From 3bd677707053444cab9093cb376e4baabb5328ca Mon Sep 17 00:00:00 2001
From: Elian Doran <contact@eliandoran.me>
Date: Sat, 28 Mar 2026 12:57:53 +0200
Subject: [PATCH] chore(core): integrate scripting routes

---
 apps/server/src/routes/routes.ts               |  9 ---------
 .../trilium-core}/src/routes/api/script.ts     | 18 +++++++++---------
 packages/trilium-core/src/routes/index.ts      | 11 +++++++++++
 3 files changed, 20 insertions(+), 18 deletions(-)
 rename {apps/server => packages/trilium-core}/src/routes/api/script.ts (94%)

diff --git a/apps/server/src/routes/routes.ts b/apps/server/src/routes/routes.ts
index 5a1a2bdb5e..b33dde72f0 100644
--- a/apps/server/src/routes/routes.ts
+++ b/apps/server/src/routes/routes.ts
@@ -28,7 +28,6 @@ import loginApiRoute from "./api/login.js";
 import metricsRoute from "./api/metrics.js";
 import passwordApiRoute from "./api/password.js";
 import recoveryCodes from './api/recovery_codes.js';
-import scriptRoute from "./api/script.js";
 import senderRoute from "./api/sender.js";
 import systemInfoRoute from "./api/system_info.js";
 import totp from './api/totp.js';
@@ -177,14 +176,6 @@ function register(app: express.Application) {
 
     apiRoute(GET, "/api/database/check-integrity", databaseRoute.checkIntegrity);
 
-    asyncRoute(PST, "/api/script/exec", [auth.checkApiAuth, csrfMiddleware], scriptRoute.exec, apiResultHandler);
-
-    apiRoute(PST, "/api/script/run/:noteId", scriptRoute.run);
-    apiRoute(GET, "/api/script/startup", scriptRoute.getStartupBundles);
-    apiRoute(GET, "/api/script/widgets", scriptRoute.getWidgetBundles);
-    apiRoute(PST, "/api/script/bundle/:noteId", scriptRoute.getBundle);
-    apiRoute(GET, "/api/script/relation/:noteId/:relationName", scriptRoute.getRelationBundles);
-
     // no CSRF since this is called from android app
     route(PST, "/api/sender/login", [loginRateLimiter], loginApiRoute.token, apiResultHandler);
     asyncRoute(PST, "/api/sender/image", [auth.checkEtapiToken, uploadMiddlewareWithErrorHandling], senderRoute.uploadImage, apiResultHandler);
diff --git a/apps/server/src/routes/api/script.ts b/packages/trilium-core/src/routes/api/script.ts
similarity index 94%
rename from apps/server/src/routes/api/script.ts
rename to packages/trilium-core/src/routes/api/script.ts
index eda6dff878..7a6d065c2b 100644
--- a/apps/server/src/routes/api/script.ts
+++ b/packages/trilium-core/src/routes/api/script.ts
@@ -5,9 +5,9 @@ import type { Request } from "express";
 import becca from "../../becca/becca.js";
 import attributeService from "../../services/attributes.js";
 import scriptService, { type Bundle } from "../../services/script.js";
-import sql from "../../services/sql.js";
 import syncService from "../../services/sync.js";
-import { safeExtractMessageAndStackFromError } from "../../services/utils.js";
+import { safeExtractMessageAndStackFromError } from "../../services/utils/index.js";
+import { getSql } from "../../services/sql/index.js";
 
 interface ScriptBody {
     script: string;
@@ -28,7 +28,7 @@ async function exec(req: Request) {
 
         const execute = (body: ScriptBody) => scriptService.executeScript(body.script, body.params, body.startNoteId, body.currentNoteId, body.originEntityName, body.originEntityId);
 
-        const result = body.transactional ? sql.transactional(() => execute(body)) : await execute(body);
+        const result = body.transactional ? getSql().transactional(() => execute(body)) : await execute(body);
 
         return {
             success: true,
@@ -72,20 +72,20 @@ function getStartupBundles(req: Request) {
     if (!process.env.TRILIUM_SAFE_MODE) {
         if (req.query.mobile === "true") {
             return getBundlesWithLabel("run", "mobileStartup");
-        } 
+        }
         return getBundlesWithLabel("run", "frontendStartup");
-        
-    } 
+
+    }
     return [];
-    
+
 }
 
 function getWidgetBundles() {
     if (!process.env.TRILIUM_SAFE_MODE) {
         return getBundlesWithLabel("widget");
-    } 
+    }
     return [];
-    
+
 }
 
 function getRelationBundles(req: Request<{ noteId: string, relationName: string }>) {
diff --git a/packages/trilium-core/src/routes/index.ts b/packages/trilium-core/src/routes/index.ts
index 2c276b40ce..aaf779cd88 100644
--- a/packages/trilium-core/src/routes/index.ts
+++ b/packages/trilium-core/src/routes/index.ts
@@ -27,6 +27,7 @@ import setupApiRoute from "./api/setup";
 import filesRoute from "./api/files";
 import importRoute from "./api/import";
 import exportRoute from "./api/export";
+import scriptRoute from "./api/script";
 
 // TODO: Deduplicate with routes.ts
 const GET = "get",
@@ -217,6 +218,16 @@ export function buildSharedApiRoutes({ route, asyncRoute, apiRoute, asyncApiRout
     // this "hacky" path is used for easier referencing of CSS resources
     route(GET, "/api/attachments/download/:attachmentId", [checkApiAuthOrElectron], filesRoute.downloadAttachment);
     //#endregion
+
+    //#region Export
+    asyncRoute(PST, "/api/script/exec", [checkApiAuth, csrfMiddleware], scriptRoute.exec, apiResultHandler);
+
+    apiRoute(PST, "/api/script/run/:noteId", scriptRoute.run);
+    apiRoute(GET, "/api/script/startup", scriptRoute.getStartupBundles);
+    apiRoute(GET, "/api/script/widgets", scriptRoute.getWidgetBundles);
+    apiRoute(PST, "/api/script/bundle/:noteId", scriptRoute.getBundle);
+    apiRoute(GET, "/api/script/relation/:noteId/:relationName", scriptRoute.getRelationBundles);
+    //#endregion
 }
 
 /** Handling common patterns. If entity is not caught, serialization to JSON will fail */