katecms 0.0.0-stage → 1.0.0-beta.1

package/dist/runtime/server/api/_katecms/dictionaries/[dictionary]/[id].get.js

@@ -0,0 +1,45 @@
+import { defineEventHandler, getRouterParam } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { can, findDictionaryById, listDictionaries } from "@katecms/core";
+import { getDb } from "../../../../utils/db.js";
+import { requireUser } from "../../../../utils/session.js";
+import { requirePermission } from "../../../../utils/permissions.js";
+import {
+  fail,
+  flattenDictionaryTerms,
+  listDictionaryParentOptions,
+  readDictionarySlug,
+  readEntryId,
+  requireDictionary,
+  toAdminTerm,
+  toDictionaryMeta
+} from "../../../../utils/dictionaries.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  const dictionarySlug = readDictionarySlug(getRouterParam(event, "dictionary"));
+  const id = readEntryId(getRouterParam(event, "id"));
+  const def = requireDictionary(dictionarySlug);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  requirePermission(actor, "dictionaries", "read", roles, dictionarySlug);
+  const db = getDb();
+  const row = await findDictionaryById(db, id);
+  if (!row || row.type !== dictionarySlug) {
+    fail(404, "Term not found.");
+  }
+  const rows = await listDictionaries(db, dictionarySlug);
+  const listed = flattenDictionaryTerms(rows);
+  const node = listed.find((item) => item.row.id === row.id);
+  const canUpdate = can(actor, "dictionaries", "update", { roles, scope: dictionarySlug });
+  const canDelete = can(actor, "dictionaries", "delete", { roles, scope: dictionarySlug });
+  return {
+    dictionary: toDictionaryMeta(dictionarySlug, def),
+    term: toAdminTerm(row, node?.slugPath ?? row.slug, {
+      canUpdate,
+      canDelete,
+      depth: node?.depth
+    }),
+    canUpdate,
+    canDelete,
+    parents: listDictionaryParentOptions(rows, id)
+  };
+});

package/dist/runtime/server/api/_katecms/dictionaries/[dictionary]/[id].patch.d.ts

@@ -0,0 +1,4 @@
+import type { DictionaryTermResponse } from '../../../../../utils/dictionaries.js';
+/** Partial update of a dictionary term. */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<DictionaryTermResponse>>;
+export default _default;

package/dist/runtime/server/api/_katecms/dictionaries/[dictionary]/[id].patch.js

@@ -0,0 +1,83 @@
+import { defineEventHandler, getRouterParam, readBody } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { can, findDictionaryById, listDictionaries, updateDictionary } from "@katecms/core";
+import { getDb } from "../../../../utils/db.js";
+import { requireUser } from "../../../../utils/session.js";
+import { requirePermission } from "../../../../utils/permissions.js";
+import {
+  assertDictionaryParent,
+  fail,
+  flattenDictionaryTerms,
+  listDictionaryParentOptions,
+  readDictionarySlug,
+  readEntryId,
+  readFields,
+  readParentId,
+  readSlug,
+  readTitle,
+  requireDictionary,
+  requireTermFields,
+  rethrowDictionaryWriteError,
+  toAdminTerm,
+  toDictionaryMeta
+} from "../../../../utils/dictionaries.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  const dictionarySlug = readDictionarySlug(getRouterParam(event, "dictionary"));
+  const id = readEntryId(getRouterParam(event, "id"));
+  const def = requireDictionary(dictionarySlug);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  requirePermission(actor, "dictionaries", "update", roles, dictionarySlug);
+  const db = getDb();
+  const existing = await findDictionaryById(db, id);
+  if (!existing || existing.type !== dictionarySlug) {
+    fail(404, "Term not found.");
+  }
+  const body = await readBody(event);
+  const patch = {};
+  if (body?.title !== void 0) {
+    patch.title = readTitle(body.title);
+  }
+  if (body?.slug !== void 0) {
+    patch.slug = readSlug(body.slug);
+  }
+  if (body?.fields !== void 0) {
+    patch.fields = readFields(body.fields);
+  }
+  if (def.hierarchical === true && body?.parentId !== void 0) {
+    patch.parent_id = readParentId(body.parentId);
+  }
+  const nextFields = patch.fields ?? existing.fields ?? {};
+  requireTermFields(def, nextFields);
+  const rows = await listDictionaries(db, dictionarySlug);
+  assertDictionaryParent(
+    rows,
+    dictionarySlug,
+    patch.parent_id !== void 0 ? patch.parent_id : existing.parent_id,
+    id
+  );
+  try {
+    const row = await updateDictionary(db, id, patch);
+    if (!row) {
+      fail(404, "Term not found.");
+    }
+    const nextRows = await listDictionaries(db, dictionarySlug);
+    const listed = flattenDictionaryTerms(nextRows);
+    const node = listed.find((item) => item.row.id === row.id);
+    const canUpdate = can(actor, "dictionaries", "update", { roles, scope: dictionarySlug });
+    const canDelete = can(actor, "dictionaries", "delete", { roles, scope: dictionarySlug });
+    return {
+      dictionary: toDictionaryMeta(dictionarySlug, def),
+      term: toAdminTerm(row, node?.slugPath ?? row.slug, {
+        canUpdate,
+        canDelete,
+        depth: node?.depth
+      }),
+      canUpdate,
+      canDelete,
+      parents: listDictionaryParentOptions(nextRows, id)
+    };
+  } catch (error) {
+    rethrowDictionaryWriteError(error);
+  }
+});

package/dist/runtime/server/api/_katecms/dictionaries/[dictionary].get.d.ts

@@ -0,0 +1,4 @@
+import type { DictionaryListResponse } from '../../../../utils/dictionaries.js';
+/** List terms of a dictionary type. */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<DictionaryListResponse>>;
+export default _default;

package/dist/runtime/server/api/_katecms/dictionaries/[dictionary].get.js

@@ -0,0 +1,38 @@
+import { defineEventHandler, getRouterParam } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { can, listDictionaries } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { requireUser } from "../../../utils/session.js";
+import { requirePermission } from "../../../utils/permissions.js";
+import {
+  flattenDictionaryTerms,
+  listDictionaryParentOptions,
+  readDictionarySlug,
+  requireDictionary,
+  toAdminTerm,
+  toDictionaryMeta
+} from "../../../utils/dictionaries.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  const dictionarySlug = readDictionarySlug(getRouterParam(event, "dictionary"));
+  const def = requireDictionary(dictionarySlug);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  requirePermission(actor, "dictionaries", "read", roles, dictionarySlug);
+  const db = getDb();
+  const rows = await listDictionaries(db, dictionarySlug);
+  const listed = flattenDictionaryTerms(rows);
+  const canUpdate = can(actor, "dictionaries", "update", { roles, scope: dictionarySlug });
+  const canDelete = can(actor, "dictionaries", "delete", { roles, scope: dictionarySlug });
+  return {
+    dictionary: toDictionaryMeta(dictionarySlug, def),
+    terms: listed.map(({ row, depth, slugPath }) => toAdminTerm(row, slugPath, {
+      canUpdate,
+      canDelete,
+      depth
+    })),
+    parents: listDictionaryParentOptions(rows),
+    canCreate: can(actor, "dictionaries", "create", { roles, scope: dictionarySlug }),
+    canUpdate,
+    canDelete
+  };
+});

package/dist/runtime/server/api/_katecms/dictionaries/[dictionary].post.d.ts

@@ -0,0 +1,4 @@
+import type { DictionaryTermResponse } from '../../../../utils/dictionaries.js';
+/** Create a term in the given dictionary. */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<DictionaryTermResponse>>;
+export default _default;

package/dist/runtime/server/api/_katecms/dictionaries/[dictionary].post.js

@@ -0,0 +1,64 @@
+import { defineEventHandler, getRouterParam, readBody } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { can, createDictionary, listDictionaries } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { requireUser } from "../../../utils/session.js";
+import { requirePermission } from "../../../utils/permissions.js";
+import {
+  assertDictionaryParent,
+  flattenDictionaryTerms,
+  listDictionaryParentOptions,
+  readDictionarySlug,
+  readFields,
+  readParentId,
+  readSlug,
+  readTitle,
+  requireDictionary,
+  requireTermFields,
+  rethrowDictionaryWriteError,
+  toAdminTerm,
+  toDictionaryMeta
+} from "../../../utils/dictionaries.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  const dictionarySlug = readDictionarySlug(getRouterParam(event, "dictionary"));
+  const def = requireDictionary(dictionarySlug);
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  requirePermission(actor, "dictionaries", "create", roles, dictionarySlug);
+  const body = await readBody(event);
+  const title = readTitle(body?.title);
+  const slug = readSlug(body?.slug);
+  const fields = readFields(body?.fields);
+  const parentId = def.hierarchical === true ? readParentId(body?.parentId) : null;
+  requireTermFields(def, fields);
+  const db = getDb();
+  const existing = await listDictionaries(db, dictionarySlug);
+  assertDictionaryParent(existing, dictionarySlug, parentId);
+  try {
+    const row = await createDictionary(db, {
+      type: dictionarySlug,
+      title,
+      slug,
+      fields,
+      parent_id: parentId
+    });
+    const rows = await listDictionaries(db, dictionarySlug);
+    const listed = flattenDictionaryTerms(rows);
+    const node = listed.find((item) => item.row.id === row.id);
+    const canUpdate = can(actor, "dictionaries", "update", { roles, scope: dictionarySlug });
+    const canDelete = can(actor, "dictionaries", "delete", { roles, scope: dictionarySlug });
+    return {
+      dictionary: toDictionaryMeta(dictionarySlug, def),
+      term: toAdminTerm(row, node?.slugPath ?? row.slug, {
+        canUpdate,
+        canDelete,
+        depth: node?.depth
+      }),
+      canUpdate,
+      canDelete,
+      parents: listDictionaryParentOptions(rows, row.id)
+    };
+  } catch (error) {
+    rethrowDictionaryWriteError(error);
+  }
+});

package/dist/runtime/server/api/_katecms/media/[id]/regenerate.post.d.ts

@@ -0,0 +1,8 @@
+import type { MediaItem } from '@katecms/core';
+/**
+ * Queue variant regeneration for one image. Clients poll GET by id for `ready` / `failed`.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    media: MediaItem;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/media/[id]/regenerate.post.js

@@ -0,0 +1,30 @@
+import { createError, defineEventHandler, getRouterParam } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { findMediaById, hasImageWork, isProcessableImage, updateMedia } from "@katecms/core";
+import { getDb } from "../../../../utils/db.js";
+import { getMediaConfig, parseMediaId, scheduleBackground, storedVariants, toClientMediaRow } from "../../../../utils/media.js";
+import { regenerateMedia } from "../../../../utils/regenerate.js";
+import { requirePermission } from "../../../../utils/permissions.js";
+import { requireUser } from "../../../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  requirePermission(actor, "media", "update", useRuntimeConfig().katecms?.roles ?? {});
+  const id = parseMediaId(getRouterParam(event, "id"));
+  const row = await findMediaById(getDb(), id);
+  if (!row) {
+    throw createError({ statusCode: 404, statusMessage: "File not found." });
+  }
+  if (!isProcessableImage(row.mime_type)) {
+    throw createError({ statusCode: 422, statusMessage: "This file is not an image." });
+  }
+  const willGenerate = hasImageWork(getMediaConfig());
+  const status = willGenerate ? "pending" : "none";
+  const pending = await updateMedia(getDb(), id, { variants_status: status }) ?? { ...row, variants_status: status };
+  scheduleBackground(event, regenerateMedia({
+    id: row.id,
+    filename: row.filename,
+    mime_type: row.mime_type,
+    variants: storedVariants(row.variants)
+  }));
+  return { media: await toClientMediaRow(pending) };
+});

package/dist/runtime/server/api/_katecms/media/[id].delete.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Delete a media row and its files. Missing binaries do not block the row delete.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: true;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/media/[id].delete.js

@@ -0,0 +1,22 @@
+import { createError, defineEventHandler, getRouterParam } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { deleteMedia, findMediaById } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { getMediaStorage, parseMediaId, storedVariants } from "../../../utils/media.js";
+import { requirePermission } from "../../../utils/permissions.js";
+import { requireUser } from "../../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  requirePermission(actor, "media", "delete", useRuntimeConfig().katecms?.roles ?? {});
+  const id = parseMediaId(getRouterParam(event, "id"));
+  const row = await findMediaById(getDb(), id);
+  if (!row) {
+    throw createError({ statusCode: 404, statusMessage: "File not found." });
+  }
+  const storage = getMediaStorage();
+  const keys = [row.filename, ...storedVariants(row.variants).map((variant) => variant.filename)];
+  await Promise.all(keys.map((key) => storage.delete(key).catch(() => {
+  })));
+  await deleteMedia(getDb(), id);
+  return { ok: true };
+});

package/dist/runtime/server/api/_katecms/media/[id].get.d.ts

@@ -0,0 +1,9 @@
+import type { MediaItem } from '@katecms/core';
+/**
+ * Fetch a single media library entry by id.
+ * Used to restore `returnFormat: 'id'` previews and to poll `variants_status`.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    media: MediaItem;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/media/[id].get.js

@@ -0,0 +1,17 @@
+import { createError, defineEventHandler, getRouterParam } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { findMediaById } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { parseMediaId, toClientMediaRow } from "../../../utils/media.js";
+import { requirePermission } from "../../../utils/permissions.js";
+import { requireUser } from "../../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  requirePermission(actor, "media", "read", useRuntimeConfig().katecms?.roles ?? {});
+  const id = parseMediaId(getRouterParam(event, "id"));
+  const row = await findMediaById(getDb(), id);
+  if (!row) {
+    throw createError({ statusCode: 404, statusMessage: "File not found." });
+  }
+  return { media: await toClientMediaRow(row) };
+});

package/dist/runtime/server/api/_katecms/media/[id].patch.d.ts

@@ -0,0 +1,6 @@
+import type { MediaItem } from '@katecms/core';
+/** Update editable media metadata (`alt`, `caption`). */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    media: MediaItem;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/media/[id].patch.js

@@ -0,0 +1,48 @@
+import { createError, defineEventHandler, getRouterParam, readBody } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { findMediaById, updateMedia } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { parseMediaId, toClientMediaRow } from "../../../utils/media.js";
+import { requirePermission } from "../../../utils/permissions.js";
+import { requireUser } from "../../../utils/session.js";
+function readText(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (value === null) {
+    return null;
+  }
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length ? trimmed : null;
+}
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  requirePermission(actor, "media", "update", useRuntimeConfig().katecms?.roles ?? {});
+  const id = parseMediaId(getRouterParam(event, "id"));
+  const body = await readBody(event);
+  const patch = {};
+  const alt = readText(body?.alt);
+  const caption = readText(body?.caption);
+  if (alt !== void 0) {
+    patch.alt = alt;
+  }
+  if (caption !== void 0) {
+    patch.caption = caption;
+  }
+  const db = getDb();
+  if (Object.keys(patch).length > 0) {
+    const updated = await updateMedia(db, id, patch);
+    if (!updated) {
+      throw createError({ statusCode: 404, statusMessage: "File not found." });
+    }
+    return { media: await toClientMediaRow(updated) };
+  }
+  const row = await findMediaById(db, id);
+  if (!row) {
+    throw createError({ statusCode: 404, statusMessage: "File not found." });
+  }
+  return { media: await toClientMediaRow(row) };
+});

package/dist/runtime/server/api/_katecms/media/index.get.d.ts

@@ -0,0 +1,5 @@
+import type { MediaItem } from '@katecms/core';
+import type { MediaLibraryPage } from '../../../../utils/media-library-query.js';
+/** List media library entries, newest first. Requires `media:read`. */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<MediaLibraryPage<MediaItem>>>;
+export default _default;

package/dist/runtime/server/api/_katecms/media/index.get.js

@@ -0,0 +1,75 @@
+import { defineEventHandler, getQuery } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { getDb } from "../../../utils/db.js";
+import { applyMediaListFilter, applyMediaListOrder, listMediaMonths } from "../../../utils/media-list.js";
+import { toClientMedia, uploaderNames } from "../../../utils/media.js";
+import { requirePermission } from "../../../utils/permissions.js";
+import { requireUser } from "../../../utils/session.js";
+import {
+  clampUtcOffsetMinutes,
+  isMediaSort,
+  isMediaTypeFilter
+} from "../../../../utils/media-library-query.js";
+const DEFAULT_LIMIT = 500;
+const MAX_LIMIT = 100;
+function readRaw(value) {
+  const raw = Array.isArray(value) ? value[0] : value;
+  return typeof raw === "string" ? raw.trim() : "";
+}
+function readInt(value) {
+  const raw = readRaw(value);
+  if (!raw) {
+    return void 0;
+  }
+  const n = Number(raw);
+  return Number.isInteger(n) ? n : void 0;
+}
+function readType(value) {
+  const raw = readRaw(value);
+  return isMediaTypeFilter(raw) ? raw : "all";
+}
+function readMonth(value) {
+  const raw = readRaw(value);
+  return /^\d{4}-(0[1-9]|1[0-2])$/.test(raw) ? raw : "";
+}
+function readSort(value) {
+  const raw = readRaw(value);
+  return isMediaSort(raw) ? raw : "date-desc";
+}
+function readFilter(query) {
+  const offset = readInt(query.tz);
+  return {
+    type: readType(query.type),
+    month: readMonth(query.month),
+    search: readRaw(query.q).slice(0, 200),
+    offsetMinutes: clampUtcOffsetMinutes(offset ?? 0),
+    sort: readSort(query.sort)
+  };
+}
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  requirePermission(actor, "media", "read", useRuntimeConfig().katecms?.roles ?? {});
+  const query = getQuery(event);
+  const requestedLimit = readInt(query.limit);
+  const requestedOffset = readInt(query.offset);
+  const limit = requestedLimit != null && requestedLimit > 0 ? Math.min(requestedLimit, MAX_LIMIT) : DEFAULT_LIMIT;
+  const offset = requestedOffset != null && requestedOffset > 0 ? requestedOffset : 0;
+  const filter = readFilter(query);
+  const driver = useRuntimeConfig().katecms?.database?.driver === "postgres" ? "postgres" : "sqlite";
+  const db = getDb();
+  const filtered = applyMediaListFilter(db.selectFrom("media"), filter, driver);
+  const [rows, totalRow, months] = await Promise.all([
+    applyMediaListOrder(filtered.selectAll(), filter.sort).limit(limit).offset(offset).execute(),
+    applyMediaListFilter(db.selectFrom("media"), filter, driver).select((eb) => eb.fn.countAll().as("n")).executeTakeFirst(),
+    listMediaMonths(db, filter, driver)
+  ]);
+  const names = await uploaderNames(rows.map((row) => row.uploaded_by));
+  return {
+    media: rows.map((row) => toClientMedia(
+      row,
+      row.uploaded_by != null ? names.get(row.uploaded_by) ?? null : null
+    )),
+    total: Number(totalRow?.n ?? 0),
+    months
+  };
+});

package/dist/runtime/server/api/_katecms/media/index.post.d.ts

@@ -0,0 +1,9 @@
+import type { MediaItem } from '@katecms/core';
+/**
+ * Upload a single file to `public/uploads` and record its metadata.
+ * Variant generation (if configured) runs in the background; poll GET by id.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    media: MediaItem;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/media/index.post.js

@@ -0,0 +1,84 @@
+import { createError, defineEventHandler, readMultipartFormData } from "h3";
+import { useRuntimeConfig } from "#imports";
+import {
+  contentMatchesMime,
+  createMedia,
+  generateVariants,
+  hasImageWork,
+  isMimeAllowed,
+  isProcessableImage,
+  prepareUploadKey,
+  readImageSize,
+  updateMedia
+} from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { getMediaConfig, getMediaStorage, scheduleBackground, toClientMediaRow } from "../../../utils/media.js";
+import { requirePermission } from "../../../utils/permissions.js";
+import { requireUser } from "../../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const user = await requireUser(event);
+  requirePermission(user, "media", "create", useRuntimeConfig().katecms?.roles ?? {});
+  const config = getMediaConfig();
+  const storage = getMediaStorage();
+  const parts = await readMultipartFormData(event);
+  const filePart = parts?.find((part) => part.name === "file" && part.filename);
+  if (!filePart || !filePart.data?.length) {
+    throw createError({ statusCode: 400, statusMessage: "File is missing." });
+  }
+  const mimeType = (filePart.type || "application/octet-stream").toLowerCase().split(";")[0]?.trim() || "application/octet-stream";
+  if (!isMimeAllowed(mimeType, config.allowedMimeTypes) || !contentMatchesMime(filePart.data, mimeType)) {
+    throw createError({
+      statusCode: 415,
+      statusMessage: `File type is not allowed: ${mimeType}.`
+    });
+  }
+  if (filePart.data.length > config.maxFileSize * 1024 * 1024) {
+    throw createError({
+      statusCode: 413,
+      statusMessage: `File exceeds the ${config.maxFileSize} MB limit.`
+    });
+  }
+  const data = filePart.data;
+  const key = await prepareUploadKey(filePart.filename, mimeType, (name) => storage.exists(name));
+  await storage.put(key, data);
+  const dimensions = mimeType.startsWith("image/") ? readImageSize(data) : null;
+  const willGenerate = isProcessableImage(mimeType) && hasImageWork(config);
+  let row;
+  try {
+    row = await createMedia(getDb(), {
+      filename: key,
+      mime_type: mimeType,
+      filesize: data.length,
+      width: dimensions?.width ?? null,
+      height: dimensions?.height ?? null,
+      alt: textPart(parts, "alt"),
+      caption: textPart(parts, "caption"),
+      uploaded_by: user.id,
+      variants_status: willGenerate ? "pending" : "none"
+    });
+  } catch (error) {
+    await storage.delete(key).catch(() => {
+    });
+    throw error;
+  }
+  if (willGenerate) {
+    const mediaId = row.id;
+    const task = generateVariants({ storage, key, mimeType, data, config }).then(async (variants) => {
+      await updateMedia(getDb(), mediaId, {
+        variants,
+        variants_status: "ready"
+      });
+    }).catch(async (error) => {
+      console.error("[katecms] failed to generate image variants", error);
+      await updateMedia(getDb(), mediaId, { variants_status: "failed" }).catch(() => {
+      });
+    });
+    scheduleBackground(event, task);
+  }
+  return { media: await toClientMediaRow(row) };
+});
+function textPart(parts, name) {
+  const part = parts?.find((p) => p.name === name && !p.filename);
+  const value = part?.data?.toString("utf-8").trim();
+  return value || null;
+}

package/dist/runtime/server/api/_katecms/media/regenerate.post.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Queue variant regeneration for every processable image, one at a time.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    count: number;
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/media/regenerate.post.js

@@ -0,0 +1,30 @@
+import { defineEventHandler } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { isProcessableImage, listMedia, updateMedia } from "@katecms/core";
+import { getDb } from "../../../utils/db.js";
+import { scheduleBackground, storedVariants } from "../../../utils/media.js";
+import { regenerateMedia } from "../../../utils/regenerate.js";
+import { requirePermission } from "../../../utils/permissions.js";
+import { requireUser } from "../../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const actor = await requireUser(event);
+  requirePermission(actor, "media", "update", useRuntimeConfig().katecms?.roles ?? {});
+  const rows = await listMedia(getDb());
+  const targets = rows.filter((row) => isProcessableImage(row.mime_type));
+  if (!targets.length) {
+    return { count: 0 };
+  }
+  const db = getDb();
+  await Promise.all(targets.map((row) => updateMedia(db, row.id, { variants_status: "pending" })));
+  scheduleBackground(event, (async () => {
+    for (const row of targets) {
+      await regenerateMedia({
+        id: row.id,
+        filename: row.filename,
+        mime_type: row.mime_type,
+        variants: storedVariants(row.variants)
+      });
+    }
+  })());
+  return { count: targets.length };
+});

package/dist/runtime/server/api/_katecms/menu.get.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resources the signed-in user may read. Addon menu items name one of these
+ * in `access` and the admin shell hides the rest.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    visible: string[];
+}>>;
+export default _default;

package/dist/runtime/server/api/_katecms/menu.get.js

@@ -0,0 +1,14 @@
+import { defineEventHandler } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { RESOURCES, can } from "@katecms/core";
+import { getCurrentUser } from "../../utils/session.js";
+export default defineEventHandler(async (event) => {
+  const user = await getCurrentUser(event);
+  if (!user) {
+    return { visible: [] };
+  }
+  const roles = useRuntimeConfig().katecms?.roles ?? {};
+  return {
+    visible: RESOURCES.filter((resource) => can(user, resource, "read", { roles }))
+  };
+});

package/dist/runtime/server/api/_katecms/oembed.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<import("@katecms/core").OembedResponse>>;
+export default _default;