@growth-labs/cms 0.1.0

package/dist/routes/authors.js

@@ -0,0 +1,202 @@
+// Authors CRUD route handlers (WS7-07). Ported from fulcrum-labs/fronts
+// src/pages/api/v1/publisher/authors/index.ts + [id].ts and the
+// publisher-authors.ts helpers (inventory §3: extract — authors are core CMS).
+// Auth/authz is injected via config.authz.requirePublisher; nothing here binds
+// Fronts' context.locals.user.
+import { z } from 'zod';
+import { slugify } from '../engine/slug.js';
+import { resolveConfig } from './config.js';
+import { json, requireId } from './context.js';
+// --- publisher-authors.ts helpers (extract) -------------------------------
+export function parseSocialJson(value) {
+    if (!value)
+        return {};
+    try {
+        const parsed = JSON.parse(value);
+        if (parsed && typeof parsed === 'object') {
+            return parsed;
+        }
+    }
+    catch {
+        // ignore malformed JSON
+    }
+    return {};
+}
+export function normalizeSocialInput(input) {
+    if (!input)
+        return null;
+    const output = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (typeof value !== 'string')
+            continue;
+        const trimmed = value.trim();
+        if (trimmed)
+            output[key] = trimmed;
+    }
+    return Object.keys(output).length > 0 ? output : null;
+}
+export function serializeSocialInput(input) {
+    const normalized = normalizeSocialInput(input);
+    return normalized ? JSON.stringify(normalized) : null;
+}
+export async function ensureUniqueAuthorSlug(db, slug, excludeId) {
+    const base = slugify(slug);
+    if (!base)
+        return '';
+    let candidate = base;
+    let suffix = 2;
+    while (true) {
+        const row = await db
+            .prepare('SELECT id FROM authors WHERE slug = ? LIMIT 1')
+            .bind(candidate)
+            .first();
+        if (!row || (excludeId && row.id === excludeId)) {
+            return candidate;
+        }
+        candidate = `${base}-${suffix}`;
+        suffix += 1;
+    }
+}
+// --- schemas --------------------------------------------------------------
+const SocialSchema = z
+    .object({
+    twitter: z.string().optional(),
+    linkedin: z.string().optional(),
+    github: z.string().optional(),
+    website: z.string().optional(),
+})
+    .optional();
+const CreateSchema = z.object({
+    id: z.string().min(1).optional(),
+    name: z.string().min(1),
+    slug: z.string().min(1).optional(),
+    bio: z.string().optional().nullable(),
+    avatar: z.string().optional().nullable(),
+    email: z.string().optional().nullable(),
+    social: SocialSchema.nullish(),
+});
+const UpdateSchema = z.object({
+    name: z.string().min(1).optional(),
+    slug: z.string().min(1).optional(),
+    bio: z.string().optional().nullable(),
+    avatar: z.string().optional().nullable(),
+    email: z.string().optional().nullable(),
+    social: SocialSchema.nullish(),
+});
+function normalizeNullable(value) {
+    if (value === undefined)
+        return null;
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : null;
+}
+function serializeAuthor(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        slug: row.slug,
+        bio: row.bio,
+        avatar: row.avatar,
+        email: row.email,
+        social: parseSocialJson(row.social),
+        updatedAt: row.updated_at ? new Date(row.updated_at * 1000).toISOString() : null,
+    };
+}
+async function readJson(ctx) {
+    return ctx.request.json().catch(() => null);
+}
+export function createAuthorRoutes(config) {
+    const resolved = resolveConfig(config);
+    return {
+        async list(ctx) {
+            const denied = await resolved.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const result = await ctx.db
+                .prepare('SELECT id, name, slug, bio, avatar, email, social, updated_at FROM authors ORDER BY name')
+                .all();
+            const items = (result.results || []).map(serializeAuthor);
+            return json({ items });
+        },
+        async create(ctx) {
+            const denied = await resolved.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const parsed = CreateSchema.safeParse(await readJson(ctx));
+            if (!parsed.success) {
+                return json({ error: 'Invalid request', details: parsed.error.flatten() }, 400);
+            }
+            const slugInput = parsed.data.slug || parsed.data.name;
+            const slug = await ensureUniqueAuthorSlug(ctx.db, slugInput);
+            if (!slug)
+                return json({ error: 'Slug is required' }, 400);
+            const id = parsed.data.id?.trim() || slug;
+            const existingId = await ctx.db
+                .prepare('SELECT id FROM authors WHERE id = ? LIMIT 1')
+                .bind(id)
+                .first();
+            if (existingId)
+                return json({ error: 'Author id already exists' }, 409);
+            const social = serializeSocialInput(parsed.data.social ?? null);
+            await ctx.db
+                .prepare(`INSERT INTO authors (id, name, slug, bio, avatar, email, social, created_at, updated_at)
+					 VALUES (?, ?, ?, ?, ?, ?, ?, unixepoch(), unixepoch())`)
+                .bind(id, parsed.data.name.trim(), slug, normalizeNullable(parsed.data.bio), normalizeNullable(parsed.data.avatar), normalizeNullable(parsed.data.email), social)
+                .run();
+            return json({ id, slug }, 201);
+        },
+        async get(ctx) {
+            const denied = await resolved.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const idResult = requireId(ctx);
+            if ('error' in idResult)
+                return idResult.error;
+            const row = await ctx.db
+                .prepare('SELECT id, name, slug, bio, avatar, email, social, updated_at FROM authors WHERE id = ? LIMIT 1')
+                .bind(idResult.id)
+                .first();
+            if (!row)
+                return json({ error: 'Not found' }, 404);
+            return json({ item: serializeAuthor(row) });
+        },
+        async update(ctx) {
+            const denied = await resolved.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const idResult = requireId(ctx);
+            if ('error' in idResult)
+                return idResult.error;
+            const id = idResult.id;
+            const parsed = UpdateSchema.safeParse(await readJson(ctx));
+            if (!parsed.success) {
+                return json({ error: 'Invalid request', details: parsed.error.flatten() }, 400);
+            }
+            const existing = await ctx.db
+                .prepare('SELECT id, name, slug, bio, avatar, email, social FROM authors WHERE id = ? LIMIT 1')
+                .bind(id)
+                .first();
+            if (!existing)
+                return json({ error: 'Not found' }, 404);
+            const nextName = parsed.data.name ? parsed.data.name.trim() : existing.name;
+            const nextSlug = parsed.data.slug
+                ? await ensureUniqueAuthorSlug(ctx.db, parsed.data.slug, id)
+                : existing.slug;
+            if (parsed.data.slug && !nextSlug)
+                return json({ error: 'Slug is required' }, 400);
+            const nextBio = parsed.data.bio !== undefined ? normalizeNullable(parsed.data.bio) : existing.bio;
+            const nextAvatar = parsed.data.avatar !== undefined ? normalizeNullable(parsed.data.avatar) : existing.avatar;
+            const nextEmail = parsed.data.email !== undefined ? normalizeNullable(parsed.data.email) : existing.email;
+            const nextSocial = parsed.data.social !== undefined
+                ? serializeSocialInput(parsed.data.social ?? null)
+                : existing.social;
+            await ctx.db
+                .prepare(`UPDATE authors
+					 SET name = ?, slug = ?, bio = ?, avatar = ?, email = ?, social = ?, updated_at = unixepoch()
+					 WHERE id = ?`)
+                .bind(nextName, nextSlug, nextBio, nextAvatar, nextEmail, nextSocial, id)
+                .run();
+            return json({ id, slug: nextSlug });
+        },
+    };
+}
+//# sourceMappingURL=authors.js.map

package/dist/routes/authors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authors.js","sourceRoot":"","sources":["../../src/routes/authors.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,gEAAgE;AAChE,+EAA+E;AAC/E,+EAA+E;AAC/E,+BAA+B;AAE/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAqB,SAAS,EAAE,MAAM,cAAc,CAAA;AAEjE,6EAA6E;AAE7E,MAAM,UAAU,eAAe,CAAC,KAAgC;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,MAAgC,CAAA;QACxC,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,wBAAwB;IACzB,CAAC;IACD,OAAO,EAAE,CAAA;AACV,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,KAAgD;IAEhD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAQ;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;IACnC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,oBAAoB,CACnC,KAAgD;IAEhD,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAC9C,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,EAAc,EACd,IAAY,EACZ,SAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,IAAI,MAAM,GAAG,CAAC,CAAA;IAEd,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,MAAM,EAAE;aAClB,OAAO,CAAC,+CAA+C,CAAC;aACxD,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,EAAkB,CAAA;QAEzB,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;YACjD,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,SAAS,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,CAAA;QAC/B,MAAM,IAAI,CAAC,CAAA;IACZ,CAAC;AACF,CAAC;AAED,6EAA6E;AAE7E,MAAM,YAAY,GAAG,CAAC;KACpB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,QAAQ,EAAE,CAAA;AAEZ,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAA;AAEF,SAAS,iBAAiB,CAAC,KAAgC;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAChC,CAAC;AAaD,SAAS,eAAe,CAAC,GAAc;IACtC,OAAO;QACN,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QACnC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;KAChF,CAAA;AACF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAiB;IACxC,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AAC5C,CAAC;AAaD,MAAM,UAAU,kBAAkB,CAAC,MAAsB;IACxD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAEtC,OAAO;QACN,KAAK,CAAC,IAAI,CAAC,GAAG;YACb,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACzD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;iBACzB,OAAO,CACP,0FAA0F,CAC1F;iBACA,GAAG,EAAa,CAAA;YAElB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YACzD,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACvB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACf,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACzD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YAChF,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;YACtD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;YAC5D,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAA;YAE1D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;YACzC,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE;iBAC7B,OAAO,CAAC,6CAA6C,CAAC;iBACtD,IAAI,CAAC,EAAE,CAAC;iBACR,KAAK,EAAkB,CAAA;YACzB,IAAI,UAAU;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,GAAG,CAAC,CAAA;YAEvE,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;YAC/D,MAAM,GAAG,CAAC,EAAE;iBACV,OAAO,CACP;6DACwD,CACxD;iBACA,IAAI,CACJ,EAAE,EACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EACvB,IAAI,EACJ,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAClC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EACpC,MAAM,CACN;iBACA,GAAG,EAAE,CAAA;YAEP,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/B,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,GAAG;YACZ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACzD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,OAAO,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAA;YAE9C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE;iBACtB,OAAO,CACP,iGAAiG,CACjG;iBACA,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;iBACjB,KAAK,EAAa,CAAA;YAEpB,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;YAClD,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC5C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACf,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACzD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAC/B,IAAI,OAAO,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAA;YAC9C,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAA;YAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YAChF,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE;iBAC3B,OAAO,CACP,qFAAqF,CACrF;iBACA,IAAI,CAAC,EAAE,CAAC;iBACR,KAAK,EAQF,CAAA;YACL,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;YAEvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;YAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI;gBAChC,CAAC,CAAC,MAAM,sBAAsB,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC5D,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAA;YAChB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAA;YAElF,MAAM,OAAO,GACZ,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAA;YAClF,MAAM,UAAU,GACf,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAA;YAC3F,MAAM,SAAS,GACd,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;YACxF,MAAM,UAAU,GACf,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;gBAC/B,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;gBAClD,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAA;YAEnB,MAAM,GAAG,CAAC,EAAE;iBACV,OAAO,CACP;;mBAEc,CACd;iBACA,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC;iBACxE,GAAG,EAAE,CAAA;YAEP,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACpC,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/routes/authz-matrix.d.ts

@@ -0,0 +1,78 @@
+import type { MembershipRecord } from '../engine/members.js';
+import type { CmsRole } from '../schema/types.js';
+import type { Capability, CmsUser, RouteContext } from './context.js';
+export type { Capability };
+export declare const CAPABILITY_MATRIX: Record<Capability, ReadonlySet<CmsRole>>;
+/** Returns true when `role` is authorised to perform `cap` per the matrix. */
+export declare function roleCan(role: CmsRole, cap: Capability): boolean;
+export interface ContentOwnershipContext {
+    /** Subject of the acting user (e.g. 'user:abc'). */
+    actorSubject: string;
+    /** Subject/userId stored as the content's author. */
+    contentAuthorId: string | null;
+}
+/**
+ * Returns true when `role` may perform `cap` on a specific content item,
+ * taking the contributor/producer ownership gate into account.
+ *
+ * For non-ownership capabilities (manage_team, manage_settings, etc.) the
+ * ownership context is irrelevant — falls through to roleCan.
+ *
+ * For ownership-sensitive capabilities (edit_own_draft, publish_article, etc.):
+ *   - contributor: may only act on own content (actorSubject === contentAuthorId)
+ *   - producer:    may publish_video on any content (pipeline role); all other
+ *                  caps follow the standard ownership rule within their matrix set
+ *   - owner/senior_editor/editor: no ownership restriction
+ */
+export declare function canActOnContent(role: CmsRole, ownership: ContentOwnershipContext, cap: Capability): boolean;
+/**
+ * The mutating content surface, expressed as a small vocabulary of actions the
+ * route adapters perform. Each maps to a matrix capability so the live content
+ * routes enforce role differentially (P7 — capability matrix wired into the
+ * adapters).
+ *
+ *   - 'write'    — create / update / save a draft, set-status, snapshot,
+ *                  contributors edit. Lowest bar: edit_own_draft (any member;
+ *                  contributor/producer gated to OWN content by canActOnContent).
+ *   - 'publish'  — publish/unpublish/archive/unschedule an article. Requires
+ *                  publish_others_draft (owner/senior_editor/editor); on OWN
+ *                  content publish_article suffices (still excludes contributor).
+ *   - 'publish_video' — publish a video/podcast item (producer included).
+ *   - 'schedule' — schedule/bulk-schedule. Same bar as publish.
+ *   - 'trash'    — soft-delete / bulk-trash. Destructive → publish_others_draft.
+ *   - 'media'    — dispatch-to-foundry / regenerate AI artefacts. media_pipeline.
+ */
+export type ContentAction = 'write' | 'publish' | 'publish_video' | 'schedule' | 'trash' | 'media';
+/**
+ * Resolve whether `role` may perform a content `action` on an item authored by
+ * `contentAuthorId` (null = no recorded author). Honors the contributor/producer
+ * ownership gate via canActOnContent. owner/senior_editor/editor are never
+ * ownership-restricted (the launch roster keeps full editorial).
+ *
+ * For 'write' the bar is edit_own_draft; for 'publish'/'schedule'/'trash' the bar
+ * is publish_others_draft when acting on someone else's content, falling back to
+ * publish_article on own content (so a contributor — who lacks both — is blocked,
+ * while editors+ pass either way).
+ */
+export declare function canPerformContentAction(role: CmsRole, ownership: ContentOwnershipContext, action: ContentAction): boolean;
+export interface MatrixAuthzConfig {
+    /** Load a membership by (workspaceId, userId). Injected so engine stays pure. */
+    loadMembership(workspaceId: string, userId: string): Promise<MembershipRecord | null>;
+    /** The workspace this authz resolves against. */
+    workspaceId: string;
+    /** Resolve the current actor's subject from the request context. Returns null when unauthenticated. */
+    getSubject(ctx: RouteContext): Promise<string | null> | string | null;
+}
+/**
+ * Build an Authz-compatible { getUser, requireRole } pair that resolves the
+ * actor's role from workspace_memberships via the subject.
+ *
+ * Returned:
+ *   getUser(ctx)           → CmsUser | null  (null = no membership / unauthenticated)
+ *   requireRole(cap, ctx)  → null (allowed) | Response (401/403)
+ */
+export declare function buildMatrixAuthz(config: MatrixAuthzConfig): {
+    getUser(ctx: RouteContext): Promise<CmsUser | null>;
+    requireRole(cap: Capability, ctx: RouteContext): Promise<Response | null>;
+};
+//# sourceMappingURL=authz-matrix.d.ts.map

package/dist/routes/authz-matrix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-matrix.d.ts","sourceRoot":"","sources":["../../src/routes/authz-matrix.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAKrE,YAAY,EAAE,UAAU,EAAE,CAAA;AAuB1B,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,CAuBtE,CAAA;AAMD,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAE/D;AAMD,MAAM,WAAW,uBAAuB;IACvC,oDAAoD;IACpD,YAAY,EAAE,MAAM,CAAA;IACpB,qDAAqD;IACrD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC9B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,uBAAuB,EAClC,GAAG,EAAE,UAAU,GACb,OAAO,CAmBT;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,CAAA;AAElG;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,uBAAuB,EAClC,MAAM,EAAE,aAAa,GACnB,OAAO,CAoBT;AAMD,MAAM,WAAW,iBAAiB;IACjC,iFAAiF;IACjF,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;IACrF,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAA;IACnB,uGAAuG;IACvG,UAAU,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAA;CACrE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG;IAC5D,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACnD,WAAW,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAA;CACzE,CAqBA"}

package/dist/routes/authz-matrix.js

@@ -0,0 +1,170 @@
+// authz-matrix.ts — 5-role per-capability permission table + requireRole/
+// contributor-ownership middleware (P7 Task 2). Fills the OPTIONAL Authz.getUser /
+// Authz.requireRole seam from context.ts.
+//
+// Design:
+//   - CAPABILITY_MATRIX: a pure Record<Capability, ReadonlySet<CmsRole>> table.
+//   - roleCan(role, cap): pure predicate — role is in the set for cap.
+//   - canActOnContent(role, {actorSubject, contentAuthorId}, cap): ownership
+//     predicate for contributor/producer (own-content-only gate).
+//   - buildMatrixAuthz({loadMembership, workspaceId, getSubject}): returns an
+//     Authz-compatible { getUser, requireRole } pair that resolves the actor's role
+//     from workspace_memberships via the subject.
+//
+// The 5-role model (spec §12 authoritative source):
+//   owner           — all capabilities including owner-only settings
+//   senior_editor   — publish anything, manage team, NOT owner-only settings
+//   editor          — publish own + others' drafts, media pipeline, NOT manage team/settings
+//   contributor     — own drafts only, submit for review (NO publish)
+//   producer        — media/video pipeline + publish video only
+import { json } from './context.js';
+// ---------------------------------------------------------------------------
+// Capability matrix (spec §12 — authoritative)
+// ---------------------------------------------------------------------------
+// Roles that may perform each capability:
+//   owner:          ALL capabilities
+//   senior_editor:  everything except manage_settings (owner-only); incl. team /
+//                   api-keys / webhooks / subscriber-PII export
+//   editor:         FULL editorial — publish, media, own/others drafts, review —
+//                   but NOT team/settings/api/webhooks/PII-export
+//   contributor:    edit own draft + submit for review only (NO publish/destructive)
+//   producer:       media pipeline + publish video + own draft + submit for review
+//
+// Capability → role grouping (the launch policy):
+//   FULL editorial (owner+senior_editor+editor): publish_article,
+//     publish_others_draft, edit_own_draft (+ media_pipeline; producer too).
+//   senior_editor + owner (NOT editor): manage_team (members/invites),
+//     manage_api_keys, manage_webhooks, export_subscribers (PII).
+//   owner ONLY: manage_settings — workspace settings PATCH + the privileged
+//     LemonSqueezy entitlement sync (importLsEntitlements). Matches the 448e815
+//     gate (requireRole('manage_settings')).
+export const CAPABILITY_MATRIX = {
+    publish_article: new Set(['owner', 'senior_editor', 'editor']),
+    publish_video: new Set(['owner', 'senior_editor', 'editor', 'producer']),
+    edit_own_draft: new Set(['owner', 'senior_editor', 'editor', 'contributor', 'producer']),
+    publish_others_draft: new Set(['owner', 'senior_editor', 'editor']),
+    submit_for_review: new Set([
+        'owner',
+        'senior_editor',
+        'editor',
+        'contributor',
+        'producer',
+    ]),
+    media_pipeline: new Set(['owner', 'senior_editor', 'editor', 'producer']),
+    manage_team: new Set(['owner', 'senior_editor']),
+    // manage_settings is owner-only — spec §12 + scope guard 5 + the 448e815
+    // LS-import gate. Workspace settings PATCH + importLsEntitlements share it.
+    manage_settings: new Set(['owner']),
+    // API keys / webhooks: owner + senior_editor (management-level)
+    manage_api_keys: new Set(['owner', 'senior_editor']),
+    manage_webhooks: new Set(['owner', 'senior_editor']),
+    // Subscriber-PII export: owner + senior_editor only (NOT editor). Editors keep
+    // full editorial but never touch subscriber email lists.
+    export_subscribers: new Set(['owner', 'senior_editor']),
+};
+// ---------------------------------------------------------------------------
+// roleCan — pure predicate
+// ---------------------------------------------------------------------------
+/** Returns true when `role` is authorised to perform `cap` per the matrix. */
+export function roleCan(role, cap) {
+    return CAPABILITY_MATRIX[cap].has(role);
+}
+/**
+ * Returns true when `role` may perform `cap` on a specific content item,
+ * taking the contributor/producer ownership gate into account.
+ *
+ * For non-ownership capabilities (manage_team, manage_settings, etc.) the
+ * ownership context is irrelevant — falls through to roleCan.
+ *
+ * For ownership-sensitive capabilities (edit_own_draft, publish_article, etc.):
+ *   - contributor: may only act on own content (actorSubject === contentAuthorId)
+ *   - producer:    may publish_video on any content (pipeline role); all other
+ *                  caps follow the standard ownership rule within their matrix set
+ *   - owner/senior_editor/editor: no ownership restriction
+ */
+export function canActOnContent(role, ownership, cap) {
+    // If the role can't do this at all, short-circuit
+    if (!roleCan(role, cap))
+        return false;
+    const isOwn = ownership.actorSubject === ownership.contentAuthorId;
+    switch (role) {
+        case 'contributor':
+            // contributor may only act on their own content for any cap they hold
+            return isOwn;
+        case 'producer':
+            // producer may publish_video on ANY content (video pipeline role)
+            // for other caps they hold (edit_own_draft, submit_for_review) enforce own
+            if (cap === 'publish_video')
+                return true;
+            return isOwn;
+        default:
+            // owner / senior_editor / editor: no ownership restriction
+            return true;
+    }
+}
+/**
+ * Resolve whether `role` may perform a content `action` on an item authored by
+ * `contentAuthorId` (null = no recorded author). Honors the contributor/producer
+ * ownership gate via canActOnContent. owner/senior_editor/editor are never
+ * ownership-restricted (the launch roster keeps full editorial).
+ *
+ * For 'write' the bar is edit_own_draft; for 'publish'/'schedule'/'trash' the bar
+ * is publish_others_draft when acting on someone else's content, falling back to
+ * publish_article on own content (so a contributor — who lacks both — is blocked,
+ * while editors+ pass either way).
+ */
+export function canPerformContentAction(role, ownership, action) {
+    const isOwn = ownership.actorSubject === ownership.contentAuthorId;
+    switch (action) {
+        case 'write':
+            return canActOnContent(role, ownership, 'edit_own_draft');
+        case 'media':
+            return canActOnContent(role, ownership, 'media_pipeline');
+        case 'publish_video':
+            return canActOnContent(role, ownership, 'publish_video');
+        case 'publish':
+        case 'schedule':
+        case 'trash':
+            // On own content publish_article is enough; on others' content the
+            // stricter publish_others_draft is required. Either way contributor
+            // (which holds neither) is blocked, and editor+ pass.
+            if (isOwn && canActOnContent(role, ownership, 'publish_article'))
+                return true;
+            return canActOnContent(role, ownership, 'publish_others_draft');
+        default:
+            return false;
+    }
+}
+/**
+ * Build an Authz-compatible { getUser, requireRole } pair that resolves the
+ * actor's role from workspace_memberships via the subject.
+ *
+ * Returned:
+ *   getUser(ctx)           → CmsUser | null  (null = no membership / unauthenticated)
+ *   requireRole(cap, ctx)  → null (allowed) | Response (401/403)
+ */
+export function buildMatrixAuthz(config) {
+    async function getUser(ctx) {
+        const subject = await config.getSubject(ctx);
+        if (!subject)
+            return null;
+        const membership = await config.loadMembership(config.workspaceId, subject);
+        if (!membership)
+            return null;
+        return { subject, email: null, role: membership.role };
+    }
+    async function requireRole(cap, ctx) {
+        const subject = await config.getSubject(ctx);
+        if (!subject)
+            return json({ error: 'Unauthorized' }, 401);
+        const membership = await config.loadMembership(config.workspaceId, subject);
+        if (!membership)
+            return json({ error: 'Unauthorized' }, 401);
+        if (!roleCan(membership.role, cap)) {
+            return json({ error: 'Forbidden', required: cap, role: membership.role }, 403);
+        }
+        return null;
+    }
+    return { getUser, requireRole };
+}
+//# sourceMappingURL=authz-matrix.js.map

package/dist/routes/authz-matrix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-matrix.js","sourceRoot":"","sources":["../../src/routes/authz-matrix.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mFAAmF;AACnF,0CAA0C;AAC1C,EAAE;AACF,UAAU;AACV,gFAAgF;AAChF,uEAAuE;AACvE,6EAA6E;AAC7E,kEAAkE;AAClE,8EAA8E;AAC9E,oFAAoF;AACpF,kDAAkD;AAClD,EAAE;AACF,oDAAoD;AACpD,qEAAqE;AACrE,6EAA6E;AAC7E,6FAA6F;AAC7F,sEAAsE;AACtE,gEAAgE;AAKhE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAMnC,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E,0CAA0C;AAC1C,qCAAqC;AACrC,iFAAiF;AACjF,gEAAgE;AAChE,iFAAiF;AACjF,kEAAkE;AAClE,qFAAqF;AACrF,mFAAmF;AACnF,EAAE;AACF,kDAAkD;AAClD,kEAAkE;AAClE,6EAA6E;AAC7E,uEAAuE;AACvE,kEAAkE;AAClE,4EAA4E;AAC5E,gFAAgF;AAChF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IAC1E,eAAe,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;IACvE,aAAa,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjF,cAAc,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;IACjG,oBAAoB,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;IAC5E,iBAAiB,EAAE,IAAI,GAAG,CAAU;QACnC,OAAO;QACP,eAAe;QACf,QAAQ;QACR,aAAa;QACb,UAAU;KACV,CAAC;IACF,cAAc,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClF,WAAW,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACzD,yEAAyE;IACzE,4EAA4E;IAC5E,eAAe,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,gEAAgE;IAChE,eAAe,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7D,eAAe,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC7D,+EAA+E;IAC/E,yDAAyD;IACzD,kBAAkB,EAAE,IAAI,GAAG,CAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;CAChE,CAAA;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,8EAA8E;AAC9E,MAAM,UAAU,OAAO,CAAC,IAAa,EAAE,GAAe;IACrD,OAAQ,iBAAiB,CAAC,GAAG,CAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAC1D,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC9B,IAAa,EACb,SAAkC,EAClC,GAAe;IAEf,kDAAkD;IAClD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAErC,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,eAAe,CAAA;IAElE,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,aAAa;YACjB,sEAAsE;YACtE,OAAO,KAAK,CAAA;QACb,KAAK,UAAU;YACd,kEAAkE;YAClE,2EAA2E;YAC3E,IAAI,GAAG,KAAK,eAAe;gBAAE,OAAO,IAAI,CAAA;YACxC,OAAO,KAAK,CAAA;QACb;YACC,2DAA2D;YAC3D,OAAO,IAAI,CAAA;IACb,CAAC;AACF,CAAC;AAyBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACtC,IAAa,EACb,SAAkC,EAClC,MAAqB;IAErB,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,eAAe,CAAA;IAClE,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,OAAO;YACX,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;QAC1D,KAAK,OAAO;YACX,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;QAC1D,KAAK,eAAe;YACnB,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;QACzD,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO;YACX,mEAAmE;YACnE,oEAAoE;YACpE,sDAAsD;YACtD,IAAI,KAAK,IAAI,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,iBAAiB,CAAC;gBAAE,OAAO,IAAI,CAAA;YAC7E,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAA;QAChE;YACC,OAAO,KAAK,CAAA;IACd,CAAC;AACF,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IAIzD,KAAK,UAAU,OAAO,CAAC,GAAiB;QACvC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC3E,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAA;IACvD,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,GAAe,EAAE,GAAiB;QAC5D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QACzD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAC3E,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5D,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;AAChC,CAAC"}

package/dist/routes/calendar.d.ts

@@ -0,0 +1,19 @@
+import type { Authz, RouteContext } from './context.js';
+export interface CalendarRouteConfig {
+    authz: Authz;
+}
+export interface CalendarRouteHandlers {
+    month(ctx: RouteContext): Promise<Response>;
+}
+/** A calendar item as returned by the route — matches CalendarItem in calendar-data.ts. */
+export interface CalendarRouteItem {
+    id: string;
+    type: string;
+    title: string;
+    status: string;
+    slug: string;
+    /** ISO-8601 date string derived from publish_at (scheduled) or published_at (published). */
+    date: string;
+}
+export declare function createCalendarRoutes(config: CalendarRouteConfig): CalendarRouteHandlers;
+//# sourceMappingURL=calendar.d.ts.map

package/dist/routes/calendar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"calendar.d.ts","sourceRoot":"","sources":["../../src/routes/calendar.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAGvD,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,KAAK,CAAA;CACZ;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC3C;AAED,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,4FAA4F;IAC5F,IAAI,EAAE,MAAM,CAAA;CACZ;AA0CD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,GAAG,qBAAqB,CAqDvF"}

package/dist/routes/calendar.js

@@ -0,0 +1,89 @@
+// src/routes/calendar.ts — Editorial calendar route factory (P5 Task 7).
+// Returns first-party content_items within a from/to date range, selecting
+// items that have a publish_at (scheduled) or published_at (published) within
+// the range. Trashed items and dateless drafts are excluded.
+//
+// The response shape { items: CalendarItem[] } feeds buildCalendarMonth directly.
+// Schedule-from-calendar reuses the existing POST /content/:id?action=schedule —
+// no new mutation route here.
+//
+// No provider calls: the editorial calendar is fully first-party D1.
+import { json } from './context.js';
+/**
+ * Parse ?from= and ?to= from the URL.
+ * Accepts unix-second integers or ISO-8601 strings.
+ * Returns { from, to } in unix seconds; defaults to the current calendar month
+ * if absent or unparseable.
+ */
+function parseRange(url) {
+    const u = new URL(url);
+    const now = Math.floor(Date.now() / 1000);
+    const parseParam = (raw) => {
+        if (!raw)
+            return null;
+        // Try as a plain unix-second integer first
+        const asInt = Number(raw);
+        if (Number.isFinite(asInt) && asInt > 1000000)
+            return asInt;
+        // Try as ISO-8601
+        const parsed = Date.parse(raw);
+        if (Number.isFinite(parsed))
+            return Math.floor(parsed / 1000);
+        return null;
+    };
+    const from = parseParam(u.searchParams.get('from'));
+    const to = parseParam(u.searchParams.get('to'));
+    if (from !== null && to !== null)
+        return { from, to };
+    // Default: current calendar month
+    const d = new Date(now * 1000);
+    const monthStart = Math.floor(new Date(d.getFullYear(), d.getMonth(), 1).getTime() / 1000);
+    const monthEnd = Math.floor(new Date(d.getFullYear(), d.getMonth() + 1, 0, 23, 59, 59).getTime() / 1000);
+    return { from: monthStart, to: monthEnd };
+}
+/** Format a unix-second timestamp as an ISO-8601 date string (UTC). */
+function toIso(unixSeconds) {
+    return new Date(unixSeconds * 1000).toISOString().slice(0, 10);
+}
+export function createCalendarRoutes(config) {
+    return {
+        async month(ctx) {
+            const denied = await config.authz.requirePublisher(ctx);
+            if (denied)
+                return denied;
+            const { from, to } = parseRange(ctx.request.url);
+            // Query content_items that have a dated placement within the range.
+            // COALESCE(publish_at, published_at) picks the relevant date:
+            //   - scheduled items have publish_at set
+            //   - published items have published_at set
+            // Items with neither are dateless drafts and are excluded by the HAVING clause.
+            const result = await ctx.db
+                .prepare(`SELECT
+						id,
+						type,
+						title,
+						status,
+						slug,
+						COALESCE(publish_at, published_at) AS date_unix
+					FROM content_items
+					WHERE deleted_at IS NULL
+						AND COALESCE(publish_at, published_at) IS NOT NULL
+						AND COALESCE(publish_at, published_at) >= ?
+						AND COALESCE(publish_at, published_at) <= ?
+					ORDER BY COALESCE(publish_at, published_at) ASC`)
+                .bind(from, to)
+                .all();
+            const rows = result.results ?? [];
+            const items = rows.map((row) => ({
+                id: row.id,
+                type: row.type,
+                title: row.title,
+                status: row.status,
+                slug: row.slug,
+                date: toIso(row.date_unix),
+            }));
+            return json({ items });
+        },
+    };
+}
+//# sourceMappingURL=calendar.js.map

package/dist/routes/calendar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"calendar.js","sourceRoot":"","sources":["../../src/routes/calendar.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,6DAA6D;AAC7D,EAAE;AACF,kFAAkF;AAClF,iFAAiF;AACjF,8BAA8B;AAC9B,EAAE;AACF,qEAAqE;AAGrE,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AAqBnC;;;;;GAKG;AACH,SAAS,UAAU,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,MAAM,UAAU,GAAG,CAAC,GAAkB,EAAiB,EAAE;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,2CAA2C;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,OAAO;YAAE,OAAO,KAAK,CAAA;QAC3D,kBAAkB;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;QAC7D,OAAO,IAAI,CAAA;IACZ,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IACnD,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;IAE/C,IAAI,IAAI,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;IAErD,kCAAkC;IAClC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAA;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAC1B,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAC3E,CAAA;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAA;AAC1C,CAAC;AAED,uEAAuE;AACvE,SAAS,KAAK,CAAC,WAAmB;IACjC,OAAO,IAAI,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAA2B;IAC/D,OAAO;QACN,KAAK,CAAC,KAAK,CAAC,GAAiB;YAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACvD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YAEzB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAEhD,oEAAoE;YACpE,8DAA8D;YAC9D,0CAA0C;YAC1C,4CAA4C;YAC5C,gFAAgF;YAChF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;iBACzB,OAAO,CACP;;;;;;;;;;;;qDAYgD,CAChD;iBACA,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;iBACd,GAAG,EAOA,CAAA;YAEL,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;YAEjC,MAAM,KAAK,GAAwB,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrD,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;aAC1B,CAAC,CAAC,CAAA;YAEH,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACvB,CAAC;KACD,CAAA;AACF,CAAC"}