Merge remote-tracking branch 'origin/main' into feature/047

.gitea/ISSUE_TEMPLATE.md

@@ -1,43 +0,0 @@
----
-name: 'Codex task'
-about: 'Codex に実装させるための課題'
-title: ''
-labels:
-  - codex-ready
----
-
-## 背景
-
-なぜ必要か。
-
-## 対象範囲
-
-- backend:
-- frontend:
-- docs:
-- migration:
-
-## やること
-
-- [ ] 
-
-## 受け入れ条件
-
-- [ ] 
-
-## 実行すべき確認
-
-- [ ] `cd backend && bundle exec rspec`
-- [ ] `cd frontend && npm run build`
-- [ ] `cd frontend && npm run lint`
-
-## 禁止事項
-
-- unrelated refactor はしない
-- 既存 API response shape を壊さない
-- 認証・認可・BAN を弱めない
-
-## Codex への指示
-
-この issue を読んで実装してください。
-不明点があれば、実装前に調査結果と選択肢を提示してください。

AGENTS.md

@@ -1,143 +0,0 @@
-# AGENTS.md
-
-## Project overview
-
-BTRC Hub / タグ広場 is a split Rails API and React frontend repository.
-
-- Backend: Rails API under `backend/`.
-- Frontend: React + TypeScript + Vite under `frontend/`.
-- Docs: lightweight command notes under `docs/`.
-- There is no README or Makefile at the repository root as of this inspection.
-
-## Stack
-
-- Backend: Ruby `3.2.2` from `backend/.ruby-version`, Rails `~> 8.0.2`.
-- Backend dependencies include `mysql2`, `sqlite3`, `rspec-rails`, `factory_bot_rails`, `rack-cors`, `jwt`, `discard`, `gollum`, `whenever`, `aws-sdk-s3`, `brakeman`, and `rubocop-rails-omakase`.
-- Frontend: React `^19.1.0`, TypeScript `~5.8.3`, Vite `^6.3.5`.
-- Frontend data/UI dependencies include Axios, TanStack Query, Tailwind CSS, Framer Motion, Radix UI components, lucide-react, MDX/Markdown tooling, and Zustand.
-
-## Main directories
-
-- `backend/app/controllers`: Rails API controllers.
-- `backend/app/models`: Active Record models.
-- `backend/app/representations`: API response representation classes.
-- `backend/app/services`: domain services such as version recording, wiki commit, YouTube sync, and similarity calculation.
-- `backend/config/routes.rb`: API routes.
-- `backend/db/migrate`: migrations.
-- `backend/db/schema.rb`: current schema snapshot.
-- `backend/lib/tasks`: custom Rake tasks.
-- `backend/spec`: RSpec tests.
-- `backend/test`: Rails minitest files that still exist in the tree.
-- `frontend/src/App.tsx`: frontend route definitions and initial user setup.
-- `frontend/src/pages`: page-level React components.
-- `frontend/src/components`: shared and feature components.
-- `frontend/src/lib`: API client helpers, query keys, prefetchers, and domain helpers.
-- `frontend/src/stores`: Zustand stores.
-- `docs/commands.md`: command notes.
-
-## Commands
-
-Only list commands that are backed by files inspected in this repository.
-
-### Backend
-
-The following binstubs exist under `backend/bin`:
-
-```sh
-cd backend
-bin/setup
-bin/dev
-bin/rails
-bin/rake
-bin/rubocop
-bin/brakeman
-bin/kamal
-bin/thrust
-```
-
-Common Rails/Rake usage through existing binstubs:
-
-```sh
-cd backend
-bin/rails db:prepare
-bin/rails db:migrate
-bin/rails routes
-bin/rails server
-bin/rake
-bin/rubocop
-bin/brakeman
-```
-
-RSpec is present in `Gemfile` and `.rspec` exists:
-
-```sh
-cd backend
-bundle exec rspec
-```
-
-### Frontend
-
-The following npm scripts exist in `frontend/package.json`:
-
-```sh
-cd frontend
-npm run dev
-npm run build
-npm run lint
-npm run preview
-```
-
-`npm run build` runs `tsc -b && vite build`, then `postbuild` runs `node scripts/generate-sitemap.js`.
-
-Do not write or report `npm test` as a repository command unless a `test` script is added to `frontend/package.json`.
-
-## Coding style
-
-- Prefer precise, minimal changes.
-- Do not flatter or over-explain.
-- Explain risks directly.
-- Prefer single quotes for strings unless interpolation or escaping makes double quotes better.
-- Ruby: never put a space before method-call parentheses.
-- Ruby: do not use `%w` or `%i`.
-- TypeScript and Python: use GNU-style spacing before parentheses where syntactically valid.
-- Do not add production dependencies without explicit approval.
-
-## Backend rules
-
-- Inspect existing routes, controllers, models, services, and specs before editing backend behavior.
-- For API behavior changes, add or update request specs under `backend/spec/requests`.
-- Prefer RSpec for new backend tests; existing minitest files under `backend/test` do not make minitest the default for new coverage.
-- Do not weaken authentication, BAN user checks, or IP BAN checks.
-- Preserve the `X-Transfer-Code` user identification flow unless the task explicitly changes authentication.
-- Be careful with version tables, `version_no`, optimistic concurrency, wiki revisions, and restore/diff behavior.
-- Be careful with tag names, tag normalization, implications, similarities, and discard behavior.
-- Keep migration files and `backend/db/schema.rb` consistent when changing schema.
-
-## Frontend rules
-
-- Use `frontend/src/lib/api.ts` for API calls so headers and camelCase conversion stay consistent.
-- Add or reuse TanStack Query keys through `frontend/src/lib/queryKeys.ts`; avoid ad hoc query key arrays.
-- Encode URL path-segment values with `encodeURIComponent`.
-- React hooks must be called unconditionally.
-- Keep page-level code under `frontend/src/pages` and shared UI/feature code under `frontend/src/components` unless existing patterns point elsewhere.
-- Match existing Tailwind, component, and import alias conventions.
-
-## Codex workflow
-
-- First inspect existing patterns; do not invent new architecture when a local convention exists.
-- Keep changes scoped to the requested issue.
-- Do not scan or summarize dependency/generated/runtime directories such as `node_modules`, `dist`, `tmp`, `log`, and `storage` unless explicitly needed.
-- Before touching wiki, tag, versioning, BAN, IP BAN, or authentication behavior, inspect the related request specs and service objects.
-- If frontend code changes, run the existing frontend verification commands that apply: `npm run build` and `npm run lint`.
-- If backend code changes, run the relevant RSpec command; for broad backend changes, run `bundle exec rspec`.
-- If a verification command cannot be run or fails, report the exact command and failure.
-
-## Completion criteria
-
-A task is complete only when:
-
-- implementation is complete,
-- relevant verification commands pass, or failures are clearly explained,
-- unrelated files are not changed,
-- migrations and schema are consistent when schema changes are made,
-- user-facing behavior is documented when needed.

backend/AGENTS.md

@@ -1,147 +0,0 @@
-# backend/AGENTS.md
-
-## Scope
-
-These rules apply to work under `backend/`.
-
-This is a Rails API app using Active Record, RSpec, request specs, service objects, representation classes, and version tables for post/tag/wiki history.
-
-## Commands
-
-Use commands backed by files and dependencies in this directory:
-
-```sh
-bin/setup
-bin/dev
-bin/rails
-bin/rake
-bin/rubocop
-bin/brakeman
-bundle exec rspec
-```
-
-Common checks:
-
-```sh
-bundle exec rspec
-bin/rubocop
-bin/brakeman
-```
-
-Common Rails commands:
-
-```sh
-bin/rails db:prepare
-bin/rails db:migrate
-bin/rails routes
-bin/rails server
-```
-
-After backend behavior changes, run the relevant RSpec files. For broad backend changes, run:
-
-```sh
-bundle exec rspec
-```
-
-If a command cannot be run or fails, report the exact command and failure.
-
-## Rails structure
-
-- `app/controllers`: API controllers.
-- `app/models`: Active Record models and concerns.
-- `app/representations`: JSON response shaping.
-- `app/services`: domain services such as version recorders, wiki commit, YouTube sync, and similarity calculation.
-- `config/routes.rb`: public API routes.
-- `db/migrate`: migrations.
-- `db/schema.rb`: schema snapshot.
-- `lib/tasks`: custom Rake tasks.
-- `spec`: RSpec tests.
-
-Before changing behavior, inspect the matching route, controller, model, service, representation, and spec.
-
-## Ruby style
-
-- Prefer precise, minimal changes.
-- Use single quotes unless interpolation or escaping makes double quotes better.
-- Do not put a space before Ruby method-call parentheses.
-- Do not use `%w` or `%i` in new Ruby code.
-- Keep comments short and useful; avoid narrating obvious code.
-- Do not add production dependencies without approval.
-
-## Authentication and authorization
-
-- Authentication is handled through the `X-Transfer-Code` header in `ApplicationController#authenticate_user`.
-- `current_user` is set by looking up `User.inheritance_code`.
-- Do not bypass or weaken the `X-Transfer-Code` flow unless the task explicitly changes authentication.
-- Unauthenticated write actions should return `:unauthorized` consistently with existing controllers.
-- Role checks use `User` enum roles: `guest`, `member`, and `admin`.
-- Use `current_user.gte_member?` for member-or-admin write permissions where existing controllers do so.
-- Use `current_user.admin?` only for admin-only paths, such as tag child relationship changes.
-- Do not replace role checks with looser presence checks.
-
-## BAN and IP BAN
-
-- `ApplicationController` runs these before actions in order:
-  - `reject_banned_ip_address!`
-  - `authenticate_user`
-  - `reject_banned_user!`
-- User and IP bans use `banned_at`, not a boolean `banned` column.
-- `User#banned?` and `IpAddress#banned?` check `banned_at.present?`.
-- Do not weaken BAN or IP BAN behavior.
-- If changing request authentication or controller before actions, add or update request specs covering banned users and banned IP addresses.
-
-## RSpec
-
-- Prefer RSpec for new backend tests.
-- Put API behavior coverage under `spec/requests`.
-- Put model behavior under `spec/models`.
-- Put service behavior under `spec/services`.
-- Put Rake task coverage under `spec/tasks`.
-- `spec/rails_helper.rb` loads `spec/support/**/*.rb`.
-- Request specs include `AuthHelper` and `JsonHelper`.
-- `AuthHelper#sign_in_as(user)` stubs `ApplicationController#current_user`; use it when matching existing request spec style.
-- Add or update request specs for API behavior changes, especially status codes, permissions, response shape, and version conflict behavior.
-
-## Migrations
-
-- Keep migrations and `db/schema.rb` consistent.
-- Use reversible migrations where practical; otherwise define explicit `up` and `down`.
-- For data backfills inside migrations, follow the existing pattern of defining migration-local `ActiveRecord::Base` classes with `self.table_name`.
-- Preserve existing indexes, foreign keys, check constraints, and null constraints.
-- Be careful with MySQL-specific options already present in migrations, such as `after:`.
-- Do not edit old migrations just to change current behavior unless explicitly requested; add a new migration.
-
-## Version tables
-
-- Versioned records include posts, tags, nico tags, and wiki pages.
-- Current records have `version_no`; version tables have positive `version_no` with unique indexes scoped to the parent record.
-- Version event types are `create`, `update`, `discard`, and `restore`.
-- Version rows are readonly through the `VersionRecord` concern.
-- Use the existing recorder services instead of manually inserting version rows in application code:
-  - `PostVersionRecorder`
-  - `TagVersionRecorder`
-  - `NicoTagVersionRecorder`
-  - `WikiVersionRecorder`
-  - `TagVersioning`
-- `VersionRecorder` locks the current record, validates sequence consistency, skips unchanged update snapshots, creates the next version row, and updates the record `version_no`.
-- Do not update versioned records without considering whether a version snapshot must be created.
-- For optimistic concurrency paths, preserve `base_version_no`, `force`, and `merge` semantics and cover conflicts in request specs.
-
-## Domain cautions
-
-- Posts have tag snapshots, parent post implications, original-created ranges, viewed state, and version conflict behavior.
-- Tags have canonical names, aliases through `TagName`, categories, parent implications, discard behavior, and version snapshots.
-- Nico tags have separate relation/version behavior; do not treat them like normal editable tags without checking existing code.
-- Wiki pages involve page content, revisions/history, version rows, title/tag-name behavior, and diff/restore paths.
-- Materials, theatres, and comments have user and permission checks; inspect the controller before changing them.
-
-## API responses
-
-- Use representation classes under `app/representations` when existing endpoints do.
-- Keep response keys consistent with existing JSON contracts; frontend code expects camelCase conversion client-side, while Rails params and JSON keys are generally snake_case.
-- Preserve existing HTTP status conventions: `:unauthorized` for no user, `:forbidden` for insufficient role or banned user, `:not_found` for missing records, and `:unprocessable_entity` for validation failures.
-
-## Files to avoid in routine work
-
-- Do not inspect or edit `tmp/`, `log/`, `storage/`, `vendor/`, or dependency directories unless explicitly needed.
-- Do not modify generated schema or migration output without the corresponding migration when schema changes are made.

backend/app/controllers/posts_controller.rb

@@ -44,7 +44,7 @@ class PostsController < ApplicationController
         filtered_posts
         .joins("LEFT JOIN (#{ pt_max_sql }) pt_max ON pt_max.post_id = posts.id")
         .reselect('posts.*', Arel.sql("#{ updated_at_all_sql } AS updated_at_all"))
-        .preload(tags: [:deerjikists, :materials, { tag_name: :wiki_page }])
+        .preload(tags: [:materials, { tag_name: :wiki_page }])
         .with_attached_thumbnail
 
     q = q.where('posts.url LIKE ?', "%#{ url }%") if url
@@ -95,7 +95,7 @@ class PostsController < ApplicationController
   end
 
   def random
-    post = filtered_posts.preload(tags: [:deerjikists, :materials, { tag_name: :wiki_page }])
+    post = filtered_posts.preload(tags: [:materials, { tag_name: :wiki_page }])
                          .order('RAND()')
                          .first
     return head :not_found unless post
@@ -104,7 +104,7 @@ class PostsController < ApplicationController
   end
 
   def show
-    post = Post.includes(tags: [:deerjikists, :materials, { tag_name: :wiki_page }]).find_by(id: params[:id])
+    post = Post.includes(tags: [:materials, { tag_name: :wiki_page }]).find_by(id: params[:id])
     return head :not_found unless post
 
     render json: PostRepr.base(post, current_user)
@@ -173,68 +173,33 @@ class PostsController < ApplicationController
     return head :unauthorized unless current_user
     return head :forbidden unless current_user.gte_member?
 
-    force = bool?(:force)
-    merge = bool?(:merge)
-    return head :bad_request if force && merge
-
-    base_version_no = parse_base_version_no
-    return head :bad_request if !(force) && !(base_version_no)
-
     title = params[:title].presence
     tag_names = params[:tags].to_s.split
     original_created_from = params[:original_created_from]
     original_created_before = params[:original_created_before]
     parent_post_ids = parse_parent_post_ids
 
-    post = nil
-    conflict_json = nil
+    post = Post.find(params[:id].to_i)
 
     ApplicationRecord.transaction do
-      post = Post.lock.find(params[:id].to_i)
+      PostVersionRecorder.ensure_snapshot!(post, created_by_user: current_user)
 
-      base_version = nil
-      base_snapshot = nil
-      current_snapshot = nil
-      unless force
-        base_version = post.post_versions.find_by!(version_no: base_version_no)
+      post.update!(title:, original_created_from:, original_created_before:)
 
-        base_snapshot = post_snapshot_from_version(base_version)
-        current_snapshot = post_snapshot_from_record(post)
+      normalised_tags = Tag.normalise_tags!(tag_names, with_tagme: false)
+      TagVersioning.record_tag_snapshots!(normalised_tags, created_by_user: current_user)
+
+      tags = post.tags.nico.to_a + normalised_tags
+      tags = Tag.expand_parent_tags(tags)
+      sync_post_tags!(post, tags)
+
+      sync_parent_posts!(post, parent_post_ids)
+
+      PostVersionRecorder.record!(post:, event_type: :update, created_by_user: current_user)
     end
-      incoming_snapshot = post_incoming_snapshot(title:,
-                                                 original_created_from:,
-                                                 original_created_before:,
-                                                 tag_names:,
-                                                 parent_post_ids:)
-
-      snapshot_to_apply =
-          if force || post.version_no == base_version_no || current_snapshot == base_snapshot
-            incoming_snapshot
-          else
-            changes = post_snapshot_changes(base_snapshot, current_snapshot, incoming_snapshot)
-            conflicts = changes.select { |change| change[:conflict] }
-
-            if merge && conflicts.empty?
-              merge_post_snapshots(base_snapshot, current_snapshot, incoming_snapshot)
-            else
-              conflict_json = post_conflict_json(post:,
-                                                 base_version_no:,
-                                                 base_snapshot:,
-                                                 current_snapshot:,
-                                                 incoming_snapshot:,
-                                                 changes:,
-                                                 conflicts:)
-              raise ActiveRecord::Rollback
-            end
-          end
-
-      apply_post_snapshot!(post, snapshot_to_apply)
-    end
-
-    return render json: conflict_json, status: :conflict if conflict_json
 
     post.reload
-    json = PostRepr.base(post, current_user)
+    json = post.as_json
     json['tags'] = build_tag_tree_for(post.tags)
     render json:, status: :ok
   rescue Tag::NicoTagNormalisationError
@@ -260,7 +225,7 @@ class PostsController < ApplicationController
     pts = pts.where(post_id: id) if id.present?
     pts = pts.where(tag_id:) if tag_id.present?
     pts = pts.includes(:post, :created_user, :deleted_user,
-                       tag: [:deerjikists, :materials, { tag_name: :wiki_page }])
+                       tag: [:materials, { tag_name: :wiki_page }])
 
     events = []
     pts.each do |pt|
@@ -439,205 +404,4 @@ class PostsController < ApplicationController
       PostImplication.create_or_find_by!(post_id: post.id, parent_post_id:)
     end
   end
-
-  def parse_base_version_no
-    version_no = Integer(params[:base_version_no], exception: false)
-    if version_no&.positive?
-      version_no
-    else
-      nil
-    end
-  end
-
-  def post_snapshot_from_version version
-    { title: version.title,
-      original_created_from: snapshot_time(version.original_created_from),
-      original_created_before: snapshot_time(version.original_created_before),
-      tag_names: editable_tag_names_from_version(version),
-      parent_post_ids: snapshot_parent_post_ids_from_version(version) }
-  end
-
-  def editable_tag_names_from_version version
-    version.tags.to_s.split.reject { |name| name.downcase.start_with?('nico:') }.sort
-  end
-
-  def post_snapshot_from_record post
-    { title: post.title,
-      original_created_from: snapshot_time(post.original_created_from),
-      original_created_before: snapshot_time(post.original_created_before),
-      tag_names: editable_tag_names_from_post(post),
-      parent_post_ids: post.parent_posts.order(:id).pluck(:id) }
-  end
-
-  def editable_tag_names_from_post post
-    post.tags.not_nico.joins(:tag_name).order('tag_names.name').pluck('tag_names.name')
-  end
-
-  def post_incoming_snapshot title:, original_created_from:, original_created_before:,
-                             tag_names:, parent_post_ids:
-    { title:,
-      original_created_from: snapshot_time(original_created_from),
-      original_created_before: snapshot_time(original_created_before),
-      tag_names: incoming_tag_names_for_snapshot(tag_names),
-      parent_post_ids: parent_post_ids.sort }
-  end
-
-  def snapshot_parent_post_ids_from_version version
-    if version.respond_to?(:parent_post_ids)
-      version.parent_post_ids.to_s.split.map { |id| id.to_i }.sort
-    elsif version.respond_to?(:parent_id) && version.parent_id
-      [version.parent_id]
-    else
-      []
-    end
-  end
-
-  def snapshot_time value
-    return nil if value.blank?
-
-    value = Time.zone.parse(value.to_s) if value in String
-    value&.in_time_zone&.iso8601(6)
-  rescue ArgumentError, TypeError
-    value.to_s
-  end
-
-  def incoming_tag_names_for_snapshot raw_tag_names
-    tags = Tag.normalise_tags!(raw_tag_names, with_tagme: false)
-
-    Tag.expand_parent_tags(tags).map(&:name).uniq.sort
-  end
-
-  def post_conflict_json post:, base_version_no:, base_snapshot:,
-                         current_snapshot:, incoming_snapshot:, changes:, conflicts:
-    { error: 'conflict',
-      message: '競合が発生しました．',
-      post_id: post.id,
-      base_version_no:,
-      current_version_no: post.version_no,
-      base: base_snapshot,
-      current: current_snapshot,
-      mine: incoming_snapshot,
-      changes:,
-      conflicts:,
-      mergeable: conflicts.empty? }
-  end
-
-  def post_snapshot_changes base_snapshot, current_snapshot, incoming_snapshot
-    [scalar_snapshot_change(:title, 'タイトル',
-                            base_snapshot, current_snapshot, incoming_snapshot),
-     scalar_snapshot_change(:original_created_from, 'オリジナルの作成日時（以降）',
-                            base_snapshot, current_snapshot, incoming_snapshot),
-     scalar_snapshot_change(:original_created_before, 'オリジナルの作成日時（より前）',
-                            base_snapshot, current_snapshot, incoming_snapshot),
-     set_snapshot_change(:tag_names, 'タグ',
-                         base_snapshot, current_snapshot, incoming_snapshot),
-     set_snapshot_change(:parent_post_ids, '親投稿',
-                         base_snapshot, current_snapshot, incoming_snapshot)].compact
-  end
-
-  def scalar_snapshot_change field, label, base_snapshot, current_snapshot, incoming_snapshot
-    base = base_snapshot[field]
-    current = current_snapshot[field]
-    mine = incoming_snapshot[field]
-
-    return nil if current == base && mine == base
-
-    { field:, label:, base:, current:, mine:,
-      changed_by_current: current != base,
-      changed_by_me: mine != base,
-      conflict: scalar_snapshot_conflict?(base, current, mine) }
-  end
-
-  def scalar_snapshot_conflict? base, current, mine
-    current != base && mine != base && current != mine
-  end
-
-  def set_snapshot_change field, label, base_snapshot, current_snapshot, incoming_snapshot
-    base = base_snapshot[field].to_a
-    current = current_snapshot[field].to_a
-    mine = incoming_snapshot[field].to_a
-
-    added_by_current = current - base
-    removed_by_current = base - current
-    added_by_me = mine - base
-    removed_by_me = base - mine
-
-    if (added_by_current.empty? &&
-        removed_by_current.empty? &&
-        added_by_me.empty? &&
-        removed_by_me.empty?)
-      return nil
-    end
-
-    { field:, label:, base:, current:, mine:, added_by_current:, removed_by_current:,
-      added_by_me:, removed_by_me:,
-      changed_by_current: added_by_current.present? || removed_by_current.present?,
-      changed_by_me: added_by_me.present? || removed_by_me.present?,
-      conflict: set_snapshot_conflict?(added_by_current:,
-                                       removed_by_current:,
-                                       added_by_me:,
-                                       removed_by_me:) }
-  end
-
-  def set_snapshot_conflict? added_by_current:, removed_by_current:,
-                             added_by_me:, removed_by_me:
-    (added_by_current & removed_by_me).present? || (removed_by_current & added_by_me).present?
-  end
-
-  def apply_post_snapshot! post, snapshot
-    PostVersionRecorder.ensure_snapshot!(post, created_by_user: current_user)
-
-    post.update!(title: snapshot[:title],
-                 original_created_from: snapshot[:original_created_from],
-                 original_created_before: snapshot[:original_created_before])
-
-    editable_tags = Tag.normalise_tags!(snapshot[:tag_names], with_tagme: false)
-    TagVersioning.record_tag_snapshots!(editable_tags, created_by_user: current_user)
-
-    readonly_tags = post.tags.nico.to_a
-
-    tags = readonly_tags + editable_tags
-    tags = Tag.expand_parent_tags(tags)
-
-    sync_post_tags!(post, tags)
-    sync_parent_posts!(post, snapshot[:parent_post_ids])
-
-    PostVersionRecorder.record!(post:, event_type: :update, created_by_user: current_user)
-  end
-
-  def merge_post_snapshots base_snapshot, current_snapshot, incoming_snapshot
-    [:title, :original_created_from, :original_created_before].map {
-      [_1, merge_scalar_snapshot_value(base_snapshot[_1],
-                                       current_snapshot[_1],
-                                       incoming_snapshot[_1])]
-    }.to_h.merge([:tag_names, :parent_post_ids].map {
-      [_1, merge_set_snapshot_value(base_snapshot[_1],
-                                    current_snapshot[_1],
-                                    incoming_snapshot[_1])]
-    }.to_h)
-  end
-
-  def merge_scalar_snapshot_value base, current, mine
-    return mine if current == base
-    return current if mine == base || current == mine
-
-    raise ArgumentError, '競合してゐる項目はマージできません．'
-  end
-
-  def merge_set_snapshot_value base, current, mine
-    base = base.to_a
-    current = current.to_a
-    mine = mine.to_a
-
-    added_by_current = current - base
-    removed_by_current = base - current
-    added_by_me = mine - base
-    removed_by_me = base - mine
-
-    merged = base + added_by_current + added_by_me
-    merged -= removed_by_current
-    merged -= removed_by_me
-
-    merged.uniq.sort
-  end
 end

backend/app/controllers/wiki_assets_controller.rb

@@ -0,0 +1,39 @@
+require 'digest'
+
+
+class WikiAssetsController < ApplicationController
+  def index
+    page_id = params[:wiki_page_id].to_i
+    page = WikiPage.find_by(id: page_id)
+    return head :not_found unless page
+
+    render json: WikiAssetRepr.many(page.assets)
+  end
+
+  def create
+    return head :unauthorized unless current_user
+    return head :forbidden unless current_user.gte_member?
+
+    wiki_page_id = params[:wiki_page_id].to_i
+    page = WikiPage.find_by(id: wiki_page_id)
+    return head :not_found unless page
+
+    file = params[:file]
+    return head :bad_request if file.blank?
+
+    asset = nil
+    page.with_lock do
+      no = page.next_asset_no
+      alt_text = params[:alt_text].presence
+      sha256 = Digest::SHA256.file(file.tempfile.path).digest
+
+      asset = WikiAsset.new(wiki_page_id:, no:, alt_text:, sha256:, created_by_user: current_user)
+      asset.file.attach(file)
+      asset.save!
+
+      page.update!(next_asset_no: no + 1)
+    end
+
+    render json: WikiAssetRepr.base(asset)
+  end
+end

backend/app/controllers/wiki_pages_controller.rb

@@ -109,7 +109,7 @@ class WikiPagesController < ApplicationController
     return head :unauthorized unless current_user
     return head :forbidden unless current_user.gte_member?
 
-    title = params[:title]&.strip
+    title = params[:title].to_s.strip
     body = params[:body].to_s
 
     return head :unprocessable_entity if title.blank? || body.blank?
@@ -143,7 +143,14 @@ class WikiPagesController < ApplicationController
       end
     end
 
-    head :ok
+    message = params[:message].presence
+    Wiki::Commit.content!(page:,
+                          body:,
+                          created_user: current_user,
+                          message:,
+                          base_revision_id:)
+
+    render json: WikiPageRepr.base(page).merge(body:)
   end
 
   def search

backend/app/models/post.rb

@@ -28,8 +28,6 @@ class Post < ApplicationRecord
 
   has_one_attached :thumbnail
 
-  attribute :version_no, :integer, default: 1
-
   before_validation :normalise_url
 
   validates :url, presence: true, uniqueness: true

backend/app/models/post_version.rb

@@ -2,7 +2,6 @@ class PostVersion < ApplicationRecord
   include VersionRecord
 
   belongs_to :post
-  belongs_to :parent, class_name: 'Post', optional: true
 
   validates :url, presence: true
 

backend/app/models/tag.rb

@@ -40,8 +40,6 @@ class Tag < ApplicationRecord
   belongs_to :tag_name
   delegate :wiki_page, to: :tag_name
 
-  attribute :version_no, :integer, default: 1
-
   delegate :name, to: :tag_name, allow_nil: true
   validates :tag_name, presence: true
 

backend/app/models/wiki_asset.rb

@@ -0,0 +1,12 @@
+class WikiAsset < ApplicationRecord
+  belongs_to :wiki_page
+  belongs_to :created_by_user, class_name: 'User'
+
+  has_one_attached :file
+
+  validates :file, presence: true
+
+  def url
+    Rails.application.routes.url_helpers.rails_blob_url(file, only_path: true)
+  end
+end

backend/app/models/wiki_page.rb

@@ -13,9 +13,9 @@ class WikiPage < ApplicationRecord
            foreign_key: :redirect_page_id,
            dependent: :nullify
 
-  has_many :wiki_versions
+  has_many :assets, class_name: 'WikiAsset', dependent: :destroy
 
-  attribute :version_no, :integer, default: 1
+  has_many :wiki_versions
 
   belongs_to :tag_name
   validates :tag_name, presence: true

backend/app/representations/wiki_asset_repr.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+
+module WikiAssetRepr
+  BASE = { only: [:wiki_page_id, :no], methods: [:url] }.freeze
+
+  module_function
+
+  def base wiki_asset
+    wiki_asset.as_json(BASE)
+  end
+
+  def many wiki_assets
+    wiki_assets.map { |a| base(a) }
+  end
+end

backend/app/services/version_recorder.rb

@@ -16,20 +16,19 @@ class VersionRecorder
       @record = record_class.unscoped.lock.find(@record.id)
       latest = latest_version
 
-      validate_version_sequence!(latest)
+      if !(latest) && @event_type != 'create'
+        raise "#{ version_class.name } first event must be create"
+      end
+
+      if @event_type == 'create' && latest
+        raise "#{ version_class.name } create event already exists"
+      end
 
       attrs = snapshot_attributes
 
-      if @event_type == 'update' && latest && same_snapshot?(latest, attrs)
-        return latest
-      end
+      return latest if @event_type == 'update' && latest && same_snapshot?(latest, attrs)
 
-      version = version_class.create!(
-          base_attributes(latest).merge(record_key => @record).merge(attrs))
-
-      update_record_version_no!(version.version_no)
-
-      version
+      version_class.create!(base_attributes(latest).merge(record_key => @record).merge(attrs))
     end
   end
 
@@ -46,31 +45,7 @@ class VersionRecorder
       created_by_user: @created_by_user }
   end
 
-  def update_record_version_no! version_no
-    @record.update_columns(version_no:)
-    @record.version_no = version_no
-  end
-
-  def validate_version_sequence! latest
-    if !(latest) && @event_type != 'create'
-      raise "#{ version_class.name } first event must be create"
-    end
-
-    if @event_type == 'create' && latest
-      raise "#{ version_class.name } create event already exists"
-    end
-
-    return unless latest
-
-    if @record.version_no != latest.version_no
-      raise ("#{ record_class.name }##{ @record.id } version_no is #{ @record.version_no }, " +
-             "but latest #{ version_class.name } version_no is #{ latest.version_no }")
-    end
-  end
-
-  def same_snapshot? version, attrs
-    attrs.all? { |k, v| version.public_send(k) == v }
-  end
+  def same_snapshot?(version, attrs) = attrs.all? { |k, v| version.public_send(k) == v }
 
   def validate_event_type!
     return if EVENT_TYPES.include?(@event_type)

backend/config/routes.rb

@@ -48,6 +48,8 @@ Rails.application.routes.draw do
       get :exists
       get :diff
     end
+
+    resources :assets, controller: :wiki_assets, only: [:index, :create]
   end
 
   resources :posts, only: [:index, :show, :create, :update] do

backend/db/migrate/20260323192300_create_wiki_assets.rb

@@ -0,0 +1,17 @@
+class CreateWikiAssets < ActiveRecord::Migration[8.0]
+  def change
+    create_table :wiki_assets do |t|
+      t.references :wiki_page, null: false, foreign_key: true, index: false
+      t.integer :no, null: false
+      t.string :alt_text
+      t.column :sha256, 'binary(32)', null: false
+      t.references :created_by_user, null: false, foreign_key: { to_table: :users }
+      t.timestamps
+    end
+
+    add_index :wiki_assets, [:wiki_page_id, :sha256], unique: true
+    add_index :wiki_assets, [:wiki_page_id, :no], unique: true
+
+    add_column :wiki_pages, :next_asset_no, :integer, null: false, default: 1
+  end
+end

backend/db/migrate/20260507124000_add_version_no_to_posts.rb

@@ -1,27 +0,0 @@
-class AddVersionNoToPosts < ActiveRecord::Migration[8.0]
-  def up
-    add_column :posts, :version_no, :integer
-
-    execute <<~SQL
-      UPDATE
-        posts
-      SET
-        version_no = (
-          SELECT
-            MAX(version_no)
-          FROM
-            post_versions
-          WHERE
-            post_id = posts.id)
-    SQL
-
-    change_column_null :posts, :version_no, false
-
-    add_check_constraint :posts, 'version_no > 0', name: 'chk_posts_version_no_positive'
-  end
-
-  def down
-    remove_check_constraint :posts, name: 'chk_posts_version_no_positive'
-    remove_column :posts, :version_no
-  end
-end

backend/db/migrate/20260507211600_add_version_no_to_tags.rb

@@ -1,37 +0,0 @@
-class AddVersionNoToTags < ActiveRecord::Migration[8.0]
-  def up
-    add_column :tags, :version_no, :integer
-
-    execute <<~SQL
-      UPDATE
-        tags
-      SET
-        version_no = (
-          CASE category
-          WHEN 'nico' THEN
-            (SELECT
-               MAX(version_no)
-             FROM
-               nico_tag_versions
-             WHERE
-               tag_id = tags.id)
-          ELSE
-            (SELECT
-               MAX(version_no)
-             FROM
-               tag_versions
-             WHERE
-               tag_id = tags.id)
-          END)
-    SQL
-
-    change_column_null :tags, :version_no, false
-
-    add_check_constraint :tags, 'version_no > 0', name: 'chk_tags_version_no_positive'
-  end
-
-  def down
-    remove_check_constraint :tags, name: 'chk_tags_version_no_positive'
-    remove_column :tags, :version_no
-  end
-end

backend/db/migrate/20260507213300_add_version_no_to_wiki_pages.rb

@@ -1,27 +0,0 @@
-class AddVersionNoToWikiPages < ActiveRecord::Migration[8.0]
-  def up
-    add_column :wiki_pages, :version_no, :integer
-
-    execute <<~SQL
-      UPDATE
-        wiki_pages
-      SET
-        version_no = (
-          SELECT
-            MAX(version_no)
-          FROM
-            wiki_versions
-          WHERE
-            wiki_page_id = wiki_pages.id)
-    SQL
-
-    change_column_null :wiki_pages, :version_no, false
-
-    add_check_constraint :wiki_pages, 'version_no > 0', name: 'chk_wiki_pages_version_no_positive'
-  end
-
-  def down
-    remove_check_constraint :wiki_pages, name: 'chk_wiki_pages_version_no_positive'
-    remove_column :wiki_pages, :version_no
-  end
-end

backend/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2026_05_07_213300) do
+ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
   create_table "active_storage_attachments", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.string "name", null: false
     t.string "record_type", null: false
@@ -186,10 +186,8 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_07_213300) do
     t.datetime "original_created_from"
     t.datetime "original_created_before"
     t.datetime "updated_at", null: false
-    t.integer "version_no", null: false
     t.index ["uploaded_user_id"], name: "index_posts_on_uploaded_user_id"
     t.index ["url"], name: "index_posts_on_url", unique: true
-    t.check_constraint "`version_no` > 0", name: "chk_posts_version_no_positive"
   end
 
   create_table "settings", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -264,10 +262,8 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_07_213300) do
     t.datetime "updated_at", null: false
     t.integer "post_count", default: 0, null: false
     t.datetime "discarded_at"
-    t.integer "version_no", null: false
     t.index ["discarded_at"], name: "index_tags_on_discarded_at"
     t.index ["tag_name_id"], name: "index_tags_on_tag_name_id", unique: true
-    t.check_constraint "`version_no` > 0", name: "chk_tags_version_no_positive"
   end
 
   create_table "theatre_comments", primary_key: ["theatre_id", "no"], charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -373,12 +369,10 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_07_213300) do
     t.datetime "updated_at", null: false
     t.datetime "discarded_at"
     t.integer "next_asset_no", default: 1, null: false
-    t.integer "version_no", null: false
     t.index ["created_user_id"], name: "index_wiki_pages_on_created_user_id"
     t.index ["discarded_at"], name: "index_wiki_pages_on_discarded_at"
     t.index ["tag_name_id"], name: "index_wiki_pages_on_tag_name_id", unique: true
     t.index ["updated_user_id"], name: "index_wiki_pages_on_updated_user_id"
-    t.check_constraint "`version_no` > 0", name: "chk_wiki_pages_version_no_positive"
   end
 
   create_table "wiki_revision_lines", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|

backend/spec/requests/posts_spec.rb

@@ -10,10 +10,6 @@ RSpec.describe 'Posts API', type: :request do
     allow_any_instance_of(Post).to receive(:resized_thumbnail!).and_return(true)
   end
 
-  def create_nico_tag!(name)
-    Tag.find_or_create_by_tag_name!(name, category: :nico)
-  end
-
   def dummy_upload
     # 中身は何でもいい（加工処理はスタブしてる）
     Rack::Test::UploadedFile.new(StringIO.new('dummy'), 'image/jpeg', original_filename: 'dummy.jpg')
@@ -27,8 +23,7 @@ RSpec.describe 'Posts API', type: :request do
     Post.create!(title:, url:)
   end
 
-  def create_post_version_for!(post)
-    version =
+  def create_post_version_for! post
     PostVersion.create!(
       post:,
       version_no: 1,
@@ -41,20 +36,8 @@ RSpec.describe 'Posts API', type: :request do
       original_created_from: post.original_created_from,
       original_created_before: post.original_created_before,
       created_at: post.created_at,
-            created_by_user: post.uploaded_user)
-
-    post.update_columns(version_no: version.version_no) if post.has_attribute?(:version_no)
-    post.version_no = version.version_no if post.respond_to?(:version_no=)
-
-    version
-  end
-
-  def post_update_params(post, params = { })
-    base_version =
-        post.post_versions.order(version_no: :desc).first ||
-        create_post_version_for!(post.reload)
-
-    post_write_params({ base_version_no: base_version.version_no }.merge(params))
+      created_by_user: post.uploaded_user
+    )
   end
 
   let!(:tag_name) { TagName.create!(name: 'spec_tag') }
@@ -823,26 +806,24 @@ RSpec.describe 'Posts API', type: :request do
 
     it '401 when not logged in' do
       sign_out
-      put "/posts/#{post_record.id}", params: post_update_params(
-          post_record, title: 'updated', tags: 'spec_tag')
+      put "/posts/#{post_record.id}", params: post_write_params(title: 'updated', tags: 'spec_tag')
       expect(response).to have_http_status(:unauthorized)
     end
 
     it '403 when not member' do
       sign_in_as(create(:user, role: 'guest'))
-      put "/posts/#{post_record.id}", params: post_update_params(
-          post_record, title: 'updated', tags: 'spec_tag')
+      put "/posts/#{post_record.id}", params: post_write_params(title: 'updated', tags: 'spec_tag')
       expect(response).to have_http_status(:forbidden)
     end
 
     it '200 and updates title + resync tags when member' do
       sign_in_as(member)
 
+      # 追加で別タグも作って、更新時に入れ替わることを見る
       tn2 = TagName.create!(name: 'spec_tag_2')
       Tag.create!(tag_name: tn2, category: :general)
 
-      put "/posts/#{post_record.id}", params: post_update_params(
-          post_record,
+      put "/posts/#{post_record.id}", params: post_write_params(
           title: 'updated title',
           tags: 'spec_tag_2')
 
@@ -850,6 +831,7 @@ RSpec.describe 'Posts API', type: :request do
       expect(json).to have_key('tags')
       expect(json['tags']).to be_an(Array)
 
+      # show と同様、update 後レスポンスもツリー形式
       names = json['tags'].map { |n| n['name'] }
       expect(names).to include('spec_tag_2')
     end
@@ -864,10 +846,10 @@ RSpec.describe 'Posts API', type: :request do
       it 'return 400' do
         sign_in_as(member)
 
-        put "/posts/#{post_record.id}", params: post_update_params(
-            post_record,
+        put "/posts/#{post_record.id}", params: post_write_params(
           title: 'updated title',
-            tags: 'nico:nico_tag')
+          tags: 'nico:nico_tag'
+        )
 
         expect(response).to have_http_status(:bad_request), response.body
       end
@@ -905,11 +887,11 @@ RSpec.describe 'Posts API', type: :request do
       it 'replaces parent posts' do
         sign_in_as(member)
 
-        put "/posts/#{post_record.id}", params: post_update_params(
-            post_record,
+        put "/posts/#{post_record.id}", params: post_write_params(
           title: 'updated title',
           tags: 'spec_tag',
-            parent_post_ids: "#{new_parent_post_1.id} #{new_parent_post_2.id}")
+          parent_post_ids: "#{new_parent_post_1.id} #{new_parent_post_2.id}"
+        )
 
         expect(response).to have_http_status(:ok)
 
@@ -926,8 +908,7 @@ RSpec.describe 'Posts API', type: :request do
       it 'clears parent posts when parent_post_ids is blank' do
         sign_in_as(member)
 
-        put "/posts/#{post_record.id}", params: post_update_params(
-          post_record,
+        put "/posts/#{post_record.id}", params: post_write_params(
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: ''
@@ -941,8 +922,7 @@ RSpec.describe 'Posts API', type: :request do
         sign_in_as(member)
         create_post_version_for!(post_record.reload)
 
-        put "/posts/#{post_record.id}", params: post_update_params(
-          post_record,
+        put "/posts/#{post_record.id}", params: post_write_params(
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: "#{new_parent_post_1.id} #{new_parent_post_2.id}"
@@ -963,10 +943,7 @@ RSpec.describe 'Posts API', type: :request do
       it 'returns 422' do
         sign_in_as(member)
 
-        base_version = create_post_version_for!(post_record.reload)
-
         put "/posts/#{post_record.id}", params: {
-            base_version_no: base_version.version_no,
             title: 'updated title',
             tags: 'spec_tag' }
 
@@ -989,8 +966,7 @@ RSpec.describe 'Posts API', type: :request do
           parent_post:
         )
 
-        put "/posts/#{post_record.id}", params: post_update_params(
-          post_record,
+        put "/posts/#{post_record.id}", params: post_write_params(
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: 'abc'
@@ -1015,8 +991,7 @@ RSpec.describe 'Posts API', type: :request do
           parent_post:
         )
 
-        put "/posts/#{post_record.id}", params: post_update_params(
-          post_record,
+        put "/posts/#{post_record.id}", params: post_write_params(
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: '999999999'
@@ -1031,8 +1006,7 @@ RSpec.describe 'Posts API', type: :request do
       it 'returns 422 and does not create self implication' do
         sign_in_as(member)
 
-        put "/posts/#{post_record.id}", params: post_update_params(
-          post_record,
+        put "/posts/#{post_record.id}", params: post_write_params(
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: post_record.id.to_s
@@ -1046,221 +1020,6 @@ RSpec.describe 'Posts API', type: :request do
         )).to be(false)
       end
     end
-
-    context 'with optimistic locking' do
-      let!(:no_deerjikist_tag) { Tag.no_deerjikist }
-
-      before do
-        PostTag.create!(post: post_record, tag: no_deerjikist_tag)
-      end
-
-      it '400 when base_version_no is missing without force' do
-        sign_in_as(member)
-
-        put "/posts/#{post_record.id}", params: post_write_params(
-            title: 'updated title',
-            tags: 'spec_tag')
-
-        expect(response).to have_http_status(:bad_request)
-      end
-
-      it '400 when force and merge are both true' do
-        sign_in_as(member)
-
-        put "/posts/#{post_record.id}", params: post_write_params(
-            title: 'updated title',
-            tags: 'spec_tag',
-            force: '1',
-            merge: '1')
-
-        expect(response).to have_http_status(:bad_request)
-      end
-
-      it '409 when scalar fields are changed both by current and incoming updates' do
-        sign_in_as(member)
-
-        base_version = create_post_version_for!(post_record.reload)
-
-        post_record.update!(title: 'updated by other user')
-        PostVersionRecorder.record!(
-            post: post_record.reload,
-            event_type: :update,
-            created_by_user: member)
-
-        put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
-            title: 'updated by me',
-            tags: "spec_tag #{Tag.no_deerjikist.name}")
-
-        expect(response).to have_http_status(:conflict)
-
-        expect(json.fetch('error')).to eq('conflict')
-        expect(json.fetch('base_version_no')).to eq(base_version.version_no)
-        expect(json.fetch('current_version_no')).to eq(2)
-        expect(json.fetch('mergeable')).to be(false)
-
-        conflict_fields = json.fetch('conflicts').map { |change| change.fetch('field') }
-        expect(conflict_fields).to include('title')
-
-        expect(post_record.reload.title).to eq('updated by other user')
-      end
-
-      it 'returns 409 with mergeable true when stale tag changes do not conflict but merge is not requested' do
-        sign_in_as(member)
-
-        base_version = create_post_version_for!(post_record.reload)
-
-        current_tag = Tag.find_or_create_by_tag_name!('current_added_tag', category: :general)
-        PostTag.create!(post: post_record, tag: current_tag, created_user: member)
-
-        PostVersionRecorder.record!(
-            post: post_record.reload,
-            event_type: :update,
-            created_by_user: member)
-
-        put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
-            title: post_record.title,
-            tags: "spec_tag #{Tag.no_deerjikist.name} incoming_added_tag")
-
-        expect(response).to have_http_status(:conflict)
-
-        expect(json.fetch('mergeable')).to be(true)
-
-        tag_change = json.fetch('changes').find { |change| change.fetch('field') == 'tag_names' }
-        expect(tag_change).to be_present
-        expect(tag_change.fetch('conflict')).to be(false)
-        expect(tag_change.fetch('added_by_current')).to include('current_added_tag')
-        expect(tag_change.fetch('added_by_me')).to include('incoming_added_tag')
-      end
-
-      it 'merges non-conflicting stale tag changes when merge is true' do
-        sign_in_as(member)
-
-        base_version = create_post_version_for!(post_record.reload)
-
-        current_tag = Tag.find_or_create_by_tag_name!('current_merge_tag', category: :general)
-        PostTag.create!(post: post_record, tag: current_tag, created_user: member)
-
-        PostVersionRecorder.record!(
-            post: post_record.reload,
-            event_type: :update,
-            created_by_user: member)
-
-        put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
-            title: post_record.title,
-            tags: "spec_tag #{Tag.no_deerjikist.name} incoming_merge_tag",
-            merge: '1')
-
-        expect(response).to have_http_status(:ok)
-
-        names = post_record.reload.tags.map(&:name)
-
-        expect(names).to include('spec_tag')
-        expect(names).to include(Tag.no_deerjikist.name)
-        expect(names).to include('current_merge_tag')
-        expect(names).to include('incoming_merge_tag')
-      end
-
-      it 'does not conflict when only nico tags changed after the base version' do
-        sign_in_as(member)
-
-        base_version = create_post_version_for!(post_record.reload)
-
-        nico_tag = create_nico_tag!('nico:optimistic_lock_nico')
-        PostTag.create!(post: post_record, tag: nico_tag, created_user: member)
-
-        PostVersionRecorder.record!(
-            post: post_record.reload,
-            event_type: :update,
-            created_by_user: member)
-
-        expect(post_record.reload.version_no).to eq(2)
-
-        put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
-            title: post_record.title,
-            tags: "spec_tag #{ Tag.no_deerjikist.name }")
-
-        expect(response).to have_http_status(:ok)
-
-        names = post_record.reload.tags.map(&:name)
-
-        expect(names).to include('spec_tag')
-        expect(names).to include(Tag.no_deerjikist.name)
-        expect(names).to include(nico_tag.name)
-      end
-
-      it 'keeps nico tags even when they are not included in PUT tags' do
-        sign_in_as(member)
-
-        nico_tag = create_nico_tag!('nico:readonly_update_nico')
-        PostTag.create!(post: post_record, tag: nico_tag, created_user: member)
-
-        base_version = create_post_version_for!(post_record.reload)
-
-        put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
-            title: 'updated title',
-            tags: "spec_tag #{ Tag.no_deerjikist.name }")
-
-        expect(response).to have_http_status(:ok)
-
-        names = post_record.reload.tags.map(&:name)
-
-        expect(names).to include('spec_tag')
-        expect(names).to include(Tag.no_deerjikist.name)
-        expect(names).to include(nico_tag.name)
-      end
-
-      it 'allows non-nico tags linked from nico tags to be removed by normal post update' do
-        sign_in_as(member)
-
-        nico_tag = create_nico_tag!('nico:relation_source')
-        linked_tag = Tag.find_or_create_by_tag_name!('relation_linked_tag', category: :general)
-
-        NicoTagRelation.create!(nico_tag:, tag: linked_tag)
-        PostTag.create!(post: post_record, tag: nico_tag, created_user: member)
-        PostTag.create!(post: post_record, tag: linked_tag, created_user: member)
-
-        base_version = create_post_version_for!(post_record.reload)
-
-        put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
-            title: post_record.title,
-            tags: "spec_tag #{ Tag.no_deerjikist.name }")
-
-        expect(response).to have_http_status(:ok)
-
-        names = post_record.reload.tags.map(&:name)
-
-        expect(names).to include(nico_tag.name)
-        expect(names).to include('spec_tag')
-        expect(names).to include(Tag.no_deerjikist.name)
-        expect(names).not_to include(linked_tag.name)
-      end
-
-      it 'force-updates stale posts without base_version_no' do
-        sign_in_as(member)
-
-        create_post_version_for!(post_record.reload)
-
-        post_record.update!(title: 'updated by other user')
-        PostVersionRecorder.record!(
-            post: post_record.reload,
-            event_type: :update,
-            created_by_user: member)
-
-        put "/posts/#{post_record.id}", params: post_write_params(
-            title: 'forced title',
-            tags: "spec_tag #{Tag.no_deerjikist.name}",
-            force: '1')
-
-        expect(response).to have_http_status(:ok)
-        expect(post_record.reload.title).to eq('forced title')
-      end
-    end
   end
 
   describe 'GET /posts/random' do
@@ -1650,6 +1409,22 @@ RSpec.describe 'Posts API', type: :request do
       post.snapshot_tag_names.join(' ')
     end
 
+    def create_post_version_for!(post)
+      PostVersion.create!(
+        post: post,
+        version_no: 1,
+        event_type: 'create',
+        title: post.title,
+        url: post.url,
+        thumbnail_base: post.thumbnail_base,
+        tags: snapshot_tags(post),
+        original_created_from: post.original_created_from,
+        original_created_before: post.original_created_before,
+        created_at: post.created_at,
+        created_by_user: post.uploaded_user
+      )
+    end
+
     it 'creates version 1 on POST /posts' do
       sign_in_as(member)
 
@@ -1675,14 +1450,13 @@ RSpec.describe 'Posts API', type: :request do
 
     it 'creates next version on PUT /posts/:id when snapshot changes' do
       sign_in_as(member)
-      base_version = create_post_version_for!(post_record)
+      create_post_version_for!(post_record)
 
       tag_name2 = TagName.create!(name: 'spec_tag_2')
       Tag.create!(tag_name: tag_name2, category: :general)
 
       expect do
         put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
             title: 'updated title',
             tags: 'spec_tag_2')
       end.to change(PostVersion, :count).by(1)
@@ -1701,15 +1475,13 @@ RSpec.describe 'Posts API', type: :request do
       sign_in_as(member)
 
       PostTag.create!(post: post_record, tag: Tag.no_deerjikist)
-      base_version = create_post_version_for!(post_record.reload)
+      create_post_version_for!(post_record.reload)
 
       expect {
         put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
             title: post_record.title,
             tags: 'spec_tag')
       }.not_to change(PostVersion, :count)
-
       expect(response).to have_http_status(:ok)
 
       version = post_record.reload.post_versions.order(:version_no).last
@@ -1734,11 +1506,10 @@ RSpec.describe 'Posts API', type: :request do
 
     it 'does not create a version when PUT /posts/:id is invalid' do
       sign_in_as(member)
-      base_version = create_post_version_for!(post_record)
+      create_post_version_for!(post_record)
 
       expect do
         put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
             title: 'updated title',
             tags: 'spec_tag',
             original_created_from: Time.zone.local(2020, 1, 2, 0, 0, 0).iso8601,
@@ -1752,22 +1523,46 @@ RSpec.describe 'Posts API', type: :request do
   describe 'tag versioning from post write actions' do
     let(:member) { create(:user, :member) }
 
-    it 'creates tag snapshot for normalised tags on PUT /posts/:id' do
+    it 'creates tag snapshot for normalised tags on POST /posts' do
       sign_in_as(member)
 
-      base_version = create_post_version_for!(post_record.reload)
+      expect {
+        post '/posts', params: post_write_params(
+            title: 'tag versioned post',
+            url: 'https://example.com/tag-versioned-post',
+            tags: 'spec_tag',
+            thumbnail: dummy_upload)
+      }.to change { tag.reload.tag_versions.count }.by(1)
+
+      expect(response).to have_http_status(:created)
+
+      version = tag.reload.tag_versions.order(:version_no).last
+      expect(version.version_no).to eq(1)
+      expect(version.event_type).to eq('create')
+      expect(version.name).to eq('spec_tag')
+      expect(version.category).to eq('general')
+      expect(version.created_by_user_id).to eq(member.id)
+    end
+
+    it 'creates tag snapshot for normalised tags on PUT /posts/:id' do
+      sign_in_as(member)
 
       tag_name2 = TagName.create!(name: 'spec_tag_2')
       tag2 = Tag.create!(tag_name: tag_name2, category: :general)
 
       expect {
         put "/posts/#{post_record.id}", params: post_write_params(
-            base_version_no: base_version.version_no,
             title: 'updated title',
             tags: 'spec_tag_2')
       }.to change { tag2.reload.tag_versions.count }.by(1)
 
-      expect(response).to have_http_status(:ok), response.body
+      expect(response).to have_http_status(:ok)
+
+      version = tag2.reload.tag_versions.order(:version_no).last
+      expect(version.version_no).to eq(1)
+      expect(version.event_type).to eq('create')
+      expect(version.name).to eq('spec_tag_2')
+      expect(version.created_by_user_id).to eq(member.id)
     end
   end
 end

backend/spec/requests/tag_versions_spec.rb

@@ -26,7 +26,6 @@ RSpec.describe 'TagVersions API', type: :request do
     created_by_user:,
     created_at:
   )
-    version =
     TagVersion.create!(
       tag: tag,
       version_no: version_no,
@@ -36,12 +35,8 @@ RSpec.describe 'TagVersions API', type: :request do
       aliases: Array(aliases).join(' '),
       parent_tag_ids: Array(parent_tags).map(&:id).join(' '),
       created_by_user: created_by_user,
-            created_at: created_at)
-
-    tag.update_columns(version_no: version_no) if tag.has_attribute?(:version_no)
-    tag.version_no = version_no if tag.respond_to?(:version_no=)
-
-    version
+      created_at: created_at
+    )
   end
 
   let!(:v1) do

backend/spec/requests/wiki_assets_spec.rb

@@ -0,0 +1,191 @@
+require 'digest'
+require 'rails_helper'
+require 'stringio'
+
+
+RSpec.describe 'WikiAssets API', type: :request do
+  def dummy_upload(content = 'dummy-image', filename: 'dummy.png', content_type: 'image/png')
+    Rack::Test::UploadedFile.new(StringIO.new(content),
+                                 content_type,
+                                 original_filename: filename)
+  end
+
+  let(:member) { create(:user, :member, name: 'member user') }
+  let(:guest)  { create(:user, name: 'guest user') }
+
+  let!(:tag_name) { TagName.create!(name: 'spec_wiki_asset_page') }
+  let!(:page) do
+    WikiPage.create!(tag_name: tag_name, created_user: member, updated_user: member).tap do |p|
+      Wiki::Commit.content!(page: p, body: 'init', created_user: member, message: 'init')
+    end
+  end
+
+  describe 'GET /wiki/:wiki_page_id/assets' do
+    subject(:do_request) do
+      get "/wiki/#{wiki_page_id}/assets"
+    end
+
+    let(:wiki_page_id) { page.id }
+
+    let!(:asset) do
+      WikiAsset.new(wiki_page: page,
+                    no: 1,
+                    alt_text: 'spec alt',
+                    sha256: Digest::SHA256.digest('asset-1'),
+                    created_by_user: member).tap do |record|
+        record.file.attach(dummy_upload('asset-1'))
+        record.save!
+      end
+    end
+
+    context 'when wiki page exists' do
+      it 'returns assets for the page' do
+        do_request
+
+        expect(response).to have_http_status(:ok)
+        expect(json).to be_an(Array)
+        expect(json.size).to eq(1)
+
+        expect(json.first).to include(
+            'wiki_page_id' => page.id,
+            'no' => 1)
+      end
+
+      it 'does not include assets from other pages' do
+        other_tag_name = TagName.create!(name: 'spec_other_wiki_asset_page')
+        other_page = WikiPage.create!(tag_name: other_tag_name,
+                                      created_user: member,
+                                      updated_user: member)
+        Wiki::Commit.content!(page: other_page, body: 'other', created_user: member, message: 'other')
+
+        WikiAsset.new(wiki_page: other_page,
+                      no: 1,
+                      alt_text: 'other alt',
+                      sha256: Digest::SHA256.digest('asset-2'),
+                      created_by_user: member).tap do |record|
+          record.file.attach(dummy_upload('asset-2', filename: 'other.png'))
+          record.save!
+        end
+
+        do_request
+
+        expect(response).to have_http_status(:ok)
+        expect(json.size).to eq(1)
+        expect(json.first['wiki_page_id']).to eq(page.id)
+      end
+    end
+
+    context 'when wiki page does not exist' do
+      let(:wiki_page_id) { 999_999_999 }
+
+      it 'returns 404' do
+        do_request
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+  end
+
+  describe 'POST /wiki/:wiki_page_id/assets' do
+    subject(:do_request) do
+      post "/wiki/#{wiki_page_id}/assets", params: params
+    end
+
+    let(:wiki_page_id) { page.id }
+    let(:params) do
+      { file: dummy_upload(upload_content),
+        alt_text: 'uploaded alt' }
+    end
+    let(:upload_content) { 'uploaded-image-binary' }
+
+    context 'when not logged in' do
+      it 'returns 401' do
+        sign_out
+        do_request
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when logged in but not member' do
+      it 'returns 403' do
+        sign_in_as(guest)
+        do_request
+        expect(response).to have_http_status(:forbidden)
+      end
+    end
+
+    context 'when wiki page does not exist' do
+      let(:wiki_page_id) { 999_999_999 }
+
+      it 'returns 404' do
+        sign_in_as(member)
+        do_request
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+
+    context 'when file is blank' do
+      let(:params) { { alt_text: 'uploaded alt' } }
+
+      it 'returns 400' do
+        sign_in_as(member)
+        do_request
+        expect(response).to have_http_status(:bad_request)
+      end
+    end
+
+    context 'when success' do
+      before do
+        sign_in_as(member)
+      end
+
+      it 'creates asset, attaches file, increments next_asset_no, and returns json' do
+        expect { do_request }
+          .to change(WikiAsset, :count).by(1)
+
+        expect(response).to have_http_status(:ok)
+
+        asset = WikiAsset.order(:id).last
+        expect(asset.wiki_page_id).to eq(page.id)
+        expect(asset.no).to eq(1)
+        expect(asset.alt_text).to eq('uploaded alt')
+        expect(asset.sha256).to eq(Digest::SHA256.digest(upload_content))
+        expect(asset.created_by_user_id).to eq(member.id)
+        expect(asset.file).to be_attached
+        expect(asset.file.download).to eq(upload_content)
+
+        expect(page.reload.next_asset_no).to eq(2)
+
+        expect(json).to include(
+          'wiki_page_id' => page.id,
+          'no' => 1,
+          'url' => asset.url
+        )
+      end
+
+      it 'uses the next page-local number when assets already exist' do
+        existing = WikiAsset.new(wiki_page: page,
+                                 no: 1,
+                                 alt_text: 'existing alt',
+                                 sha256: Digest::SHA256.digest('existing'),
+                                 created_by_user: member)
+        existing.file.attach(dummy_upload('existing', filename: 'existing.png'))
+        existing.save!
+        page.update!(next_asset_no: 2)
+
+        do_request
+
+        expect(response).to have_http_status(:ok)
+
+        asset = WikiAsset.order(:id).last
+        expect(asset.no).to eq(2)
+        expect(page.reload.next_asset_no).to eq(3)
+
+        expect(json).to include(
+          'wiki_page_id' => page.id,
+          'no' => 2,
+          'url' => asset.url
+        )
+      end
+    end
+  end
+end

backend/spec/requests/wiki_spec.rb

@@ -113,6 +113,7 @@ RSpec.describe 'Wiki API', type: :request do
 
         page_id = json.fetch('id')
         expect(json.fetch('title')).to eq('TestPage')
+        expect(json.fetch('body')).to eq("a\nb\nc")
 
         created_page = WikiPage.find(page_id)
         version = created_page.wiki_versions.order(:version_no).last

backend/spec/services/version_recorder_spec.rb

@@ -1,85 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe VersionRecorder do
-  let(:member) { create(:user, :member) }
-
-  let(:post_record) do
-    Post.create!(
-        title: 'version recorder post',
-        url: 'https://example.com/version-recorder-post')
-  end
-
-  it 'updates record version_no when creating the first version' do
-    version =
-        PostVersionRecorder.record!(
-            post: post_record,
-            event_type: :create,
-            created_by_user: member)
-
-    expect(version.version_no).to eq(1)
-    expect(post_record.reload.version_no).to eq(1)
-  end
-
-  it 'updates record version_no when creating the next version' do
-    PostVersionRecorder.record!(
-        post: post_record,
-        event_type: :create,
-        created_by_user: member)
-
-    post_record.update!(title: 'updated version recorder post')
-
-    version =
-        PostVersionRecorder.record!(
-            post: post_record.reload,
-            event_type: :update,
-            created_by_user: member)
-
-    expect(version.version_no).to eq(2)
-    expect(post_record.reload.version_no).to eq(2)
-  end
-
-  it 'does not create a new version or advance version_no when snapshot is unchanged' do
-    first =
-        PostVersionRecorder.record!(
-            post: post_record,
-            event_type: :create,
-            created_by_user: member)
-
-    expect {
-      version =
-          PostVersionRecorder.record!(
-              post: post_record.reload,
-              event_type: :update,
-              created_by_user: member)
-
-      expect(version).to eq(first)
-    }.not_to change(PostVersion, :count)
-
-    expect(post_record.reload.version_no).to eq(1)
-  end
-
-  it 'raises when record version_no is older than the latest version' do
-    PostVersionRecorder.record!(
-        post: post_record,
-        event_type: :create,
-        created_by_user: member)
-
-    post_record.update!(title: 'updated once')
-
-    PostVersionRecorder.record!(
-        post: post_record.reload,
-        event_type: :update,
-        created_by_user: member)
-
-    post_record.update_columns(version_no: 1)
-
-    post_record.update!(title: 'updated with stale version_no')
-
-    expect {
-      PostVersionRecorder.record!(
-          post: post_record.reload,
-          event_type: :update,
-          created_by_user: member)
-    }.to raise_error(RuntimeError, /version_no/)
-  end
-end

docs/codex-handoff.md

@@ -1,646 +0,0 @@
-# Codex handoff for BTRC Hub / タグ広場
-
-This document transfers project-specific context from prior ChatGPT-assisted design and review work to Codex.
-
-Use this file as project background.
-Use `AGENTS.md`, `backend/AGENTS.md`, and `frontend/AGENTS.md` for concrete coding rules and verification commands.
-
-## Project identity
-
-BTRC Hub / タグ広場 is a collaborative knowledge base for collecting, tagging, explaining, and rediscovering Bocchi the Rock creature-related works.
-
-It is not a generic SNS.
-It is not a comment board.
-It is not a service for rehosting external content.
-It is primarily a structured link, tag, wiki, material, and viewing-party system.
-
-Core domains:
-
-1. Posts
-2. Tags
-3. Wiki pages
-4. Materials
-5. Theatre / watch-party features
-
-The project is already publicly accessible and indexed by search engines, but it has not been broadly announced. Treat it as a small public production system, not a private prototype.
-
-## Current stack
-
-Backend:
-
-- Ruby 3.2.2
-- Rails 8.0.2 API
-- MySQL 8
-- Active Storage
-- Cloudflare R2 / S3-compatible storage is expected for uploaded files
-- RSpec
-
-Frontend:
-
-- React 19.1
-- Vite 6.3
-- TypeScript 5.8
-- Axios
-- TanStack Query
-- Tailwind CSS
-- Framer Motion
-- shadcn-like local components
-- react-markdown
-- react-markdown-editor-lite
-- remark-wiki-autolink
-
-Batch / background-like tasks:
-
-- Rake tasks
-- Nico sync
-- YouTube sync
-- Similarity calculation tasks
-
-## Repository working principle
-
-Before editing, inspect the existing implementation.
-
-Do not invent a new architecture when the current repo already has an established convention.
-
-Keep changes scoped to the requested issue.
-
-Prefer small, reviewable changes over broad rewrites.
-
-Do not perform unrelated cleanup in the same patch.
-
-When a task has design ambiguity, first produce a short investigation and recommended plan. Do not silently choose a risky design.
-
-## User coding preferences
-
-General:
-
-- Prefer single quotes for strings unless interpolation, escaping, or framework convention makes double quotes better.
-- Do not add production dependencies without explicit approval.
-- Do not perform broad formatting churn.
-- Do not convert unrelated files to a different style.
-
-Ruby:
-
-- Do not put a space before method-call parentheses.
-- Do not use `%w`.
-- Do not use `%i`.
-- Keep Rails code idiomatic, but preserve the user's style where the repo already uses it.
-
-TypeScript / Python:
-
-- The user prefers GNU-style spacing before parentheses where syntactically valid.
-- Preserve existing project formatting if a formatter or nearby code dictates otherwise.
-
-## Current authentication model
-
-The system does not use normal email/password authentication.
-
-Users are authenticated by inheritance code.
-
-Frontend:
-
-- Stores the code in `localStorage.user_code`.
-- Sends it as the `X-Transfer-Code` header.
-
-Backend:
-
-- Looks up `users.inheritance_code`.
-- Sets `current_user`.
-
-Roles:
-
-- `guest`
-- `member`
-- `admin`
-
-Important helper:
-
-- `User#gte_member?` returns true for `member` and `admin`.
-
-Never introduce a conventional login assumption unless the issue explicitly asks for it.
-
-## BAN / abuse-control model
-
-The backend currently enforces BAN at API level.
-
-The relevant before_action order is conceptually:
-
-1. Reject banned IP address.
-2. Authenticate user if transfer code exists.
-3. Reject banned user.
-
-Entities:
-
-- `users.banned_at`
-- `ip_addresses.banned_at`
-- `user_ips`
-
-IP addresses are stored as binary values using `IPAddr#hton`.
-
-Do not weaken BAN behavior.
-
-Do not move BAN checks behind optional authentication.
-
-Do not make preview, theatre, verify, user creation, or public-looking endpoints bypass BAN without an explicit design decision.
-
-## Public-operation assumptions
-
-Current practical operation:
-
-- A few editor accounts exist.
-- Meaningful editing is mostly done by the owner.
-- Read access is already public.
-- Search engines have indexed the site.
-- Future editor applications are expected through Discord.
-- Prospective editors are likely people known in the Bocchi creature community.
-
-This means security and moderation issues matter even if traffic is still small.
-
-## Core domain summary
-
-### Posts
-
-Posts are external URL-based link records.
-
-Important properties:
-
-- `url` is required and unique.
-- URLs are normalized.
-- Only HTTP / HTTPS are allowed.
-- Posts can have thumbnails through Active Storage.
-- `uploaded_user_id` may be NULL for synced or bot-created posts.
-- `original_created_from` and `original_created_before` represent a time range for original content creation.
-- When both original time bounds exist, `from < before` is required.
-
-Parent/child posts:
-
-- Current implementation uses `post_implications`.
-- It is many-to-many.
-- Do not assume `posts.parent_id`.
-- Frontend/API clients must send `parent_post_ids`, even when empty.
-- `parent_post_ids` is parsed as a space-separated ID string.
-- Self-parenting is invalid.
-- Missing parent IDs are invalid.
-
-Versions:
-
-- `post_versions` stores snapshots.
-- `version_no` is a per-post sequence.
-- Snapshot includes title, URL, thumbnail base, tags, parent post IDs, original time bounds, event type, and actor.
-- Optimistic locking for posts is planned / important, but do not assume it is fully implemented unless the code proves it.
-
-### Tags
-
-Tags are central.
-
-There is separation between tag names and tag entities:
-
-- `tag_names`
-- `tags`
-
-Categories:
-
-- `deerjikist`
-- `meme`
-- `character`
-- `general`
-- `material`
-- `nico`
-- `meta`
-
-Alias model:
-
-- `tag_names.canonical_id` expresses aliases.
-- `canonical_id = NULL` means canonical name.
-- `canonical_id != NULL` means alias.
-- An alias must not point to another alias.
-- A tag name that already has a tag or wiki page generally must not be aliasified.
-
-Tag normalization:
-
-- User-entered tags are normalized through existing backend logic.
-- Known aliases are canonicalized.
-- Parent tags are expanded recursively.
-- `nico:` is normally rejected for manual entry.
-- Special tags such as tag-request / bot / unknown-deerjikist / video / niconico / youtube must be protected.
-
-Do not casually change tag normalization, alias resolution, or parent expansion. These affect search, wiki, sync, and historical data.
-
-### Nico tags
-
-Nico tags use the `nico` category and have separate versioning.
-
-Important relation:
-
-- `nico_tag_relations` maps external Nico tags to internal tags.
-- `nico_tag_id` must be a Nico category tag.
-- `tag_id` must not be Nico category.
-
-Do not allow ordinary manual tag editing to create or corrupt Nico tags.
-
-### Deerjikists
-
-Deerjikists map external platform identities to internal `deerjikist` tags.
-
-Known platforms include:
-
-- `nico`
-- `youtube`
-
-YouTube handles may be normalized to `UC...` channel IDs.
-
-Do not treat user-facing handles and canonical channel IDs as interchangeable without checking existing code.
-
-### Wiki
-
-Wiki pages are a major knowledge layer.
-
-Important points:
-
-- Wiki pages are tied to tag-like titles.
-- Title handling, aliases, and canonical tag names matter.
-- There is line-level storage / revision-oriented behavior in the current implementation.
-- There has been design tension between wiki revisions and wiki versions.
-- Wiki conflict detection using `base_revision_id` exists on the backend side.
-- Frontend support for conflict detection must be verified before assuming it is complete.
-
-Do not redesign Wiki storage casually.
-
-Do not add a second competing history system.
-
-Do not break existing wiki URLs.
-
-### Materials
-
-Materials connect files or reference URLs to `material` or `character` tags.
-
-Important properties:
-
-- A material has a `tag_id`.
-- The tag must be `material` or `character`.
-- A material requires either `url` or attached `file`.
-- Active Storage is involved.
-- Upload/security policy matters more than plain link posting.
-
-Important unresolved/risky area:
-
-- Material creation permissions have historically been risky because upload endpoints can be abused.
-- Prefer `member` or higher for material creation unless the issue explicitly says otherwise.
-
-### Theatre
-
-Theatre is an experimental watch-party style feature.
-
-Known pieces include:
-
-- Display
-- Presence
-- Next post
-- Comments
-- Host-like control
-
-Do not assume theatre has complete CRUD/admin support unless the code proves it.
-
-Theatre may become expensive if next-item selection uses random DB ordering.
-
-## Current high-risk areas
-
-Treat these areas with extra care.
-
-### Security
-
-- Preview API SSRF protection.
-- External iframe / embed CSP.
-- Markdown link safety.
-- BAN / IP BAN bypass.
-- Transfer-code leakage.
-- Guest write access.
-- Upload endpoints.
-- Admin-only tag operations.
-- System tag mutation.
-
-### Data integrity
-
-- Tag alias canonicalization.
-- Tag parent expansion.
-- Post parent many-to-many relationships.
-- Version tables.
-- `version_no` synchronization.
-- Schema drift from branch migration contamination.
-- Wiki revision/version split.
-- Material version recording.
-
-### Frontend correctness
-
-- React Hooks must not be called conditionally.
-- Role guards are currently spread across components/pages.
-- TanStack Query keys must not collide between ID/name or ID/title variants.
-- URL path segments containing tag names or wiki titles must use `encodeURIComponent`.
-- API response types may allow `null` users for bot or migration data.
-- Tag autocomplete has had duplicated logic and stale state hazards.
-
-### Performance
-
-- Avoid unbounded `limit`.
-- Avoid `order('RAND()')` for growing tables.
-- Avoid loading full relations just to count.
-- Avoid Ruby-side sorting/paging for large histories.
-- Tag sidebar client-side aggregation can become expensive.
-- Wiki full-text search needs deliberate indexing/design.
-
-## Current priority order
-
-Use this as the default priority unless an issue says otherwise.
-
-### P0: Safety before broad announcement
-
-1. Preview API SSRF hardening.
-2. Material creation permission tightening.
-3. System tag mutation holes.
-4. `GET /users/me` transfer-code leakage through query params.
-5. Limit caps for index/history/comment APIs.
-6. CSP / iframe sandbox policy.
-7. Confirm BAN enforcement remains global.
-
-### P1: Core correctness
-
-1. Post optimistic locking with `version_no`.
-2. Wiki edit conflict handling.
-3. Wiki history/revision model clarification.
-4. Wiki search truthfulness: implement body search or remove false UI.
-5. Tag alias/canonical/wiki interaction.
-6. Tag URL encoding.
-7. TanStack Query key separation.
-8. Frontend null-user handling.
-9. React Hooks rule fixes.
-10. Material version policy.
-
-### P2: Operational/admin usability
-
-1. Admin screens for users, IPs, bans, aliases, and settings.
-2. Settings table and user settings usage.
-3. Better tag sidebar.
-4. Better role guard helpers.
-5. Better frontend tests.
-6. Better issue triage and closure of already-implemented issues.
-
-### P3: Future features
-
-1. Theatre list/create/edit/admin flow.
-2. Muted/hidden tags.
-3. Tag category custom colors.
-4. Responsive refinements.
-5. Watch-party improvements.
-6. Broader embed support.
-
-## Known issue triage notes
-
-Some existing issues may already be partially or mostly implemented.
-
-Before implementing an issue, check code first.
-
-Examples:
-
-- Tag search and OR/NOT search may already be mostly implemented.
-- BAN enforcement may have been implemented after earlier issue drafts.
-- YouTube sync exists and should not be treated as purely planned.
-- Parent posts are many-to-many in current schema, even if older issues mention one-to-many.
-- Some issues may reflect old schema or old branch state.
-
-When in doubt:
-
-1. Inspect current code.
-2. Inspect schema.
-3. Inspect routes.
-4. Inspect frontend usage.
-5. Report whether the issue is implemented, partially implemented, not implemented, or obsolete.
-6. Only then edit.
-
-## Verification expectations
-
-Backend changes:
-
-- Run RSpec when possible.
-- Add request specs for API behavior changes.
-- Add model specs for validation / normalization changes.
-- Check migrations and schema consistency.
-- Do not silently ignore pending migrations.
-
-Frontend changes:
-
-- Run build.
-- Run lint if configured.
-- Run tests if configured.
-- Add tests for important behavior when the test framework exists.
-- If frontend tests are not yet installed, state that clearly.
-
-Full-stack changes:
-
-- Verify both backend and frontend compile/test paths where possible.
-- Confirm API response shapes match TypeScript types.
-- Confirm authorization behavior on both server and UI.
-
-If commands cannot be run because dependencies are missing, report that explicitly. Do not pretend verification passed.
-
-## Branch / migration caution
-
-The project has previously suffered from schema contamination caused by running migrations from another branch.
-
-Be careful when touching:
-
-- `db/schema.rb`
-- migration files
-- parent post schema
-- banned / banned_at schema
-- version_no migrations
-- wiki asset schema
-
-Before changing migrations:
-
-1. Inspect current schema.
-2. Inspect existing migrations.
-3. Confirm whether the intended branch already includes related migrations.
-4. Prefer additive migrations for shared branches.
-5. Do not edit already-applied production migrations unless explicitly instructed.
-
-## API design principles
-
-Prefer explicit server-side authorization.
-
-Do not rely only on frontend hiding.
-
-Do not return sensitive codes unnecessarily.
-
-Use 403 for authorization failures.
-
-Use 422 for validation failures.
-
-Use 409 for edit conflicts.
-
-Do not expose internal exception messages to users.
-
-Clamp or reject abusive limits consistently.
-
-Keep response shape stable unless the issue explicitly includes a breaking API change.
-
-## Frontend design principles
-
-Use existing route and query-key conventions.
-
-Use TanStack Query `enabled` rather than conditional hook calls.
-
-Do not let role-based early returns change hook order.
-
-Centralize repeated tag autocomplete logic when touching it.
-
-Use `encodeURIComponent` for tag names and wiki titles in URL path segments.
-
-Prefer graceful fallback for nullable actors:
-
-- bot operation
-- deleted user
-- migration-created data
-- external sync
-
-Do not assume all API user fields are non-null.
-
-## Testing priorities to add over time
-
-Frontend tests are especially important because the backend already has more mature RSpec coverage.
-
-Suggested first frontend tests:
-
-1. Tag autocomplete.
-2. Post form tag editing.
-3. Tag URL encoding.
-4. Wiki edit conflict UI.
-5. Role guard behavior.
-6. Null-user history rendering.
-7. Dialog behavior.
-8. Top navigation responsive behavior.
-
-Backend test priorities:
-
-1. BAN enforcement across public-looking endpoints.
-2. Material permissions.
-3. Preview SSRF rejection.
-4. System tag protection.
-5. Post optimistic locking.
-6. Wiki conflict detection.
-7. Tag alias/canonical behavior.
-8. Limit caps.
-9. Parent post parsing.
-10. Version recorder behavior.
-
-## What Codex should not do without explicit approval
-
-Do not:
-
-- Replace Rails.
-- Replace React.
-- Replace TanStack Query.
-- Redesign the database.
-- Rewrite Wiki storage.
-- Remove version tables.
-- Change authentication model.
-- Change role names.
-- Change tag category names.
-- Add background job infrastructure.
-- Add a new UI framework.
-- Add a new test framework if one already exists.
-- Add major dependencies.
-- Change public URL design.
-- Change production storage configuration.
-- Remove historical data behavior.
-- Simplify BAN/security checks.
-- Treat the site as private-only.
-
-## Good first Codex tasks
-
-Start with investigation-only tasks.
-
-Example:
-
-```txt
-Inspect the repository and summarize the Rails, React, TypeScript, and test setup.
-Do not modify files.
-List commands that actually exist in this repository.
-List risks Codex should know before editing.
-```
-
-Then small safe patches:
-
-```txt
-Fix a React Hooks rule violation in one file.
-Keep behavior unchanged.
-Run the relevant frontend verification commands.
-```
-
-```txt
-Add encodeURIComponent around one tag-name URL path segment.
-Add or update a test if the project has a frontend test setup.
-Run build/lint.
-```
-
-```txt
-Add a request spec for a known authorization rule.
-Do not change implementation unless the spec fails for the expected reason.
-```
-
-Avoid starting with:
-
-- Wiki history redesign.
-- Post versioning redesign.
-- Full admin screen suite.
-- Broad frontend refactor.
-- Database cleanup.
-- Authentication rewrite.
-
-## Relationship with ChatGPT
-
-ChatGPT has been used for:
-
-- Design review.
-- Risk analysis.
-- Prioritization.
-- Specification reconstruction.
-- Migration/locking discussions.
-- Codex migration planning.
-
-Codex should be used mainly for:
-
-- Repository inspection.
-- Localized implementation.
-- Test addition.
-- Running verification commands.
-- Producing small reviewable diffs.
-
-For ambiguous architecture, Codex should stop and present options rather than implement a guessed design.
-
-## Current strategic stance
-
-The project should not be rewritten from scratch.
-
-The current Rails + React system is acceptable.
-
-The immediate goal is not elegance.
-The immediate goal is safe public operation, data integrity, and maintainable incremental improvement.
-
-Priority is:
-
-1. Prevent abuse/security incidents.
-2. Preserve data correctness.
-3. Make editing safe for multiple users.
-4. Add tests around fragile frontend behavior.
-5. Improve admin/operation workflows.
-6. Optimize performance after obvious dangerous patterns are removed.
-
-## Final rule
-
-When current code, old specs, issue drafts, and memory disagree, current code wins.
-
-When current code is unsafe, write that explicitly and propose a small safe fix.
-
-When the task is too broad, split it.
-
-When verification cannot be performed, say exactly what was not verified.

docs/commands.md

@@ -1,29 +0,0 @@
-# Commands
-
-## Backend
-
-```sh
-cd backend
-bundle install
-bundle exec rails db:migrate
-bundle exec rspec
-bundle exec rails routes
-```
-
-## Frontend
-
-```sh
-cd frontend
-npm install
-npm run dev
-npm run build
-npm run lint
-npm test
-```
-
-### Full verification
-
-```sh
-cd backend && bundle exec rspec
-cd ../frontend && npm run build && npm run lint
-```

docs/issue-workflow.md

@@ -1,80 +0,0 @@
-# Issue workflow
-
-## Source of truth
-
-Gitea Issues are the source of truth for tasks, discussions, labels, milestones, and status.
-
-Do not copy the full backlog into git.
-
-Repository documents may define:
-
-- issue templates
-- triage rules
-- Codex task format
-- verification rules
-- release checklist
-
-## Labels
-
-Recommended labels:
-
-- `P0`
-- `P1`
-- `P2`
-- `P3`
-- `security`
-- `data-integrity`
-- `backend`
-- `frontend`
-- `wiki`
-- `tags`
-- `materials`
-- `theatre`
-- `codex-ready`
-- `needs-design`
-- `blocked`
-- `good-first-codex-task`
-
-## Codex-ready criteria
-
-An issue can be labeled `codex-ready` only when it has:
-
-- clear background
-- target area
-- concrete tasks
-- acceptance criteria
-- verification commands
-- explicit non-goals
-- no unresolved architecture decision
-
-## Workflow
-
-1. Create or refine the issue in Gitea.
-2. Add labels and milestone.
-3. If design is unclear, label `needs-design`.
-4. Discuss design before implementation.
-5. When scoped enough, label `codex-ready`.
-6. Give Codex the issue URL or copied issue body.
-7. Codex creates a branch.
-8. Codex implements a small patch.
-9. Codex runs verification commands.
-10. Human reviews the diff.
-11. Merge.
-12. Close the issue from the PR/commit message.
-
-## Commit message
-
-Use issue references when possible:
-
-```txt
-fix: prevent preview SSRF
-
-Refs: #123
-```
-or
-```
-fix: prevent preview SSRF
-
-Closes: #123
-```
-depending on whether the change fully resolves the issue.

docs/release-checklist.md

@@ -1,8 +0,0 @@
-# Release checklist
-
-- [ ] Backend specs pass
-- [ ] Frontend build passes
-- [ ] No pending migrations
-- [ ] Preview API SSRF checked
-- [ ] BAN behavior checked
-- [ ] CSP checked

docs/roadmap.md

@@ -1,8 +0,0 @@
-# Roadmap
-
-## Public announcement readiness
-
-- Harden preview API
-- Tighten material creation permission
-- Add admin MVP
-- Improve frontend tests

frontend/AGENTS.md

@@ -1,95 +0,0 @@
-# frontend/AGENTS.md
-
-## Scope
-
-These rules apply to work under `frontend/`.
-
-This is a Vite + React + TypeScript app using TanStack Query, Tailwind CSS, Framer Motion, Radix UI-style components, MDX, and Zustand.
-
-## Commands
-
-Use only scripts that exist in `package.json`:
-
-```sh
-npm run dev
-npm run build
-npm run lint
-npm run preview
-```
-
-`npm run build` runs `tsc -b && vite build`, and `postbuild` runs `node scripts/generate-sitemap.js`.
-
-There is currently no `test` script in `package.json`. Do not run or report `npm test` unless a test script is added.
-
-After frontend changes, run:
-
-```sh
-npm run build
-npm run lint
-```
-
-If either command cannot be run or fails, report the exact command and failure.
-
-## TypeScript
-
-- TypeScript is strict. `tsconfig.app.json` enables `strict`, `noUnusedLocals`, `noUnusedParameters`, `erasableSyntaxOnly`, `noFallthroughCasesInSwitch`, and `noUncheckedSideEffectImports`.
-- Keep types explicit at module boundaries, API helpers, and exported utilities.
-- Use `import type` for type-only imports.
-- Prefer existing shared types from `src/types.ts` before adding local duplicate types.
-- Preserve the repository's existing spacing style in TypeScript, including GNU-style spacing before call parentheses where it is already used.
-- Prefer single quotes for strings unless interpolation or escaping makes double quotes better.
-
-## React
-
-- Use function components.
-- Existing page components commonly export an anonymous function satisfying `FC`; match nearby file style when editing.
-- React hooks must be called unconditionally and at the top level of components or custom hooks.
-- Keep page-level components under `src/pages`.
-- Keep shared and feature components under `src/components`.
-- Use `react-router-dom` route params and navigation patterns already present in `src/App.tsx`.
-- Encode URL path-segment values with `encodeURIComponent`.
-
-## TanStack Query
-
-- Use `@tanstack/react-query` for server state.
-- Query keys should come from `src/lib/queryKeys.ts`; add key builders there instead of using ad hoc arrays in components.
-- Fetch functions should live in domain helpers under `src/lib`, such as `posts.ts`, `tags.ts`, or `wiki.ts`.
-- Use `useQueryClient().invalidateQueries` with the shared root keys when mutations affect cached lists or detail views.
-- The app-wide `QueryClient` is configured in `src/main.tsx`; do not create additional clients in feature code.
-
-## API calls
-
-- Use `src/lib/api.ts` for HTTP calls.
-- The API wrapper attaches `X-Transfer-Code` from `localStorage` and converts non-blob responses to camelCase.
-- Send Rails snake_case params and request body keys where the backend expects them.
-- Do not bypass the API wrapper unless there is a specific reason, such as a third-party request outside the Rails API.
-- For blob responses, pass `responseType: 'blob'` so the wrapper does not camelCase the body.
-
-## Imports and aliases
-
-- The `@` alias points to `frontend/src`.
-- Prefer `@/...` imports for app code instead of long relative paths.
-- Keep type imports separate with `import type`.
-- Match existing import grouping: external packages, app modules, then type imports.
-
-## Tailwind and UI
-
-- Tailwind scans `src/**/*.{html,js,ts,jsx,tsx,mdx}`.
-- Use `cn` from `src/lib/utils.ts` for conditional class names and class merging.
-- Reuse components from `src/components/common`, `src/components/layout`, and `src/components/ui` before adding new primitives.
-- Keep Tailwind classes consistent with nearby components.
-- When adding dynamic tag color classes, update `tailwind.config.js` safelist if the class cannot be statically detected.
-- Do not introduce new UI libraries or production dependencies without approval.
-
-## Lint and build constraints
-
-- ESLint uses `@eslint/js`, `typescript-eslint`, `eslint-plugin-react-hooks`, and `eslint-plugin-react-refresh`.
-- The hooks rules are enforced; fix hook ordering instead of disabling the rule.
-- `react-refresh/only-export-components` is enabled as a warning with `allowConstantExport`.
-- Build failures from unused locals or unused parameters are TypeScript errors, not lint-only issues.
-
-## Files to avoid in routine work
-
-- Do not edit `dist/` output directly.
-- Do not inspect or modify `node_modules/` unless explicitly needed.
-- Keep generated build artifacts out of source changes unless the user asks for them.

frontend/src/App.tsx

@@ -8,7 +8,6 @@ import { BrowserRouter,
 
 import RouteBlockerOverlay from '@/components/RouteBlockerOverlay'
 import TopNav from '@/components/TopNav'
-import DialogueProvider from '@/components/dialogues/DialogueProvider'
 import { Toaster } from '@/components/ui/toaster'
 import { apiPost, isApiError } from '@/lib/api'
 import DeerjikistDetailPage from '@/pages/deerjikists/DeerjikistDetailPage'
@@ -139,9 +138,7 @@ export default (() => {
   return (
       <>
 	<RouteBlockerOverlay/>
-
 	<BrowserRouter>
-	  <DialogueProvider>
 	  <LayoutGroup>
 	    <motion.div
 		layout="position"
@@ -151,9 +148,7 @@ export default (() => {
 	      <RouteTransitionWrapper user={user} setUser={setUser}/>
 	    </motion.div>
 	  </LayoutGroup>
-
 	  <Toaster/>
-	  </DialogueProvider>
 	</BrowserRouter>
       </>)
 }) satisfies FC

frontend/src/components/PostEditForm.tsx

@@ -3,12 +3,11 @@ import { useEffect, useState } from 'react'
 import PostFormTagsArea from '@/components/PostFormTagsArea'
 import PostOriginalCreatedTimeField from '@/components/PostOriginalCreatedTimeField'
 import Label from '@/components/common/Label'
-import { useDialogue } from '@/components/dialogues/DialogueProvider'
 import { Button } from '@/components/ui/button'
 import { toast } from '@/components/ui/use-toast'
-import { updatePost } from '@/lib/posts'
+import { apiPut } from '@/lib/api'
 
-import type { FC, FormEvent } from 'react'
+import type { FC } from 'react'
 
 import type { Post, Tag } from '@/types'
 
@@ -33,7 +32,6 @@ type Props = { post:    Post
 
 
 export default (({ post, onSave }: Props) => {
-  const [disabled, setDisabled] = useState (false)
   const [originalCreatedBefore, setOriginalCreatedBefore] =
       useState<string | null> (post.originalCreatedBefore)
   const [originalCreatedFrom, setOriginalCreatedFrom] =
@@ -43,14 +41,16 @@ export default (({ post, onSave }: Props) => {
   const [tags, setTags] = useState<string> ('')
   const [title, setTitle] = useState (post.title)
 
-  const dialogue = useDialogue ()
-
-  const update = async (...args: Parameters<typeof updatePost>) => {
+  const handleSubmit = async () => {
     try
     {
-      const data = await updatePost (...args)
+      const data = await apiPut<Post> (
+	  `/posts/${ post.id }`,
+	  { title, tags, parent_post_ids: parentPostIds,
+	    original_created_from: originalCreatedFrom,
+	    original_created_before: originalCreatedBefore },
+	  { headers: { 'Content-Type': 'multipart/form-data' } })
       onSave ({ ...post,
-		versionNo:              data.versionNo,
 		title:                  data.title,
 		tags:                   data.tags,
 		parentPosts:            data.parentPosts,
@@ -60,58 +60,9 @@ export default (({ post, onSave }: Props) => {
 		originalCreatedBefore:  data.originalCreatedBefore } as Post)
       toast ({ description: '更新しました．' })
     }
-    catch (e)
-    {
-      const response = (e as any)?.response
-
-      if (response?.status !== 409)
+    catch
     {
       toast ({ description: '更新はできなかったよ……' })
-	  return
-	}
-
-      const action = await dialogue.choice ({
-	  title: '競合が発生しました．',
-	  description: (
-	      <div>
-		<p>ほかの耕作員が先に更新してゐます．</p>
-		<p>現在の変更をどう扱ひますか?</p>
-	      </div>),
-	  choices: [...(response?.data?.mergeable ? [{ value: 'merge', label: '差分をマージ' }] : []),
-		    { value: 'overwrite', label: '強制上書き', variant: 'danger' }] })
-
-      if (action === 'merge')
-	{
-	  // TODO: 差分 UI
-	  await update ({ id: post.id, title, tags, parentPostIds,
-			  originalCreatedFrom, originalCreatedBefore },
-			{ baseVersionNo: post.versionNo, merge: true })
-	  return
-	}
-
-      if (action === 'overwrite')
-	{
-	  await update ({ id: post.id, title, tags, parentPostIds,
-			  originalCreatedFrom, originalCreatedBefore },
-			{ baseVersionNo: post.versionNo, force: true })
-	  return
-	}
-    }
-  }
-
-  const handleSubmit = async (e: FormEvent) => {
-    e.preventDefault ()
-
-    setDisabled (true)
-    try
-    {
-      await update ({ id: post.id, title, tags, parentPostIds,
-		      originalCreatedFrom, originalCreatedBefore },
-		    { baseVersionNo: post.versionNo })
-    }
-    finally
-    {
-      setDisabled (false)
     }
   }
 
@@ -120,13 +71,11 @@ export default (({ post, onSave }: Props) => {
   }, [post])
 
   return (
-      <form onSubmit={handleSubmit} className="max-w-xl pt-2 space-y-4">
+      <div className="max-w-xl pt-2 space-y-4">
 	{/* タイトル */}
 	<div>
 	  <Label>タイトル</Label>
-	  <input
-	      type="text"
-	      disabled={disabled}
+	  <input type="text"
 		 className="w-full border rounded p-2"
 		 value={title ?? ''}
 		 onChange={ev => setTitle (ev.target.value)}/>
@@ -137,31 +86,25 @@ export default (({ post, onSave }: Props) => {
 	  <Label>親投稿</Label>
 	  <input
 	      type="text"
-	      disabled={disabled}
 	      value={parentPostIds}
 	      onChange={e => setParentPostIds (e.target.value)}
 	      className="w-full border p-2 rounded"/>
 	</div>
 
 	{/* タグ */}
-	<PostFormTagsArea
-	    disabled={disabled}
-	    tags={tags}
-	    setTags={setTags}/>
+	<PostFormTagsArea tags={tags} setTags={setTags}/>
 
 	{/* オリジナルの作成日時 */}
 	<PostOriginalCreatedTimeField
-	    disabled={disabled}
 	    originalCreatedFrom={originalCreatedFrom}
 	    setOriginalCreatedFrom={setOriginalCreatedFrom}
 	    originalCreatedBefore={originalCreatedBefore}
 	    setOriginalCreatedBefore={setOriginalCreatedBefore}/>
 
 	{/* 送信 */}
-	<Button
-	    type="submit"
-	    disabled={disabled}>
+	<Button onClick={handleSubmit}
+		className="px-4 py-2 bg-blue-600 text-white rounded disabled:bg-gray-400">
 	  更新
 	</Button>
-      </form>)
+      </div>)
 }) satisfies FC<Props>

frontend/src/components/PostEmbed.tsx

@@ -3,7 +3,6 @@ import YoutubeEmbed from 'react-youtube'
 
 import NicoViewer from '@/components/NicoViewer'
 import TwitterEmbed from '@/components/TwitterEmbed'
-import { useDialogue } from '@/components/dialogues/DialogueProvider'
 
 import type { FC, RefObject } from 'react'
 
@@ -17,8 +16,6 @@ type Props = {
 
 
 export default (({ ref, post, onLoadComplete, onMetadataChange }: Props) => {
-  const dialogue = useDialogue ()
-
   const url = new URL (post.url)
 
   switch (url.hostname.split ('.').slice (-2).join ('.'))
@@ -85,17 +82,12 @@ export default (({ ref, post, onLoadComplete, onMetadataChange }: Props) => {
 		height={360}/>)
 	 : (
 	    <div>
-	      <a href="#" onClick={async e => {
+	      <a href="#" onClick={e => {
 		e.preventDefault ()
-
-		setFramed (await dialogue.confirm ({
-		    title: '未確認の外部ページを表示します。',
-		    description: (
-			<div>
-			  <p>悪意のあるスクリプトが実行される可能性があります。</p>
-			  <p>表示しますか?</p>
-			</div>),
-		    confirmText: '表示' }))
+		setFramed (confirm ('未確認の外部ページを表示します。\n'
+				    + '悪意のあるスクリプトが実行される可能性があります。\n'
+				    + '表示しますか?'))
+		return
 	      }}>
 		外部ページを表示
 	      </a>

frontend/src/components/PostFormTagsArea.tsx

@@ -7,7 +7,7 @@ import Label from '@/components/common/Label'
 import TextArea from '@/components/common/TextArea'
 import { apiGet } from '@/lib/api'
 
-import type { ComponentPropsWithoutRef, FC, SyntheticEvent } from 'react'
+import type { FC, SyntheticEvent } from 'react'
 
 import type { Tag } from '@/types'
 
@@ -31,12 +31,12 @@ const replaceToken = (value: string, start: number, end: number, text: string) =
     `${ value.slice (0, start) }${ text }${ value.slice (end) }`
 
 
-type Props = Omit<ComponentPropsWithoutRef<'textarea'>, 'value' | 'onChange' | 'onBlur'> & {
+type Props = {
     tags:     string
     setTags:  (tags: string) => void }
 
 
-export default (({ tags, setTags, ...rest }: Props) => {
+export default (({ tags, setTags }: Props) => {
   const ref = useRef<HTMLTextAreaElement> (null)
 
   const [bounds, setBounds] = useState<{ start: number; end: number }> ({ start: 0, end: 0 })
@@ -76,7 +76,6 @@ export default (({ tags, setTags, ...rest }: Props) => {
       <div className="relative w-full">
 	<Label>タグ</Label>
 	<TextArea
-	    {...rest}
 	    ref={ref}
 	    value={tags}
 	    onChange={ev => setTags (ev.target.value)}

frontend/src/components/PostList.tsx

@@ -42,7 +42,7 @@ export default (({ posts, onClick }: Props) => {
 		    layoutId={layoutId}
 		    className={cn ('w-full h-full overflow-hidden rounded-xl shadow',
 				   'transform-gpu will-change-transform',
-				   (post.childPosts ?? []).length > 0 && 'ring-4 ring-green-500',
+				   (post.childPosts ?? []).length > 0 && 'outline-4 outline-green-500',
 				   (post.parentPosts ?? []).length > 0 && 'ring-4 ring-yellow-500')}
 		    whileHover={{ scale: 1.02 }}
 		    onLayoutAnimationStart={() => {

frontend/src/components/PostOriginalCreatedTimeField.tsx

@@ -5,15 +5,13 @@ import { Button } from '@/components/ui/button'
 import type { FC } from 'react'
 
 type Props = {
-    disabled?:                boolean
     originalCreatedFrom:      string | null
     setOriginalCreatedFrom:   (x: string | null) => void
     originalCreatedBefore:    string | null
     setOriginalCreatedBefore: (x: string | null) => void }
 
 
-export default (({ disabled,
-		   originalCreatedFrom,
+export default (({ originalCreatedFrom,
 		   setOriginalCreatedFrom,
 		   originalCreatedBefore,
 		   setOriginalCreatedBefore }: Props) => (
@@ -23,7 +21,6 @@ export default (({ disabled,
 	<div className="w-80">
 	  <DateTimeField
 	      className="mr-2"
-	      disabled={disabled ?? false}
 	      value={originalCreatedFrom ?? undefined}
 	      onChange={setOriginalCreatedFrom}
 	      onBlur={ev => {
@@ -43,7 +40,6 @@ export default (({ disabled,
 	<div>
 	  <Button
 	      className="bg-gray-600 text-white rounded"
-	      disabled={disabled}
 	      onClick={() => {
 		setOriginalCreatedFrom (null)
 	      }}>
@@ -55,7 +51,6 @@ export default (({ disabled,
 	<div className="w-80">
 	  <DateTimeField
 	      className="mr-2"
-	      disabled={disabled}
 	      value={originalCreatedBefore ?? undefined}
 	      onChange={setOriginalCreatedBefore}/>
 	  より前
@@ -63,7 +58,6 @@ export default (({ disabled,
 	<div>
 	  <Button
 	      className="bg-gray-600 text-white rounded"
-	      disabled={disabled}
 	      onClick={() => {
 		setOriginalCreatedBefore (null)
 	      }}>

frontend/src/components/TopNav.tsx

@@ -36,12 +36,12 @@ export const menuOutline = ({ tag, wikiId, user, pathName }: {
 	  { name: '一覧', to: '/posts' },
 	  { name: '検索', to: '/posts/search' },
 	  { name: '追加', to: '/posts/new' },
-	  { name: '全体履歴', to: '/posts/changes' },
+	  { name: '履歴', to: '/posts/changes' },
 	  { name: 'ヘルプ', to: '/wiki/ヘルプ:広場' }] },
       { name: 'タグ', to: '/tags', subMenu: [
 	  { name: 'マスタ', to: '/tags' },
 	  { name: 'ニコニコ連携', to: '/tags/nico' },
-	  { name: '全体履歴', to: '/tags/changes' },
+	  { name: '履歴', to: '/tags/changes' },
 	  { name: 'ヘルプ', to: '/wiki/ヘルプ:タグ' },
 	  { component: <Separator/>, visible: tagFlg },
 	  { name: `広場 (${ postCount || 0 })`,
@@ -53,7 +53,7 @@ export const menuOutline = ({ tag, wikiId, user, pathName }: {
 	  { name: '一覧', to: '/materials' },
 	  { name: '検索', to: '/materials/search', visible: false }, 
 	  { name: '追加', to: '/materials/new' },
-	  { name: '全体履歴', to: '/materials/changes', visible: false },
+	  { name: '履歴', to: '/materials/changes', visible: false },
 	  { name: 'ヘルプ', to: '/wiki/ヘルプ:素材集' }] },
       { name: '上映会', to: '/theatres/1', base: '/theatres', subMenu: [
 	  { name: <>第&thinsp;1&thinsp;会場</>, to: '/theatres/1' },

frontend/src/components/WikiBody.tsx

@@ -1,42 +1,9 @@
-import { useQuery } from '@tanstack/react-query'
-import { useMemo } from 'react'
-import ReactMarkdown from 'react-markdown'
-import remarkGFM from 'remark-gfm'
-
-import PrefetchLink from '@/components/PrefetchLink'
-import { wikiKeys } from '@/lib/queryKeys'
-import remarkWikiAutoLink from '@/lib/remark-wiki-autolink'
-import { fetchWikiPages } from '@/lib/wiki'
+import WikiMarkdown from '@/components/WikiMarkdown'
 
 import type { FC } from 'react'
-import type { Components } from 'react-markdown'
 
 type Props = { title: string
 	       body?: string }
 
-const mdComponents = { a: (({ href, children }) => (
-			      ['/', '.'].some (e => href?.startsWith (e))
-			      ? <PrefetchLink to={href!}>{children}</PrefetchLink>
-			      : (
-				  <a href={href}
-				     target="_blank"
-				     rel="noopener noreferrer">
-				    {children}
-				  </a>))) } as const satisfies Components
-
-
-export default (({ title, body }: Props) => {
-  const { data } = useQuery ({
-      enabled: Boolean (body),
-      queryKey: wikiKeys.index ({ }),
-      queryFn: () => fetchWikiPages ({ }) })
-  const pageNames = (data ?? []).map (page => page.title).sort ((a, b) => b.length - a.length)
-
-  const remarkPlugins = useMemo (
-      () => [() => remarkWikiAutoLink (pageNames), remarkGFM], [pageNames])
-
-  return (
-      <ReactMarkdown components={mdComponents} remarkPlugins={remarkPlugins}>
-	{body || `このページは存在しません。[新規作成してください](/wiki/new?title=${ encodeURIComponent (title) })。`}
-      </ReactMarkdown>)
-}) satisfies FC<Props>
+export default (({ title, body }: Props) =>
+    <WikiMarkdown title={title} body={body ?? ''}/>) satisfies FC<Props>

frontend/src/components/WikiEditForm.tsx

@@ -0,0 +1,76 @@
+import { useEffect, useState } from 'react'
+import MdEditor from 'react-markdown-editor-lite'
+
+import WikiMarkdown from '@/components/WikiMarkdown'
+import Label from '@/components/common/Label'
+import { apiPost } from '@/lib/api'
+
+import type { FC } from 'react'
+
+import type { WikiAsset } from '@/types'
+
+type Props = {
+    title:    string
+    body:     string
+    onSubmit: (title: string, body: string) => void
+    id?:      number | null }
+
+
+export default (({ title: initTitle, body: initBody, onSubmit, id }: Props) => {
+  const forEdit = id != null
+
+  const [title, setTitle] = useState<string> (initTitle)
+  const [body, setBody] = useState<string> (initBody)
+
+  useEffect (() => {
+    setTitle (initTitle)
+    setBody (initBody)
+  }, [initTitle, initBody])
+
+  const handleImageUpload = async (file: File) => {
+    if (!(forEdit))
+      throw new Error ('画像は Wiki 作成前に追加することができません．')
+
+    const formData = new FormData
+    formData.append ('file', file)
+
+    const asset = await apiPost<WikiAsset> (
+	`/wiki/${ id }/assets`,
+	formData,
+	{ headers: { 'Content-Type': 'multipart/form-data' } })
+
+    return asset.url
+  }
+
+  return (
+      <>
+	{/* タイトル */}
+	{/* TODO: タグ補完 */}
+	<div>
+	  <Label>タイトル</Label>
+	  <input
+	      type="text"
+	      value={title}
+	      onChange={e => setTitle (e.target.value)}
+	      className="w-full border p-2 rounded"/>
+	</div>
+
+	{/* 本文 */}
+	<div>
+	  <Label>本文</Label>
+	  <MdEditor
+	      value={body}
+	      style={{ height: '500px' }}
+	      renderHTML={text => <WikiMarkdown body={text} preview/>}
+	      onChange={({ text }) => setBody (text)}
+	      onImageUpload={handleImageUpload}/>
+	</div>
+
+	{/* 送信 */}
+	<button
+	    onClick={() => onSubmit (title, body)}
+	    className="px-4 py-2 bg-blue-600 text-white rounded disabled:bg-gray-400">
+	  {forEdit ? '編輯' : '追加'}
+	</button>
+      </>)
+}) satisfies FC<Props>

frontend/src/components/WikiMarkdown.tsx

@@ -0,0 +1,77 @@
+import { useQuery } from '@tanstack/react-query'
+import { useMemo } from 'react'
+import ReactMarkdown from 'react-markdown'
+import remarkGFM from 'remark-gfm'
+
+import PrefetchLink from '@/components/PrefetchLink'
+import SectionTitle from '@/components/common/SectionTitle'
+import SubsectionTitle from '@/components/common/SubsectionTitle'
+import { wikiKeys } from '@/lib/queryKeys'
+import remarkWikiAutoLink from '@/lib/remark-wiki-autolink'
+import { fetchWikiPages } from '@/lib/wiki'
+
+import type { FC } from 'react'
+import type { Components } from 'react-markdown'
+
+type Props = {
+    title?:   string
+    body:     string
+    preview?: boolean }
+
+
+const makeComponents = (preview = false) => (
+    { h1: ({ children }) => <SectionTitle>{children}</SectionTitle>,
+      h2: ({ children }) => <SubsectionTitle>{children}</SubsectionTitle>,
+      ol: ({ children }) => <ol className="list-decimal pl-6">{children}</ol>,
+      ul: ({ children }) => <ul className="list-disc pl-6">{children}</ul>,
+      a:  ({ href, children }) => {
+	if (!(href))
+	  return <>{children}</>
+
+	if (!(preview) && ['/', '.'].some (e => href.startsWith (e)))
+	  return <PrefetchLink to={href}>{children}</PrefetchLink>
+
+	const ext = /^(?:https?:)?\/\//.test (href)
+
+	return (
+	    <a href={href}
+	       target={ext ? '_blank' : undefined}
+	       rel={ext ? 'noopener noreferrer' : undefined}>
+	      {children}
+	    </a>)
+      },
+      img: (({ src, alt }) => (
+	  <img src={src ?? ''}
+	       alt={alt ?? ''}
+	       className="max-w-[240px] max-h-[320px]"/>)),
+    } as const satisfies Components)
+
+
+export default (({ title, body, preview = false }: Props) => {
+  const { data } = useQuery ({
+      queryKey: wikiKeys.index ({ }),
+      queryFn: () => fetchWikiPages ({ }) })
+
+  const pageNames = useMemo (
+      () => (data ?? []).map ((page) => page.title).sort ((a, b) => b.length - a.length),
+      [data])
+
+  const remarkPlugins = useMemo (
+      () => [() => remarkWikiAutoLink (pageNames), remarkGFM],
+      [pageNames])
+
+  const components = useMemo (
+      () => makeComponents (preview),
+      [preview])
+
+  return (
+      <ReactMarkdown
+	  components={components}
+	  remarkPlugins={remarkPlugins}>
+        {body
+	 || (title
+	     ? ('このページは存在しません。'
+		+`[新規作成してください](/wiki/new?title=${ encodeURIComponent (title) })。`)
+	     : '')}
+      </ReactMarkdown>)
+}) satisfies FC<Props>

frontend/src/components/common/DateTimeField.tsx

@@ -2,7 +2,7 @@ import { useEffect, useState } from 'react'
 
 import { cn } from '@/lib/utils'
 
-import type { ComponentPropsWithoutRef, FC, FocusEvent } from 'react'
+import type { FC, FocusEvent } from 'react'
 
 
 const pad = (n: number): string => n.toString ().padStart (2, '0')
@@ -18,14 +18,14 @@ const toDateTimeLocalValue = (d: Date) => {
 }
 
 
-type Props = Omit<ComponentPropsWithoutRef<'input'>, 'onChange'> & {
+type Props = {
     value?:     string
     onChange?:  (isoUTC: string | null) => void
     className?: string
     onBlur?:    (ev: FocusEvent<HTMLInputElement>) => void }
 
 
-export default (({ value, onChange, className, onBlur, ...rest }: Props) => {
+export default (({ value, onChange, className, onBlur }: Props) => {
   const [local, setLocal] = useState ('')
 
   useEffect (() => {
@@ -34,7 +34,6 @@ export default (({ value, onChange, className, onBlur, ...rest }: Props) => {
 
   return (
       <input
-	  {...rest}
 	  className={cn ('border rounded p-2', className)}
 	  type="datetime-local"
 	  value={local}

frontend/src/components/dialogues/DialogueProvider.tsx

@@ -1,187 +0,0 @@
-import { createContext, useCallback, useContext, useMemo, useState } from 'react'
-
-import { Button } from '@/components/ui/button'
-import { Dialog,
-	 DialogContent,
-	 DialogDescription,
-	 DialogFooter,
-	 DialogHeader,
-	 DialogTitle } from '@/components/ui/dialog'
-
-import type { FC, ReactNode } from 'react'
-
-type DialogueVariant = 'default' | 'danger'
-
-type ConfirmOptions = { title:        string
-			description?: ReactNode
-			confirmText?: string
-			cancelText?:  string
-			variant?:     DialogueVariant }
-
-type AlertOptions = { title:        string
-		      description?: ReactNode
-		      okText?:      string }
-
-type Choice<T extends string> = { value:    T
-				  label:    string
-				  variant?: DialogueVariant }
-
-type ChoiceOptions<T extends string> = { title:         string
-					 description?:  ReactNode
-					 choices:       Choice<T>[]
-					 cancelText?:   string }
-
-type DialogueRequest =
-    | { id:       number
-	kind:     'confirm'
-	options:  ConfirmOptions
-	resolve:  (value: boolean) => void }
-    | { id:       number
-	kind:     'alert'
-	options:  AlertOptions
-	resolve:  () => void }
-    | { id:       number
-	kind:     'choice'
-	options:  ChoiceOptions<string>
-	resolve:  (value: string | null) => void }
-
-type DialogueAPI =
-    { confirm:  (options: ConfirmOptions) => Promise<boolean>
-      alert:    (options: AlertOptions) => Promise<void>
-      choice:   <T extends string> (options: ChoiceOptions<T>) => Promise<T | null> }
-
-const DialogueContext = createContext<DialogueAPI | null> (null)
-
-let nextDialogueId = 1
-
-type Props = { children: ReactNode }
-
-
-export default (({ children }: Props) => {
-  const [queue, setQueue] = useState<DialogueRequest[]> ([])
-
-  const push = useCallback ((request: Omit<DialogueRequest, 'id'>) => {
-    const id = nextDialogueId
-    ++nextDialogueId
-
-    setQueue (q => [...q, { ...request, id } as DialogueRequest])
-  }, [])
-
-  const closeActive = useCallback ((result?: unknown) => {
-    setQueue (q => {
-      const [active, ...rest] = q
-
-      if (!(active))
-	return rest
-
-      switch (active.kind)
-      {
-      case 'confirm':
-	active.resolve (Boolean (result))
-	break
-
-      case 'alert':
-	active.resolve ()
-	break
-
-      case 'choice':
-	active.resolve ((result ?? null) as string | null)
-	break
-      }
-
-      return rest
-    })
-  }, [])
-
-  const api = useMemo<DialogueAPI> (() => ({
-      confirm: options => new Promise<boolean> (resolve => {
-	push ({ kind: 'confirm', options, resolve })
-      }),
-      alert: options => new Promise<void> (resolve => {
-	push ({ kind: 'alert', options, resolve })
-      }),
-      choice: options => new Promise (resolve => {
-	push ({ kind: 'choice',
-		options: options as ChoiceOptions<string>,
-		resolve: resolve as (value: string | null) => void })
-      }) }), [push])
-
-  const active = queue[0]
-
-  return (
-      <DialogueContext.Provider value={api}>
-	{children}
-
-	<Dialog
-	    open={Boolean (active)}
-	    onOpenChange={open => {
-	      if (!(open))
-		closeActive (active?.kind !== 'confirm' && null)
-	    }}>
-	  {active && (
-	      <DialogContent className="px-6 pb-6 pt-7">
-		<DialogHeader className="pl-8">
-		  <DialogTitle>{active.options.title}</DialogTitle>
-
-		  {active.options.description && (
-		      <DialogDescription asChild>
-			<div>{active.options.description}</div>
-		      </DialogDescription>)}
-		</DialogHeader>
-
-		<DialogFooter>
-		  {active.kind === 'confirm' && (
-		      <>
-			<Button
-			    variant="outline"
-			    onClick={() => closeActive (false)}>
-			  {active.options.cancelText ?? '取消'}
-			</Button>
-
-			<Button
-			    variant={(active.options.variant === 'danger')
-				     ? 'destructive'
-				     : 'default'}
-			    onClick={() => closeActive (true)}>
-			  {active.options.confirmText ?? '確定'}
-			</Button>
-		      </>)}
-
-		  {active.kind === 'alert' && (
-		      <Button onClick={() => closeActive ()}>
-			{active.options.okText ?? '確定'}
-		      </Button>)}
-
-		  {active.kind === 'choice' && (
-		      <>
-			<Button
-			    variant="outline"
-			    onClick={() => closeActive (null)}>
-			  {active.options.cancelText ?? '取消'}
-			</Button>
-
-			{active.options.choices.map (choice => (
-			    <Button
-				key={choice.value}
-				variant={(choice.variant === 'danger')
-					 ? 'destructive'
-					 : 'default'}
-				onClick={() => closeActive (choice.value)}>
-			      {choice.label}
-			    </Button>))}
-		      </>)}
-		</DialogFooter>
-	      </DialogContent>)}
-	</Dialog>
-      </DialogueContext.Provider>)
-}) satisfies FC<Props>
-
-
-export const useDialogue = () => {
-  const dialogue = useContext (DialogueContext)
-
-  if (!(dialogue))
-    throw new Error ('useDialogue must be used inside DialogueProvider')
-
-  return dialogue
-}

frontend/src/components/ui/button.tsx

@@ -5,46 +5,33 @@ import { cva, type VariantProps } from "class-variance-authority"
 import { cn } from "@/lib/utils"
 
 const buttonVariants = cva(
-  [
-    'inline-flex items-center justify-center gap-2 whitespace-nowrap',
-    'rounded-md text-sm font-medium transition-colors',
-    'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-slate-400',
-    'disabled:pointer-events-none disabled:opacity-50',
-    '[&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0',
-  ].join (' '),
+  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0",
   {
     variants: {
       variant: {
-        default:
-          'bg-slate-900 text-white hover:bg-slate-700 dark:bg-slate-100 dark:text-slate-900 dark:hover:bg-slate-300',
-
+        default: "bg-primary text-primary-foreground hover:bg-primary/90",
         destructive:
-          'bg-red-600 text-white hover:bg-red-700 dark:bg-red-700 dark:hover:bg-red-600',
-
+          "bg-destructive text-destructive-foreground hover:bg-destructive/90",
         outline:
-          'border border-slate-300 bg-white text-slate-900 hover:bg-slate-100 dark:border-slate-700 dark:bg-slate-900 dark:text-slate-100 dark:hover:bg-slate-800',
-
+          "border border-input bg-background hover:bg-accent hover:text-accent-foreground",
         secondary:
-          'bg-slate-100 text-slate-900 hover:bg-slate-200 dark:bg-slate-800 dark:text-slate-100 dark:hover:bg-slate-700',
-
-        ghost:
-          'text-slate-900 hover:bg-slate-100 dark:text-slate-100 dark:hover:bg-slate-800',
-
-        link:
-          'text-blue-700 underline-offset-4 hover:underline dark:text-blue-300',
+          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
+        ghost: "hover:bg-accent hover:text-accent-foreground",
+        link: "text-primary underline-offset-4 hover:underline",
       },
       size: {
-        default: 'h-10 px-4 py-2',
-        sm:      'h-9 rounded-md px-3',
-        lg:      'h-11 rounded-md px-8',
-        icon:    'h-10 w-10',
+        default: "h-10 px-4 py-2",
+        sm: "h-9 rounded-md px-3",
+        lg: "h-11 rounded-md px-8",
+        icon: "h-10 w-10",
       },
     },
     defaultVariants: {
-      variant: 'default',
-      size:    'default',
+      variant: "default",
+      size: "default",
     },
-  })
+  }
+)
 
 export interface ButtonProps
   extends React.ButtonHTMLAttributes<HTMLButtonElement>,

frontend/src/components/ui/dialog.tsx

@@ -38,28 +38,24 @@ const DialogContent = React.forwardRef<
     <DialogPrimitive.Content
       ref={ref}
       className={cn(
-	  'fixed left-[50%] top-[50%] z-50 grid w-[calc(100%-2rem)] max-w-lg',
+	  'fixed left-[50%] top-[50%] z-50 w-[90%] grid max-w-lg',
 	  'translate-x-[-50%] translate-y-[-50%]',
-	  'gap-5 rounded-2xl border border-border',
-	  'bg-background p-6 text-foreground shadow-2xl',
-	  'duration-200',
+	  'gap-4 border bg-gray-300/80 dark:bg-gray-700/80',
+	  'p-6 shadow-lg duration-200',
 	  'data-[state=open]:animate-in data-[state=closed]:animate-out',
 	  'data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0',
 	  'data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95',
+	  'data-[state=closed]:slide-out-to-left-1/2',
+	  'data-[state=closed]:slide-out-to-top-[48%]',
+	  'data-[state=open]:slide-in-from-left-1/2',
+	  'data-[state=open]:slide-in-from-top-[48%] rounded-lg',
 	  className)}
       {...props}
     >
       {children}
-
-      <DialogPrimitive.Close
-	  className={cn (
-	      'absolute left-4 top-4 rounded-full p-1',
-	      'text-slate-500 transition-colors',
-	      'hover:bg-slate-200 hover:text-slate-900',
-	      'dark:text-slate-400 dark:hover:bg-slate-700 dark:hover:text-slate-50',
-	      'focus:outline-none focus:ring-2 focus:ring-slate-400')}>
-	<X className="h-4 w-4"/>
-	<span className="sr-only">閉ぢる</span>
+      <DialogPrimitive.Close className="absolute right-4 top-4 bg-red-500 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-accent data-[state=open]:text-muted-foreground">
+        <X className="h-3 w-3" />
+        <span className="sr-only">Close</span>
       </DialogPrimitive.Close>
     </DialogPrimitive.Content>
   </DialogPortal>

frontend/src/components/users/InheritDialogue.tsx

@@ -1,11 +1,8 @@
 import { useState } from 'react'
 
-import { useDialogue } from '@/components/dialogues/DialogueProvider'
 import { Button } from '@/components/ui/button'
 import { Dialog,
          DialogContent,
-	 DialogDescription,
-	 DialogHeader,
          DialogTitle } from '@/components/ui/dialog'
 import { Input } from '@/components/ui/input'
 import { toast } from '@/components/ui/use-toast'
@@ -19,16 +16,10 @@ type Props = { visible:         boolean
 
 
 export default ({ visible, onVisibleChange, setUser }: Props) => {
-  const dialogue = useDialogue ()
-
   const [inputCode, setInputCode] = useState ('')
 
   const handleTransfer = async () => {
-    if (!(await dialogue.confirm ({
-	title: '引継ぎを行ってもよろしいですか?',
-	description: '現在のアカウントからはログアウトされます．',
-	confirmText: '引継ぐ',
-	variant: 'danger' })))
+    if (!(confirm ('引継ぎを行ってもよろしいですか?\n現在のアカウントからはログアウトされます．')))
       return
 
     try
@@ -53,18 +44,14 @@ export default ({ visible, onVisibleChange, setUser }: Props) => {
 
   return (
       <Dialog open={visible} onOpenChange={onVisibleChange}>
-	<DialogContent className="px-6 pp-6 pt-7">
-	  <DialogHeader className="pl-8">
+	<DialogContent>
 	  <DialogTitle>ほかのブラウザから引継ぐ</DialogTitle>
-	    <DialogDescription asChild>
 	  <div className="flex gap-2">
 	    <Input placeholder="引継ぎコードを入力"
 		   value={inputCode}
 		   onChange={ev => setInputCode (ev.target.value)}/>
 	    <Button onClick={handleTransfer}>引継ぐ</Button>
 	  </div>
-	    </DialogDescription>
-	  </DialogHeader>
 	</DialogContent>
       </Dialog>)
 }

frontend/src/components/users/UserCodeDialogue.tsx

@@ -1,10 +1,6 @@
-import { useDialogue } from '@/components/dialogues/DialogueProvider'
 import { Button } from '@/components/ui/button'
 import { Dialog,
 	 DialogContent,
-	 DialogDescription,
-	 DialogFooter,
-	 DialogHeader,
 	 DialogTitle } from '@/components/ui/dialog'
 import { toast } from '@/components/ui/use-toast'
 import { apiPost } from '@/lib/api'
@@ -18,20 +14,11 @@ type Props = { visible:         boolean
 
 
 export default ({ visible, onVisibleChange, user, setUser }: Props) => {
-  const dialogue = useDialogue ()
-
   const handleChange = async () => {
     if (!(user))
       return
 
-    if (!(await dialogue.confirm ({
-	title: '引継ぎコードを再発行しますか?',
-	description: (
-	    <div>
-	      <p>再発行するとほかのブラウザからはログアウトされます．</p>
-	    </div>),
-	confirmText: '再発行',
-	variant: 'danger' })))
+    if (!(confirm ('引継ぎコードを再発行しますか?\n再発行するとほかのブラウザからはログアウトされます．')))
       return
 
     const data = await apiPost<{ code: string }> ('/users/code/renew', { },
@@ -46,26 +33,21 @@ export default ({ visible, onVisibleChange, user, setUser }: Props) => {
 
   return (
       <Dialog open={visible} onOpenChange={onVisibleChange}>
-	<DialogContent className="px-6 pb-6 pt-7">
-	  <DialogHeader className="pl-8">
+	<DialogContent>
 	  <DialogTitle>引継ぎコード</DialogTitle>
-
-	    <DialogDescription asChild>
 	  <div>
 	    <p>あなたの引継ぎコードはこちらです：</p>
 	    <div className="m-2">{user?.inheritanceCode}</div>
-		<p className="mt-1 text-sm text-destructive">
+	    <p className="mt-1 text-sm text-red-500">
 	      このコードはほかの人には教えないでください!
 	    </p>
-	      </div>
-	    </DialogDescription>
-	  </DialogHeader>
-
-	  <DialogFooter>
-	    <Button onClick={handleChange} variant="destructive">
+	    <div className="my-4">
+	      <Button onClick={handleChange}
+		      className="px-4 py-2 bg-red-600 text-white rounded disabled:bg-gray-400">
 		引継ぎコード再発行
 	      </Button>
-	  </DialogFooter>
+	    </div>
+	  </div>
 	</DialogContent>
       </Dialog>)
 }

frontend/src/index.css

@@ -6,56 +6,6 @@
 
 @layer base
 {
-  :root
-  {
-    --background: 0 0% 100%;
-    --foreground: 222.2 84% 4.9%;
-
-    --primary: 222.2 47.4% 11.2%;
-    --primary-foreground: 210 40% 98%;
-
-    --secondary: 210 40% 96.1%;
-    --secondary-foreground: 222.2 47.4% 11.2%;
-
-    --destructive: 0 72.2% 50.6%;
-    --destructive-foreground: 210 40% 98%;
-
-    --muted: 210 40% 96.1%;
-    --muted-foreground: 215.4 16.3% 46.9%;
-
-    --accent: 210 40% 96.1%;
-    --accent-foreground: 222.2 47.4% 11.2%;
-
-    --border: 214.3 31.8% 91.4%;
-    --input: 214.3 31.8% 91.4%;
-    --ring: 222.2 84% 4.9%;
-  }
-
-  .dark
-  {
-    --background: 222.2 84% 4.9%;
-    --foreground: 210 40% 98%;
-
-    --primary: 210 40% 98%;
-    --primary-foreground: 222.2 47.4% 11.2%;
-
-    --secondary: 217.2 32.6% 17.5%;
-    --secondary-foreground: 210 40% 98%;
-
-    --destructive: 0 62.8% 45%;
-    --destructive-foreground: 210 40% 98%;
-
-    --muted: 217.2 32.6% 17.5%;
-    --muted-foreground: 215 20.2% 65.1%;
-
-    --accent: 217.2 32.6% 17.5%;
-    --accent-foreground: 210 40% 98%;
-
-    --border: 217.2 32.6% 17.5%;
-    --input: 217.2 32.6% 17.5%;
-    --ring: 212.7 26.8% 83.9%;
-  }
-
   body
   {
     @apply overflow-x-clip;
@@ -104,6 +54,34 @@ body
   min-height: 100dvh;
 }
 
+h1
+{
+  font-size: 3.2em;
+  line-height: 1.1;
+}
+
+button
+{
+  border-radius: 8px;
+  border: 1px solid transparent;
+  padding: 0.6em 1.2em;
+  font-size: 1em;
+  font-weight: 500;
+  font-family: inherit;
+  background-color: #1a1a1a;
+  cursor: pointer;
+  transition: border-color 0.25s;
+}
+button:hover
+{
+  border-color: #646cff;
+}
+button:focus,
+button:focus-visible
+{
+  outline: 4px auto -webkit-focus-ring-color;
+}
+
 @media (prefers-color-scheme: light)
 {
   :root

frontend/src/lib/posts.ts

@@ -1,4 +1,4 @@
-import { apiDelete, apiGet, apiPost, apiPut } from '@/lib/api'
+import { apiDelete, apiGet, apiPost } from '@/lib/api'
 
 import type { FetchPostsParams, Post, PostVersion } from '@/types'
 
@@ -42,30 +42,6 @@ export const fetchPostChanges = async (
 						     page, limit } })
 
 
-export const updatePost = async (
-    post: { id:                     number
-	    title:                  string | null
-	    tags:                   string
-	    parentPostIds:          string
-	    originalCreatedFrom:    string | null
-	    originalCreatedBefore:  string | null },
-    { baseVersionNo, force, merge }: {
-	baseVersionNo?: number
-	force?:         boolean
-	merge?:         boolean }
-) =>
-    await apiPut<Post> (
-	`/posts/${ post.id }`,
-	{ title: post.title,
-	  tags: post.tags,
-	  parent_post_ids: post.parentPostIds,
-	  original_created_from: post.originalCreatedFrom,
-	  original_created_before: post.originalCreatedBefore },
-	{ params: { ...(baseVersionNo && { base_version_no: String (baseVersionNo) }),
-	            force: force ? '1' : '0',
-		    merge: merge ? '1' : '0' } })
-
-
 export const toggleViewedFlg = async (id: string, viewed: boolean): Promise<void> => {
   await (viewed ? apiPost : apiDelete) (`/posts/${ id }/viewed`)
 }

frontend/src/pages/posts/PostHistoryPage.tsx

@@ -8,18 +8,16 @@ import TagLink from '@/components/TagLink'
 import PrefetchLink from '@/components/PrefetchLink'
 import PageTitle from '@/components/common/PageTitle'
 import Pagination from '@/components/common/Pagination'
-import { useDialogue } from '@/components/dialogues/DialogueProvider'
 import MainArea from '@/components/layout/MainArea'
 import { toast } from '@/components/ui/use-toast'
 import { SITE_TITLE } from '@/config'
-import { fetchPostChanges, updatePost } from '@/lib/posts'
+import { apiPut } from '@/lib/api'
+import { fetchPostChanges } from '@/lib/posts'
 import { postsKeys, tagsKeys } from '@/lib/queryKeys'
 import { fetchTag } from '@/lib/tags'
 import { cn, dateString, originalCreatedAtString } from '@/lib/utils'
 
-import type { FC, MouseEvent } from 'react'
-
-import type { PostVersion } from '@/types'
+import type { FC } from 'react'
 
 
 const renderDiff = (diff: { current: string | null; prev: string | null }) => (
@@ -36,8 +34,6 @@ const renderDiff = (diff: { current: string | null; prev: string | null }) => (
 
 
 export default (() => {
-  const dialogue = useDialogue ()
-
   const location = useLocation ()
   const query = new URLSearchParams (location.search)
   const id = query.get ('id')
@@ -66,48 +62,6 @@ export default (() => {
 
   const qc = useQueryClient ()
 
-  const handleRevert = async (e: MouseEvent<HTMLAnchorElement>, change: PostVersion) => {
-    e.preventDefault ()
-
-    if (!(await dialogue.confirm ({
-	title: '差戻の確認',
-	description: `『${ change.title.current || change.url.current }』を版 ${
-	    change.versionNo } に差戻します．\nよろしいですか?`,
-	confirmText: '差戻' })))
-      return
-
-    try
-    {
-      const id = change.postId
-      const title = change.title.current
-      const tags =
-	  change.tags
-	  .filter (t => t.type !== 'removed')
-	  .map (t => t.name)
-	  .filter (t => t.slice (0, 5) !== 'nico:')
-	  .join (' ')
-      const parentPostIds =
-	  (change.parentPosts ?? [])
-	  .filter (p => p.type !== 'removed')
-	  .map (p => p.id)
-	  .join (' ')
-      const originalCreatedFrom = change.originalCreatedFrom.current
-      const originalCreatedBefore = change.originalCreatedBefore.current
-      await updatePost ({ id, title, tags, parentPostIds,
-			  originalCreatedFrom, originalCreatedBefore },
-		        { force: true })
-
-      qc.invalidateQueries ({ queryKey: postsKeys.root })
-      qc.invalidateQueries ({ queryKey: tagsKeys.root })
-
-      toast ({ description: '差戻しました．' })
-    }
-    catch
-    {
-      toast ({ description: '差戻に失敗……' })
-    }
-  }
-
   useEffect (() => {
     document.querySelector ('table')?.scrollIntoView ({ behavior: 'smooth' })
   }, [location.search])
@@ -277,7 +231,46 @@ export default (() => {
 			      {dateString (change.createdAt)}
 			    </td>
 			    <td className="p-2">
-			      <a href="#" onClick={async e => await handleRevert (e, change)}>
+			      <a
+				  href="#"
+				  onClick={async e => {
+				    e.preventDefault ()
+
+				    if (!(confirm (
+					`『${ change.title.current
+					      || change.url.current }』を版 ${
+					change.versionNo } に差戻します．\nよろしいですか?`)))
+				      return
+
+				    try
+				    {
+				      await apiPut (
+					  `/posts/${ change.postId }`,
+					  { title: change.title.current,
+					    tags: change.tags
+						  .filter (t => t.type !== 'removed')
+						  .map (t => t.name)
+						  .filter (t => t.slice (0, 5) !== 'nico:')
+						  .join (' '),
+					    parent_post_ids:
+						(change.parentPosts ?? [])
+						.filter (p => p.type !== 'removed')
+						.map (p => p.id)
+						.join (' '),
+					    original_created_from:
+						change.originalCreatedFrom.current,
+					    original_created_before:
+						change.originalCreatedBefore.current })
+
+				      qc.invalidateQueries ({ queryKey: postsKeys.root })
+				      qc.invalidateQueries ({ queryKey: tagsKeys.root })
+				      toast ({ description: '差戻しました．' })
+				    }
+				    catch
+				    {
+				      toast ({ description: '差戻に失敗……' })
+				    }
+				  }}>
 				復元
 			      </a>
 			    </td>

frontend/src/pages/wiki/WikiEditPage.tsx

@@ -1,10 +1,9 @@
 import { useQueryClient } from '@tanstack/react-query'
-import MarkdownIt from 'markdown-it'
 import { useEffect, useState } from 'react'
 import { Helmet } from 'react-helmet-async'
-import MdEditor from 'react-markdown-editor-lite'
 import { useParams, useNavigate } from 'react-router-dom'
 
+import WikiEditForm from '@/components/WikiEditForm'
 import MainArea from '@/components/layout/MainArea'
 import { toast } from '@/components/ui/use-toast'
 import { SITE_TITLE } from '@/config'
@@ -18,8 +17,6 @@ import type { FC } from 'react'
 
 import type { User, WikiPage } from '@/types'
 
-const mdParser = new MarkdownIt
-
 type Props = { user: User | null }
 
 
@@ -37,7 +34,7 @@ export default (({ user }: Props) => {
   const [loading, setLoading] = useState (true)
   const [title, setTitle] = useState ('')
 
-  const handleSubmit = async () => {
+  const handleSubmit = async (title: string, body: string) => {
     const formData = new FormData ()
     formData.append ('title', title)
     formData.append ('body', body)
@@ -46,8 +43,6 @@ export default (({ user }: Props) => {
     {
       await apiPut (`/wiki/${ id }`, formData,
 		    { headers: { 'Content-Type': 'multipart/form-data' } })
-      qc.setQueryData (wikiKeys.show (title, { }),
-		       (prev: WikiPage) => ({ ...prev, title, body }))
       qc.invalidateQueries ({ queryKey: wikiKeys.root })
       toast ({ title: '投稿成功!' })
       navigate (`/wiki/${ title }`)
@@ -77,32 +72,11 @@ export default (({ user }: Props) => {
 	  <h1 className="text-2xl font-bold mb-2">Wiki ページを編輯</h1>
 
 	  {loading ? 'Loading...' : (
-	      <>
-		{/* タイトル */}
-		{/* TODO: タグ補完 */}
-		<div>
-		  <label className="block font-semibold mb-1">タイトル</label>
-		  <input type="text"
-			 value={title}
-			 onChange={e => setTitle (e.target.value)}
-			 className="w-full border p-2 rounded"/>
-		</div>
-
-		{/* 本文 */}
-		<div>
-		  <label className="block font-semibold mb-1">本文</label>
-		  <MdEditor value={body}
-			    style={{ height: '500px' }}
-			    renderHTML={text => mdParser.render (text)}
-			    onChange={({ text }) => setBody (text)}/>
-		</div>
-
-		{/* 送信 */}
-		<button onClick={handleSubmit}
-			className="px-4 py-2 bg-blue-600 text-white rounded disabled:bg-gray-400">
-		  編輯
-		</button>
-	      </>)}
+	      <WikiEditForm
+		  title={title}
+		  body={body}
+		  onSubmit={handleSubmit}
+		  id={Number (id)}/>)}
 	</div>
       </MainArea>)
 }) satisfies FC<Props>

frontend/src/pages/wiki/WikiNewPage.tsx

@@ -1,21 +1,19 @@
-import MarkdownIt from 'markdown-it'
-import { useState } from 'react'
+import { useQueryClient } from '@tanstack/react-query'
 import { Helmet } from 'react-helmet-async'
-import MdEditor from 'react-markdown-editor-lite'
 import { useLocation, useNavigate } from 'react-router-dom'
 
+import WikiEditForm from '@/components/WikiEditForm'
 import MainArea from '@/components/layout/MainArea'
 import { toast } from '@/components/ui/use-toast'
 import { SITE_TITLE } from '@/config'
 import { apiPost } from '@/lib/api'
+import { wikiKeys } from '@/lib/queryKeys'
 import Forbidden from '@/pages/Forbidden'
 
 import 'react-markdown-editor-lite/lib/index.css'
 
 import type { User, WikiPage } from '@/types'
 
-const mdParser = new MarkdownIt
-
 type Props = { user: User | null }
 
 
@@ -26,13 +24,12 @@ export default ({ user }: Props) => {
   const location = useLocation ()
   const navigate = useNavigate ()
 
+  const qc = useQueryClient ()
+
   const query = new URLSearchParams (location.search)
   const titleQuery = query.get ('title') ?? ''
 
-  const [title, setTitle] = useState (titleQuery)
-  const [body, setBody] = useState ('')
-
-  const handleSubmit = async () => {
+  const handleSubmit = async (title: string, body: string) => {
     const formData = new FormData
     formData.append ('title', title)
     formData.append ('body', body)
@@ -41,6 +38,7 @@ export default ({ user }: Props) => {
     {
       const data = await apiPost<WikiPage> ('/wiki', formData,
 	  { headers: { 'Content-Type': 'multipart/form-data' } })
+      qc.invalidateQueries ({ queryKey: wikiKeys.root })
       toast ({ title: '投稿成功!' })
       navigate (`/wiki/${ data.title }`)
     }
@@ -58,30 +56,10 @@ export default ({ user }: Props) => {
 	<div className="max-w-xl mx-auto p-4 space-y-4">
 	  <h1 className="text-2xl font-bold mb-2">新規 Wiki ページ</h1>
 
-	  {/* タイトル */}
-	  {/* TODO: タグ補完 */}
-	  <div>
-	    <label className="block font-semibold mb-1">タイトル</label>
-	    <input type="text"
-		   value={title}
-		   onChange={e => setTitle (e.target.value)}
-		   className="w-full border p-2 rounded"/>
-	  </div>
-
-	  {/* 本文 */}
-	  <div>
-	    <label className="block font-semibold mb-1">本文</label>
-	    <MdEditor value={body}
-		      style={{ height: '500px' }}
-		      renderHTML={text => mdParser.render (text)}
-		      onChange={({ text }) => setBody (text)}/>
-	  </div>
-
-	  {/* 送信 */}
-	  <button onClick={handleSubmit}
-		  className="px-4 py-2 bg-blue-600 text-white rounded disabled:bg-gray-400">
-	    追加
-	  </button>
+	  <WikiEditForm
+	      title={titleQuery}
+	      body=""
+	      onSubmit={handleSubmit}/>
 	</div>
       </MainArea>)
 }

frontend/src/types.ts

@@ -121,7 +121,6 @@ export type Platform = typeof PLATFORMS[number]
 
 export type Post = {
     id:                     number
-    versionNo:              number
     url:                    string
     title:                  string | null
     thumbnail:              string | null
@@ -147,7 +146,6 @@ export type PostTagChange = {
 
 export type PostVersion = {
     postId:                 number
-    latestVersionNo:        number
     versionNo:              number
     eventType:              'create' | 'update' | 'discard' | 'restore'
     title:                  { current: string | null; prev: string | null }
@@ -225,6 +223,11 @@ export type User = {
 
 export type ViewFlagBehavior = typeof ViewFlagBehavior[keyof typeof ViewFlagBehavior]
 
+export type WikiAsset = {
+    wikiPageId: number
+    no:         number
+    url:        string }
+
 export type WikiPage = {
     id:             number
     title:          string

frontend/tailwind.config.js

@@ -19,22 +19,7 @@ export default {
 		'rainbow-scroll': 'rainbow-scroll .25s linear infinite' },
 	    colors: {
 		red: { 925: '#5f1414',
-		       975: '#230505' },
-		border: 'hsl(var(--border))',
-		input: 'hsl(var(--input))',
-		ring: 'hsl(var(--ring))',
-		background: 'hsl(var(--background))',
-		foreground: 'hsl(var(--foreground))',
-		primary: { DEFAULT: 'hsl(var(--primary))',
-			   foreground: 'hsl(var(--primary-foreground))' },
-		secondary: { DEFAULT: 'hsl(var(--secondary))',
-			     foreground: 'hsl(var(--secondary-foreground))' },
-		destructive: { DEFAULT: 'hsl(var(--destructive))',
-			       foreground: 'hsl(var(--destructive-foreground))' },
-		muted: { DEFAULT: 'hsl(var(--muted))',
-			 foreground: 'hsl(var(--muted-foreground))' },
-		accent: { DEFAULT: 'hsl(var(--accent))',
-			  foreground: 'hsl(var(--accent-foreground))' } },
+		       975: '#230505' } },
 	    keyframes: {
 		'rainbow-scroll': {
 		    '0%':   { backgroundPosition: '0% 50%' },