags",
-        label: "Current readonly bags",
-        type: "table",
-        section: "runtime",
-        mode: "server",
-        architecture: "Read-only projection of compiled recipe-bag rows in the same top-to-bottom order the resolver uses for reads."
-      },
-      {
-        key: "effectivePluginSet",
-        label: "Current plugin set",
-        type: "table",
-        section: "runtime",
-        mode: "server",
-        architecture: "Read-only projection of the resolved plugin rows that will actually be used by the wiki page and preload path."
-      },
-      {
-        key: "recipeUsers",
-        label: "Role name",
-        type: "search-multiselect",
-        section: "authored",
-        mode: "create edit",
-        architecture: "Edits permission rows on the wiki definition itself. These govern access to the wiki surface separately from bag-level read and write rights."
-      },
-      {
-        key: "recipeAdmins",
-        label: "Role name",
-        type: "search-multiselect",
-        section: "authored",
-        mode: "create edit",
-        architecture: "Edits permission rows on the wiki definition itself. These govern access to the wiki surface separately from bag-level read and write rights."
-      },
-      {
-        key: "compileValidation",
-        label: "Compile validation",
-        type: "validation-report",
-        section: "runtime",
-        mode: "",
-        architecture: "Read-only validation and compilation result across template, parameters, bag references, plugin references, and routing invariants."
-      },
-      {
-        key: "titleResolutionPreview",
-        label: "Title routing test",
-        type: "resolver-preview",
-        section: "operations",
-        mode: "edit temp",
-        architecture: "Diagnostic resolver output for a title entered by the user: computed prefix match and authored write target selection only. Read answers and final write permission would require live server state."
-      }
-    ],
-    fieldGroups: {
-      authored: [
-        { title: "Basic Info", keys: ["slug", "displayName", "description", "templateName"], width: fullWidth, layout: stackLayout },
-        {
-          title: "Writable bags",
-          description: "Tiddlers are written to and read from the longest matching prefix; unmatched titles use the default bag.",
-          keys: ["writablePrefixBags"],
-          width: fullWidth
-        },
-        {
-          title: "Readonly bags",
-          description: "Checked when the tiddler is not in the writable bag matching the prefix.",
-          keys: ["readonlyBags"],
-          width: halfWidth
-        },
-        { title: "Plugins", description: "Add wiki-specific plugins on top of the template plugin set.", keys: ["plugins"], width: halfWidth },
-        { title: "Recipe Users", description: "Users able to open this wiki, assuming they have read permission on every bag as well.", keys: ["recipeUsers"], width: halfWidth },
-        { title: "Recipe Admins", description: "Users able to make changes on this page.", keys: ["recipeAdmins"], width: halfWidth },
-        { title: "Access", description: "Controls who can edit the wiki settings.", keys: ["recipePermissions"], width: fullWidth }
-      ],
-      runtime: [
-        // { title: "Computed Write Prefix", description: "", keys: ["effectiveWritableBags"], width: fullWidth },
-        // { title: "Computed Bag Order", description: "", keys: ["effectiveReadonlyBags"], width: halfWidth },
-        // { title: "Computed Plugin Set", description: "", keys: ["effectivePluginSet"], width: halfWidth },
-        // { title: "Compilation status", description: "Validation and compilation outcome for the current authored state.", keys: ["compileValidation"], width: fullWidth },
-      ],
-      operations: [
-        {
-          title: "Title routing test",
-          description: "Test a title against the wiki's current prefix rules to see which bag would receive writes.",
-          keys: ["titleResolutionPreview"],
-          width: fullWidth
-        }
-      ]
-    },
-    sidebarDisplay: [
-      "displayName",
-      "slug",
-      "templateName",
-      "effectiveWritableBags",
-      "effectiveReadonlyBags",
-      "effectivePluginSet"
-    ]
-  },
-  templates: {
-    id: "templates",
-    label: "Templates",
-    createLabel: "Create template",
-    eyebrow: "Wiki Blueprints",
-    description: "Reusable recipe definitions. Changes made to a template apply to every wiki using it.",
-    columns: [
-      { key: "name", label: "Name", width: 2 },
-      { key: "description", label: "Description", width: 3 },
-      { key: "readonlyBagsSummary", label: "Readonly bags" },
-      // { key: "writablePrefixSummary", label: "Writable prefixes" },
-      { key: "dependentWikiCount", label: "Dependent wikis" },
-      { key: "lastUpdatedAt", label: "Updated", width: 2 }
-      // { key: "validationStatus", label: "Validation" },
-    ],
-    fields: [
-      { key: "type", label: "Type", type: "template-type", section: "authored", mode: "create" },
-      { key: "name", label: "Name", type: "string", section: "authored", mode: "create edit" },
-      { key: "description", label: "Description", type: "text", section: "authored", mode: "create edit" },
-      { key: "lastUpdatedAt", label: "Updated", type: "string", section: "runtime", mode: "server" },
-      {
-        key: "writablePrefixBags",
-        label: "Writable prefix bags",
-        type: "prefix-table",
-        section: "authored",
-        mode: "create edit",
-        architecture: "Edits the template-level prefix-to-bag routing table that wikis inherit first. Longest prefix wins, and the empty string row is the fallback write target when no wiki-level override matches."
-      },
-      { key: "readonlyBags", label: "Bag name", type: "search-multiselect", section: "authored", mode: "create edit" },
-      { key: "plugins", label: "Plugin name", type: "search-multiselect", section: "authored", mode: "create edit" },
-      {
-        key: "templateUsers",
-        label: "Role name",
-        type: "search-multiselect",
-        section: "authored",
-        mode: "create edit",
-        architecture: "Edits permission rows on the wiki definition itself. These govern access to the wiki surface separately from bag-level read and write rights."
-      },
-      {
-        key: "templateAdmins",
-        label: "Role name",
-        type: "search-multiselect",
-        section: "authored",
-        mode: "create edit",
-        architecture: "Edits permission rows on the wiki definition itself. These govern access to the wiki surface separately from bag-level read and write rights."
-      },
-      {
-        key: "requiredPluginsEnabled",
-        label: "Include Required Plugins",
-        type: "switch",
-        section: "authored",
-        mode: "create edit",
-        description: "Core plugins enable wiki sync functionality. Disabling removes the plugins, but does not disable the endpoints."
-      },
-      {
-        key: "externalStore",
-        label: "External JS Store",
-        type: "switch",
-        section: "authored",
-        mode: "create edit",
-        description: "Loads the entire store, including plugins, via a script tag."
-      },
-      {
-        key: "externalPlugins",
-        label: "Enable Plugin Caching",
-        type: "switch",
-        section: "authored",
-        mode: "create edit",
-        description: "Serves plugins separately, allowing the browser to cache plugins separate from the store."
-      },
-      {
-        key: "twVersion",
-        label: "TiddlyWiki Version",
-        type: "search-optional",
-        section: "authored",
-        mode: "create edit",
-        description: "TW5 version pinning. Leave blank to use site default."
-      },
-      {
-        key: "customHtmlEnabled",
-        label: "Custom HTML shell",
-        type: "switch",
-        section: "authored",
-        mode: "create edit",
-        description: "Enable custom HTML shell settings when this template should serve authored HTML instead of the default page shell."
-      },
-      {
-        key: "htmlContent",
-        label: "HTML content",
-        type: "text",
-        section: "authored",
-        mode: "create edit",
-        description: "Store the raw HTML that will be served for this template. All HTTP endpoints still work, but any boot, library, or raw markup tiddlers must be included here manually."
-      },
-      {
-        key: "injectionFunction",
-        label: "Injection function",
-        type: "string",
-        section: "authored",
-        mode: "create edit",
-        description: "Name of the JavaScript function to call with each tiddler, for example $tw.preloadTiddler."
-      },
-      {
-        key: "injectionLocation",
-        label: "Injection marker",
-        type: "string",
-        section: "authored",
-        mode: "create edit",
-        description: "Inject the tiddlers before this string in the HTML file, for example <!-- INJECT STORE TIDDLERS HERE -->. It must not be inside a script tag."
-      },
-      {
-        key: "defaultWritableBag",
-        label: "Default writable bag",
-        type: "string",
-        section: "runtime",
-        mode: "",
-        architecture: "Read-only convenience projection of the writablePrefixBags row whose prefix is the empty string."
-      },
-      {
-        key: "dependentWikis",
-        label: "Dependent wikis",
-        type: "relationship-table",
-        section: "runtime",
-        mode: "",
-        architecture: "Read-only relationship view listing all wikis that reference this template and will be revalidated or recompiled if it changes."
-      },
-      {
-        key: "validationReport",
-        label: "Validation result",
-        type: "validation-report",
-        section: "runtime",
-        mode: "",
-        architecture: "Read-only summary of whether the definition can compile cleanly against current bag and plugin references."
-      }
-    ],
-    fieldGroups: {
-      authored: [
-        { title: "Template basics", keys: ["name", "description", "twVersion"], width: fullWidth, layout: stackLayout },
-        { title: "Writable routing", description: writableRoutingDescription, keys: ["writablePrefixBags"], width: fullWidth },
-        { title: "Bags", keys: ["readonlyBags"], width: halfWidth },
-        { title: "Plugins", keys: ["plugins", "requiredPluginsEnabled", "externalPlugins"], width: halfWidth, layout: stackLayout },
-        { title: "Template Users", description: "Users who can set this template on a recipe. This only applies to the user creating the recipe.", keys: ["templateUsers"], width: halfWidth },
-        { title: "Template Admins", description: "Users able to make changes on this page. This affects all recipes that use the template, regardless of any other permissions.", keys: ["templateAdmins"], width: halfWidth },
-        { title: "Custom HTML shell", keys: ["htmlContent", "injectionFunction", "injectionLocation"], headerFieldKey: "customHtmlEnabled", disabledWhenHeaderOff: true, width: fullWidth, layout: stackLayout }
-      ],
-      runtime: [
-        // { keys: ["defaultWritableBag"], width: halfWidth },
-        // { keys: ["dependentWikis"], width: halfWidth },
-        // { keys: ["validationReport"], width: halfWidth },
-      ]
-    },
-    sidebarDisplay: [
-      "name",
-      "description",
-      "dependentWikiCount"
-    ]
-  },
-  bags: {
-    id: "bags",
-    label: "Bags",
-    createLabel: "Create bag",
-    eyebrow: "Tiddler Storage",
-    description: "Concrete tiddler storage with role-based access control.",
-    columns: [
-      { key: "name", label: "Name", width: 2 },
-      { key: "description", label: "Description", width: 2 },
-      { key: "usedByCount", label: "Used by" },
-      { key: "readonlyUsageCount", label: "Readonly" },
-      { key: "writableUsageCount", label: "Writable" },
-      { key: "defaultUsageCount", label: "Default" },
-      { key: "permissionSummary", label: "Permissions" }
-      // { key: "tiddlerCount", label: "Tiddlers" },
-      // { key: "lastActivityAt", label: "Last activity" },
-    ],
-    fields: [
-      { key: "name", label: "Name", type: "string", section: "authored", mode: "create edit" },
-      { key: "description", label: "Description", type: "text", section: "authored", mode: "create edit" },
-      {
-        key: "bagPermissions",
-        label: "Permissions",
-        type: "permission-table",
-        section: "authored",
-        mode: "create edit",
-        architecture: "Edits bag permission rows. These rows are consulted directly by the resolver when deciding who can read from or write to the storage container."
-      },
-      {
-        key: "referencedByTemplates",
-        label: "Referenced by templates",
-        type: "relationship-table",
-        section: "runtime",
-        mode: "",
-        architecture: "Read-only relationship view derived from authored template definition JSON that mentions this bag in readonly or writable routing positions."
-      },
-      {
-        key: "referencedByWikis",
-        label: "Referenced by wikis",
-        type: "relationship-table",
-        section: "runtime",
-        mode: "",
-        architecture: "Read-only relationship view derived from compiled recipe-bag rows, reflecting the effective runtime routing topology."
-      },
-      {
-        key: "routingRoles",
-        label: "Routing roles",
-        type: "summary-list",
-        section: "runtime",
-        mode: "",
-        architecture: "Derived routing summary classifying how this bag participates across compiled wikis, such as readonly layer, writable prefix target, or default fallback."
-      }
-      // { key: "tiddlerCount", label: "Tiddler count", type: "number", section: "runtime", mode: "", },
-      // {
-      //   key: "recentActivity",
-      //   label: "Recent activity",
-      //   type: "activity-feed",
-      //   section: "runtime",
-      //   mode: "",
-      //   architecture: "Read-only operational summary built from recent tiddler event rows for this bag.",
-      // },
-    ],
-    fieldGroups: {
-      authored: [
-        { title: "Bag basics", keys: ["name", "description"], width: fullWidth, layout: stackLayout },
-        { keys: ["bagPermissions"], width: fullWidth }
-      ],
-      runtime: [
-        { keys: ["referencedByTemplates"], width: halfWidth },
-        { keys: ["referencedByWikis"], width: halfWidth }
-        // { keys: ["routingRoles"], width: halfWidth },
-        // { keys: ["tiddlerCount"], width: halfWidth },
-        // { keys: ["recentActivity"], width: fullWidth },
-      ]
-    },
-    sidebarDisplay: [
-      "name",
-      "description",
-      "referencedByTemplates",
-      "referencedByWikis"
-    ]
-  },
-  // plugins: {
-  //   id: "plugins",
-  //   label: "Plugins",
-  //   createLabel: "Create plugin",
-  //   eyebrow: "Managed Assets",
-  //   description: "Separately versioned plugins compiled into each wiki’s resolved plugin set. Still work in progress.",
-  //   columns: [
-  //     { key: "name", label: "Name" },
-  //     { key: "description", label: "Description" },
-  //     { key: "pluginPath", label: "Plugin Path" },
-  //     { key: "usageCount", label: "Usage" },
-  //   ],
-  //   fields: [
-  //     { key: "name", label: "Name", type: "string", section: "authored", mode: "server" },
-  //     { key: "description", label: "Description", type: "text", section: "authored", mode: "server" },
-  //     { key: "pluginPath", label: "Path", type: "string", section: "authored", mode: "server" },
-  //     { key: "usageCount", label: "Wiki Count", type: "number", section: "runtime", mode: "" },
-  //     { key: "usedByWikis", label: "Active Wikis", type: "table", section: "runtime", mode: "" },
-  //   ],
-  //   fieldGroups: {
-  //     runtime: [
-  //       { title: "Used in", description: "List of wikis this plugin is used in. Only includes templates that are in use.", keys: ["usedByWikis"], width: fullWidth, layout: "grid" },
-  //     ],
-  //   },
-  //   sidebarDisplay: [
-  //     "name",
-  //     "description",
-  //     "usageCount",
-  //     "pluginPath",
-  //   ],
-  // },
-  roles: {
-    id: "roles",
-    label: "Roles",
-    createLabel: "Create role",
-    eyebrow: "Access profiles",
-    description: "Named access profiles that can be assigned to user accounts.",
-    columns: [
-      { key: "name", label: "Role name", width: 2 },
-      { key: "description", label: "Role description", width: 7 }
-    ],
-    fields: [
-      { key: "name", label: "Role name", type: "string", section: "authored", mode: "create edit" },
-      { key: "description", label: "Role description", type: "text", section: "authored", mode: "create edit" }
-    ],
-    fieldGroups: {
-      authored: [
-        { title: "Role basics", keys: ["name", "description"], width: fullWidth, layout: stackLayout }
-      ]
-    },
-    sidebarDisplay: ["name", "description"]
-  },
-  // #region users
-  users: {
-    id: "users",
-    label: "Users",
-    createLabel: "Create user",
-    eyebrow: "Account logins",
-    description: "User accounts with assigned roles.",
-    columns: [
-      { key: "username", label: "Username", width: 2 },
-      { key: "email", label: "Email", width: 7 }
-    ],
-    fields: [
-      { key: "username", label: "Username", type: "string", section: "authored", mode: "create edit" },
-      { key: "email", label: "Email", type: "string", section: "authored", mode: "create edit" },
-      { key: "userRoles", label: "Roles", type: "search-multiselect", section: "authored", mode: "create edit" },
-      { key: "resetCode", label: "Reset Code", type: "string", section: "authored", mode: "create edit" }
-      // { key: "password", label: "Password", type: "string", section: "authored", mode: "create edit" },
-      // { key: "confirmPassword", label: "Confirm password", type: "string", section: "authored", mode: "create edit temp" },
-    ],
-    fieldGroups: {
-      authored: [
-        { title: "User identity", keys: ["username", "email"], width: fullWidth, layout: stackLayout },
-        { title: "Roles", description: "Assign one or more role ids to this user account.", keys: ["userRoles"], width: halfWidth },
-        { title: "Reset Code", description: "Allow the user to reset their password with this code.", keys: ["resetCode"], width: halfWidth },
-        { title: "Credentials", keys: ["password", "confirmPassword"], width: halfWidth, layout: stackLayout }
-      ]
-    },
-    sidebarDisplay: [
-      "username",
-      "email",
-      "userRoles"
-    ]
-  }
-};
-function shouldIncludeFieldInTabZodObject(mode, filter) {
-  if (filter === "DataStore") {
-    return mode !== "" && mode !== "create edit temp" && mode !== "create temp" && mode !== "edit temp";
-  }
-  if (filter === "DataSave") {
-    return mode !== "" && mode !== "create edit temp" && mode !== "create temp" && mode !== "edit temp" && mode !== "server";
-  }
-  return true;
-}
-__name(shouldIncludeFieldInTabZodObject, "shouldIncludeFieldInTabZodObject");
-function buildTabZodObject(tabId, filter) {
-  const tab = tabs[tabId];
-  const fieldEntries = tab.fields.filter((field) => shouldIncludeFieldInTabZodObject(field.mode, filter)).map((field) => [field.key, fieldTypeZodShapes[field.type]]);
-  return v4_exports.object({
-    id: stringLikeFieldShape,
-    ...Object.fromEntries(fieldEntries)
-  });
-}
-__name(buildTabZodObject, "buildTabZodObject");
-
-// packages/mws/src/new-managers/RecipeResolver.ts
 var WRITE_LEVELS = ["B_write", "C_admin"];
 var RecipeResolver = class {
   // #region constructor
@@ -52608,7 +52287,8 @@ var RecipeRoutes = class _RecipeRoutes {
       state.assertWikiReferer(recipe_slug);
       const recipe = await RecipeResolver.assertRecipe({
         state,
-        recipe_slug
+        recipe_slug,
+        sendNotFound: true
       }).then((e) => {
         state.asserted = true;
         return e;
@@ -52647,7 +52327,8 @@ var RecipeRoutes = class _RecipeRoutes {
       state.assertWikiReferer(recipe_slug);
       const recipe = await RecipeResolver.assertRecipe({
         state,
-        recipe_slug
+        recipe_slug,
+        sendNotFound: true
       }).then((e) => {
         state.asserted = true;
         return e;
@@ -52671,7 +52352,7 @@ var RecipeRoutes = class _RecipeRoutes {
     inner: /* @__PURE__ */ __name(async (state) => {
       const { recipe_slug } = state.pathParams;
       state.assertWikiReferer(recipe_slug);
-      throw await serveWikiIndex(state, recipe_slug, "store.js");
+      throw await serveWikiIndex(state, recipe_slug, "store.js", true);
     }, "inner")
   });
   // #region RecipeStore
@@ -52687,7 +52368,7 @@ var RecipeRoutes = class _RecipeRoutes {
     inner: /* @__PURE__ */ __name(async (state) => {
       const { recipe_slug } = state.pathParams;
       state.assertWikiReferer(recipe_slug);
-      throw await serveWikiIndex(state, recipe_slug, "store.json");
+      throw await serveWikiIndex(state, recipe_slug, "store.json", true);
     }, "inner")
   });
   // #region RecipeUpdates
@@ -52706,7 +52387,8 @@ var RecipeRoutes = class _RecipeRoutes {
       state.assertWikiReferer(recipe_slug);
       const recipe = await RecipeResolver.assertRecipe({
         state,
-        recipe_slug
+        recipe_slug,
+        sendNotFound: true
       }).then((e) => {
         state.asserted = true;
         return e;
@@ -52763,7 +52445,8 @@ var RecipeRoutes = class _RecipeRoutes {
       state.assertWikiReferer(recipe_slug);
       const recipe = await RecipeResolver.assertRecipe({
         state,
-        recipe_slug
+        recipe_slug,
+        sendNotFound: true
       }).then((e) => {
         state.asserted = true;
         return e;
@@ -53649,6 +53332,11 @@ var AdminRoutes = class _AdminRoutes {
     registerZodRoutes(root, route, keys);
   }
   static AdminPrefix;
+  okIsLoggedIn(state) {
+    state.asserted = state.user.isLoggedIn;
+    if (!state.asserted)
+      throw new SendError("UNAUTHORIZED", 401, null);
+  }
   // #region AdminSave
   AdminSave = zodRoute({
     method: ["PUT"],
@@ -53662,13 +53350,30 @@ var AdminRoutes = class _AdminRoutes {
     zodRequestBody: /* @__PURE__ */ __name((z3) => z3.any(), "zodRequestBody"),
     inner: /* @__PURE__ */ __name(async (state) => {
       state.assertReferer(["/"]);
-      state.asserted = state.user.isLoggedIn;
+      this.okIsLoggedIn(state);
       state.data = JSON.parse(JSON.stringify(state.data), (key, val) => {
         if (typeof val === "string" && val.startsWith(IdString.prefix))
           return new IdString(val.slice(IdString.prefix.length));
         return val;
       });
-      checkData(state, () => buildTabZodObject(state.pathParams.tab, "DataSave"), new Error());
+      checkData(state, () => {
+        switch (state.pathParams.tab) {
+          case "wikis":
+            return zodWikiDataSaveSchema;
+          case "templates":
+            return zodTemplateDataSaveSchema;
+          case "bags":
+            return zodBagDataSaveSchema;
+          case "roles":
+            return zodRoleDataSaveSchema;
+          case "users":
+            return zodUserDataSaveSchema;
+          default: {
+            const _exhaustive = state.pathParams.tab;
+            throw new Error(`Unsupported admin tab: ${_exhaustive}`);
+          }
+        }
+      }, new Error());
       const res = await state.$transaction(async (prisma) => {
         const { pathParams: { op, tab }, data } = state;
         switch (op) {
@@ -53695,7 +53400,24 @@ var AdminRoutes = class _AdminRoutes {
           }
         }
       });
-      const { success: success2, data: res2, error: error48 } = buildTabZodObject(state.pathParams.tab, "DataStore").safeParse(res);
+      const { success: success2, data: res2, error: error48 } = (() => {
+        switch (state.pathParams.tab) {
+          case "wikis":
+            return iWikiLoadSchema;
+          case "templates":
+            return iTemplateLoadSchema;
+          case "bags":
+            return iBagLoadSchema;
+          case "roles":
+            return iRoleLoadSchema;
+          case "users":
+            return iUserLoadSchema;
+          default: {
+            const _exhaustive = state.pathParams.tab;
+            throw new Error(`Unsupported admin tab: ${_exhaustive}`);
+          }
+        }
+      })().safeParse(res);
       if (!success2) console.log("Response validation: ", error48);
       return res2;
     }, "inner")
@@ -53709,7 +53431,7 @@ var AdminRoutes = class _AdminRoutes {
     zodPathParams: /* @__PURE__ */ __name((z3) => ({}), "zodPathParams"),
     inner: /* @__PURE__ */ __name(async (state) => {
       state.assertReferer(["/"]);
-      state.asserted = state.user.isLoggedIn;
+      this.okIsLoggedIn(state);
       const res = await state.$transaction(async (prisma) => {
         const roles = await new RoleImportWriter(prisma, false).getIdMapper();
         return {
@@ -53724,17 +53446,7 @@ var AdminRoutes = class _AdminRoutes {
           }))
         };
       });
-      const { success: success2, data, error: error48 } = v4_exports.object({
-        wikis: buildTabZodObject("wikis", "DataStore").array(),
-        templates: buildTabZodObject("templates", "DataStore").array(),
-        bags: buildTabZodObject("bags", "DataStore").array(),
-        roles: buildTabZodObject("roles", "DataStore").array(),
-        users: buildTabZodObject("users", "DataStore").array(),
-        availablePlugins: v4_exports.array(v4_exports.object({
-          name: v4_exports.string(),
-          description: v4_exports.string()
-        }))
-      }).safeParse(res);
+      const { success: success2, data, error: error48 } = dataStoreSchema.safeParse(res);
       if (!success2) throw error48;
       return data;
     }, "inner")
@@ -53746,7 +53458,7 @@ init_esm_shims();
 
 // packages/mws/src/new-managers/index.ts
 serverEvents.on("mws.routes", (root, config3) => {
-  config3.rootRoutes;
+  SessionManager.defineRoutes(root);
   const parent = root.defineRoute({
     method: [],
     denyFinal: true,
@@ -55153,6 +54865,7 @@ SendError.oninstance.push((e) => {
     case "TIDDLER_WIRE_FORMAT_UNKNOWN":
     case "WRITE_NOT_PERMITTED":
     case "ACCESS_DENIED":
+    case "UNAUTHORIZED":
     case "NOT_FOUND": {
       e.skiplog = true;
       break;