@growth-labs/cms 0.1.0

package/dist/routes/ai.js

@@ -0,0 +1,381 @@
+// AI house-style assist routes (P4 Tasks 3 + 4).
+// createAiRoutes(config) — streaming actions: proofreadAndTighten + suggestHeadlines (SSE)
+//                        — sync actions: generateKeyTakeaways + draftMetaDescription.
+//
+// Architecture:
+// - Every AI call goes through the injected LlmDispatch hook (config.hooks.llm).
+//   Absent hook → 501. This is the §9 hard constraint.
+// - The streaming actions call dispatch({ ...prompt, stream: true }) and return the
+//   result as a text/event-stream Response. If the hook returns { text } (a non-
+//   streaming implementation), the text is wrapped as a single SSE event (graceful
+//   fallback).
+// - Streaming actions are read-only suggestions — they NEVER write back to D1.
+// - Sync actions (takeaways, meta-description) call dispatch({ ...prompt, stream: false }),
+//   apply the ai_locked_fields gate, persist when allowed, and return the result.
+// - OG-image generation lands in Task 5.
+import { headlinesPrompt, metaDescriptionPrompt, proofreadPrompt, takeawaysPrompt, } from '../engine/ai-prompts.js';
+import { applyAiWrite, parseLockedFields } from '../engine/ai-writeback.js';
+import { buildOgCardSpec } from '../engine/og-render.js';
+import { getContentItem } from '../engine/publisher.js';
+import { resolveConfig } from './config.js';
+import { json, requireId } from './context.js';
+import { buildImageAssetKey, insertMediaAsset, publicUrlFor } from './media-lib.js';
+/**
+ * AI editorial assists are write-adjacent surfaces (proofread/headlines are
+ * read-only suggestions; takeaways/meta/og persist). They gate on the
+ * edit_own_draft capability via requireRole when the host wires the role seam
+ * (any of the 5 roles holds it — no launch-role lockout), falling back to the
+ * flat requirePublisher gate otherwise. Actual write-back is additionally gated
+ * by the ownership-aware content routes.
+ */
+async function aiGuard(authz, ctx) {
+    if (authz.requireRole) {
+        return authz.requireRole('edit_own_draft', ctx);
+    }
+    return authz.requirePublisher(ctx);
+}
+/**
+ * Clamp a meta description to at most `limit` characters, breaking at a word
+ * boundary. Trailing whitespace is trimmed from the result.
+ *
+ * Algorithm: if the text is already within the limit, return it unchanged.
+ * Otherwise find the last space at or before position `limit` and cut there.
+ * If there is no space before `limit`, perform a hard cut at `limit`.
+ */
+export function clampMeta(text, limit) {
+    const trimmed = text.trim();
+    if (trimmed.length <= limit)
+        return trimmed;
+    // Find the last space at or before `limit`.
+    const slice = trimmed.slice(0, limit);
+    const lastSpace = slice.lastIndexOf(' ');
+    if (lastSpace > 0) {
+        return slice.slice(0, lastSpace).trimEnd();
+    }
+    // No space found — hard cut.
+    return slice.trimEnd();
+}
+/**
+ * Tolerant JSON parse for the takeaways LLM response.
+ * The LLM is instructed to return a JSON array of 3 strings; in practice it may
+ * return malformed JSON or wrap the array in markdown. We try JSON.parse first;
+ * on failure we wrap the raw text as a single-element array so the caller always
+ * gets a string[].
+ */
+function parseTakeawaysText(text) {
+    const t = text.trim();
+    try {
+        const parsed = JSON.parse(t);
+        if (Array.isArray(parsed)) {
+            return parsed.map((item) => String(item));
+        }
+        // Non-array JSON — wrap it
+        return [String(parsed)];
+    }
+    catch {
+        // Not JSON — return the raw text as a single element
+        return [t];
+    }
+}
+/**
+ * Wrap a ReadableStream or { text } result from LlmDispatch as an SSE Response.
+ *
+ * - ReadableStream → pass through as text/event-stream (the provider does SSE framing).
+ * - { text } → wrap the text as one SSE data event (graceful fallback for sync impls).
+ */
+function isUnavailableLlmResult(result) {
+    return !(result instanceof ReadableStream) && result.status === 'unavailable';
+}
+function llmUnavailableResponse(result, extra = {}) {
+    return json({
+        error: 'AI generation is unavailable',
+        written: false,
+        ...(result.reason ? { reason: result.reason } : {}),
+        ...extra,
+    }, 503);
+}
+function toSseResponse(result) {
+    if (isUnavailableLlmResult(result))
+        return llmUnavailableResponse(result);
+    const headers = {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache',
+        'X-Content-Type-Options': 'nosniff',
+    };
+    if (result instanceof ReadableStream) {
+        return new Response(result, { status: 200, headers });
+    }
+    // { text } fallback: emit a single SSE data event
+    const body = `data: ${result.text}\n\n`;
+    return new Response(body, { status: 200, headers });
+}
+/**
+ * Load the article body markdown for a given content item id.
+ * Returns null if the item does not exist or has no article_content row.
+ */
+async function loadArticleBody(ctx, id) {
+    const item = await getContentItem(ctx.db, id);
+    if (!item)
+        return null;
+    // For non-article types we still load the body if available; for article/newsletter
+    // the body_markdown column is in article_content.
+    const row = await ctx.db
+        .prepare('SELECT body_markdown FROM article_content WHERE content_id = ? LIMIT 1')
+        .bind(id)
+        .first();
+    const bodyMarkdown = row?.body_markdown ?? '';
+    return { item, bodyMarkdown };
+}
+export function createAiRoutes(config) {
+    const resolved = resolveConfig(config);
+    async function proofreadAndTighten(ctx) {
+        // Guard: edit_own_draft capability (any member; ownership-aware write-back).
+        const authGuard = await aiGuard(resolved.authz, ctx);
+        if (authGuard)
+            return authGuard;
+        // Guard: llm hook must be configured.
+        if (!resolved.hooks.llm) {
+            return json({ error: 'AI generation is not configured' }, 501);
+        }
+        // Resolve the content id.
+        const idResult = requireId(ctx);
+        if ('error' in idResult)
+            return idResult.error;
+        const { id } = idResult;
+        // Load the item + body.
+        const loaded = await loadArticleBody(ctx, id);
+        if (!loaded)
+            return json({ error: 'Not found' }, 404);
+        const { bodyMarkdown } = loaded;
+        // Build the prompt and dispatch (streaming).
+        const prompt = proofreadPrompt({ body: bodyMarkdown });
+        const result = await resolved.hooks.llm.dispatch({ ...prompt, stream: true });
+        return toSseResponse(result);
+    }
+    async function suggestHeadlines(ctx) {
+        // Guard: edit_own_draft capability (any member; ownership-aware write-back).
+        const authGuard = await aiGuard(resolved.authz, ctx);
+        if (authGuard)
+            return authGuard;
+        // Guard: llm hook must be configured.
+        if (!resolved.hooks.llm) {
+            return json({ error: 'AI generation is not configured' }, 501);
+        }
+        // Resolve the content id.
+        const idResult = requireId(ctx);
+        if ('error' in idResult)
+            return idResult.error;
+        const { id } = idResult;
+        // Load the item + body.
+        const loaded = await loadArticleBody(ctx, id);
+        if (!loaded)
+            return json({ error: 'Not found' }, 404);
+        const { item, bodyMarkdown } = loaded;
+        // Build the prompt and dispatch (streaming).
+        const prompt = headlinesPrompt({ title: item.title, body: bodyMarkdown });
+        const result = await resolved.hooks.llm.dispatch({ ...prompt, stream: true });
+        return toSseResponse(result);
+    }
+    async function generateKeyTakeaways(ctx) {
+        // Guard: edit_own_draft capability (any member; ownership-aware write-back).
+        const authGuard = await aiGuard(resolved.authz, ctx);
+        if (authGuard)
+            return authGuard;
+        // Guard: llm hook must be configured.
+        if (!resolved.hooks.llm) {
+            return json({ error: 'AI generation is not configured' }, 501);
+        }
+        // Resolve the content id.
+        const idResult = requireId(ctx);
+        if ('error' in idResult)
+            return idResult.error;
+        const { id } = idResult;
+        // Load the item.
+        const item = await getContentItem(ctx.db, id);
+        if (!item)
+            return json({ error: 'Not found' }, 404);
+        // Takeaways only makes sense for articles (mirrors regenerate-takeaways guard).
+        if (item.type !== 'article') {
+            return json({ error: 'Invalid content type — takeaways require an article' }, 400);
+        }
+        // Load the article body.
+        const bodyRow = await ctx.db
+            .prepare('SELECT body_markdown FROM article_content WHERE content_id = ? LIMIT 1')
+            .bind(id)
+            .first();
+        const bodyMarkdown = bodyRow?.body_markdown ?? '';
+        // Build the prompt and dispatch (sync).
+        const prompt = takeawaysPrompt({ body: bodyMarkdown });
+        const result = await resolved.hooks.llm.dispatch({ ...prompt, stream: false });
+        if (isUnavailableLlmResult(result)) {
+            return llmUnavailableResponse(result, { takeaways: [] });
+        }
+        // result should be { text } for a sync (stream:false) call
+        const text = 'text' in result ? result.text : '';
+        const takeaways = parseTakeawaysText(text);
+        // Apply the ai_locked_fields write-back gate.
+        const lockedFields = parseLockedFields(item.ai_locked_fields);
+        const writeResult = applyAiWrite({
+            locked: lockedFields,
+            field: 'ai_takeaways',
+            value: takeaways,
+        });
+        if (writeResult.written) {
+            const now = Math.floor(Date.now() / 1000);
+            await ctx.db
+                .prepare(`UPDATE article_content
+					SET ai_takeaways = ?,
+						ai_takeaways_at = ?,
+						ai_takeaways_model = ?
+					WHERE content_id = ?`)
+                .bind(JSON.stringify(takeaways), now, 'llm-dispatch', id)
+                .run();
+        }
+        return json({
+            takeaways: writeResult.value,
+            written: writeResult.written,
+            ...(writeResult.written ? {} : { locked: true }),
+        });
+    }
+    async function draftMetaDescription(ctx) {
+        // Guard: edit_own_draft capability (any member; ownership-aware write-back).
+        const authGuard = await aiGuard(resolved.authz, ctx);
+        if (authGuard)
+            return authGuard;
+        // Guard: llm hook must be configured.
+        if (!resolved.hooks.llm) {
+            return json({ error: 'AI generation is not configured' }, 501);
+        }
+        // Resolve the content id.
+        const idResult = requireId(ctx);
+        if ('error' in idResult)
+            return idResult.error;
+        const { id } = idResult;
+        // Load the item.
+        const item = await getContentItem(ctx.db, id);
+        if (!item)
+            return json({ error: 'Not found' }, 404);
+        // Load the article body (best-effort — non-article types use empty string).
+        let bodyMarkdown = '';
+        if (item.type === 'article' || item.type === 'newsletter') {
+            const bodyRow = await ctx.db
+                .prepare('SELECT body_markdown FROM article_content WHERE content_id = ? LIMIT 1')
+                .bind(id)
+                .first();
+            bodyMarkdown = bodyRow?.body_markdown ?? '';
+        }
+        // Build the prompt and dispatch (sync).
+        const prompt = metaDescriptionPrompt({ title: item.title, body: bodyMarkdown });
+        const result = await resolved.hooks.llm.dispatch({ ...prompt, stream: false });
+        if (isUnavailableLlmResult(result)) {
+            return llmUnavailableResponse(result, { description: null });
+        }
+        // result should be { text } for a sync (stream:false) call
+        const rawText = 'text' in result ? result.text : '';
+        // Belt-and-braces: clamp to 160 chars at a word boundary.
+        const description = clampMeta(rawText, 160);
+        // Apply the ai_locked_fields write-back gate.
+        const lockedFields = parseLockedFields(item.ai_locked_fields);
+        const writeResult = applyAiWrite({
+            locked: lockedFields,
+            field: 'description',
+            value: description,
+        });
+        if (writeResult.written) {
+            await ctx.db
+                .prepare('UPDATE content_items SET description = ?, updated_at = unixepoch() WHERE id = ?')
+                .bind(description, id)
+                .run();
+        }
+        return json({
+            description: writeResult.value,
+            written: writeResult.written,
+            ...(writeResult.written ? {} : { locked: true }),
+        });
+    }
+    async function generateOgImage(ctx) {
+        // Guard: edit_own_draft capability (any member; ownership-aware write-back).
+        const authGuard = await aiGuard(resolved.authz, ctx);
+        if (authGuard)
+            return authGuard;
+        // Guard: ogRenderer hook must be configured.
+        if (!resolved.hooks.ogRenderer) {
+            return json({ error: 'OG image rendering is not configured' }, 501);
+        }
+        // Guard: bucket must be available.
+        if (!ctx.bucket) {
+            return json({ error: 'Missing R2 bucket configuration' }, 500);
+        }
+        // Resolve the content id.
+        const idResult = requireId(ctx);
+        if ('error' in idResult)
+            return idResult.error;
+        const { id } = idResult;
+        // Load the content item.
+        const item = await getContentItem(ctx.db, id);
+        if (!item)
+            return json({ error: 'Not found' }, 404);
+        // Build the card spec from the content row.
+        // Brand defaults to the configured mediaPublicDomain as a publication label
+        // (stripped of TLD) or a generic fallback.
+        const brand = resolved.mediaPublicDomain
+            ? resolved.mediaPublicDomain.split('.').slice(0, -1).join('.') || resolved.mediaPublicDomain
+            : 'The Publication';
+        const cardSpec = buildOgCardSpec(item, { brand });
+        // Render the OG image via the injected renderer.
+        const pngBytes = await resolved.hooks.ogRenderer.render(cardSpec);
+        // Persist the PNG to R2.
+        const imageKey = buildImageAssetKey(item.slug, 'og-image.png', crypto.randomUUID());
+        await ctx.bucket.put(imageKey, pngBytes, {
+            httpMetadata: { contentType: 'image/png' },
+        });
+        // Insert a media_assets row.
+        const publicUrl = publicUrlFor({
+            r2Binding: resolved.mediaR2Binding,
+            objectKey: imageKey,
+            publicDomain: resolved.mediaPublicDomain,
+        });
+        await insertMediaAsset(ctx.db, {
+            id: imageKey,
+            siteId: resolved.mediaSiteId,
+            assetType: 'image',
+            sourceType: 'ai-og-image',
+            originalFilename: 'og-image.png',
+            status: 'ready',
+            objectKey: imageKey,
+            publicUrl,
+            url: publicUrl,
+            width: null,
+            height: null,
+            variantsJson: null,
+            r2Binding: resolved.mediaR2Binding,
+        });
+        // Apply the ai_locked_fields write-back gate for ai_og_image_id.
+        const lockedFields = parseLockedFields(item.ai_locked_fields);
+        const writeResult = applyAiWrite({
+            locked: lockedFields,
+            field: 'ai_og_image_id',
+            value: imageKey,
+        });
+        if (writeResult.written) {
+            await ctx.db
+                .prepare('UPDATE content_items SET ai_og_image_id = ?, updated_at = unixepoch() WHERE id = ?')
+                .bind(imageKey, id)
+                .run();
+        }
+        return json({
+            ogImageId: imageKey,
+            url: publicUrl,
+            written: writeResult.written,
+            ...(writeResult.written ? {} : { locked: true }),
+        });
+    }
+    return {
+        proofreadAndTighten,
+        suggestHeadlines,
+        generateKeyTakeaways,
+        draftMetaDescription,
+        generateOgImage,
+    };
+}
+//# sourceMappingURL=ai.js.map

package/dist/routes/ai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai.js","sourceRoot":"","sources":["../../src/routes/ai.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,2FAA2F;AAC3F,sFAAsF;AACtF,EAAE;AACF,gBAAgB;AAChB,iFAAiF;AACjF,uDAAuD;AACvD,oFAAoF;AACpF,iFAAiF;AACjF,mFAAmF;AACnF,eAAe;AACf,+EAA+E;AAC/E,4FAA4F;AAC5F,kFAAkF;AAClF,yCAAyC;AAEzC,OAAO,EACN,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,eAAe,GACf,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAA0B,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAG/E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAA+B,IAAI,EAAqB,SAAS,EAAE,MAAM,cAAc,CAAA;AAC9F,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAEnF;;;;;;;GAOG;AACH,KAAK,UAAU,OAAO,CAAC,KAAY,EAAE,GAAiB;IACrD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,WAAW,CAAC,gBAAqC,EAAE,GAAG,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;AACnC,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,OAAO,CAAA;IAE3C,4CAA4C;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAA;IAC3C,CAAC;IACD,6BAA6B;IAC7B,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;AACvB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1C,CAAC;QACD,2BAA2B;QAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,qDAAqD;QACrD,OAAO,CAAC,CAAC,CAAC,CAAA;IACX,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC9B,MAAyB;IAEzB,OAAO,CAAC,CAAC,MAAM,YAAY,cAAc,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,CAAA;AAC9E,CAAC;AAED,SAAS,sBAAsB,CAC9B,MAA2B,EAC3B,QAAiC,EAAE;IAEnC,OAAO,IAAI,CACV;QACC,KAAK,EAAE,8BAA8B;QACrC,OAAO,EAAE,KAAK;QACd,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,KAAK;KACR,EACD,GAAG,CACH,CAAA;AACF,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC/C,IAAI,sBAAsB,CAAC,MAAM,CAAC;QAAE,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAEzE,MAAM,OAAO,GAAG;QACf,cAAc,EAAE,mBAAmB;QACnC,eAAe,EAAE,UAAU;QAC3B,wBAAwB,EAAE,SAAS;KACnC,CAAA;IAED,IAAI,MAAM,YAAY,cAAc,EAAE,CAAC;QACtC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,kDAAkD;IAClD,MAAM,IAAI,GAAG,SAAS,MAAM,CAAC,IAAI,MAAM,CAAA;IACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;AACpD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC7B,GAAiB,EACjB,EAAU;IAEV,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAEtB,oFAAoF;IACpF,kDAAkD;IAClD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;SACtB,OAAO,CAAC,wEAAwE,CAAC;SACjF,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,EAAoC,CAAA;IAE3C,MAAM,YAAY,GAAG,GAAG,EAAE,aAAa,IAAI,EAAE,CAAA;IAC7C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAsB;IACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAEtC,KAAK,UAAU,mBAAmB,CAAC,GAAiB;QACnD,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAE/B,sCAAsC;QACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAA;QAC9C,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAA;QAEvB,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAErD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAA;QAE/B,6CAA6C;QAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAE7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,GAAiB;QAChD,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAE/B,sCAAsC;QACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAA;QAC9C,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAA;QAEvB,wBAAwB;QACxB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAErD,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,CAAA;QAErC,6CAA6C;QAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;QACzE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAE7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,GAAiB;QACpD,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAE/B,sCAAsC;QACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAA;QAC9C,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAA;QAEvB,iBAAiB;QACjB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAEnD,gFAAgF;QAChF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,qDAAqD,EAAE,EAAE,GAAG,CAAC,CAAA;QACnF,CAAC;QAED,yBAAyB;QACzB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;aAC1B,OAAO,CAAC,wEAAwE,CAAC;aACjF,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAoC,CAAA;QAC3C,MAAM,YAAY,GAAG,OAAO,EAAE,aAAa,IAAI,EAAE,CAAA;QAEjD,wCAAwC;QACxC,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,sBAAsB,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;QAED,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QAChD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QAE1C,8CAA8C;QAC9C,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7D,MAAM,WAAW,GAAG,YAAY,CAAC;YAChC,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,SAAS;SAChB,CAAC,CAAA;QAEF,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;YACzC,MAAM,GAAG,CAAC,EAAE;iBACV,OAAO,CACP;;;;0BAIqB,CACrB;iBACA,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,CAAC;iBACxD,GAAG,EAAE,CAAA;QACR,CAAC;QAED,OAAO,IAAI,CAAC;YACX,SAAS,EAAE,WAAW,CAAC,KAAK;YAC5B,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAChD,CAAC,CAAA;IACH,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,GAAiB;QACpD,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAE/B,sCAAsC;QACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAA;QAC9C,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAA;QAEvB,iBAAiB;QACjB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAEnD,4EAA4E;QAC5E,IAAI,YAAY,GAAG,EAAE,CAAA;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE;iBAC1B,OAAO,CAAC,wEAAwE,CAAC;iBACjF,IAAI,CAAC,EAAE,CAAC;iBACR,KAAK,EAAoC,CAAA;YAC3C,YAAY,GAAG,OAAO,EAAE,aAAa,IAAI,EAAE,CAAA;QAC5C,CAAC;QAED,wCAAwC;QACxC,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;QAC/E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9E,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,sBAAsB,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,CAAC;QAED,2DAA2D;QAC3D,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QAEnD,0DAA0D;QAC1D,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAE3C,8CAA8C;QAC9C,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7D,MAAM,WAAW,GAAG,YAAY,CAAC;YAChC,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE,WAAW;SAClB,CAAC,CAAA;QAEF,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,EAAE;iBACV,OAAO,CAAC,iFAAiF,CAAC;iBAC1F,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;iBACrB,GAAG,EAAE,CAAA;QACR,CAAC;QAED,OAAO,IAAI,CAAC;YACX,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAChD,CAAC,CAAA;IACH,CAAC;IAED,KAAK,UAAU,eAAe,CAAC,GAAiB;QAC/C,6EAA6E;QAC7E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;QAE/B,6CAA6C;QAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,EAAE,GAAG,CAAC,CAAA;QACpE,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/D,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,OAAO,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,KAAK,CAAA;QAC9C,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAA;QAEvB,yBAAyB;QACzB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;QAEnD,4CAA4C;QAC5C,4EAA4E;QAC5E,2CAA2C;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,iBAAiB;YACvC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,iBAAiB;YAC5F,CAAC,CAAC,iBAAiB,CAAA;QAEpB,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAEjD,iDAAiD;QACjD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAEjE,yBAAyB;QACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE;YACxC,YAAY,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE;SAC1C,CAAC,CAAA;QAEF,6BAA6B;QAC7B,MAAM,SAAS,GAAG,YAAY,CAAC;YAC9B,SAAS,EAAE,QAAQ,CAAC,cAAc;YAClC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,QAAQ,CAAC,iBAAiB;SACxC,CAAC,CAAA;QACF,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE;YAC9B,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,QAAQ,CAAC,WAAW;YAC5B,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,aAAa;YACzB,gBAAgB,EAAE,cAAc;YAChC,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,QAAQ;YACnB,SAAS;YACT,GAAG,EAAE,SAAS;YACd,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,QAAQ,CAAC,cAAc;SAClC,CAAC,CAAA;QAEF,iEAAiE;QACjE,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7D,MAAM,WAAW,GAAG,YAAY,CAAC;YAChC,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,gBAAgB;YACvB,KAAK,EAAE,QAAQ;SACf,CAAC,CAAA;QAEF,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,EAAE;iBACV,OAAO,CACP,oFAAoF,CACpF;iBACA,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;iBAClB,GAAG,EAAE,CAAA;QACR,CAAC;QAED,OAAO,IAAI,CAAC;YACX,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE,SAAS;YACd,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAChD,CAAC,CAAA;IACH,CAAC;IAED,OAAO;QACN,mBAAmB;QACnB,gBAAgB;QAChB,oBAAoB;QACpB,oBAAoB;QACpB,eAAe;KACf,CAAA;AACF,CAAC"}

package/dist/routes/analytics.d.ts

@@ -0,0 +1,15 @@
+import type { CmsProviders } from '../providers/types.js';
+import type { Authz, RouteContext } from './context.js';
+export interface AnalyticsRouteConfig {
+    authz: Authz;
+    providers?: Partial<CmsProviders>;
+}
+export interface AnalyticsRouteHandlers {
+    kpis(ctx: RouteContext): Promise<Response>;
+    readsTimeSeries(ctx: RouteContext): Promise<Response>;
+    topContent(ctx: RouteContext): Promise<Response>;
+    trafficSources(ctx: RouteContext): Promise<Response>;
+    articleDetail(ctx: RouteContext): Promise<Response>;
+}
+export declare function createAnalyticsRoutes(config: AnalyticsRouteConfig): AnalyticsRouteHandlers;
+//# sourceMappingURL=analytics.d.ts.map

package/dist/routes/analytics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/routes/analytics.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,uBAAuB,CAAA;AACpE,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAGvD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,KAAK,CAAA;IACZ,SAAS,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACtC,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,eAAe,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrD,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAChD,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpD,aAAa,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CACnD;AAaD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,GAAG,sBAAsB,CAyC1F"}

package/dist/routes/analytics.js

@@ -0,0 +1,61 @@
+// src/routes/analytics.ts — Analytics route factory (P5 Task 5).
+// All four handlers are AnalyticsProvider passthrough: KPIs, reads-over-time,
+// top content, and traffic sources. Each handler accepts a ?range= param
+// (7d / 30d / 90d, defaulting to 30d) and returns the ProviderResult
+// {status, data} envelope unchanged — the screen branches on status.
+// No D1 analytics query anywhere; reads/sessions/etc are the provider's domain.
+import { nullProviders } from '../providers/null.js';
+import { json } from './context.js';
+/** Parse ?range=<Nd> from the request URL, defaulting to 30d. */
+function parseRange(url) {
+    const u = new URL(url);
+    const raw = u.searchParams.get('range') ?? '30d';
+    const match = /^(\d+)d$/.exec(raw);
+    const days = match ? Number(match[1]) : 30;
+    const to = Math.floor(Date.now() / 1000);
+    const from = to - days * 24 * 60 * 60;
+    return { from, to };
+}
+export function createAnalyticsRoutes(config) {
+    const providers = { ...nullProviders, ...(config.providers ?? {}) };
+    return {
+        async kpis(ctx) {
+            const denied = await config.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const range = parseRange(ctx.request.url);
+            return json(await providers.analytics.getKpis(range));
+        },
+        async readsTimeSeries(ctx) {
+            const denied = await config.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const range = parseRange(ctx.request.url);
+            return json(await providers.analytics.getReadsTimeSeries(range));
+        },
+        async topContent(ctx) {
+            const denied = await config.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const range = parseRange(ctx.request.url);
+            return json(await providers.analytics.getTopContent(range));
+        },
+        async trafficSources(ctx) {
+            const denied = await config.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const range = parseRange(ctx.request.url);
+            return json(await providers.analytics.getTrafficSources(range));
+        },
+        async articleDetail(ctx) {
+            const denied = await config.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const url = new URL(ctx.request.url);
+            const range = parseRange(ctx.request.url);
+            const slug = url.searchParams.get('slug') ?? '';
+            return json(await providers.analytics.getArticleDetail(slug, range));
+        },
+    };
+}
+//# sourceMappingURL=analytics.js.map

package/dist/routes/analytics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/routes/analytics.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,8EAA8E;AAC9E,yEAAyE;AACzE,qEAAqE;AACrE,qEAAqE;AACrE,gFAAgF;AAEhF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAGpD,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAenC,iEAAiE;AACjE,SAAS,UAAU,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAA;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IACrC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA4B;IACjE,MAAM,SAAS,GAAiB,EAAE,GAAG,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAA;IAEjF,OAAO;QACN,KAAK,CAAC,IAAI,CAAC,GAAiB;YAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YACzB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QACtD,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,GAAiB;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YACzB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAA;QACjE,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,GAAiB;YACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YACzB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;QAC5D,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,GAAiB;YACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YACzB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACzC,OAAO,IAAI,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAA;QAChE,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,GAAiB;YACpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YACzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACzC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;YAC/C,OAAO,IAAI,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QACrE,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/routes/api-keys.d.ts

@@ -0,0 +1,13 @@
+import type { Authz, RouteContext } from './context.js';
+export { verifyCmsApiKey } from '../engine/api-keys.js';
+export interface ApiKeyRouteConfig {
+    authz: Authz;
+    workspaceId: string;
+}
+export interface ApiKeyRouteHandlers {
+    create(ctx: RouteContext): Promise<Response>;
+    list(ctx: RouteContext): Promise<Response>;
+    revoke(ctx: RouteContext): Promise<Response>;
+}
+export declare function createApiKeyRoutes(config: ApiKeyRouteConfig): ApiKeyRouteHandlers;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/routes/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/routes/api-keys.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,KAAK,EAAc,YAAY,EAAE,MAAM,cAAc,CAAA;AAGnE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,KAAK,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IACnC,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC5C;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,mBAAmB,CAsGjF"}

package/dist/routes/api-keys.js

@@ -0,0 +1,109 @@
+// api-keys.ts — API key route factories (P7 Task 7).
+//
+// Routes:
+//   POST   /settings/api-keys          create (returns raw key ONCE)
+//   GET    /settings/api-keys          list (masked, no hash/raw)
+//   DELETE /settings/api-keys/:id      revoke
+//
+// All routes gated on requireRole('manage_api_keys') — owner + senior_editor only.
+// The create route returns the rawKey ONCE in the response body with an explicit
+// one-time-reveal envelope; it is never retrievable again.
+//
+// Re-exports verifyCmsApiKey for the content-API gateway (consumed by Fronts at cutover).
+import { createApiKey, listApiKeys, revokeApiKey } from '../engine/api-keys.js';
+import { json } from './context.js';
+export { verifyCmsApiKey } from '../engine/api-keys.js';
+export function createApiKeyRoutes(config) {
+    function requireWorkspace() {
+        if (!config.workspaceId) {
+            return json({ error: 'Configuration error: workspaceId is required for API key routes.' }, 500);
+        }
+        return null;
+    }
+    async function gate(ctx) {
+        if (config.authz.requireRole) {
+            return config.authz.requireRole('manage_api_keys', ctx);
+        }
+        return null;
+    }
+    return {
+        // -----------------------------------------------------------------------
+        // POST /settings/api-keys
+        // Creates an API key. Returns the rawKey ONCE — it is never retrievable again.
+        // -----------------------------------------------------------------------
+        async create(ctx) {
+            const wsErr = requireWorkspace();
+            if (wsErr)
+                return wsErr;
+            const denied = await gate(ctx);
+            if (denied)
+                return denied;
+            let body;
+            try {
+                body = await ctx.request.json();
+            }
+            catch {
+                return json({ error: 'Invalid JSON' }, 400);
+            }
+            const b = body;
+            const name = b?.name;
+            if (!name || typeof name !== 'string' || !name.trim()) {
+                return json({ error: 'name is required' }, 400);
+            }
+            const rawScopes = b?.scopes ?? [];
+            if (!Array.isArray(rawScopes) || rawScopes.some((s) => typeof s !== 'string')) {
+                return json({ error: 'scopes must be an array of strings' }, 400);
+            }
+            const scopes = rawScopes;
+            const result = await createApiKey(ctx.db, {
+                workspaceId: config.workspaceId,
+                name: name.trim(),
+                scopes,
+            });
+            // Return the rawKey ONCE with an explicit one-time-reveal envelope.
+            // The client MUST copy the key — it cannot be retrieved again.
+            return json({
+                id: result.id,
+                name: name.trim(),
+                rawKey: result.rawKey,
+                masked: result.masked,
+                oneTimeReveal: true,
+                notice: 'Copy this key now — it will not be shown again.',
+            }, 201);
+        },
+        // -----------------------------------------------------------------------
+        // GET /settings/api-keys
+        // Returns masked API key list — no hash, no raw key.
+        // -----------------------------------------------------------------------
+        async list(ctx) {
+            const wsErr = requireWorkspace();
+            if (wsErr)
+                return wsErr;
+            const denied = await gate(ctx);
+            if (denied)
+                return denied;
+            const keys = await listApiKeys(ctx.db, config.workspaceId);
+            return json({ apiKeys: keys });
+        },
+        // -----------------------------------------------------------------------
+        // DELETE /settings/api-keys/:id
+        // Revokes (deletes) an API key.
+        // -----------------------------------------------------------------------
+        async revoke(ctx) {
+            const wsErr = requireWorkspace();
+            if (wsErr)
+                return wsErr;
+            const denied = await gate(ctx);
+            if (denied)
+                return denied;
+            const id = ctx.params.id;
+            if (!id)
+                return json({ error: 'Missing id' }, 400);
+            // Scope the revoke to the authenticated caller's workspace (resolved
+            // from config, never the client) — closes a cross-workspace IDOR.
+            await revokeApiKey(ctx.db, id, config.workspaceId);
+            return json({ ok: true, id });
+        },
+    };
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/routes/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/routes/api-keys.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,UAAU;AACV,qEAAqE;AACrE,kEAAkE;AAClE,8CAA8C;AAC9C,EAAE;AACF,mFAAmF;AACnF,iFAAiF;AACjF,2DAA2D;AAC3D,EAAE;AACF,0FAA0F;AAE1F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAE/E,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAEnC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAavD,MAAM,UAAU,kBAAkB,CAAC,MAAyB;IAC3D,SAAS,gBAAgB;QACxB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACzB,OAAO,IAAI,CACV,EAAE,KAAK,EAAE,kEAAkE,EAAE,EAC7E,GAAG,CACH,CAAA;QACF,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,GAAiB;QACpC,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,iBAAsC,EAAE,GAAG,CAAC,CAAA;QAC7E,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,OAAO;QACN,0EAA0E;QAC1E,0BAA0B;QAC1B,+EAA+E;QAC/E,0EAA0E;QAC1E,KAAK,CAAC,MAAM,CAAC,GAAiB;YAC7B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAA;YAChC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAA;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,IAAI,IAAa,CAAA;YACjB,IAAI,CAAC;gBACJ,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YAChC,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;YAC5C,CAAC;YAED,MAAM,CAAC,GAAG,IAA+B,CAAA;YACzC,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,CAAA;YACpB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAA;YAChD,CAAC;YAED,MAAM,SAAS,GAAY,CAAC,EAAE,MAAM,IAAI,EAAE,CAAA;YAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,EAAE,GAAG,CAAC,CAAA;YAClE,CAAC;YACD,MAAM,MAAM,GAAG,SAAqB,CAAA;YAEpC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE;gBACzC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,MAAM;aACN,CAAC,CAAA;YAEF,oEAAoE;YACpE,+DAA+D;YAC/D,OAAO,IAAI,CACV;gBACC,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;gBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa,EAAE,IAAI;gBACnB,MAAM,EAAE,iDAAiD;aACzD,EACD,GAAG,CACH,CAAA;QACF,CAAC;QAED,0EAA0E;QAC1E,yBAAyB;QACzB,qDAAqD;QACrD,0EAA0E;QAC1E,KAAK,CAAC,IAAI,CAAC,GAAiB;YAC3B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAA;YAChC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAA;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;YAC1D,OAAO,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/B,CAAC;QAED,0EAA0E;QAC1E,gCAAgC;QAChC,gCAAgC;QAChC,0EAA0E;QAC1E,KAAK,CAAC,MAAM,CAAC,GAAiB;YAC7B,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAA;YAChC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAA;YACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAA;YACxB,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,CAAA;YAElD,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;YAClD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9B,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/routes/authors.d.ts

@@ -0,0 +1,19 @@
+import type { D1Database } from '../engine/d1.js';
+import type { CmsRouteConfig } from './config.js';
+import { type RouteContext } from './context.js';
+export declare function parseSocialJson(value: string | null | undefined): Record<string, string>;
+export declare function normalizeSocialInput(input: Record<string, string> | null | undefined): Record<string, string> | null;
+export declare function serializeSocialInput(input: Record<string, string> | null | undefined): string | null;
+export declare function ensureUniqueAuthorSlug(db: D1Database, slug: string, excludeId?: string): Promise<string>;
+export interface AuthorRouteHandlers {
+    /** GET /authors — list. */
+    list(ctx: RouteContext): Promise<Response>;
+    /** POST /authors — create. */
+    create(ctx: RouteContext): Promise<Response>;
+    /** GET /authors/:id — read one. */
+    get(ctx: RouteContext): Promise<Response>;
+    /** PATCH /authors/:id — update. */
+    update(ctx: RouteContext): Promise<Response>;
+}
+export declare function createAuthorRoutes(config: CmsRouteConfig): AuthorRouteHandlers;
+//# sourceMappingURL=authors.d.ts.map

package/dist/routes/authors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authors.d.ts","sourceRoot":"","sources":["../../src/routes/authors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,OAAO,EAAQ,KAAK,YAAY,EAAa,MAAM,cAAc,CAAA;AAIjE,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxF;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAC9C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAS/B;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAC9C,MAAM,GAAG,IAAI,CAGf;AAED,wBAAsB,sBAAsB,CAC3C,EAAE,EAAE,UAAU,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAkBjB;AAkED,MAAM,WAAW,mBAAmB;IACnC,2BAA2B;IAC3B,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,8BAA8B;IAC9B,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5C,mCAAmC;IACnC,GAAG,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACzC,mCAAmC;IACnC,MAAM,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC5C;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,mBAAmB,CAsI9E"}