feat(audio-player): Resume Rewind select in the settings popover

The player window could only change Skip and Speed; resume rewind
lived exclusively on the profile page. The user-facing settings now
match Speed's precedent — changeable from the player, saved to the
account, applied immediately.

The select mirrors the default-speed row (CSP-safe @change bound to
one Alpine method; templ emits the option list from the shared
ResumeRewindOptions allow-list and the :selected expression against
the live resumeRewind field). Applying updates the running player's
value first — the next open/unpause uses it with no reload — then
PUTs audio_resume_rewind_seconds to the profile endpoint as the
string wire shape the server binds. normalizeResumeRewind gates the
select's value through 0/5/10 before both steps.

.env.example

@@ -6,10 +6,18 @@
 # Generate with: openssl rand -hex 32
 JWT_SECRET=your-secure-jwt-secret-key-here
 
-# PostgreSQL database password
+# PostgreSQL database password (the bootstrap superuser account; kept
+# for container initialization — the app itself connects as bookhoard_srv)
 # Generate with: openssl rand -hex 16
 DBPASS=your-secure-database-password-here
 
+# Runtime database role password (bookhoard_srv — the non-superuser
+# account the app connects as; subject to RLS). Required for the app to
+# start. Consumed by the one-shot db-init service on every startup
+# (idempotent — creates/refreshes the role and its privileges).
+# Generate with: openssl rand -hex 16
+DBSRVPASS=your-secure-runtime-role-password-here
+
 # Networking: change a port if it conflicts on your host
 # Postgres port, host + container (e.g. another local DB already uses 5432)
 # DB_PORT=15432

.gitignore

@@ -86,3 +86,5 @@ session-*.md
 # Binary media fixtures: never commit (generate with ffmpeg at test time,
 # see docs/contributing/development.md → Media fixtures)
 internal/services/testdata/
+test-results
+.openchamber/

AGENTS.md

@@ -4,6 +4,32 @@ Standing rules for any agent or developer working in this repo.
 Project-wide context lives in the sibling repos' AGENTS.md files
 (../bookhoard-app/AGENTS.md is the Android client's).
 
+## Commit as each unit of work completes — ALWAYS apply
+
+Commit when a logically complete piece of the project is done — a fix,
+a feature slice, a schema change, a docs/test batch — before moving on
+to the next piece. Do not hold a whole session's work for one giant
+end-of-session commit, and never push uncommitted work aside until the
+tree is clean.
+
+- **One commit per related edit.** If the changed files serve more than
+  one purpose, they are separate commits; only share a commit when you
+  are sure every file in it is the same related edit. Generated
+  artifacts (templ codegen, sqlc output, vite/tailwind build output,
+  bruno/openapi mirrors) commit with the source change that produced
+  them.
+- **Detailed messages**, in the repo's conventional-commit style
+  (`fix(scanner): …`, `feat(issues): …`) with a body that says WHY the
+  change exists, what behavior changed, and any precedent it follows —
+  not just what the diff shows. The body is how the next agent (and
+  git history) arbitrates "test stale vs code changed".
+- **Ordering**: stack commits so each tree compiles where practical
+  (a service before the handler that calls it, a guard before the
+  feature that relies on it).
+- **Committing ≠ pushing.** Commits are local bookkeeping and land as
+  work completes; pushing (once, after the last commit) is the author's
+  call. Never push half-finished units just because they were committed.
+
 ## Rendering ownership (templ vs TypeScript) — ALWAYS apply
 
 The point of templ + htmx + Alpine is: the server renders the UI, and
@@ -41,33 +67,100 @@ with heavy interactivity. First-paint section markup is still templ
 deliberate; do not clone it to new pages, and do not "fix" the dashboard
 without restoring a templ-partial fade path first.
 
+## CSP discipline (hash-allow-listed script-src) — ALWAYS apply
+
+script-src carries a sha256 hash, not `'unsafe-inline'` (and never
+`'unsafe-eval'` — the Alpine build is `@alpinejs/csp` for exactly this
+reason; keep it in lockstep with alpinejs). The browser therefore
+refuses, **silently at build/test time**, two authoring patterns:
+
+- **No inline `<script>` content outside `theme_flash_guard.templ`.**
+  The guard is the app's only inline script; its bytes are pinned by
+  `middleware.ScriptHashThemeFlashGuard` + the drift test. Editing the
+  guard means recomputing the hash (the failing test prints it); adding
+  a *second* inline script means hashing it too and extending
+  `cspSanctionedInlineScripts` in `templates/csp_source_test.go`.
+  Everything else goes in a bundled `web/src` module. This includes
+  partials emitted from Go handler strings — those use data attributes
+  + `web/src/auth_forms.ts` (post-swap redirect/stash) or htmx's
+  `HX-Redirect`/`HX-Refresh` headers; `internal/middleware`'s
+  Go-source scan is the tripwire for that vector.
+- **No native `on*=` handler attributes** (`onclick=`, `onerror=`,
+  `onsubmit=`, `onchange=`, … — quote AND templ brace forms). Inline
+  handlers never go through the hash path; hash-mode CSP refuses them
+  unconditionally. Use Alpine `@click`/`@change`/… bound to component
+  methods (see the 2026-10 CSP-build conversion commits for the
+  pattern), or delegated listeners for htmx-swapped content.
+- **No htmx eval-dependent bindings** (`hx-on*`, `js:`-prefixed
+  `hx-vals`) — `'unsafe-eval'` is not granted.
+
+`templates/csp_source_test.go` is the tripwire for all three (it
+scans the `.templ` sources; it runs in seconds on host). `style-src
+'unsafe-inline'` remains by design (htmx-injected styles, Alpine
+`:style`); `'self'` still trusts the origin not to serve
+attacker-supplied scripts — don't let upload paths become
+script-executable. Remember: `templ` does not interpolate `{ expr }`
+inside quoted attribute values (gotcha #1 below), so dynamic
+`@click={ "fn('" + id + "')" }` attribute values must BE expressions.
+
 ## Library visibility (family-lens rule) — ALWAYS apply
 
 Per-user library visibility (`library_visibility` table, default-ALLOW:
-every user sees every library unless an admin hides one) must be
+every user sees every library unless an admin hides one) is enforced by
-enforced on **every endpoint that returns media metadata or content**.
+**Postgres RLS** — one source of truth: the labeled policy block in
-It is NOT automatic — enforcement is per-handler.
+`database/schema/schema.sql` + the runtime role provisioned by the
+`db-init` compose service.
 
-- **New endpoints that list/filter media or series** MUST filter by the
+- **The engine is the enforcement.** Every `media_items` read is
-  requesting user's visible-library set, and MUST reject an explicit
+  filtered by the policy, which joins `library_visibility` on the
-  `library_id` outside that set with 403 (never silently pass).
+  per-transaction GUC `app.user_id`. New media-listing queries need
-- Helpers (do not hand-roll):
+  NO visibility clause; new endpoints need NO visibility plumbing.
-  - `handlers`: `(*MediaHandler).visibleLibrarySet` /
+- **The app declares identity; it never computes visibility.** All
-    `(*SeriesHandler).visibleLibrarySet` — membership map + id slice.
+  sqlc statements run through `ScopedDB`
-  - `router`: `visibleLibraryIDsFor` — same for SSR routes.
+  (`internal/database/scoped.go`), which declares `app.user_id` from
-  - `resolveLibrary` (helpers.go) only honors requested library ids
+  the stdlib request context. Three bridge sites put it there:
-    inside the visible set.
+  `router.go` JWT, `router.go` cookie/device, and
-- SQL pattern: `AND (sqlc.narg('visible_library_ids')::uuid[] IS NULL OR
+  `middleware/device_auth.go` (KOReader/Kobo sync devices). A media
-  library_id = ANY(sqlc.narg('visible_library_ids')::uuid[]))` — see
+  read on a detached `context.Background()` RAISES — thread the
-  `ListMediaItems`, `GetDistinctSeries`, `SearchMediaItems`.
+  request context or the acting identity (see conflicts.go and
-- Content endpoints (file bytes, page images) additionally gate per item
+  analytics.go for the pattern).
-  like `ReaderHandler.ensureItemVisible` / the download endpoint.
+- **Background jobs declare the acting identity** before detached
-- Tests must pin visibility: hidden library → 403 on the endpoint, and
+  work: scan jobs carry the library owner / first-admin fallback
-  absent from unscoped aggregates.
+  (the job Context carries it — `ScanFolders` self-declares the
+  configured admin), the hash backfill runs as first admin. The sync
+  queue processor needs nothing (`sync_queue` is not RLS-governed).
+- **NEVER**: session-scoped `app.user_id` (pooled-connection identity
+  bleed); a bypass flag; connecting the app as the bootstrap
+  superuser (superusers bypass RLS unconditionally — `DATABASE_USER`
+  stays `bookhoard_srv`; the `db-init` compose service provisions the
+  role on every startup).
+- **schema.sql re-runs on EVERY boot** (executeSchema) — everything
+  added to it must be idempotent (`DROP .. IF EXISTS` + `CREATE`).
+  The migration tx declares a synthetic identity
+  (`schemaMigrationIdentity`) because the schema's own dedup block
+  reads `media_items`.
+- **Auditors**: `TestRlsInvariant` (API black-box — add new
+  media-returning surfaces to it; loosening requires a
+  docs/contract_pins.md entry) and the Playwright sweep (`tests/ui`,
+  new pages/controls go into `tests/ui/COVERAGE.md`). Item-scoped
+  gates may answer 404 as well as 403 (row invisible vs Go-level
+  check — contract_pins 2026-10-29).
+- **Collections RLS (2026-10-31)**: `collections` and
+  `collection_items` are governed too — predicates
+  `app_can_read_collection` / `app_can_write_collection`, PURE over
+  their arguments (never query `collections`, so no policy recursion
+  under FORCE RLS). Reads: owner-or-admin; writes: owner, admin escape
+  for SYSTEM collections only. Future sharing = one EXISTS branch
+  inside the predicate functions, no policy migration. Registration
+  seeding declares the new user's identity (`rls.WithUser` in
+  `CreateDefaultCollectionsForUser` — the JWT does not exist yet);
+  test-harness writes to non-system collections must run as the row's
+  OWNER (`scopeExecAs`/`ownerSeedCtx`, not the admin handle).
 
 History: 2026-10-13 (`431fec0`) the series/media listing surfaces
-leaked hidden libraries to any authenticated account — series endpoints
+leaked hidden libraries; **2026-10-29 enforcement moved to RLS** — the
-were name-only across ALL libraries. Fixed; do not regress.
+dashboard section queries had silently never carried the clauses,
+and the invariant test went red → green and stays as the auditor.
 
 ## Tests
 

Dockerfile

@@ -41,12 +41,14 @@ RUN npm run build:ts
 # Declared after `COPY . .` so a version bump only invalidates this layer.
 # The release workflow passes the git tag, e.g. APP_VERSION=v1.5.
 ARG APP_VERSION=dev
+# Short commit hash of the built source (stale-container drift guard).
+ARG GIT_COMMIT=none
 
 # Build Go binary (cached unless Go files or generated code changes)
 RUN --mount=type=cache,target=/root/go/pkg/mod \
   --mount=type=cache,target=/root/.cache/go-build \
   CGO_ENABLED=0 GOOS=linux go build -installsuffix cgo \
-  -ldflags "-X bookhoard/internal/version.Version=${APP_VERSION}" \
+  -ldflags "-X bookhoard/internal/version.Version=${APP_VERSION} -X bookhoard/internal/version.Commit=${GIT_COMMIT}" \
   -o main ./cmd/server
 
 # Materialize the Go module cache into an image layer so the test-runner

Makefile

@@ -11,6 +11,10 @@ endif
 # Override with: CONTAINER_RUNTIME=podman make rebuild-app
 CONTAINER_RUNTIME ?= $(shell command -v docker 2>/dev/null || command -v podman 2>/dev/null)
 
+# Build stamp (stale-container drift guard): the rebuilt image carries
+# the source commit; the app logs it at boot and /api/health reports it.
+GIT_COMMIT ?= $(shell git rev-parse --short HEAD 2>/dev/null || echo none)
+
 # Dev compose stack: base prod file merged with the dev override (local build + tests).
 # Prod deploy does NOT use this — it runs plain `docker compose` against the base file only.
 COMPOSE := $(CONTAINER_RUNTIME) compose -f docker-compose.yml -f docker-compose.dev.yml
@@ -54,11 +58,13 @@ test: lint-rendering
 # UI markup, JS orchestrates. Fails when a web/src file builds more HTML
 # template literals than its recorded baseline (web/src/rendering-allowlist.txt),
 # or when a .templ file gains an inline <script> block (theme_flash_guard.templ
-# is the only sanctioned one). Shrink baselines as fragments move to templ
+# is the only sanctioned one). *.test.ts files are excluded: jsdom fixtures
+# build DOM in tests, they don't render shipped UI. Shrink baselines as
+# fragments move to templ
 # partials; grow one only with a written reason.
 lint-rendering:
 	@violations=""; \
-	for f in $$(grep -rlE 'innerHTML[[:space:]]*=[[:space:]]*' web/src --include='*.ts' | grep -v 'web/src/reader/'); do \
+	for f in $$(grep -rlE 'innerHTML[[:space:]]*=[[:space:]]*' web/src --include='*.ts' | grep -v 'web/src/reader/' | grep -v '\.test\.ts$$'); do \
 		count=$$(grep -E 'innerHTML[[:space:]]*=[[:space:]]*' $$f | grep -cvE 'innerHTML[[:space:]]*=[[:space:]]*""[[:space:]]*$$'); \
 		allowed=$$(grep -F "$$f:" web/src/rendering-allowlist.txt | cut -d: -f2); \
 		allowed=$${allowed:-0}; \

README.md

@@ -21,160 +21,165 @@ A modern self-hosted media library system built with Go, PostgreSQL, HTMX, and T
 - **Podman** (recommended) or Docker
 - **5 minutes** of your time
 
-### Installation
+### Installation (no source checkout needed)
+
+Create a directory on the Docker host. You only need the compose file,
+an `.env`, and an `uploads` folder — everything else rides the published
+image.
 
 ```bash
-# 1. Clone the repository
+mkdir bookhoard && cd bookhoard
-git clone https://git.linuxhg.com/Bookhoard/bookhoard.git
+mkdir uploads
-cd bookhoard
-
-# 2. Set up environment
-cp .env.example .env
-# Generate secure passwords (no special characters):
-#   JWT_SECRET: openssl rand -hex 32
-#   DBPASS: openssl rand -hex 16
-# Edit .env with your generated values
-
-# 3. Pull images and start the server
-docker compose pull
-docker compose up -d
-# Optionally pin a specific version: set IMAGE_TAG in .env (defaults to "latest")
-
-# 4. Open your browser
-open http://localhost:8765
 ```
 
-The first user to register automatically becomes an admin.
+**`docker-compose.yml`** — copy this wholesale:
 
----
+```yaml
+services:
+  # PostgreSQL Database
+  db:
+    image: postgres:15-alpine
+    container_name: bookhoard_db
+    environment:
+      POSTGRES_DB: bookhoard
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: ${DBPASS}
+      # PGPORT makes Postgres listen on DB_PORT (kept in sync with the host mapping + app's DATABASE_PORT)
+      PGPORT: ${DB_PORT:-5432}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    ports:
+      - "127.0.0.1:${DB_PORT:-5432}:${DB_PORT:-5432}"
+      - "[::1]:${DB_PORT:-5432}:${DB_PORT:-5432}"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+    env_file:
+      - .env
 
-## 📖 Key Features
+  # One-shot bootstrap: creates the bookhoard_srv runtime role and
+  # transfers object ownership to it (RLS prerequisite). Idempotent —
+  # safe on every startup; the app waits for its success. Passwords
+  # accept inline values or .env, like the rest of this file.
+  # NOTE: plpgsql $$ tags are written $$$$ — compose eats one dollar
+  # per pair before the container sees the SQL.
+  db-init:
+    image: postgres:15-alpine
+    container_name: bookhoard_db_init
+    environment:
+      PGHOST: db
+      PGPORT: ${DB_PORT:-5432}
+      PGUSER: postgres
+      PGDATABASE: bookhoard
+      PGPASSWORD: ${DBPASS}
+      DBSRVPASS: ${DBSRVPASS}
+    entrypoint: ["bash", "-c"]
+    command:
+      - |
+        set -e
+        : "${DBSRVPASS:?DBSRVPASS required in .env}"
+        psql -v ON_ERROR_STOP=1 -v role_pass="$DBSRVPASS" <<'EOSQL'
+        DO $$$$
+        BEGIN
+          IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'bookhoard_srv') THEN
+            CREATE ROLE bookhoard_srv LOGIN;
+          END IF;
+        END $$$$;
+        ALTER ROLE bookhoard_srv LOGIN PASSWORD :'role_pass';
+        DO $$$$
+        DECLARE r RECORD;
+        BEGIN
+          FOR r IN SELECT tablename FROM pg_tables WHERE schemaname = 'public' LOOP
+            EXECUTE format('ALTER TABLE public.%I OWNER TO bookhoard_srv', r.tablename);
+          END LOOP;
+          FOR r IN SELECT sequencename FROM pg_sequences WHERE schemaname = 'public' LOOP
+            EXECUTE format('ALTER SEQUENCE public.%I OWNER TO bookhoard_srv', r.sequencename);
+          END LOOP;
+          FOR r IN SELECT p.oid::regprocedure AS fn FROM pg_proc p
+                   JOIN pg_namespace n ON p.pronamespace = n.oid
+                   WHERE n.nspname = 'public' AND p.prokind = 'f' LOOP
+            EXECUTE format('ALTER FUNCTION %s OWNER TO bookhoard_srv', r.fn);
+          END LOOP;
+        END $$$$;
+        ALTER SCHEMA public OWNER TO bookhoard_srv;
+        ALTER DATABASE bookhoard OWNER TO bookhoard_srv;
+        EOSQL
+    depends_on:
+      db:
+        condition: service_healthy
+    restart: "no"
 
-### Universal Cross-Platform Sync
+  # Bookhoard Application
+  # In production this image is pulled from the Gitea container registry.
+  # Override IMAGE_TAG in .env to pin or rollback a specific version (defaults to "latest").
+  app:
+    image: git.linuxhg.com/bookhoard/bookhoard:${IMAGE_TAG:-latest}
+    container_name: bookhoard
+    restart: unless-stopped
+    environment:
+      # Database Configuration
+      # Runtime role = bookhoard_srv (non-superuser OWNER, subject to RLS
+      # via FORCE). POSTGRES_USER above is the bootstrap account ONLY —
+      # the app must NEVER connect as it (superusers bypass RLS).
+      DATABASE_HOST: db
+      DATABASE_PORT: ${DB_PORT:-5432}
+      DATABASE_USER: bookhoard_srv
+      DATABASE_PASSWORD: ${DBSRVPASS}
+      DATABASE_NAME: bookhoard
 
-- **Real-Time Progress**: Turn a page on your e-reader, see it in your browser
+      # Application Configuration
-- **Format-Aware**: EPUB CFI, page numbers, percentages - all handled correctly
+      JWT_SECRET: ${JWT_SECRET}
-- **Offline Queue**: Changes sync when you reconnect, priority-processed
+      SERVER_PORT: ${SERVER_PORT:-8765}
-- **Conflict Resolution**: Smart handling when same book read on multiple devices
+      # IMPORTANT: Device sync requires full URL with protocol
-- **Book Matching**: Automatic matching using SHA-256, ISBN, UUID
+      # Local: http://localhost:8765
-- **OPDS Catalog**: Wireless book delivery to e-readers over Wi-Fi
+      # Local network: http://192.168.1.X:8765
-- **Format Conversion**: On-the-fly EPUB→KEPUB conversion (for upcoming native Kobo support)
+      # Domain: https://bookhoard.example.com
+      BASE_URL: ${BASE_URL:-http://localhost:8765}
+      # Mark session cookies Secure; set true behind a TLS-terminating reverse proxy (Caddy/nginx/traefik)
+      COOKIE_SECURE: ${COOKIE_SECURE:-false}
 
-### Media Management
+      # Rate Limiting Configuration
+      TEST_MODE: ${TEST_MODE:-false}
+      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-true}
+      REQUESTS_PER_MINUTE: ${REQUESTS_PER_MINUTE:-10}
 
-- **Calibre Integration**: Automatic metadata import from Calibre `metadata.opf` sidecar files
+      # Conversion Service Configuration
-- **Smart Search**: Partial matching with fuzzy search fallback for typos
+      BOOKHOARD_CONVERSION_CACHE_DIR: ${BOOKHOARD_CONVERSION_CACHE_DIR:-/app/cache/kepub}
-- **Advanced Filtering**: Filter by author, series, genre, language, year, cover images
+      BOOKHOARD_CONVERSION_TOOL: ${BOOKHOARD_CONVERSION_TOOL:-/usr/bin/kepubify}
-- **Dynamic Sorting**: By title, author, date added, published date, page count, series
+      BOOKHOARD_CONVERSION_CACHE_TTL: ${BOOKHOARD_CONVERSION_CACHE_TTL:-24h}
-- **Rich Metadata**: Title, author, series, publisher, ISBN, language, edition, tags
-- **5-Star Ratings**: Half-star precision (1-10 scale)
-- **Notes & Highlights**: Color-coded annotations with linked notes
-- **Usage Analytics**: Reading statistics, device usage, popular books
 
-### Smart Collections
+      # Library Maintenance
+      # Days an archived item (file missing from disk for 2+ scans) is kept,
+      # with its reading history, before library scans purge it for good.
+      # Set 0 to keep archived items until purged manually on the library admin page.
+      ARCHIVE_RETENTION_DAYS: ${ARCHIVE_RETENTION_DAYS:-90}
 
-- **Auto-Assign Rules**: Automatically add books based on genre, author, series, tags, language, publisher, year
+      # System timezone (fallback for server-side time operations)
-- **Device Shelf Mappings**: Map collections to device shelves (used by native Kobo sync, coming soon)
+      TZ: ${TZ:-UTC}
-- **Test Before Creating**: Preview which books match your rules
+    ports:
+      - "${SERVER_PORT:-8765}:${SERVER_PORT:-8765}"
+    depends_on:
+      db:
+        condition: service_healthy
+      db-init:
+        condition: service_completed_successfully
+    volumes:
+      - ./uploads:/app/uploads
+      - bookhoard_conversion_cache:/app/cache/kepub
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:${SERVER_PORT:-8765}/health || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
 
-### Library Organization
+# Named Volumes
-
+volumes:
-- **Multi-Library Support**: Ebooks, Comics, and Manga with type-specific file formats
+  postgres_data:
-- **Multiple Folders**: Add multiple scanning folders per library
+  bookhoard_conversion_cache:
-- **Visibility Control**: Admins control which libraries each user can see
-- **Background Scanning**: Auto-scan with per-user frequency settings
-- **Watch Mode**: Real-time file system monitoring for instant updates
-
-### Security
-
-- **JWT Authentication**: Short-lived access tokens (1 hour) with refresh tokens (7 days)
-- **Strong Passwords**: Complexity requirements enforced (8+ chars, uppercase, lowercase, number, special)
-- **Account Lockout**: 5 failed attempts = 15-minute lockout
-- **Rate Limiting**: 10 requests/minute on auth endpoints
-- **Input Validation**: Comprehensive validation on all inputs
-- **No Passwords on Devices**: Web-based device approval with QR codes
-
----
-
-## 📚 Documentation
-
-### For Users & Self-Hosters
-
-- **[docs/user/calibre-integration.md](docs/user/calibre-integration.md)** - Calibre library integration
-- **[docs/user/sync-guide.md](docs/user/sync-guide.md)** - Understanding and using universal sync
-- **[docs/user/devices/koreader-setup.md](docs/user/devices/koreader-setup.md)** - KOReader configuration
-- **[docs/user/devices/kobo-setup.md](docs/user/devices/kobo-setup.md)** - Kobo e-reader configuration (coming soon)
-- **[docs/user/user-guide.md](docs/user/user-guide.md)** - General user guide
-- **[docs/user/admin-guide.md](docs/user/admin-guide.md)** - Admin features and configuration
-- **[docs/user/settings-guide.md](docs/user/settings-guide.md)** - Settings and preferences
-
-### For Developers
-
-- **[docs/developer/api/api-reference.md](docs/developer/api/api-reference.md)** - Complete API documentation
-- **[docs/developer/android-app.md](docs/developer/android-app.md)** - Android app design & roadmap
-- **[docs/contributing/development.md](docs/contributing/development.md)** - Development workflow
-
----
-
-## 🎯 Supported Devices
-
-| Platform         | Sync | OPDS | Status                                                        |
-| ---------------- | ---- | ---- | ------------------------------------------------------------- |
-| **Web Browser**  | ✅   | ✅   | Full support                                                  |
-| **KOReader**     | ✅   | ✅   | Runs on Kindle, Kobo, PocketBook hardware                     |
-| **Kobo Devices** | 🚧   | 🚧   | Native Kobo sync coming soon (use KOReader on Kobo today)     |
-| **Mobile Apps**  | 🚧   | 🚧   | Native Android app in design ([docs](docs/developer/android-app.md)); iOS later |
-
----
-
-## 💾 Network Storage (NAS / NFS / SMB)
-
-Libraries on network mounts are supported for everyday use — serving,
-reading, progress, and annotation sync all work over the mount — with a
-few behaviors worth knowing:
-
-- **Outage hysteresis.** When the mount drops, files miss one scan
-  (marked missing, hidden) then a second (archived, still recoverable).
-  When the mount returns — by path or by identical content elsewhere —
-  everything is restored automatically: annotations, progress, and
-  covers included.
-- **Retention purge.** Archived items older than `ARCHIVE_RETENTION_DAYS`
-  (default **90**, `0` = never auto-purge) are deleted for good by
-  library scans, annotations included. A NAS offline longer than the
-  retention window loses those books' metadata on return.
-- **Deleting while the storage is down is refused.** Deleting a book
-  cascades its annotations, so deletes are rejected with a clear error
-  while the item's library storage is unreachable. Archive the item
-  instead, or retry when the mount is back.
-- **Watch mode does not fire on network mounts** (inotify doesn't work
-  over NFS/SMB). The periodic scan is the change detector.
-- **Latency** — folder reachability checks are cached ~30s; large
-  libraries on slow mounts will still feel slower than local disk.
-
----
-
-## 🛠 Tech Stack
-
-- **Backend**: Go 1.25+ with Echo framework
-- **Database**: PostgreSQL 15+ with pgx v5
-- **Frontend**: HTMX + Tailwind CSS + Templ
-- **Auth**: JWT tokens with bcrypt password hashing
-- **Container**: Podman (Docker compatible)
-
----
-
-## 🧪 Testing
-
-```bash
-# Run all tests
-make test-all
-
-# Run integration tests (with test mode)
-make test-integration
-
-# Run Bruno OpenCollection YAML API tests
-npm install -g @usebruno/cli
-bruno run
 ```
 
 ---

bruno/admin/Get Admin Library.yml

@@ -1,30 +0,0 @@
-info:
-  name: Get Admin Library
-  type: http
-  seq: 5
-http:
-  method: GET
-  url: '{{base_url}}/admin/library'
-  auth: inherit
-  body:
-    type: none
-
-docs: |-
-  ## Get Admin Library Page
-    
-    Retrieves the admin library page for administrative access.
-    
-    **Method:** GET
-    
-    **Endpoint:** /admin/library
-    
-    **Headers:**
-    - `Authorization` (string): Bearer token
-    
-    **Response:**
-    - HTML content for the admin library page
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized
-    - 403: Forbidden

bruno/admin/hash_conflicts_api.yml

@@ -0,0 +1,31 @@
+info:
+  name: Hash Conflicts (API)
+  type: http
+  seq: 1
+
+http:
+  method: GET
+  url: '{{base_url}}/api/admin/hash-conflicts'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Hash Conflicts (API)
+
+    `GET /api/admin/hash-conflicts` — auth: jwt+admin.
+
+    Canonical reference: docs/developer/api/admin/hash_conflicts_api.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/admin/list_users.yml

@@ -0,0 +1,31 @@
+info:
+  name: List Users
+  type: http
+  seq: 2
+
+http:
+  method: GET
+  url: '{{base_url}}/api/auth/users'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # List Users
+
+    `GET /api/auth/users` — auth: jwt+admin.
+
+    Canonical reference: docs/developer/api/admin/list_users.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/admin/update_user_max_devices.yml

@@ -0,0 +1,37 @@
+info:
+  name: Update User Max Devices
+  type: http
+  seq: 3
+
+http:
+  method: PUT
+  url: '{{base_url}}/api/auth/users/{{media_item_id}}/max-devices'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "max_devices": 15
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Update User Max Devices
+
+    `PUT /api/auth/users/:id/max-devices` — auth: jwt+admin.
+
+    Canonical reference: docs/developer/api/admin/update_user_max_devices.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/analytics/Get Device Usage.yml

@@ -1,47 +0,0 @@
-info:
-  name: Get Device Usage
-  type: http
-  seq: 2
-http:
-  method: GET
-  url: '{{base_url}}/api/analytics/device-usage'
-  auth: inherit
-  body:
-    type: none
-runtime:
-  scripts:
-  - type: tests
-    code: "test(\"status must be 200\", function() {\n    expect(res.status).to.eql(200);"
-
-docs: |-
-  Get usage statistics for all devices.
-  
-    **Endpoint**: GET /api/analytics/device-usage
-    **Auth**: Required (Bearer token)
-  
-    ## Response Fields
-  
-    | Field | Type | Description |
-    |-------|------|-------------|
-    | devices | array | List of device usage statistics |
-    | devices[].id | string | Device ID |
-    | devices[].device_name | string | Device name |
-    | devices[].device_type | string | Device type (kobo, kindle, koreader) |
-    | devices[].sync_count | int | Number of sync operations |
-    | devices[].last_sync | string | Last sync timestamp |
-    | devices[].total_reading_minutes | int | Total reading time on device |
-    | devices[].books_read | int | Number of books completed on device |
-  
-    ## Example Response
-  
-    ```json
-    {
-      "devices": [
-        {
-          "id": "789e4567-e89b-12d3-a456-426614174001",
-          "device_name": "My Kobo Clara",
-          "device_type": "kobo",
-          "sync_count": 45,
-          "last_sync": "2026-02-08T17:25:00Z",
-          "total_reading_minutes": 1250,
-          "books_read": 3

bruno/analytics/Get Popular Books.yml

@@ -1,57 +0,0 @@
-info:
-  name: Get Popular Books
-  type: http
-  seq: 1
-http:
-  method: GET
-  url: '{{base_url}}/api/analytics/popular-books?limit=10'
-  auth: inherit
-  body:
-    type: none
-runtime:
-  scripts:
-  - type: tests
-    code: "test(\"status must be 200\", function() {\n    expect(res.status).to.eql(200);"
-
-docs: |-
-  Get popular books sorted by read count.
-  
-    **Endpoint**: GET /api/analytics/popular-books
-    **Auth**: Required (Bearer token)
-  
-    ## Query Parameters
-  
-    | Parameter | Type | Required | Description |
-    |-----------|------|-----------|-------------|
-    | limit | int | No | Maximum number of books to return (default: 10) |
-  
-    ## Response Fields
-  
-    | Field | Type | Description |
-    |-------|------|-------------|
-    | books | array | List of popular books |
-    | books[].media_item_id | string | Book ID |
-    | books[].title | string | Book title |
-    | books[].author | string | Book author |
-    | books[].read_count | int | Number of times read |
-    | books[].avg_completion | float | Average completion rate (0-1) |
-    | books[].cover_url | string | Cover image URL |
-  
-    ## Example Request
-  
-    ```
-    GET /api/analytics/popular-books?limit=10
-    ```
-  
-    ## Example Response
-  
-    ```json
-    {
-      "books": [
-        {
-          "media_item_id": "323e4567-e89b-12d3-a456-426614174002",
-          "title": "The Great Gatsby",
-          "author": "F. Scott Fitzgerald",
-          "read_count": 5,
-          "avg_completion": 0.85,
-          "cover_url": "/api/books/323e4567-e89b-12d3-a456-426614174002/cover"

bruno/analytics/Get Reading Stats Date Range.yml

@@ -1,58 +0,0 @@
-info:
-  name: Get Reading Stats Date Range
-  type: http
-  seq: 3
-http:
-  method: GET
-  url: '{{base_url}}/api/analytics/reading-stats?start_date=2024-01-01&end_date=2024-01-31'
-  auth: inherit
-  body:
-    type: none
-runtime:
-  scripts:
-  - type: tests
-    code: "test(\"status must be 200\", function() {\n    expect(res.status).to.eql(200);"
-
-docs: |-
-  Get reading statistics for a specific date range.
-  
-    **Endpoint**: GET /api/analytics/reading-stats
-    **Auth**: Required (Bearer token)
-  
-    ## Query Parameters
-  
-    | Parameter | Type | Required | Description |
-    |-----------|------|-----------|-------------|
-    | start_date | string | No | Start date (ISO 8601 format, default: 30 days ago) |
-    | end_date | string | No | End date (ISO 8601 format, default: today) |
-  
-    ## Response Fields
-  
-    | Field | Type | Description |
-    |-------|------|-------------|
-    | total_books_read | int | Total books completed in range |
-    | total_pages_read | int | Total pages read in range |
-    | total_reading_time_minutes | int | Total reading time in minutes |
-    | completion_rate | float | Percentage of books completed (0-1) |
-    | daily_reading_minutes | array | Daily reading time per day |
-    | daily_reading_minutes[].date | string | Date (ISO 8601) |
-    | daily_reading_minutes[].minutes | int | Minutes read on that date |
-  
-    ## Example Request
-  
-    ```
-    GET /api/analytics/reading-stats?start_date=2024-01-01&end_date=2024-01-31
-    ```
-  
-    ## Example Response
-  
-    ```json
-    {
-      "total_books_read": 2,
-      "total_pages_read": 450,
-      "total_reading_time_minutes": 720,
-      "completion_rate": 0.85,
-      "daily_reading_minutes": [
-        {
-          "date": "2024-01-01",
-          "minutes": 30

bruno/analytics/Get Reading Stats.yml

@@ -1,58 +0,0 @@
-info:
-  name: Get Reading Stats
-  type: http
-  seq: 4
-http:
-  method: GET
-  url: '{{base_url}}/api/analytics/reading-stats'
-  auth: inherit
-  body:
-    type: none
-runtime:
-  scripts:
-  - type: tests
-    code: "test(\"status must be 200\", function() {\n    expect(res.status).to.eql(200);"
-
-docs: |-
-  Get overall reading statistics for the authenticated user.
-  
-    **Endpoint**: GET /api/analytics/reading-stats
-    **Auth**: Required (Bearer token)
-  
-    ## Query Parameters
-  
-    | Parameter | Type | Required | Description |
-    |-----------|------|-----------|-------------|
-    | start_date | string | No | Start date (ISO 8601 format) |
-    | end_date | string | No | End date (ISO 8601 format) |
-  
-    ## Response Fields
-  
-    | Field | Type | Description |
-    |-------|------|-------------|
-    | total_books_read | int | Total books completed |
-    | total_pages_read | int | Total pages read |
-    | total_reading_time_minutes | int | Total reading time in minutes |
-    | completion_rate | float | Average book completion rate (0-1) |
-    | daily_reading_minutes | array | Daily reading time breakdown |
-    | daily_reading_minutes[].date | string | Date (ISO 8601) |
-    | daily_reading_minutes[].minutes | int | Minutes read on that date |
-  
-    ## Example Request
-  
-    ```
-    GET /api/analytics/reading-stats
-    ```
-  
-    ## Example Response
-  
-    ```json
-    {
-      "total_books_read": 12,
-      "total_pages_read": 3450,
-      "total_reading_time_minutes": 5400,
-      "completion_rate": 0.78,
-      "daily_reading_minutes": [
-        {
-          "date": "2026-01-15",
-          "minutes": 45

bruno/analytics/get_analytics.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Reading Statistics
+  type: http
+  seq: 1
+
+http:
+  method: GET
+  url: '{{base_url}}/api/analytics/reading-stats'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Reading Statistics
+
+    `GET /api/analytics/reading-stats` — auth: jwt.
+
+    Canonical reference: docs/developer/api/analytics/get_analytics.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/analytics/get_device_usage.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Device Usage
+  type: http
+  seq: 2
+
+http:
+  method: GET
+  url: '{{base_url}}/api/analytics/device-usage'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Device Usage
+
+    `GET /api/analytics/device-usage` — auth: jwt.
+
+    Canonical reference: docs/developer/api/analytics/get_device_usage.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/analytics/get_popular_books.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Popular Books
+  type: http
+  seq: 3
+
+http:
+  method: GET
+  url: '{{base_url}}/api/analytics/popular-books'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Popular Books
+
+    `GET /api/analytics/popular-books` — auth: jwt.
+
+    Canonical reference: docs/developer/api/analytics/get_popular_books.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/authentication/login.yml

@@ -0,0 +1,59 @@
+info:
+  name: Login User
+  type: http
+  seq: 1
+
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/login'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "login": "user@example.com",
+        "password": "SecureP@ss123!"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: after-response
+      code: |-
+        function onResponse(res) {
+          try {
+            const responseBody = res.getBody();
+            const token = responseBody.access_token;
+            const refreshToken = responseBody.refresh_token;
+            if (token) {
+              bru.setEnvVar("token", token, { persist: true });
+              console.log("Access token saved");
+            }
+            if (refreshToken) {
+              bru.setEnvVar("refresh_token", refreshToken, { persist: true });
+              console.log("Refresh token saved");
+            }
+          } catch (error) {
+            console.error("Token capture failed:", error.message);
+          }
+        }
+        onResponse();
+
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Login User
+
+    `POST /api/auth/login` — auth: none.
+
+    Canonical reference: docs/developer/api/authentication/login.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/authentication/logout.yml

@@ -0,0 +1,31 @@
+info:
+  name: Logout User
+  type: http
+  seq: 2
+
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/logout'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Logout User
+
+    `POST /api/auth/logout` — auth: none.
+
+    Canonical reference: docs/developer/api/authentication/logout.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/authentication/password_rules.yml

@@ -0,0 +1,31 @@
+info:
+  name: Password Rules
+  type: http
+  seq: 3
+
+http:
+  method: GET
+  url: '{{base_url}}/api/auth/password-rules'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Password Rules
+
+    `GET /api/auth/password-rules` — auth: none.
+
+    Canonical reference: docs/developer/api/authentication/password_rules.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/authentication/refresh_token.yml

@@ -0,0 +1,58 @@
+info:
+  name: Refresh Token
+  type: http
+  seq: 4
+
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/refresh'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "refresh_token": "d4f5g6h7..."
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: after-response
+      code: |-
+        function onResponse(res) {
+          try {
+            const responseBody = res.getBody();
+            const token = responseBody.access_token;
+            const refreshToken = responseBody.refresh_token;
+            if (token) {
+              bru.setEnvVar("token", token, { persist: true });
+              console.log("Access token saved");
+            }
+            if (refreshToken) {
+              bru.setEnvVar("refresh_token", refreshToken, { persist: true });
+              console.log("Refresh token saved");
+            }
+          } catch (error) {
+            console.error("Token capture failed:", error.message);
+          }
+        }
+        onResponse();
+
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Refresh Token
+
+    `POST /api/auth/refresh` — auth: none.
+
+    Canonical reference: docs/developer/api/authentication/refresh_token.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/authentication/register.yml

@@ -0,0 +1,62 @@
+info:
+  name: Register User
+  type: http
+  seq: 5
+
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/register'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "email": "user@example.com",
+        "username": "john",
+        "password": "SecureP@ss123!",
+        "first_name": "John",
+        "last_name": "Doe"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: after-response
+      code: |-
+        function onResponse(res) {
+          try {
+            const responseBody = res.getBody();
+            const token = responseBody.access_token;
+            const refreshToken = responseBody.refresh_token;
+            if (token) {
+              bru.setEnvVar("token", token, { persist: true });
+              console.log("Access token saved");
+            }
+            if (refreshToken) {
+              bru.setEnvVar("refresh_token", refreshToken, { persist: true });
+              console.log("Refresh token saved");
+            }
+          } catch (error) {
+            console.error("Token capture failed:", error.message);
+          }
+        }
+        onResponse();
+
+    - type: tests
+      code: |-
+        test("status is 201", function() {
+          expect(res.status).to.eql(201);
+        });
+
+docs:
+  content: |-
+    # Register User
+
+    `POST /api/auth/register` — auth: none.
+
+    Canonical reference: docs/developer/api/authentication/register.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/authentication/scenarios/register-admin-with-admins-present-403.yml

@@ -0,0 +1,40 @@
+info:
+  name: Register - Admin Role Unauthenticated (403)
+  type: http
+  seq: 2
+
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/register'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "email": "smoke-admin-attempts@tests.bookhoard.internal",
+        "username": "smokeadminattempts",
+        "password": "Sm0ke@Pass123!",
+        "role": "admin"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 403", function() {
+          expect(res.status).to.eql(403);
+        });
+
+docs:
+  content: |-
+    # Register - Admin Role Unauthenticated (403)
+
+    With admins already present, an unauthenticated register attempt
+    carrying role=admin must be rejected with 403 and create nothing.
+    Repeats safely.
+  type: text/markdown

bruno/authentication/scenarios/register-duplicate-email-409.yml

@@ -0,0 +1,39 @@
+info:
+  name: Register - Duplicate Email (409)
+  type: http
+  seq: 1
+
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/register'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "email": "testuser@tests.bookhoard.internal",
+        "username": "testuser",
+        "password": "Wh4t3v3r@Pass!"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 409", function() {
+          expect(res.status).to.eql(409);
+        });
+
+docs:
+  content: |-
+    # Register - Duplicate Email (409)
+
+    Registering with an email that already exists must fail with 409 and
+    create nothing. Negative scenario — hand-authored (the generated set
+    covers only happy paths). Repeats safely.
+  type: text/markdown

bruno/authentication/scenarios/register-weak-password-400.yml

@@ -0,0 +1,38 @@
+info:
+  name: Register - Weak Password (400)
+  type: http
+  seq: 3
+
+http:
+  method: POST
+  url: '{{base_url}}/api/auth/register'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "email": "smoke-weak-attempts@tests.bookhoard.internal",
+        "username": "smokeweakattempts",
+        "password": "weak"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 400", function() {
+          expect(res.status).to.eql(400);
+        });
+
+docs:
+  content: |-
+    # Register - Weak Password (400)
+
+    Passwords below the configured complexity rules (see
+    GET /api/auth/password-rules) must be rejected with 400. Repeats safely.
+  type: text/markdown

bruno/book-matching/auto_link_books.yml

@@ -0,0 +1,38 @@
+info:
+  name: Auto Link Books
+  type: http
+  seq: 1
+
+http:
+  method: POST
+  url: '{{base_url}}/api/sync/auto-link-books'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "confidence_threshold": 0.8,
+        "limit": 100
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Auto Link Books
+
+    `POST /api/sync/auto-link-books` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/auto_link_books.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/bulk_link_books.yml

@@ -0,0 +1,48 @@
+info:
+  name: Bulk Link Books
+  type: http
+  seq: 2
+
+http:
+  method: POST
+  url: '{{base_url}}/api/sync/bulk-link-books'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "links": [
+          {
+            "unlinked_book_id": "770e8400-e29b-41d4-a716-446655440002",
+            "media_item_id": "660e8400-e29b-41d4-a716-446655440001",
+            "confidence_score": 0.95
+          },
+          {
+            "unlinked_book_id": "880e8400-e29b-41d4-a716-446655440003",
+            "media_item_id": "990e8400-e29b-41d4-a716-446655440004",
+            "confidence_score": 0.87
+          }
+        ]
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Bulk Link Books
+
+    `POST /api/sync/bulk-link-books` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/bulk_link_books.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/create_device_file_alias.yml

@@ -0,0 +1,39 @@
+info:
+  name: Create Device File Alias
+  type: http
+  seq: 3
+
+http:
+  method: POST
+  url: '{{base_url}}/api/devices/{{device_id}}/file-aliases'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "media_item_id": "550e8400-e29b-41d4-a716-446655440001",
+        "file_name": "book.epub",
+        "file_hash": "abc123..."
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 201", function() {
+          expect(res.status).to.eql(201);
+        });
+
+docs:
+  content: |-
+    # Create Device File Alias
+
+    `POST /api/devices/:id/file-aliases` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/create_device_file_alias.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/delete_device_file_alias.yml

@@ -0,0 +1,31 @@
+info:
+  name: Delete Device File Alias
+  type: http
+  seq: 4
+
+http:
+  method: DELETE
+  url: '{{base_url}}/api/devices/{{device_id}}/file-aliases/{{alias_id}}'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 204", function() {
+          expect(res.status).to.eql(204);
+        });
+
+docs:
+  content: |-
+    # Delete Device File Alias
+
+    `DELETE /api/devices/:id/file-aliases/:aliasId` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/delete_device_file_alias.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/get_book_matches.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Book Matches
+  type: http
+  seq: 5
+
+http:
+  method: GET
+  url: '{{base_url}}/api/books/match'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Book Matches
+
+    `GET /api/books/match` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/get_book_matches.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/get_device_file_aliases.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Device File Aliases
+  type: http
+  seq: 6
+
+http:
+  method: GET
+  url: '{{base_url}}/api/devices/{{device_id}}/file-aliases'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Device File Aliases
+
+    `GET /api/devices/:id/file-aliases` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/get_device_file_aliases.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/get_unlinked_book_suggestions.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Unlinked Book Suggestions
+  type: http
+  seq: 7
+
+http:
+  method: GET
+  url: '{{base_url}}/api/sync/unlinked-books/{{unlinked_book_id}}/suggestions'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Unlinked Book Suggestions
+
+    `GET /api/sync/unlinked-books/:id/suggestions` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/get_unlinked_book_suggestions.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/get_unlinked_books.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Unlinked Books
+  type: http
+  seq: 8
+
+http:
+  method: GET
+  url: '{{base_url}}/api/devices/{{device_id}}/sync/unlinked-books'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Unlinked Books
+
+    `GET /api/devices/:deviceId/sync/unlinked-books` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/get_unlinked_books.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/link_book.yml

@@ -0,0 +1,43 @@
+info:
+  name: Link Book
+  type: http
+  seq: 9
+
+http:
+  method: POST
+  url: '{{base_url}}/api/devices/{{device_id}}/sync/link-book'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "device_file": {
+          "file_path": "/books/hobbit.epub",
+          "sha256": "abc123...",
+          "title": "The Hobbit"
+        },
+        "media_item_id": "550e8400-e29b-41d4-a716-446655440000",
+        "confidence_score": 1.0
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Link Book
+
+    `POST /api/devices/:deviceId/sync/link-book` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/link_book.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/search_books.yml

@@ -0,0 +1,41 @@
+info:
+  name: Search Books for Matching
+  type: http
+  seq: 10
+
+http:
+  method: POST
+  url: '{{base_url}}/api/sync/books/query'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "identifiers": ["isbn:978-0345391802", "uuid:abc-123"],
+        "sha256": "a1b2c3d4e5f6abc123...",
+        "title": "The Hobbit",
+        "author": "J.R.R. Tolkien",
+        "file_size": 2456789
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Search Books for Matching
+
+    `POST /api/sync/books/query` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/search_books.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/book-matching/update_device_file_alias.yml

@@ -0,0 +1,38 @@
+info:
+  name: Update Device File Alias
+  type: http
+  seq: 11
+
+http:
+  method: PUT
+  url: '{{base_url}}/api/devices/{{device_id}}/file-aliases/{{alias_id}}'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "file_name": "updated-book.epub",
+        "file_hash": "newhash123..."
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Update Device File Alias
+
+    `PUT /api/devices/:id/file-aliases/:aliasId` — auth: jwt.
+
+    Canonical reference: docs/developer/api/book-matching/update_device_file_alias.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/books/Bulk Delete Books.yml

@@ -1,15 +0,0 @@
-info:
-  name: Bulk Delete Media Items
-  type: http
-  seq: 1
-http:
-  method: POST
-  url: '{{base_url}}/api/media-items/bulk-delete'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"media_item_ids\": [\n      \"{{bookId1"
-  headers:
-  - key: Content-Type
-    value: application/json
-docs: "## Bulk Delete Media Items\n\n  Deletes multiple media items in a single request.\n\n  **Method:** POST\n\n  **Endpoint:** /api/media-items/bulk-delete\n\n  **Authentication:** Required (Bearer token)\n\n  **Request Body:**\n  - `media_item_ids` (array of strings): Array of media item UUIDs to delete\n\n  **Response:**\n  - `results` (array): Results for each deletion attempt\n  - `total` (number): Total number of media items processed\n  - `deleted` (number): Number of successfully deleted media items\n  - `failed` (number): Number of failed deletions\n\n  **Status Codes:**\n  - 200: Success (with partial results if some failed)\n  - 400: Invalid request data\n  - 401: Unauthorized\n  - 403: Forbidden\n  - 500: Internal server error\n\n  **Example:**\n  ```json\n  {\n    \"media_item_ids\": [\n      \"uuid-1\",\n      \"uuid-2\",\n      \"uuid-3\"\n    ]"

bruno/books/Bulk Update Books.yml

@@ -1,16 +0,0 @@
-info:
-  name: Bulk Update Media Items
-  type: http
-  seq: 2
-http:
-  method: POST
-  url: '{{base_url}}/api/media-items/bulk-update'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"media_item_updates\": [\n      {\n        \"media_item_id\": \"{{bookId1"
-  headers:
-  - key: Content-Type
-    value: application/json
-docs: "## Bulk Update Media Items\n\n  Updates multiple media items in a single request with different fields for each item.\n\n  **Method:** POST\n\n  **Endpoint:** /api/media-items/bulk-update\n\n  **Authentication:** Required (Bearer token)\n\n  **Request Body:**\n  - `media_item_updates` (array): Array of update objects\n    - `media_item_id` (string): Media item UUID to update\n    - `updates` (object): Fields to update (can include title, author, genre, tags, contributors, etc.)\n\n  **Response:**\n  - `results` (array): Results for each update attempt\n  - `total` (number): Total number of media items processed\n  - `updated` (number): Number of successfully updated media items\n  - `failed` (number): Number of failed updates\n\n  **Status Codes:**\n  - 200: Success (with partial results if some failed)\n  - 400: Invalid request data\n  - 401: Unauthorized\n  - 403: Forbidden\n  - 500: Internal server error\n\n  **Example:**\n  ```json\n  {\n    \"media_item_updates\": [\n      {\n\
-  \        \"media_item_id\": \"uuid-1\",\n        \"updates\": {\n          \"title\": \"New Title\",\n          \"genre\": \"Fiction\",\n          \"tags\": [\"fiction\", \"adventure\"]"

bruno/collections/Add Books to Collection.yml

@@ -1,12 +0,0 @@
-info:
-  name: Add Books to Collection
-  type: http
-  seq: 6
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/{{collection_id}}/books'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"book_ids\": [\n      \"{{book_id_1}}"
-docs: "## Add Books to Collection\n\n  Adds multiple books to an existing collection.\n  \n  **Method:** POST\n  \n  **Endpoint:** /api/collections/{collection_id}/books\n  \n  **Authentication:** Required (Bearer token)\n  \n  **Path Parameters:**\n  - `collection_id` (string): Collection ID\n  \n  **Request Body:**\n  - `book_ids` (array of strings, required): List of book IDs to add\n  \n  **Response:**\n  - `message` (string): Success message\n  - `added_count` (integer): Number of books added\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Invalid request\n  - 401: Unauthorized\n  - 404: Collection not found"

bruno/collections/Create Collection.yml

@@ -1,13 +0,0 @@
-info:
-  name: Create Collection
-  type: http
-  seq: 1
-http:
-  method: POST
-  url: '{{base_url}}/api/collections'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"name\": \"Science Fiction\",\n    \"description\": \"My favorite sci-fi books\",\n    \"color\": \"#ff0000\",\n    \"icon\": \"\U0001F680\",\n    \"auto_assign_rules\": [\n      {\n        \"id\": \"rule-1\",\n        \"field\": \"genre\",\n        \"operator\": \"equals\",\n        \"value\": \"Science Fiction\",\n        \"priority\": 8"
-docs: "## Create Collection\n\n  Creates a new collection for organizing books.\n  \n  **Method:** POST\n  \n  **Endpoint:** /api/collections\n  \n  **Authentication:** Required (Bearer token)\n  \n  **Request Body:**\n  - `name` (string, required): Collection name (max 100 chars)\n  - `description` (string, optional): Collection description (max 500 chars)\n  - `color` (string, optional): Hex color code (default #3498db)\n  - `icon` (string, optional): Emoji icon (default \U0001F4DA)\n  - `auto_assign_rules` (array, optional): Auto-assignment rules\n    - `id` (string): Rule ID\n    - `field` (string): Field to match (genre, author, series, etc.)\n    - `operator` (string): Comparison operator (equals, contains, startsWith)\n    - `value` (string): Value to match\n    - `priority` (integer): Rule priority (1-10)\n  \n  **Response:**\n  - Collection object with generated ID\n  \n  **Status Codes:**\n  - 201: Created\n  - 400: Invalid request\n  - 401: Unauthorized\n  - 409: Collection name\
-  \ already exists"

bruno/collections/Create Device Mapping.yml

@@ -1,12 +0,0 @@
-info:
-  name: Create Device Mapping
-  type: http
-  seq: 9
-http:
-  method: POST
-  url: '{{base_url}}/api/devices/{{device_id}}/collections'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"collection_id\": \"{{collection_id}}"
-docs: "## Create Device Mapping\n\n  Maps a collection to a device shelf for synchronization.\n  \n  **Method:** POST\n  \n  **Endpoint:** /api/devices/{device_id}/collections\n  \n  **Authentication:** Required (Bearer token)\n  \n  **Path Parameters:**\n  - `device_id` (string): Device ID\n  \n  **Request Body:**\n  - `collection_id` (string, required): Collection ID to map\n  - `device_shelf_name` (string, optional): Custom shelf name on device\n  - `sync_direction` (string, optional): sync direction (book_to_device, device_to_book, bidirectional)\n  \n  **Response:**\n  - Mapping object with generated ID\n  \n  **Status Codes:**\n  - 201: Created\n  - 400: Invalid request\n  - 401: Unauthorized\n  - 404: Device or collection not found"

bruno/collections/Delete Collection.yml

@@ -1,30 +0,0 @@
-info:
-  name: Delete Collection
-  type: http
-  seq: 5
-http:
-  method: DELETE
-  url: '{{base_url}}/api/collections/{{collection_id}}'
-  auth: inherit
-
-docs: |-
-  ## Delete Collection
-  
-    Permanently deletes a collection and all its mappings.
-    
-    **Method:** DELETE
-    
-    **Endpoint:** /api/collections/{collection_id}
-    
-    **Authentication:** Required (Bearer token)
-    
-    **Path Parameters:**
-    - `collection_id` (string): Collection ID
-    
-    **Response:**
-    - `message` (string): Success message
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized
-    - 404: Collection not found

bruno/collections/Delete Device Mapping.yml

@@ -1,31 +0,0 @@
-info:
-  name: Delete Device Mapping
-  type: http
-  seq: 11
-http:
-  method: DELETE
-  url: '{{base_url}}/api/devices/{{device_id}}/collections/{{mapping_id}}'
-  auth: inherit
-
-docs: |-
-  ## Delete Device Mapping
-  
-    Removes a collection-to-device mapping.
-    
-    **Method:** DELETE
-    
-    **Endpoint:** /api/devices/{device_id}/collections/{mapping_id}
-    
-    **Authentication:** Required (Bearer token)
-    
-    **Path Parameters:**
-    - `device_id` (string): Device ID
-    - `mapping_id` (string): Mapping ID
-    
-    **Response:**
-    - `message` (string): Success message
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized
-    - 404: Device or mapping not found

bruno/collections/Get Book Collections.yml

@@ -1,44 +0,0 @@
-info:
-  name: Get Book Collections
-  type: http
-  seq: 12
-
-http:
-  method: GET
-  url: "{{base_url}}/api/collections/books"
-  body:
-    type: json
-    data: |-
-      {
-        "collection_id": "{{collection_id}}"
-      }
-  auth: inherit
-
-settings:
-  encodeUrl: true
-  timeout: 0
-  followRedirects: true
-  maxRedirects: 5
-
-docs: |-
-  ## Get Book Collections
-  
-    Retrieves all collections that a specific book belongs to.
-  
-    **Method:** GET
-  
-    **Endpoint:** /api/collections/books
-  
-    **Authentication:** Required (Bearer token)
-  
-    **Query Parameters:**
-    - `book_id` (string, required): Book ID
-  
-    **Response:**
-    - Array of collection objects containing the book
-  
-    **Status Codes:**
-    - 200: Success
-    - 400: Invalid request
-    - 401: Unauthorized
-    - 404: Book not found

bruno/collections/Get Collection.yml

@@ -1,30 +0,0 @@
-info:
-  name: Get Collection
-  type: http
-  seq: 3
-http:
-  method: GET
-  url: '{{base_url}}/api/collections/{{collection_id}}'
-  auth: inherit
-
-docs: |-
-  ## Get Collection
-  
-    Retrieves detailed information about a specific collection.
-    
-    **Method:** GET
-    
-    **Endpoint:** /api/collections/{collection_id}
-    
-    **Authentication:** Required (Bearer token)
-    
-    **Path Parameters:**
-    - `collection_id` (string): Collection ID
-    
-    **Response:**
-    - Collection object with all fields including books, rules, and mappings
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized
-    - 404: Collection not found

bruno/collections/Get Collections.yml

@@ -1,31 +0,0 @@
-info:
-  name: Get Collections
-  type: http
-  seq: 2
-http:
-  method: GET
-  url: '{{base_url}}/api/collections?include_auto=true&sort_by=name'
-  auth: inherit
-
-docs: |-
-  ## Get Collections
-  
-    Retrieves all collections for the authenticated user.
-    
-    **Method:** GET
-    
-    **Endpoint:** /api/collections
-    
-    **Authentication:** Required (Bearer token)
-    
-    **Query Parameters:**
-    - `include_auto` (boolean, optional): Include auto-created collections (default false)
-    - `sort_by` (string, optional): Sort field (name, created_at, book_count)
-    - `order` (string, optional): Sort order (asc, desc)
-    
-    **Response:**
-    - Array of collection objects
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized

bruno/collections/Get Device Mappings.yml

@@ -1,30 +0,0 @@
-info:
-  name: Get Device Mappings
-  type: http
-  seq: 8
-http:
-  method: GET
-  url: '{{base_url}}/api/devices/{{device_id}}/collections'
-  auth: inherit
-
-docs: |-
-  ## Get Device Mappings
-  
-    Retrieves all collection mappings for a specific device.
-    
-    **Method:** GET
-    
-    **Endpoint:** /api/devices/{device_id}/collections
-    
-    **Authentication:** Required (Bearer token)
-    
-    **Path Parameters:**
-    - `device_id` (string): Device ID
-    
-    **Response:**
-    - Array of device mapping objects with collection details
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized
-    - 404: Device not found

bruno/collections/Remove Book from Collection.yml

@@ -1,31 +0,0 @@
-info:
-  name: Remove Book from Collection
-  type: http
-  seq: 7
-http:
-  method: DELETE
-  url: '{{base_url}}/api/collections/{{collection_id}}/books/{{book_id}}'
-  auth: inherit
-
-docs: |-
-  ## Remove Book from Collection
-  
-    Removes a single book from a collection.
-    
-    **Method:** DELETE
-    
-    **Endpoint:** /api/collections/{collection_id}/books/{book_id}
-    
-    **Authentication:** Required (Bearer token)
-    
-    **Path Parameters:**
-    - `collection_id` (string): Collection ID
-    - `book_id` (string): Book ID
-    
-    **Response:**
-    - `message` (string): Success message
-    
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized
-    - 404: Collection or book not found

bruno/collections/Update Collection.yml

@@ -1,12 +0,0 @@
-info:
-  name: Update Collection
-  type: http
-  seq: 4
-http:
-  method: PUT
-  url: '{{base_url}}/api/collections/{{collection_id}}'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"name\": \"Sci-Fi Favorites\",\n    \"description\": \"Updated description\",\n    \"color\": \"#00ff00\",\n    \"icon\": \"⭐\",\n    \"auto_assign_rules\": [\n      {\n        \"id\": \"rule-2\",\n        \"field\": \"series\",\n        \"operator\": \"equals\",\n        \"value\": \"Foundation\",\n        \"priority\": 9"
-docs: "## Update Collection\n\n  Updates an existing collection's properties.\n  \n  **Method:** PUT\n  \n  **Endpoint:** /api/collections/{collection_id}\n  \n  **Authentication:** Required (Bearer token)\n  \n  **Path Parameters:**\n  - `collection_id` (string): Collection ID\n  \n  **Request Body:**\n  - `name` (string, optional): New collection name\n  - `description` (string, optional): New description\n  - `color` (string, optional): New hex color code\n  - `icon` (string, optional): New emoji icon\n  - `auto_assign_rules` (array, optional): Updated auto-assignment rules\n  \n  **Response:**\n  - Updated collection object\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Invalid request\n  - 401: Unauthorized\n  - 404: Collection not found\n  - 409: Collection name already exists"

bruno/collections/Update Device Mapping.yml

@@ -1,12 +0,0 @@
-info:
-  name: Update Device Mapping
-  type: http
-  seq: 10
-http:
-  method: PUT
-  url: '{{base_url}}/api/devices/{{device_id}}/collections/{{mapping_id}}'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"device_shelf_name\": \"Science Fiction\",\n    \"sync_direction\": \"book_to_device\""
-docs: "## Update Device Mapping\n\n  Updates settings for a collection-to-device mapping.\n  \n  **Method:** PUT\n  \n  **Endpoint:** /api/devices/{device_id}/collections/{mapping_id}\n  \n  **Authentication:** Required (Bearer token)\n  \n  **Path Parameters:**\n  - `device_id` (string): Device ID\n  - `mapping_id` (string): Mapping ID\n  \n  **Request Body:**\n  - `device_shelf_name` (string, optional): Custom shelf name on device\n  - `sync_direction` (string, optional): Sync direction (book_to_device, device_to_book, bidirectional)\n  \n  **Response:**\n  - Updated mapping object\n  \n  **Status Codes:**\n  - 200: Success\n  - 400: Invalid request\n  - 401: Unauthorized\n  - 404: Device or mapping not found"

bruno/collections/bulk_add_books.yml

@@ -0,0 +1,36 @@
+info:
+  name: Bulk Add Books
+  type: http
+  seq: 2
+
+http:
+  method: POST
+  url: '{{base_url}}/api/collections/bulk-add-books'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "operations": [
+          {
+            "collection_id": "550e8400-e29b-41d4-a716-446655440000",
+            "book_ids": [
+              "660e8400-e29b-41d4-a716-446655440001"
+            ]
+          }
+        ]
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs:
+  content: |-
+    # Bulk Add Books
+
+    `POST /api/collections/bulk-add-books` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/bulk_add_books.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/bulk_assign.yml

@@ -0,0 +1,41 @@
+info:
+  name: Bulk Assign Books
+  type: http
+  seq: 3
+
+http:
+  method: POST
+  url: '{{base_url}}/api/collections/{{collection_id}}/books'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "book_ids": [
+          "660e8400-e29b-41d4-a716-446655440000",
+          "770e8400-e29b-41d4-a716-446655440000",
+          "880e8400-e29b-41d4-a716-446655440000"
+        ]
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 204", function() {
+          expect(res.status).to.eql(204);
+        });
+
+docs:
+  content: |-
+    # Bulk Assign Books
+
+    `POST /api/collections/:id/books` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/bulk_assign.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/bulk_remove_books.yml

@@ -0,0 +1,32 @@
+info:
+  name: Bulk Remove Books
+  type: http
+  seq: 4
+
+http:
+  method: POST
+  url: '{{base_url}}/api/collections/{{collection_id}}/books/bulk-remove'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "book_ids": [
+          "550e8400-e29b-41d4-a716-446655440000",
+          "660e8400-e29b-41d4-a716-446655440001"
+        ]
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs:
+  content: |-
+    # Bulk Remove Books
+
+    `POST /api/collections/:id/books/bulk-remove` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/bulk_remove_books.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/create-custom-section-manual.yml

@@ -1,16 +0,0 @@
-meta:
-  name: Create Custom Section with Manual Books
-  type: http
-  seq: 2
-http:
-  method: POST
-  url: '{{base_url}}/api/collections'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"library_id\": \"{{library_id}}\",\n  \"name\": \"My Favorites\",\n  \"icon\": \"⭐\",\n  \"description\": \"My favorite books\",\n  \"show_on_dashboard\": true,\n  \"auto_assign_rules\": \"\",\n  \"manual_book_ids\": [\"{{media_item_id}}\"],\n  \"match_type\": \"all\"\n}"
-runtime:
-  scripts:
-  - type: after-response
-    code: "function onResponse(res) {\ntest(\"status must be 201 with valid request\", function() {\n    expect(res.status).to.eql(201);\n});\n\ntest(\"response contains collection id\", function() {\n    expect(res.body.id).to.exist;\nexpect(res.body.id).to.be.a('string');\n  });\n\ntest(\"response contains collection name\", function() {\n    expect(res.body.name).to.eql(\"My Favorites\");\n  });\n}"
-docs: "Create a custom collection with manually selected books.\n\n**Endpoint**: POST /api/collections\n**Auth**: Required (Bearer token)\n\n## Example Request\n\n```json\n{\n  \"library_id\": \"cc23c3a7-f8fb-451a-a78d-2a16df1b725a\",\n  \"name\": \"My Favorites\",\n  \"icon\": \"⭐\",\n  \"description\": \"My favorite books\",\n  \"show_on_dashboard\": true,\n  \"auto_assign_rules\": \"\",\n  \"manual_book_ids\": [\"book-id-1\", \"book-id-2\"],\n  \"match_type\": \"all\"\n}\n```\n\n## Response\n\nReturns the created collection with generated ID."

bruno/collections/create-custom-section-missing-fields.yml

@@ -1,19 +0,0 @@
-meta:
-  name: Create Custom Section Missing Required Fields
-  type: http
-  seq: 3
-http:
-  method: POST
-  url: '{{base_url}}/api/collections'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"library_id\": \"{{library_id}}\",\n  \"icon\": \"\U0001F4DA\"\n}"
-runtime:
-  scripts:
-  - type: after-response
-    code: "function onResponse(res) {\ntest(\"status must be 400 with missing name\", function() {\n    expect(res.status).to.eql(400);\n});\n\ntest(\"response contains error message\", function() {\n    expect(res.body.error).to.exist;\n  });\n}"
-docs: 'Test error handling when creating a collection without required fields.
-
-
-  **Expected Response**: 400 Bad Request with error message.'

bruno/collections/create-custom-section-rules.yml

@@ -1,17 +0,0 @@
-meta:
-  name: Create Custom Section with Filter Rules
-  type: http
-  seq: 1
-http:
-  method: POST
-  url: '{{base_url}}/api/collections'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"library_id\": \"{{library_id}}\",\n  \"name\": \"Science Fiction Books\",\n  \"icon\": \"\U0001F680\",\n  \"description\": \"All my sci-fi books\",\n  \"show_on_dashboard\": true,\n  \"auto_assign_rules\": \"{\\\"rules\\\":[{\\\"id\\\":\\\"rule1\\\",\\\"field\\\":\\\"genre\\\",\\\"operator\\\":\\\"equals\\\",\\\"value\\\":\\\"Sci-Fi\\\",\\\"priority\\\":1}]}\",\n  \"manual_book_ids\": [],\n  \"match_type\": \"all\"\n}"
-runtime:
-  scripts:
-  - type: after-response
-    code: "function onResponse(res) {\ntest(\"status must be 201 with valid request\", function() {\n    expect(res.status).to.eql(201);\n});\n\ntest(\"response contains collection id\", function() {\n    expect(res.body.id).to.exist;\nexpect(res.body.id).to.be.a('string');\n  });\n\ntest(\"response contains collection name\", function() {\n    expect(res.body.name).to.eql(\"Science Fiction Books\");\n  });\n\ntest(\"response contains is_system false\", function() {\n    expect(res.body.is_system).to.exist;\n    expect(res.body.is_system).to.eql(false);\n  });\n}"
-docs: "Create a custom collection with filter rules.\n\n**Endpoint**: POST /api/collections\n**Auth**: Required (Bearer token)\n\n## Request Body\n\n| Field | Type | Required | Description |\n|-------|------|----------|-------------|\n| library_id | string | Yes | Library UUID |\n| name | string | Yes | Collection name |\n| icon | string | No | Emoji icon |\n| description | string | No | Collection description |\n| show_on_dashboard | boolean | No | Show on dashboard (default: true) |\n| auto_assign_rules | string | No | JSON string of filter rules |\n| manual_book_ids | array | No | Array of book IDs |\n| match_type | string | No | \"all\" (AND) or \"any\" (OR) |\n\n## Example Request\n\n```json\n{\n  \"library_id\": \"cc23c3a7-f8fb-451a-a78d-2a16df1b725a\",\n  \"name\": \"Science Fiction Books\",\n  \"icon\": \"\U0001F680\",\n  \"description\": \"All my sci-fi books\",\n  \"show_on_dashboard\": true,\n  \"auto_assign_rules\": \"{\\\"rules\\\":[{\\\"id\\\":\\\"rule1\\\",\\\"field\\\":\\\
-  \"genre\\\",\\\"operator\\\":\\\"equals\\\",\\\"value\\\":\\\"Sci-Fi\\\",\\\"priority\\\":1}]}\",\n  \"manual_book_ids\": [],\n  \"match_type\": \"all\"\n}\n```\n\n## Response\n\nReturns the created collection with generated ID."

bruno/collections/create_collection.yml

@@ -0,0 +1,34 @@
+info:
+  name: Create Collection
+  type: http
+  seq: 5
+
+http:
+  method: POST
+  url: '{{base_url}}/api/collections'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "name": "To Read",
+        "description": "Books I want to read soon",
+        "color": "#00FF00",
+        "icon": "📖",
+        "collection_type": "static",
+        "view_settings": { "kobo": { "view_mode": "grid" } }
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs:
+  content: |-
+    # Create Collection
+
+    `POST /api/collections` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/create_collection.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/create_shelf_mapping.yml

@@ -0,0 +1,39 @@
+info:
+  name: Create Shelf Mapping
+  type: http
+  seq: 6
+
+http:
+  method: POST
+  url: '{{base_url}}/api/devices/{{device_id}}/collections'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "collection_id": "550e8400-e29b-41d4-a716-446655440000",
+        "device_shelf_name": "Sci-Fi",
+        "sync_direction": "bidirectional"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 201", function() {
+          expect(res.status).to.eql(201);
+        });
+
+docs:
+  content: |-
+    # Create Shelf Mapping
+
+    `POST /api/devices/:id/collections` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/create_shelf_mapping.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/delete_collection.yml

@@ -0,0 +1,31 @@
+info:
+  name: Delete Collection
+  type: http
+  seq: 7
+
+http:
+  method: DELETE
+  url: '{{base_url}}/api/collections/{{collection_id}}'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 204", function() {
+          expect(res.status).to.eql(204);
+        });
+
+docs:
+  content: |-
+    # Delete Collection
+
+    `DELETE /api/collections/:id` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/delete_collection.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/delete_shelf_mapping.yml

@@ -0,0 +1,31 @@
+info:
+  name: Delete Shelf Mapping
+  type: http
+  seq: 8
+
+http:
+  method: DELETE
+  url: '{{base_url}}/api/devices/{{device_id}}/collections/{{collection_id}}'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 204", function() {
+          expect(res.status).to.eql(204);
+        });
+
+docs:
+  content: |-
+    # Delete Shelf Mapping
+
+    `DELETE /api/devices/:id/collections/:collectionId` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/delete_shelf_mapping.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/get_collection.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Collection
+  type: http
+  seq: 9
+
+http:
+  method: GET
+  url: '{{base_url}}/api/collections/{{collection_id}}'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Collection
+
+    `GET /api/collections/:id` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/get_collection.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/get_collection_books.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Book Collections
+  type: http
+  seq: 10
+
+http:
+  method: GET
+  url: '{{base_url}}/api/collections/{{collection_id}}/books'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Book Collections
+
+    `GET /api/collections/:id/books` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/get_collection_books.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/list_collections.yml

@@ -0,0 +1,31 @@
+info:
+  name: List Collections
+  type: http
+  seq: 11
+
+http:
+  method: GET
+  url: '{{base_url}}/api/collections'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # List Collections
+
+    `GET /api/collections` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/list_collections.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/preview-collection.yml

@@ -1,16 +0,0 @@
-meta:
-  name: Preview Collection
-  type: http
-  seq: 1
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/preview'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"library_id\": \"{{library_id}}\",\n  \"rules\": [\n{\n      \"id\": \"rule1\",\n      \"field\": \"genre\",\n\"operator\": \"equals\",\n      \"value\": \"Fiction\",\n\"priority\": 1\n    }\n  ],\n  \"manual_book_ids\": [],\n  \"limit\": 20\n}"
-runtime:
-  scripts:
-  - type: after-response
-    code: "function onResponse(res) {\ntest(\"status must be 200 with valid request\", function() {\n    expect(res.status).to.eql(200);\n});\n\ntest(\"response contains items array\", function() {\n    expect(res.body.items).to.exist;\nexpect(res.body.items).to.be.an('array');\n  });\n}"
-docs: "Preview collection with filter rules before saving.\n\n**Endpoint**: POST /api/collections/preview\n**Auth**: Required (Bearer token)\n\n## Request Body\n\n| Field | Type | Required | Description |\n|-------|------|----------|-------------|\n| library_id | string | Yes | Library UUID |\n| rules | array | No | Filter rules to evaluate |\n| manual_book_ids | array | No | Manually selected book IDs |\n| limit | int | No | Max items to return (default: 20, max: 100) |\n\n## Example Request\n\n```json\n{\n  \"library_id\": \"cc23c3a7-f8fb-451a-a78d-2a16df1b725a\",\n  \"rules\": [\n    {\n      \"id\": \"rule1\",\n      \"field\": \"genre\",\n      \"operator\": \"equals\",\n      \"value\": \"Fiction\",\n      \"priority\": 1\n    }\n  ],\n  \"manual_book_ids\": [],\n  \"limit\": 20\n}\n```\n\n## Response\n\nReturns array of matching book items.\n\nThis endpoint is used by the Custom Section Builder to show users what books will match their filter rules before they save the collection."

bruno/collections/preview_collection.yml

@@ -0,0 +1,32 @@
+info:
+  name: Preview Collection
+  type: http
+  seq: 12
+
+http:
+  method: POST
+  url: '{{base_url}}/api/collections/preview'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "library_id": "550e8400-e29b-41d4-a716-446655440000",
+        "rules": [],
+        "manual_book_ids": [],
+        "limit": 20
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs:
+  content: |-
+    # Preview Collection
+
+    `POST /api/collections/preview` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/preview_collection.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/reorder_items.yml

@@ -0,0 +1,32 @@
+info:
+  name: Reorder Collection Items
+  type: http
+  seq: 14
+
+http:
+  method: PUT
+  url: '{{base_url}}/api/collections/{{collection_id}}/items/order'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "item_ids": [
+          "550e8400-e29b-41d4-a716-446655440000",
+          "660e8400-e29b-41d4-a716-446655440001"
+        ]
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs:
+  content: |-
+    # Reorder Collection Items
+
+    `PUT /api/collections/:id/items/order` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/reorder_items.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/scenarios/Bulk Add Books to Collections.yml

@@ -1,18 +0,0 @@
-info:
-  name: Bulk Add Books to Collections
-  type: http
-  seq: 1
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/bulk-add-books'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"operations\": [\n      {\n        \"collection_id\": \"{{collectionId1"
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Bulk Add Books to Collections\n\n  Adds multiple books to multiple collections in a single request. Each operation specifies a collection and a list of books to add.\n\n  **Method:** POST\n\n  **Endpoint:** /api/collections/bulk-add-books\n\n  **Authentication:** Bearer token\n\n  **Request Body:**\n  - `operations` (array): Array of collection-book operations\n    - `collection_id` (string): Collection UUID\n    - `book_ids` (array): Array of book UUIDs to add to the collection\n\n  **Response:**\n  - `results` (array): Results for each operation\n  - `total` (number): Total number of operations\n  - `success` (number): Number of successful operations\n  - `failed` (number): Number of failed operations\n\n  **Status Codes:**\n  - 200: Success (with partial results if some failed)\n  - 400: Invalid request data\n  - 401: Unauthorized\n  - 403: Forbidden\n  - 500: Internal server error\n\n  **Example:**\n  ```json\n  {\n    \"operations\": [\n      {\n        \"collection_id\":\
-  \ \"collection-uuid-1\",\n        \"book_ids\": [\"book-1\", \"book-2\"]"

bruno/collections/scenarios/Bulk Remove Books - All Books.yml

@@ -1,15 +0,0 @@
-info:
-  name: Bulk Remove Books - All Books
-  type: http
-  seq: 5
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/{{collection_id}}/books/bulk-remove'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"book_ids\": [\n      \"{{bookId1"
-  headers:
-  - key: Content-Type
-    value: application/json
-docs: "## Bulk Remove Books from Collection\n\n  Removes multiple books from a collection in a single request.\n\n  **Method:** POST\n\n  **Endpoint:** /api/collections/{collection_id"

bruno/collections/scenarios/Bulk Remove Books - Empty List.yml

@@ -1,17 +0,0 @@
-info:
-  name: Bulk Remove Books - Empty List
-  type: http
-  seq: 2
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/{{collection_id}}/books/bulk-remove'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"book_ids\": []"
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Bulk Remove Books - Empty List Validation\n\n  Tests validation behavior when providing an empty book_ids array.\n\n  **Expected Result:** 400 Bad Request\n\n  **Validation Rule:** book_ids array must contain at least one book UUID.\n\n  **Purpose:** Ensures the API properly validates input and rejects empty removal requests."

bruno/collections/scenarios/Bulk Remove Books - Invalid IDs.yml

@@ -1,17 +0,0 @@
-info:
-  name: Bulk Remove Books - Invalid IDs
-  type: http
-  seq: 4
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/{{collection_id}}/books/bulk-remove'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"book_ids\": [\n      \"{{bookId1"
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Bulk Remove Books - Invalid IDs\n\n  Tests behavior when the book_ids array contains invalid UUID formats or non-existent books.\n\n  **Expected Result:** 200 OK with partial success\n\n  **Purpose:** Verifies that:\n  - Invalid UUID formats don't crash the endpoint\n  - Non-existent book IDs are handled gracefully\n  - Valid IDs in the same request are still processed\n  - Response includes detailed results showing which succeeded/failed\n\n  **Note:** The endpoint should process all valid IDs and report failures for invalid ones, allowing clients to handle partial failures appropriately."

bruno/collections/scenarios/Bulk Remove Books - Single Book.yml

@@ -1,17 +0,0 @@
-info:
-  name: Bulk Remove Books - Single Book
-  type: http
-  seq: 3
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/{{collection_id}}/books/bulk-remove'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"book_ids\": [\n      \"{{bookId1"
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Bulk Remove Books - Single Book\n\n  Tests that bulk remove endpoint works correctly with a single book.\n\n  **Expected Result:** 200 OK with removed: 1, total: 1\n\n  **Purpose:** Verifies the bulk remove endpoint handles single-item arrays correctly, providing flexibility for clients to use the same endpoint for both single and multiple removals.\n\n  **Note:** Using bulk remove for a single book is functionally equivalent to the single remove endpoint but allows for consistent error handling and response format."

bruno/collections/scenarios/Test Collection Rules - Author Contains.yml

@@ -1,17 +0,0 @@
-info:
-  name: Test Collection Rules - Author Contains
-  type: http
-  seq: 2
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/test-rules'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"rules\": [\n      {\n        \"field\": \"author\",\n        \"operator\": \"contains\",\n        \"value\": \"Asimov\""
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Test Collection Rules - Author Contains\n\n  Tests the \"contains\" operator on the author field to find books by a specific author (partial match).\n\n  **Example Use Case:** Finding all books by an author whose name contains \"Asimov\" (e.g., \"Isaac Asimov\").\n\n  **Operator:** `contains` - Matches if the field contains the specified value as a substring (case-insensitive typically).\n\n  **Expected Result:** Returns all books where the author field contains \"Asimov\".\n\n  **Purpose:** Demonstrates text-based partial matching for author searches, useful when you don't need the exact author name or want to find books by authors with similar names."

bruno/collections/scenarios/Test Collection Rules - Copyright Year Greater Than.yml

@@ -1,17 +0,0 @@
-info:
-  name: Test Collection Rules - Copyright Year Greater Than
-  type: http
-  seq: 3
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/test-rules'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"rules\": [\n      {\n        \"field\": \"copyright_year\",\n        \"operator\": \"greater_than\",\n        \"value\": \"2000\""
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Test Collection Rules - Copyright Year Greater Than\n\n  Tests the \"greater_than\" operator on the copyright_year field to find books published after a specific year.\n\n  **Example Use Case:** Creating a \"Modern Books\" collection with books published after 2000.\n\n  **Operator:** `greater_than` - Matches if the field value is greater than the specified value (numeric comparison).\n\n  **Field:** `copyright_year` - The year the book was copyrighted/published.\n\n  **Expected Result:** Returns all books with copyright_year greater than 2000 (i.e., published in 2001 or later).\n\n  **Purpose:** Demonstrates numeric comparison operators for creating date-based collections, useful for organizing books by publication era."

bruno/collections/scenarios/Test Collection Rules - Empty Rules Array.yml

@@ -1,17 +0,0 @@
-info:
-  name: Test Collection Rules - Empty Rules Array
-  type: http
-  seq: 5
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/test-rules'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"rules\": []"
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Test Collection Rules - Empty Rules Array\n\n  Tests validation behavior when providing an empty rules array.\n\n  **Expected Result:** 400 Bad Request\n\n  **Validation Rule:** rules array must contain at least one rule object.\n\n  **Purpose:** Ensures the API properly validates input and rejects empty rule sets, preventing accidental queries that would return all books or cause performance issues.\n\n  **Use Case:** Client-side validation should prevent sending empty rules, but the API should also validate to catch malformed requests."

bruno/collections/scenarios/Test Collection Rules - No Matches.yml

@@ -1,17 +0,0 @@
-info:
-  name: Test Collection Rules - No Matches
-  type: http
-  seq: 4
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/test-rules'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"rules\": [\n      {\n        \"field\": \"genre\",\n        \"operator\": \"equals\",\n        \"value\": \"NonExistentGenre123456\""
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Test Collection Rules - No Matches\n\n  Tests behavior when collection rules don't match any books in the library.\n\n  **Example Use Case:** Validating that a new genre name doesn't exist before creating a collection for it, or testing edge cases.\n\n  **Expected Result:** 200 OK with empty matches array and total: 0\n\n  **Purpose:** Verifies that the API handles zero-match scenarios gracefully:\n  - Returns 200 (success) not 404\n  - Returns empty array, not null\n  - Returns total: 0 for clarity\n  - No errors thrown for no results\n\n  **Note:** An empty result set is a valid response and doesn't indicate an error. This allows users to test rules confidently before creating collections."

bruno/collections/scenarios/Test Collection Rules.yml

@@ -1,18 +0,0 @@
-info:
-  name: Test Collection Rules
-  type: http
-  seq: 1
-http:
-  method: POST
-  url: '{{base_url}}/api/collections/test-rules'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"rules\": [\n      {\n        \"field\": \"genre\",\n        \"operator\": \"equals\",\n        \"value\": \"Science Fiction\""
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Test Collection Rules\n\n  Tests collection rules against the library to see which books match, without creating a collection. Useful for previewing what books would be included in a collection with specific rules.\n\n  **Method:** POST\n\n  **Endpoint:** /api/collections/test-rules\n\n  **Authentication:** Bearer token\n\n  **Request Body:**\n  - `rules` (array): Array of rule objects to test\n    - `field` (string): Field to test (genre, author, copyright_year, tags, etc.)\n    - `operator` (string): Comparison operator\n      - `equals`: Exact match\n      - `contains`: Contains substring (for text fields)\n      - `greater_than`: Greater than (for numeric fields)\n      - `less_than`: Less than (for numeric fields)\n      - `not_equals`: Not equal to\n      - `starts_with`: Starts with\n      - `ends_with`: Ends with\n      - `is_empty`: Field is empty or null\n      - `is_not_empty`: Field is not empty and not null\n    - `value` (string): Value to compare against (not required\
-  \ for is_empty/is_not_empty)\n\n  **Response:**\n  - `matches` (array): Array of matching books\n    - `id` (string): Book UUID\n    - `title` (string): Book title\n    - `author` (string): Book author\n    - `genre` (string): Book genre\n    - Additional book metadata\n  - `total` (number): Total number of matching books\n\n  **Status Codes:**\n  - 200: Success - returns matching books\n  - 400: Invalid request (empty rules array, invalid field/operator)\n  - 401: Unauthorized\n  - 500: Internal server error\n\n  **Example Request:**\n  ```json\n  {\n    \"rules\": [\n      {\n        \"field\": \"genre\",\n        \"operator\": \"equals\",\n        \"value\": \"Science Fiction\""

bruno/collections/set_chain_order.yml

@@ -0,0 +1,29 @@
+info:
+  name: Set Collection Chain Order
+  type: http
+  seq: 13
+
+http:
+  method: PUT
+  url: '{{base_url}}/api/collections/{{collection_id}}/view-settings'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "chain_order": "newest"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs:
+  content: |-
+    # Set Collection Chain Order
+
+    `PUT /api/collections/:id/view-settings` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/set_chain_order.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/collections/update_collection.yml

@@ -0,0 +1,35 @@
+info:
+  name: Update Collection
+  type: http
+  seq: 16
+
+http:
+  method: PUT
+  url: '{{base_url}}/api/collections/{{collection_id}}'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "name": "To Read (2026)",
+        "description": "Updated description",
+        "color": "#33CCFF",
+        "icon": "📚",
+        "view_settings": { "hide_finished": true },
+        "hide_finished": ["true"],
+        "show_up_next": ["true"]
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs:
+  content: |-
+    # Update Collection
+
+    `PUT /api/collections/:id` — auth: jwt.
+
+    Canonical reference: docs/developer/api/collections/update_collection.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/conflicts/Delete Conflict.yml

@@ -1,22 +0,0 @@
-info:
-  name: Delete Conflict
-  type: http
-  seq: 4
-http:
-  method: DELETE
-  url: '{{base_url}}/api/conflicts/{{conflict_id}}'
-  auth: inherit
-  body:
-    type: none
-  headers:
-  - key: Authorization
-    value: Bearer {{token
-
-docs: |-
-  ## Delete Conflict
-  
-    Permanently deletes a specific conflict record from the system.
-  
-    **Method:** DELETE
-  
-    **Endpoint:** /api/conflicts/{conflict_id

bruno/conflicts/Dismiss All Resolved.yml

@@ -1,37 +0,0 @@
-info:
-  name: Dismiss All Resolved Conflicts
-  type: http
-  seq: 5
-http:
-  method: POST
-  url: '{{base_url}}/api/conflicts/dismiss-all'
-  auth: inherit
-  body:
-    type: none
-  headers:
-  - key: Authorization
-    value: Bearer {{token
-
-docs: |-
-  ## Dismiss All Resolved Conflicts
-  
-    Deletes all resolved conflicts for the authenticated user, cleaning up the conflict list.
-  
-    **Method:** POST
-  
-    **Endpoint:** /api/conflicts/dismiss-all
-  
-    **Authentication:** Bearer token
-  
-    **Response:**
-    - `deleted` (number): Number of conflict records that were deleted
-  
-    **Status Codes:**
-    - 200: Success - conflicts deleted
-    - 401: Unauthorized
-    - 500: Internal server error
-  
-    **Example Response:**
-    ```json
-    {
-      "deleted": 5

bruno/conflicts/Get Conflict Details.yml

@@ -1,22 +0,0 @@
-info:
-  name: Get Conflict Details
-  type: http
-  seq: 2
-http:
-  method: GET
-  url: '{{base_url}}/api/conflicts/{{conflict_id}}'
-  auth: inherit
-  body:
-    type: none
-  headers:
-  - key: Authorization
-    value: Bearer {{token
-
-docs: |-
-  ## Get Conflict Details
-  
-    Retrieves detailed information about a specific conflict, including side-by-side comparison of conflicting data from all sources.
-  
-    **Method:** GET
-  
-    **Endpoint:** /api/conflicts/{conflict_id

bruno/conflicts/List Conflicts.yml

@@ -1,74 +0,0 @@
-info:
-  name: List Conflicts
-  type: http
-  seq: 1
-http:
-  method: GET
-  url: '{{base_url}}/api/conflicts?status=unresolved'
-  auth: inherit
-  body:
-    type: none
-  headers:
-  - key: Authorization
-    value: Bearer {{token
-
-docs: |-
-  ## List Conflicts
-  
-    Lists all sync conflicts for the authenticated user with optional filtering.
-  
-    **Method:** GET
-  
-    **Endpoint:** /api/conflicts
-  
-    **Authentication:** Bearer token
-  
-    **Query Parameters:**
-    - `status` (string, optional): Filter by resolution status
-      - `unresolved`: Only unresolved conflicts (default)
-      - `user_resolved`: Conflicts resolved by user
-      - `auto_resolved`: Automatically resolved conflicts
-      - `all`: All conflicts regardless of status
-    - `type` (string, optional): Filter by conflict type
-      - `progress`: Reading progress conflicts
-      - `note`: Bookmark/note conflicts
-      - `highlight`: Highlight conflicts
-  
-    **Response:**
-    - `conflicts` (array): Array of conflict objects
-    - `total` (number): Total number of conflicts matching filters
-    - `unresolved` (number): Number of unresolved conflicts
-  
-    **Each Conflict Object:**
-    - `id` (string): Conflict UUID
-    - `media_item_id` (string): Associated book UUID
-    - `media_item_title` (string): Book title
-    - `conflict_type` (string): Type of conflict (progress, note, highlight)
-    - `conflict_data` (object): Side-by-side comparison of conflicting data
-      - `koreader`: Data from KOReader device
-      - `kobo`: Data from Kobo device
-      - `web`: Data from web interface
-    - `resolution_status` (string): Current status (unresolved, user_resolved, auto_resolved)
-    - `created_at` (string): ISO 8601 timestamp when conflict was detected
-  
-    **Status Codes:**
-    - 200: Success
-    - 401: Unauthorized
-    - 500: Internal server error
-  
-    **Example Request:**
-    ```
-    GET /api/conflicts?status=unresolved&type=progress
-    ```
-  
-    **Example Response:**
-    ```json
-    {
-      "conflicts": [
-        {
-          "id": "conflict-uuid",
-          "media_item_id": "book-uuid",
-          "media_item_title": "Foundation",
-          "conflict_type": "progress",
-          "conflict_data": {
-            "koreader": { "percentage": 0.65, "epubcfi": "..."

bruno/conflicts/Resolve Conflict.yml

@@ -1,15 +0,0 @@
-info:
-  name: Resolve Conflict
-  type: http
-  seq: 3
-http:
-  method: POST
-  url: '{{base_url}}/api/conflicts/{{conflict_id}}/resolve'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"winner\": \"koreader\",\n    \"manual_data\": null,\n    \"apply_to_all_future_conflicts\": false,\n    \"reason\": \"User chose more recent progress\""
-  headers:
-  - key: Authorization
-    value: Bearer {{token
-docs: "## Resolve Conflict\n\n  Resolves a sync conflict by choosing which source to use for the conflicting data.\n\n  **Method:** POST\n\n  **Endpoint:** /api/conflicts/{conflict_id"

bruno/conflicts/bulk_dismiss_conflicts.yml

@@ -0,0 +1,40 @@
+info:
+  name: Bulk Dismiss Conflicts
+  type: http
+  seq: 1
+
+http:
+  method: POST
+  url: '{{base_url}}/api/conflicts/bulk-dismiss'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "conflict_ids": [
+          "550e8400-e29b-41d4-a716-446655440000",
+          "660e8400-e29b-41d4-a716-446655440001"
+        ]
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Bulk Dismiss Conflicts
+
+    `POST /api/conflicts/bulk-dismiss` — auth: jwt.
+
+    Canonical reference: docs/developer/api/conflicts/bulk_dismiss_conflicts.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/conflicts/bulk_resolve_conflicts.yml

@@ -0,0 +1,41 @@
+info:
+  name: Bulk Resolve Conflicts
+  type: http
+  seq: 2
+
+http:
+  method: POST
+  url: '{{base_url}}/api/conflicts/bulk-resolve'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "conflict_ids": [
+          "550e8400-e29b-41d4-a716-446655440000",
+          "660e8400-e29b-41d4-a716-446655440001"
+        ],
+        "strategy": "highest_progress"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Bulk Resolve Conflicts
+
+    `POST /api/conflicts/bulk-resolve` — auth: jwt.
+
+    Canonical reference: docs/developer/api/conflicts/bulk_resolve_conflicts.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/conflicts/delete_conflict.yml

@@ -0,0 +1,31 @@
+info:
+  name: Delete Conflict
+  type: http
+  seq: 3
+
+http:
+  method: DELETE
+  url: '{{base_url}}/api/conflicts/{{media_item_id}}'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 204", function() {
+          expect(res.status).to.eql(204);
+        });
+
+docs:
+  content: |-
+    # Delete Conflict
+
+    `DELETE /api/conflicts/:id` — auth: jwt.
+
+    Canonical reference: docs/developer/api/conflicts/delete_conflict.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/conflicts/dismiss_all_resolved.yml

@@ -0,0 +1,31 @@
+info:
+  name: Dismiss All Resolved
+  type: http
+  seq: 4
+
+http:
+  method: POST
+  url: '{{base_url}}/api/conflicts/dismiss-all'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Dismiss All Resolved
+
+    `POST /api/conflicts/dismiss-all` — auth: jwt.
+
+    Canonical reference: docs/developer/api/conflicts/dismiss_all_resolved.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/conflicts/get_conflict.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Conflict Details
+  type: http
+  seq: 5
+
+http:
+  method: GET
+  url: '{{base_url}}/api/conflicts/{{media_item_id}}'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Conflict Details
+
+    `GET /api/conflicts/:id` — auth: jwt.
+
+    Canonical reference: docs/developer/api/conflicts/get_conflict.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/conflicts/list_conflicts.yml

@@ -0,0 +1,31 @@
+info:
+  name: List Conflicts
+  type: http
+  seq: 6
+
+http:
+  method: GET
+  url: '{{base_url}}/api/conflicts'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # List Conflicts
+
+    `GET /api/conflicts` — auth: jwt.
+
+    Canonical reference: docs/developer/api/conflicts/list_conflicts.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/conflicts/resolve_conflict.yml

@@ -0,0 +1,37 @@
+info:
+  name: Resolve Conflict
+  type: http
+  seq: 7
+
+http:
+  method: POST
+  url: '{{base_url}}/api/conflicts/{{media_item_id}}/resolve'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "winner": "kobo"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Resolve Conflict
+
+    `POST /api/conflicts/:id/resolve` — auth: jwt.
+
+    Canonical reference: docs/developer/api/conflicts/resolve_conflict.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/conflicts/scenarios/Bulk Dismiss Conflicts.yml

@@ -1,17 +0,0 @@
-info:
-  name: Bulk Dismiss Conflicts
-  type: http
-  seq: 1
-http:
-  method: POST
-  url: '{{base_url}}/api/conflicts/bulk-dismiss'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"conflict_ids\": [\n      \"{{conflictId1"
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Bulk Dismiss Conflicts\n\n  Dismisses multiple sync conflicts without resolving them. This removes them from the conflict list while leaving the data unchanged.\n\n  **Method:** POST\n\n  **Endpoint:** /api/conflicts/bulk-dismiss\n\n  **Authentication:** Bearer token\n\n  **Request Body:**\n  - `conflict_ids` (array): Array of conflict UUIDs to dismiss\n\n  **Response:**\n  - `results` (array): Results for each dismissal\n  - `total` (number): Total number of conflicts processed\n  - `success` (number): Number of successfully dismissed conflicts\n  - `failed` (number): Number of failed dismissals\n\n  **Status Codes:**\n  - 200: Success\n  - 400: Invalid request data\n  - 401: Unauthorized\n  - 403: Forbidden\n  - 404: One or more conflicts not found\n  - 500: Internal server error\n\n  **Example:**\n  ```json\n  {\n    \"conflict_ids\": [\"uuid-1\", \"uuid-2\"]"

bruno/conflicts/scenarios/Bulk Resolve Conflicts.yml

@@ -1,18 +0,0 @@
-info:
-  name: Bulk Resolve Conflicts
-  type: http
-  seq: 1
-http:
-  method: POST
-  url: '{{base_url}}/api/conflicts/bulk-resolve'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"conflict_ids\": [\n      \"{{conflictId1"
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Bulk Resolve Conflicts\n\n  Resolves multiple sync conflicts in a single request using a specified resolution strategy.\n\n  **Method:** POST\n\n  **Endpoint:** /api/conflicts/bulk-resolve\n\n  **Authentication:** Bearer token\n\n  **Request Body:**\n  - `conflict_ids` (array): Array of conflict UUIDs to resolve\n  - `strategy` (string): Resolution strategy\n    - `most_recent`: Use the most recently updated progress\n    - `highest_progress`: Use the reading progress with the highest percent read\n    - `server`: Always prefer server-side data\n    - `device`: Always prefer device-side data\n\n  **Response:**\n  - `results` (array): Results for each conflict resolution\n  - `total` (number): Total number of conflicts processed\n  - `success` (number): Number of successfully resolved conflicts\n  - `failed` (number): Number of failed resolutions\n\n  **Status Codes:**\n  - 200: Success (with partial results if some failed)\n  - 400: Invalid request data\n  - 401: Unauthorized\n\
-  \  - 403: Forbidden\n  - 404: One or more conflicts not found\n  - 500: Internal server error\n\n  **Example:**\n  ```json\n  {\n    \"conflict_ids\": [\"uuid-1\", \"uuid-2\", \"uuid-3\"],\n    \"strategy\": \"most_recent\""

bruno/conflicts/scenarios/Bulk Resolve Highest Progress.yml

@@ -1,18 +0,0 @@
-info:
-  name: Bulk Resolve with Highest Progress Strategy
-  type: http
-  seq: 1
-http:
-  method: POST
-  url: '{{base_url}}/api/conflicts/bulk-resolve'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n    \"conflict_ids\": [\n      \"{{conflictId1"
-  headers:
-  - key: Content-Type
-    value: application/json
-  - key: Authorization
-    value: Bearer {{authToken
-docs: "## Bulk Resolve with Highest Progress Strategy\n\n  Resolves multiple sync conflicts using the \"highest_progress\" strategy, which keeps the reading progress with the highest percentage read.\n\n  **Method:** POST\n\n  **Endpoint:** /api/conflicts/bulk-resolve\n\n  **Authentication:** Bearer token\n\n  **Request Body:**\n  - `conflict_ids` (array): Array of conflict UUIDs to resolve\n  - `strategy` (string): Must be \"highest_progress\"\n\n  **Response:**\n  - `results` (array): Results for each conflict resolution\n  - `total` (number): Total number of conflicts processed\n  - `success` (number): Number of successfully resolved conflicts\n  - `failed` (number): Number of failed resolutions\n\n  **Status Codes:**\n  - 200: Success\n  - 400: Invalid request data\n  - 401: Unauthorized\n  - 403: Forbidden\n  - 500: Internal server error\n\n  **Note:** The highest progress strategy is ideal when you want to preserve the most reading progress across devices. Use this when you've been\
-  \ reading on multiple devices and want to keep the furthest position."

bruno/dashboard/create-collection-with-dashboard.yml

@@ -1,38 +0,0 @@
-info:
-  name: Create Collection with Dashboard
-  type: http
-  seq: 4
-http:
-  method: POST
-  url: '{{base_url}}/api/collections'
-  auth: inherit
-runtime:
-  scripts:
-  - type: tests
-    code: "test(\"creates collection successfully\", function() {\n    expect(res.status).to.eql(201);"
-
-docs: |-
-  Create a new collection with dashboard visibility enabled.
-  
-    **Endpoint**: POST /api/collections
-    **Auth**: Required (Bearer token)
-  
-    ## Request Body
-  
-    | Field | Type | Required | Description |
-    |-------|------|----------|-------------|
-    | name | string | Yes | Collection name |
-    | description | string | No | Collection description |
-    | color | string | No | Hex color code |
-    | icon | string | No | Icon emoji or name |
-    | show_on_dashboard | boolean | No | Show on dashboard (default: false) |
-  
-    ## Example Request
-  
-    ```json
-    {
-      "name": "My Favorites",
-      "description": "My favorite books",
-      "color": "#FF5733",
-      "icon": "⭐",
-      "show_on_dashboard": true

bruno/dashboard/get-dashboard-sections.yml

@@ -1,73 +0,0 @@
-info:
-  name: Get Dashboard Sections
-  type: http
-  seq: 1
-http:
-  method: GET
-  url: '{{base_url}}/api/dashboard/sections?library_id={{library_id}}'
-  auth: inherit
-  body:
-    type: none
-runtime:
-  scripts:
-  - type: tests
-    code: "test(\"status must be 200 with auth\", function() {\n    expect(res.status).to.eql(200);\n\
-      });\n\ntest(\"response contains sections array\", function() {\n    expect(res.body.sections).to.exist;\n\
-         expect(res.body.sections).to.be.an('array');\n  });"
-
-docs: |-
-  Get all dashboard sections for a specific library.
-
-  **Endpoint**: GET /api/dashboard/sections
-  **Auth**: Required (Bearer token via auth: inherit)
-
-  ## Query Parameters
-
-  | Parameter | Type | Required | Description |
-  |-----------|------|----------|-------------|
-  | library_id | string | Yes | Library UUID |
-  | limit | int | No | Items per section (default: 20, max: 100) |
-
-  ## Response
-
-  Returns array of sections including:
-  - System collections (continue-reading, recently-added, recently-read, not-started)
-  - User collections marked with show_on_dashboard: true
-
-  ## Section Structure
-
-  Each section has:
-  - `id`: Collection name (string)
-  - `is_system`: Boolean indicating if this is a system collection
-  - `title`: Display title
-  - `description`: Collection description
-  - `icon`: Emoji icon
-  - `items`: Array of BookInfo objects
-  - `view_all_url`: URL to view all items (system collections only)
-  - `priority`: Display order (lower numbers first)
-
-  ## Example Response
-
-  ```json
-  {
-    "sections": [
-      {
-        "id": "continue-reading",
-        "is_system": true,
-        "title": "Continue Reading",
-        "description": "Books you're currently reading (0 < progress < 1)",
-        "icon": "📖",
-        "items": [
-          {
-            "media_item_id": "uuid",
-            "title": "Book Title",
-            "author": "Author Name",
-            "cover_image_path": "/path/to/cover.jpg"
-          }
-        ],
-        "view_all_url": "/section/continue-reading",
-        "priority": 1
-      }
-    ]
-  }
-  ```

bruno/dashboard/get-sections-by-library.yml

@@ -1,30 +0,0 @@
-info:
-  name: Get Dashboard Sections by Library
-  type: http
-  seq: 3
-http:
-  method: GET
-  url: '{{base_url}}/api/dashboard/sections'
-  auth: inherit
-runtime:
-  scripts:
-  - type: tests
-    code: "test(\"status must be 200\", function() {\n    expect(res.status).to.eql(200);"
-
-docs: |-
-  Get all dashboard sections for a specific library.
-  
-    **Endpoint**: GET /api/dashboard/sections
-    **Auth**: Required (Bearer token)
-  
-    ## Query Parameters
-  
-    | Parameter | Type | Required | Description |
-    |-----------|------|----------|-------------|
-    | library_id | string | Yes | Library UUID |
-  
-    ## Response
-  
-    Returns array of sections including:
-    - Smart sections (continue-reading, in-progress, recently-added, etc.)
-    - User collections marked for dashboard

bruno/dashboard/get_preferences.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Dashboard Preferences
+  type: http
+  seq: 1
+
+http:
+  method: GET
+  url: '{{base_url}}/api/dashboard/preferences'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Dashboard Preferences
+
+    `GET /api/dashboard/preferences` — auth: jwt.
+
+    Canonical reference: docs/developer/api/dashboard/get_preferences.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/dashboard/get_sections.yml

@@ -0,0 +1,31 @@
+info:
+  name: Get Dashboard Sections
+  type: http
+  seq: 2
+
+http:
+  method: GET
+  url: '{{base_url}}/api/dashboard/sections'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 200", function() {
+          expect(res.status).to.eql(200);
+        });
+
+docs:
+  content: |-
+    # Get Dashboard Sections
+
+    `GET /api/dashboard/sections` — auth: jwt.
+
+    Canonical reference: docs/developer/api/dashboard/get_sections.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown

bruno/dashboard/restore-system-collection.yml

@@ -1,16 +0,0 @@
-info:
-  name: Restore System Collection
-  type: http
-  seq: 3
-http:
-  method: POST
-  url: '{{base_url}}/api/dashboard/restore-system-collection'
-  auth: inherit
-  body:
-    type: json
-    data: "{\n  \"collection_name\": \"continue-reading\"\n}"
-runtime:
-  scripts:
-  - type: tests
-    code: "test(\"status must be 200 with valid collection\", function() {\n    expect(res.status).to.eql(200);\n});\n\ntest(\"response has success message\", function() {\n    expect(res.body.message).to.exist;\n});"
-docs: "Restore a system collection to its default state.\n\n**Endpoint**: POST /api/dashboard/restore-system-collection\n**Auth**: Required (Bearer token)\n\n## Request Body\n\n| Field | Type | Required | Description |\n|-------|------|----------|-------------|\n| collection_name | string | Yes | Name of system collection to restore |\n\nValid collection names:\n- `continue-reading`: Books you're currently reading (0 < progress < 1)\n- `recently-added`: Newly added items to this library\n- `recently-read`: Books you've finished (progress >= 1)\n- `not-started`: Books you haven't read yet (progress = 0 or no record)\n\n## Example Request\n\n```json\n{\n  \"collection_name\": \"continue-reading\"\n}\n```\n\n## Response\n\nReturns success message on restore."

bruno/dashboard/restore_system_collection.yml

@@ -0,0 +1,30 @@
+info:
+  name: Restore System Collection
+  type: http
+  seq: 3
+
+http:
+  method: POST
+  url: '{{base_url}}/api/dashboard/restore-system-collection'
+  auth: inherit
+  body:
+    type: json
+    data: |-
+      {
+        "collection_name": "Continue Reading",
+        "reset_type": "full"
+      }
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+docs:
+  content: |-
+    # Restore System Collection
+
+    `POST /api/dashboard/restore-system-collection` — auth: jwt.
+
+    Canonical reference: docs/developer/api/dashboard/restore_system_collection.md (docs site → Developer → API). This request is GENERATED from that doc; edit the doc, then run the drift test with -update.
+  type: text/markdown