// PUT /api/lists (desktop) — full-replace of the caller's catalog. Upsert all supplied;
// delete the caller's lists not present. Any client-supplied ownerId is ignored — the
// server stamps ownership from the verified token.
export default defineEventHandler(async (event) => {
  const body = await readBody(event);
  if (
    !Array.isArray(body) ||
    body.some((l) => typeof l?.id !== "string" || typeof l?.name !== "string")
  ) {
    throw createError({ statusCode: 400, statusMessage: "expected [{ id, name }]" });
  }
  await replaceLists(
    getSql(),
    ownerOf(event),
    body.map((l) => ({ id: l.id, name: l.name })),
  );
  return { ok: true };
});