feat(editor): serve the sticker-picker payload in one response

Every editor in the ecosystem shipped its own copy of the same 498 URLs,
generated from `KUNgal{set}/{n}.webp` plus a hardcoded array of pack sizes --
forum, moyu and this site each had one. All of them died the day this host
stopped serving static files, and all of them were silently wrong long before
that, because a pack that gained a sticker did not update anybody's array.

GET /api/v1/editor-packs returns all 7 official packs and their 498 stickers
at once, shaped so a consumer can hand it straight to @kungal/editor-core's
`stickerSource` adapter. One request, not the face's list-then-fetch-each: a
picker needs every sticker of every pack to draw one panel, and 1+N round
trips is exactly what makes a consumer hardcode the list instead.

The `src` values are content-addressed CDN URLs, and they are what the picker
inserts into post content. That is the real fix for the class of bug rather
than for this instance of it: the old path encoded a position in a mutable
collection, so years of forum posts rotted when the collection moved; a
content hash encodes the bytes and cannot. The corollary is a rule for this
site -- official stickers get retired by status, never hard-deleted, or the
image service's refcount reaches zero and those posts break anyway.

Official packs only: a picker rendered inside somebody else's editor is not
the place to surface unmoderated user uploads.

Claude-Session: https://claude.ai/code/session_01WYeKk1xWGbYeENdb6Ez3xL

Author: KunMoe

apps/api/internal/app/app.go

@@ -154,6 +154,12 @@ func New(cfg *config.Config) *App {
 	// old copy instead of falling back.
 	api.Get("/avatar-pool", readLimit, avatarPoolCache, etag.New(), h.AvatarPool)
 
+	// The sticker-picker payload other sites' editors render, in one response
+	// rather than the face's list-then-fetch-each: a picker needs every
+	// sticker of every pack at once, and 1+N round trips to build one panel is
+	// what made every consumer hardcode the URLs in the first place.
+	api.Get("/editor-packs", readLimit, avatarPoolCache, etag.New(), h.EditorPacks)
+
 	// Public, but an author also sees their own drafts here.
 	api.Get("/packs/:packId", readLimit, optionalAuth, h.GetPack)
 	api.Get("/packs/:packId/download", readLimit, optionalAuth, h.DownloadPack)

apps/api/internal/platform/sticker/dto/sticker.go

@@ -199,3 +199,20 @@ type AvatarPool struct {
 	Variant string   `json:"variant"`
 	URLs    []string `json:"urls"`
 }
+
+// EditorPacks is the sticker-picker payload other sites' editors render. The
+// field names match @kungal/editor-core's StickerPack/StickerItem so a
+// consumer can hand the response straight to its `stickerSource` adapter.
+type EditorPacks struct {
+	Packs []EditorPack `json:"packs"`
+}
+
+type EditorPack struct {
+	Name     string          `json:"name"`
+	Stickers []EditorSticker `json:"stickers"`
+}
+
+type EditorSticker struct {
+	Src  string `json:"src"`
+	Name string `json:"name"`
+}

apps/api/internal/platform/sticker/handler/pack.go

@@ -161,3 +161,15 @@ func (h *Handler) AvatarPool(c fiber.Ctx) error {
 	}
 	return response.OK(c, pool)
 }
+
+// EditorPacks serves the sticker-picker payload other sites' editors render.
+// Public and unauthenticated for the same reason as AvatarPool: it lists
+// images that are already public, and the consuming sites fetch it from their
+// own servers.
+func (h *Handler) EditorPacks(c fiber.Ctx) error {
+	packs, appErr := h.svc.EditorPacks()
+	if appErr != nil {
+		return response.Error(c, appErr)
+	}
+	return response.OK(c, packs)
+}

apps/api/internal/platform/sticker/repository/pack_repo.go

@@ -140,3 +140,13 @@ func escapeLike(s string) string {
 	r := strings.NewReplacer(`\`, `\\`, `%`, `\%`, `_`, `\_`)
 	return r.Replace(s)
 }
+
+// OfficialPublished lists the official packs in publication order. It is the
+// picker's pack list, so it deliberately ignores the list filters: an editor
+// panel in someone else's app shows the same tabs to everyone.
+func (r *PackRepo) OfficialPublished() ([]model.Pack, error) {
+	var rows []model.Pack
+	err := r.db.Where("status = ? AND is_official", model.PackPublished).
+		Order("created_at ASC, id ASC").Find(&rows).Error
+	return rows, err
+}

apps/api/internal/platform/sticker/repository/sticker_repo.go

@@ -240,3 +240,20 @@ func (r *StickerRepo) AvatarPoolHashes() ([]string, error) {
 		Pluck("sticker.image_hash", &hashes).Error
 	return hashes, err
 }
+
+// ForPacks loads the stickers of several packs in one query, grouped by pack.
+func (r *StickerRepo) ForPacks(packIDs []uuid.UUID) (map[uuid.UUID][]model.Sticker, error) {
+	out := make(map[uuid.UUID][]model.Sticker, len(packIDs))
+	if len(packIDs) == 0 {
+		return out, nil
+	}
+	var rows []model.Sticker
+	if err := r.db.Where("pack_id IN ?", packIDs).
+		Order("pack_id ASC, position ASC").Find(&rows).Error; err != nil {
+		return nil, err
+	}
+	for _, row := range rows {
+		out[row.PackID] = append(out[row.PackID], row)
+	}
+	return out, nil
+}

apps/api/internal/platform/sticker/service/editor_packs.go

@@ -0,0 +1,99 @@
+package service
+
+import (
+	"log/slog"
+	"strconv"
+
+	"kun-galgame-sticker-api/internal/platform/sticker/dto"
+	"kun-galgame-sticker-api/pkg/errors"
+
+	"github.com/google/uuid"
+	"gorm.io/datatypes"
+)
+
+// editorPackVariant is what a picker grid renders. 320 is the same variant the
+// site's own grid uses; an editor tile is the same size as a pack-page tile.
+const editorPackVariant = "320"
+
+// EditorPacks is the whole official sticker catalogue in one response, shaped
+// for a sticker picker.
+//
+// It exists because every editor in the ecosystem shipped its own copy of the
+// same 498 URLs, generated from `KUNgal{set}/{n}.webp` with a hardcoded set of
+// pack sizes -- forum, moyu and this site each had one, all of them dead the
+// day this host stopped serving static files, and all of them silently wrong
+// long before that (a pack gained stickers; the arrays did not).
+//
+// Two shape decisions:
+//
+//   - ONE request, not the face's list-then-fetch-each. A picker needs every
+//     sticker of every pack at once, and 1+N round trips to build one panel is
+//     the sort of thing consumers work around by hardcoding again.
+//   - `src` is the CDN URL, and it is what the picker INSERTS INTO POST
+//     CONTENT. That is the actual fix for the class of bug: the old path
+//     encoded a position in a mutable collection, so years of posts rotted
+//     when the collection moved. A content hash encodes the bytes and cannot.
+//     The corollary is a rule for this site, not for consumers: official
+//     stickers are retired by status, never hard-deleted, or the image
+//     service's refcount drops to zero and the old posts break anyway.
+//
+// Official packs only. A picker offered in someone else's editor is not the
+// place to surface unmoderated user uploads.
+func (s *Service) EditorPacks() (*dto.EditorPacks, *errors.AppError) {
+	rows, err := s.packs.OfficialPublished()
+	if err != nil {
+		slog.Error("editor packs query failed", "error", err)
+		return nil, errors.ErrInternal("failed to load the sticker packs")
+	}
+	ids := make([]uuid.UUID, 0, len(rows))
+	for _, row := range rows {
+		ids = append(ids, row.ID)
+	}
+	byPack, err := s.stickers.ForPacks(ids)
+	if err != nil {
+		slog.Error("editor packs sticker query failed", "error", err)
+		return nil, errors.ErrInternal("failed to load the sticker packs")
+	}
+
+	packs := make([]dto.EditorPack, 0, len(rows))
+	for _, row := range rows {
+		label := displayTitle(row.Title)
+		stickers := make([]dto.EditorSticker, 0, len(byPack[row.ID]))
+		for _, st := range byPack[row.ID] {
+			if st.ImageHash == "" || s.images == nil {
+				continue
+			}
+			stickers = append(stickers, dto.EditorSticker{
+				Src:  s.images.VariantURL(st.ImageHash, editorPackVariant),
+				Name: label + " - " + strconv.Itoa(st.Position),
+			})
+		}
+		if len(stickers) == 0 {
+			continue
+		}
+		packs = append(packs, dto.EditorPack{Name: label, Stickers: stickers})
+	}
+	return &dto.EditorPacks{Packs: packs}, nil
+}
+
+// displayTitle flattens a multilingual title to the one string a picker tab
+// can show. The picker has no locale to negotiate with -- it is rendered
+// inside somebody else's app -- so this is a fixed preference order rather
+// than content negotiation, and zh-cn leads because that is what the official
+// packs are authored in.
+var titlePreference = []string{"zh-cn", "zh-tw", "ja-jp", "en-us", "und"}
+
+func displayTitle(raw datatypes.JSON) string {
+	title := decodeML(raw)
+	for _, key := range titlePreference {
+		if value := title[key]; value != "" {
+			return value
+		}
+	}
+	for _, value := range title {
+		if value != "" {
+			return value
+		}
+	}
+	return "Stickers"
+}