@growth-labs/cms 0.1.0

package/dist/engine/api-keys.js

@@ -0,0 +1,165 @@
+// api-keys.ts — CMS API key engine (P7 Task 7).
+//
+// Implements:
+//   generateRawKey()    — prefixed random token (Web Crypto, workerd-native)
+//   sha256Hex(s)        — SHA-256 hex digest (Web Crypto — no node:crypto)
+//   createApiKey()      — generate raw, hash, store hash+prefix only, return raw once
+//   listApiKeys()       — masked list (no hash, no raw)
+//   revokeApiKey()      — DELETE row
+//   verifyCmsApiKey()   — hash the input, SELECT by key_hash, bump last_used, return
+//                         workspaceId + scopes or null
+//
+// Security invariants (spec §12 scope guard 4):
+//   - Raw key is NEVER stored. Only key_hash (SHA-256 hex) lives in D1.
+//   - Masked display uses the stored key_prefix hint (added in migration 0014).
+//   - verifyCmsApiKey equality is on the SHA-256 hash lookup — NOT a raw string
+//     comparison — so the lookup is constant-time-safe at the DB layer.
+//   - No node:crypto — uses Web Crypto (crypto.subtle / crypto.getRandomValues),
+//     workerd-native.
+// ---------------------------------------------------------------------------
+// Crypto helpers (Web Crypto — no node:crypto, workerd-native)
+// ---------------------------------------------------------------------------
+const KEY_PREFIX = 'mk_live_';
+/**
+ * Generate a random API key with the 'mk_live_' prefix.
+ * Uses crypto.getRandomValues for entropy (workerd-native).
+ * The returned value is 32 random bytes encoded as hex (64 chars) + prefix.
+ */
+export function generateRawKey() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    const hex = Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+    return `${KEY_PREFIX}${hex}`;
+}
+/**
+ * Compute the SHA-256 hex digest of a string. Uses Web Crypto (crypto.subtle)
+ * — no node:crypto, workerd-native.
+ */
+export async function sha256Hex(input) {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(input);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Build the safe display hint for a raw key.
+ * Format: '<prefix>••••<last4>' — e.g. 'mk_live_••••a1b2'
+ * The last 4 characters of the hex portion are kept; the rest is masked.
+ */
+function buildMaskedHint(rawKey) {
+    const last4 = rawKey.slice(-4);
+    return `${KEY_PREFIX}••••${last4}`;
+}
+// ---------------------------------------------------------------------------
+// createApiKey
+// ---------------------------------------------------------------------------
+/**
+ * Create a new CMS API key.
+ *
+ * - Generates a random raw key (prefix + 32 random hex bytes).
+ * - Computes SHA-256(raw) and stores ONLY the hash.
+ * - Stores a safe masked display hint (key_prefix column, migration 0014).
+ * - Returns the raw key ONCE — it is never retrievable again.
+ */
+export async function createApiKey(db, input) {
+    const id = crypto.randomUUID();
+    const rawKey = generateRawKey();
+    const keyHash = await sha256Hex(rawKey);
+    const masked = buildMaskedHint(rawKey);
+    const scopesJson = JSON.stringify(input.scopes);
+    const now = Math.floor(Date.now() / 1000);
+    await db
+        .prepare(`INSERT INTO cms_api_keys (id, workspace_id, name, key_hash, key_prefix, scopes, created_at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?)`)
+        .bind(id, input.workspaceId, input.name, keyHash, masked, scopesJson, now)
+        .run();
+    return { id, rawKey, masked };
+}
+// ---------------------------------------------------------------------------
+// listApiKeys
+// ---------------------------------------------------------------------------
+/**
+ * List all API keys for a workspace. Returns masked entries — no hash, no raw.
+ * Ordered by created_at ASC (deterministic).
+ */
+export async function listApiKeys(db, workspaceId) {
+    const result = await db
+        .prepare(`SELECT id, name, key_prefix, scopes, created_at, last_used
+			 FROM cms_api_keys
+			 WHERE workspace_id = ?
+			 ORDER BY created_at ASC`)
+        .bind(workspaceId)
+        .all();
+    return (result.results ?? []).map((row) => ({
+        id: row.id,
+        name: row.name,
+        // If key_prefix is stored (migration 0014), use it; otherwise fall back.
+        masked: row.key_prefix ?? `${KEY_PREFIX}••••`,
+        scopes: parseScopes(row.scopes),
+        createdAt: row.created_at,
+        lastUsed: row.last_used,
+    }));
+}
+// ---------------------------------------------------------------------------
+// revokeApiKey
+// ---------------------------------------------------------------------------
+/**
+ * Revoke (delete) an API key by its id, SCOPED to the caller's workspace.
+ *
+ * The workspaceId is resolved from the authenticated caller (auth/locals) and
+ * MUST be passed by the route — never trusted from the client. Scoping the
+ * DELETE by workspace_id closes a cross-workspace IDOR: a member of workspace A
+ * cannot revoke workspace B's key by guessing/leaking its id.
+ *
+ * After revocation, verifyCmsApiKey returns null for the associated raw key.
+ */
+export async function revokeApiKey(db, id, workspaceId) {
+    await db
+        .prepare(`DELETE FROM cms_api_keys WHERE id = ? AND workspace_id = ?`)
+        .bind(id, workspaceId)
+        .run();
+}
+// ---------------------------------------------------------------------------
+// verifyCmsApiKey — gateway helper (exported for the content-API gateway)
+// ---------------------------------------------------------------------------
+/**
+ * Verify a raw CMS API key at the content-API gateway.
+ *
+ * - Hashes the raw input via SHA-256.
+ * - Looks up the row by key_hash (equality on the hash — constant-time-safe
+ *   at the DB layer; the raw string is never compared).
+ * - On match: bumps last_used, returns { workspaceId, scopes }.
+ * - On miss (unknown or revoked): returns null.
+ */
+export async function verifyCmsApiKey(db, rawKey) {
+    const keyHash = await sha256Hex(rawKey);
+    const now = Math.floor(Date.now() / 1000);
+    const row = await db
+        .prepare(`SELECT id, workspace_id, scopes FROM cms_api_keys WHERE key_hash = ?`)
+        .bind(keyHash)
+        .first();
+    if (!row)
+        return null;
+    // Bump last_used (fire-and-forget — best-effort; does not affect auth decision)
+    await db.prepare(`UPDATE cms_api_keys SET last_used = ? WHERE id = ?`).bind(now, row.id).run();
+    return {
+        workspaceId: row.workspace_id,
+        scopes: parseScopes(row.scopes),
+    };
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+function parseScopes(scopesJson) {
+    try {
+        const parsed = JSON.parse(scopesJson);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/engine/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/engine/api-keys.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,cAAc;AACd,6EAA6E;AAC7E,2EAA2E;AAC3E,sFAAsF;AACtF,wDAAwD;AACxD,qCAAqC;AACrC,qFAAqF;AACrF,uDAAuD;AACvD,EAAE;AACF,gDAAgD;AAChD,wEAAwE;AACxE,gFAAgF;AAChF,gFAAgF;AAChF,wEAAwE;AACxE,iFAAiF;AACjF,sBAAsB;AAwCtB,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAE9E,MAAM,UAAU,GAAG,UAAU,CAAA;AAE7B;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;IACV,OAAO,GAAG,UAAU,GAAG,GAAG,EAAE,CAAA;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;IACxD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACtE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAc;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9B,OAAO,GAAG,UAAU,OAAO,KAAK,EAAE,CAAA;AACnC,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,EAAc,EACd,KAAwB;IAExB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAA;IAC/B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,MAAM,EAAE;SACN,OAAO,CACP;iCAC8B,CAC9B;SACA,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC;SACzE,GAAG,EAAE,CAAA;IAEP,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAC9B,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc,EAAE,WAAmB;IACpE,MAAM,MAAM,GAAG,MAAM,EAAE;SACrB,OAAO,CACP;;;4BAGyB,CACzB;SACA,IAAI,CAAC,WAAW,CAAC;SACjB,GAAG,EAOA,CAAA;IAEL,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,yEAAyE;QACzE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,UAAU,MAAM;QAC7C,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,QAAQ,EAAE,GAAG,CAAC,SAAS;KACvB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAc,EAAE,EAAU,EAAE,WAAmB;IACjF,MAAM,EAAE;SACN,OAAO,CAAC,4DAA4D,CAAC;SACrE,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC;SACrB,GAAG,EAAE,CAAA;AACR,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,EAAc,EACd,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,MAAM,GAAG,GAAG,MAAM,EAAE;SAClB,OAAO,CAAC,sEAAsE,CAAC;SAC/E,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,EAAwD,CAAA;IAE/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IAErB,gFAAgF;IAChF,MAAM,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;IAE9F,OAAO;QACN,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;KAC/B,CAAA;AACF,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,WAAW,CAAC,UAAkB;IACtC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACrC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC"}

package/dist/engine/content-insights.d.ts

@@ -0,0 +1,36 @@
+import type { InsightsIngestPayload } from '../schema/insights-ingest.js';
+import type { ContentInsightRow } from '../schema/types.js';
+import type { D1Database } from './d1.js';
+/** True when the error is a missing content_insights table (drift → 409 schema_not_ready). */
+export declare function isMissingInsightsTable(error: unknown): boolean;
+/**
+ * Read the current board for (site_id, run_date), EXCLUDING any (site_id, intent_key)
+ * present in content_insight_dismissals. Ordered best-bets first (by best_bet_rank),
+ * then by desk + desk_rank for the desk groups. evidence/brief are decoded from TEXT.
+ */
+export declare function listInsightBoard(db: D1Database, siteId: string, runDate: string): Promise<ContentInsightRow[]>;
+/** Persist a dismissal for (site_id, intent_key). Idempotent via INSERT OR REPLACE on the PK. */
+export declare function dismissInsight(db: D1Database, siteId: string, intentKey: string, dismissedBy: string | null): Promise<void>;
+/** Clear a dismissal so the intent reappears on the next board read. */
+export declare function undismissInsight(db: D1Database, siteId: string, intentKey: string): Promise<void>;
+export type ReplaceOutcome = 'applied' | 'duplicate' | 'stale';
+export interface ReplaceResult {
+    outcome: ReplaceOutcome;
+    landedRunAttempt: number;
+}
+/**
+ * Replay-safe replace of the board for (meta.site_id, meta.run_date).
+ *  - 'duplicate': meta.event_id already present in content_insight_runs.event_id → no-op.
+ *  - 'stale':     an equal-or-higher run_attempt already landed for (site_id, run_date) → no-op
+ *                 (HMAC authenticates the sender; run_attempt is the monotonic replay guard).
+ *  - 'applied':   DELETE the existing board scoped by (site_id, run_date), bulk-insert rows
+ *                 (mint id, run_id = meta.run_id, beat from payload, created_at = unixepoch()),
+ *                 upsert the run row.
+ * Dismissals are untouched — they live in their own table keyed (site_id, intent_key).
+ *
+ * The INSERT carries 16 columns (id, site_id, run_id, run_date, desk, suggestion_type,
+ * signal_type, is_best_bet, best_bet_rank, desk_rank, headline, evidence, brief,
+ * intent_key, beat, created_at) matching migration 0016 column order.
+ */
+export declare function replaceInsightsBoard(db: D1Database, payload: InsightsIngestPayload): Promise<ReplaceResult>;
+//# sourceMappingURL=content-insights.d.ts.map

package/dist/engine/content-insights.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-insights.d.ts","sourceRoot":"","sources":["../../src/engine/content-insights.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAiC,MAAM,oBAAoB,CAAA;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC,8FAA8F;AAC9F,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE9D;AAeD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACrC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAc9B;AAED,iGAAiG;AACjG,wBAAsB,cAAc,CACnC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wEAAwE;AACxE,wBAAsB,gBAAgB,CACrC,EAAE,EAAE,UAAU,EACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAA;AAC9D,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,cAAc,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACzC,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,qBAAqB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAmGxB"}

package/dist/engine/content-insights.js

@@ -0,0 +1,114 @@
+/** True when the error is a missing content_insights table (drift → 409 schema_not_ready). */
+export function isMissingInsightsTable(error) {
+    return error instanceof Error && /no such table: content_insights/i.test(error.message);
+}
+function decodeRow(raw) {
+    return {
+        ...raw,
+        evidence: JSON.parse(raw.evidence),
+        brief: JSON.parse(raw.brief),
+    };
+}
+/**
+ * Read the current board for (site_id, run_date), EXCLUDING any (site_id, intent_key)
+ * present in content_insight_dismissals. Ordered best-bets first (by best_bet_rank),
+ * then by desk + desk_rank for the desk groups. evidence/brief are decoded from TEXT.
+ */
+export async function listInsightBoard(db, siteId, runDate) {
+    const result = await db
+        .prepare(`SELECT i.* FROM content_insights i
+			 WHERE i.site_id = ? AND i.run_date = ?
+			   AND NOT EXISTS (
+			     SELECT 1 FROM content_insight_dismissals d
+			     WHERE d.site_id = i.site_id AND d.intent_key = i.intent_key
+			   )
+			 ORDER BY i.is_best_bet DESC, i.best_bet_rank ASC, i.desk ASC, i.desk_rank ASC`)
+        .bind(siteId, runDate)
+        .all();
+    return (result.results || []).map(decodeRow);
+}
+/** Persist a dismissal for (site_id, intent_key). Idempotent via INSERT OR REPLACE on the PK. */
+export async function dismissInsight(db, siteId, intentKey, dismissedBy) {
+    await db
+        .prepare(`INSERT OR REPLACE INTO content_insight_dismissals (site_id, intent_key, dismissed_at, dismissed_by)
+			 VALUES (?, ?, unixepoch(), ?)`)
+        .bind(siteId, intentKey, dismissedBy)
+        .run();
+}
+/** Clear a dismissal so the intent reappears on the next board read. */
+export async function undismissInsight(db, siteId, intentKey) {
+    await db
+        .prepare('DELETE FROM content_insight_dismissals WHERE site_id = ? AND intent_key = ?')
+        .bind(siteId, intentKey)
+        .run();
+}
+/**
+ * Replay-safe replace of the board for (meta.site_id, meta.run_date).
+ *  - 'duplicate': meta.event_id already present in content_insight_runs.event_id → no-op.
+ *  - 'stale':     an equal-or-higher run_attempt already landed for (site_id, run_date) → no-op
+ *                 (HMAC authenticates the sender; run_attempt is the monotonic replay guard).
+ *  - 'applied':   DELETE the existing board scoped by (site_id, run_date), bulk-insert rows
+ *                 (mint id, run_id = meta.run_id, beat from payload, created_at = unixepoch()),
+ *                 upsert the run row.
+ * Dismissals are untouched — they live in their own table keyed (site_id, intent_key).
+ *
+ * The INSERT carries 16 columns (id, site_id, run_id, run_date, desk, suggestion_type,
+ * signal_type, is_best_bet, best_bet_rank, desk_rank, headline, evidence, brief,
+ * intent_key, beat, created_at) matching migration 0016 column order.
+ */
+export async function replaceInsightsBoard(db, payload) {
+    const { meta, rows } = payload;
+    // 1) event_id dedupe (mirrors foundry_callback_events).
+    const dupEvent = await db
+        .prepare('SELECT id FROM content_insight_runs WHERE event_id = ? LIMIT 1')
+        .bind(meta.event_id)
+        .first();
+    if (dupEvent)
+        return { outcome: 'duplicate', landedRunAttempt: meta.run_attempt };
+    // 2) stale-replay guard: reject equal-or-lower run_attempt for (site_id, run_date).
+    const existing = await db
+        .prepare('SELECT id, run_attempt FROM content_insight_runs WHERE site_id = ? AND run_date = ? LIMIT 1')
+        .bind(meta.site_id, meta.run_date)
+        .first();
+    if (existing && meta.run_attempt <= existing.run_attempt) {
+        return { outcome: 'stale', landedRunAttempt: existing.run_attempt };
+    }
+    const now = Math.floor(Date.now() / 1000);
+    // 3) Scoped replace + bulk insert + run upsert in one D1 batch.
+    const statements = [
+        db
+            .prepare('DELETE FROM content_insights WHERE site_id = ? AND run_date = ?')
+            .bind(meta.site_id, meta.run_date),
+    ];
+    for (const row of rows) {
+        // 16 columns: id, site_id, run_id, run_date, desk, suggestion_type, signal_type,
+        // is_best_bet, best_bet_rank, desk_rank, headline, evidence, brief,
+        // intent_key, beat, created_at
+        statements.push(db
+            .prepare(`INSERT INTO content_insights
+					 (id, site_id, run_id, run_date, desk, suggestion_type, signal_type, is_best_bet,
+					  best_bet_rank, desk_rank, headline, evidence, brief, intent_key, beat, created_at)
+					 VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`)
+            .bind(crypto.randomUUID(), row.site_id, meta.run_id, row.run_date, row.desk, row.suggestion_type, row.signal_type, row.is_best_bet, row.best_bet_rank, row.desk_rank, row.headline, JSON.stringify(row.evidence), JSON.stringify(row.brief), row.intent_key, row.beat, now));
+    }
+    // Upsert the run row keyed on UNIQUE (site_id, run_date).
+    statements.push(db
+        .prepare(`INSERT INTO content_insight_runs
+				 (id, site_id, run_date, status, event_id, run_attempt, generated_at, content_hash,
+				  demand_count, opportunity_count, started_at, completed_at, error)
+				 VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)
+				 ON CONFLICT(site_id, run_date) DO UPDATE SET
+				   status = excluded.status,
+				   event_id = excluded.event_id,
+				   run_attempt = excluded.run_attempt,
+				   generated_at = excluded.generated_at,
+				   content_hash = excluded.content_hash,
+				   demand_count = excluded.demand_count,
+				   opportunity_count = excluded.opportunity_count,
+				   completed_at = excluded.completed_at,
+				   error = excluded.error`)
+        .bind(existing?.id ?? crypto.randomUUID(), meta.site_id, meta.run_date, meta.status, meta.event_id, meta.run_attempt, meta.generated_at, meta.content_hash, meta.counts.demand_count, meta.counts.opportunity_count, now, meta.status === 'completed' || meta.status === 'partial' ? now : null, meta.error ?? null));
+    await db.batch(statements);
+    return { outcome: 'applied', landedRunAttempt: meta.run_attempt };
+}
+//# sourceMappingURL=content-insights.js.map

package/dist/engine/content-insights.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-insights.js","sourceRoot":"","sources":["../../src/engine/content-insights.ts"],"names":[],"mappings":"AAIA,8FAA8F;AAC9F,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACpD,OAAO,KAAK,YAAY,KAAK,IAAI,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACxF,CAAC;AAOD,SAAS,SAAS,CAAC,GAAkB;IACpC,OAAO;QACN,GAAG,GAAG;QACN,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAoB;QACrD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAiB;KAC5C,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,EAAc,EACd,MAAc,EACd,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,EAAE;SACrB,OAAO,CACP;;;;;;kFAM+E,CAC/E;SACA,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;SACrB,GAAG,EAAiB,CAAA;IACtB,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;AAC7C,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,EAAc,EACd,MAAc,EACd,SAAiB,EACjB,WAA0B;IAE1B,MAAM,EAAE;SACN,OAAO,CACP;kCAC+B,CAC/B;SACA,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,CAAC;SACpC,GAAG,EAAE,CAAA;AACR,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,EAAc,EACd,MAAc,EACd,SAAiB;IAEjB,MAAM,EAAE;SACN,OAAO,CAAC,6EAA6E,CAAC;SACtF,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;SACvB,GAAG,EAAE,CAAA;AACR,CAAC;AAQD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,EAAc,EACd,OAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IAE9B,wDAAwD;IACxD,MAAM,QAAQ,GAAG,MAAM,EAAE;SACvB,OAAO,CAAC,gEAAgE,CAAC;SACzE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;SACnB,KAAK,EAAkB,CAAA;IACzB,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAA;IAEjF,oFAAoF;IACpF,MAAM,QAAQ,GAAG,MAAM,EAAE;SACvB,OAAO,CACP,6FAA6F,CAC7F;SACA,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC;SACjC,KAAK,EAAuC,CAAA;IAC9C,IAAI,QAAQ,IAAI,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;IACpE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,gEAAgE;IAChE,MAAM,UAAU,GAAG;QAClB,EAAE;aACA,OAAO,CAAC,iEAAiE,CAAC;aAC1E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC;KACnC,CAAA;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,iFAAiF;QACjF,oEAAoE;QACpE,+BAA+B;QAC/B,UAAU,CAAC,IAAI,CACd,EAAE;aACA,OAAO,CACP;;;+CAG0C,CAC1C;aACA,IAAI,CACJ,MAAM,CAAC,UAAU,EAAE,EACnB,GAAG,CAAC,OAAO,EACX,IAAI,CAAC,MAAM,EACX,GAAG,CAAC,QAAQ,EACZ,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,eAAe,EACnB,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,WAAW,EACf,GAAG,CAAC,aAAa,EACjB,GAAG,CAAC,SAAS,EACb,GAAG,CAAC,QAAQ,EACZ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EACzB,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,IAAI,EACR,GAAG,CACH,CACF,CAAA;IACF,CAAC;IACD,0DAA0D;IAC1D,UAAU,CAAC,IAAI,CACd,EAAE;SACA,OAAO,CACP;;;;;;;;;;;;;8BAa0B,CAC1B;SACA,IAAI,CACJ,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,EACnC,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,MAAM,CAAC,YAAY,EACxB,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,GAAG,EACH,IAAI,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EACrE,IAAI,CAAC,KAAK,IAAI,IAAI,CAClB,CACF,CAAA;IAED,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAA;AAClE,CAAC"}

package/dist/engine/contributors.d.ts

@@ -0,0 +1,25 @@
+import type { D1Database } from './d1.js';
+export interface ContributorInput {
+    authorId: string;
+    role: string | null;
+    position: number;
+}
+export interface ContributorRecord {
+    authorId: string;
+    role: string | null;
+    position: number;
+    name: string | null;
+    avatar: string | null;
+}
+/**
+ * List contributors for a content item, ordered by position ASC.
+ * LEFT JOINs the authors table to surface name + avatar.
+ */
+export declare function listContributors(db: D1Database, contentId: string): Promise<ContributorRecord[]>;
+/**
+ * Replace the full contributor list for a content item (DELETE then INSERT),
+ * mirroring the setContentTags pattern. Passing an empty array clears all
+ * contributors.
+ */
+export declare function setContributors(db: D1Database, contentId: string, contributors: ContributorInput[]): Promise<void>;
+//# sourceMappingURL=contributors.d.ts.map

package/dist/engine/contributors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contributors.d.ts","sourceRoot":"","sources":["../../src/engine/contributors.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAyB9B;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACpC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,gBAAgB,EAAE,GAC9B,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/engine/contributors.js

@@ -0,0 +1,59 @@
+// content_contributors engine (P3 Task 3).
+//
+// Backs the Organize-tab co-authors list (spec §8 / §13.1).
+// The content_contributors table was created in migration 0003:
+//   content_id TEXT NOT NULL,
+//   author_id  TEXT NOT NULL,
+//   role       TEXT,
+//   position   INTEGER NOT NULL DEFAULT 0,
+//   PRIMARY KEY (content_id, author_id)
+//   FOREIGN KEY (content_id) REFERENCES content_items(id) ON DELETE CASCADE
+//   FOREIGN KEY (author_id)  REFERENCES authors(id)       ON DELETE CASCADE
+//
+// The ordering column is `position` (NOT `rank`) to match the live prod
+// fronts-data table and the Fronts public byline renderer, which read/ORDER BY
+// `position`. The package — column, TS field, and wire API — uses `position`
+// end-to-end so all three agree with prod.
+/**
+ * List contributors for a content item, ordered by position ASC.
+ * LEFT JOINs the authors table to surface name + avatar.
+ */
+export async function listContributors(db, contentId) {
+    const result = await db
+        .prepare(`SELECT cc.author_id, cc.role, cc.position, a.name, a.avatar
+			 FROM content_contributors cc
+			 LEFT JOIN authors a ON a.id = cc.author_id
+			 WHERE cc.content_id = ?
+			 ORDER BY cc.position ASC, cc.author_id ASC`)
+        .bind(contentId)
+        .all();
+    return (result.results || []).map((row) => ({
+        authorId: row.author_id,
+        role: row.role,
+        position: row.position,
+        name: row.name,
+        avatar: row.avatar,
+    }));
+}
+/**
+ * Replace the full contributor list for a content item (DELETE then INSERT),
+ * mirroring the setContentTags pattern. Passing an empty array clears all
+ * contributors.
+ */
+export async function setContributors(db, contentId, contributors) {
+    // Delete all existing contributors for this content item.
+    await db.prepare('DELETE FROM content_contributors WHERE content_id = ?').bind(contentId).run();
+    // Insert each contributor in the new list. The LIVE prod fronts-data column is
+    // `role TEXT NOT NULL DEFAULT 'cohost'` (Fronts legacy migration 0035), so a
+    // NULL role would throw a NOT NULL constraint 500. Default to 'cohost' (prod's
+    // own DEFAULT) when role is omitted — this is the load-bearing guard; no
+    // contributor write path may bind NULL role.
+    for (const c of contributors) {
+        await db
+            .prepare(`INSERT INTO content_contributors (content_id, author_id, role, position)
+				 VALUES (?, ?, ?, ?)`)
+            .bind(contentId, c.authorId, c.role ?? 'cohost', c.position)
+            .run();
+    }
+}
+//# sourceMappingURL=contributors.js.map

package/dist/engine/contributors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contributors.js","sourceRoot":"","sources":["../../src/engine/contributors.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,4DAA4D;AAC5D,gEAAgE;AAChE,8BAA8B;AAC9B,8BAA8B;AAC9B,qBAAqB;AACrB,2CAA2C;AAC3C,wCAAwC;AACxC,4EAA4E;AAC5E,4EAA4E;AAC5E,EAAE;AACF,wEAAwE;AACxE,+EAA+E;AAC/E,6EAA6E;AAC7E,2CAA2C;AAkB3C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,EAAc,EACd,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,EAAE;SACrB,OAAO,CACP;;;;+CAI4C,CAC5C;SACA,IAAI,CAAC,SAAS,CAAC;SACf,GAAG,EAMA,CAAA;IAEL,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3C,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;KAClB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,EAAc,EACd,SAAiB,EACjB,YAAgC;IAEhC,0DAA0D;IAC1D,MAAM,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAA;IAE/F,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,yEAAyE;IACzE,6CAA6C;IAC7C,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,EAAE;aACN,OAAO,CACP;yBACqB,CACrB;aACA,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC;aAC3D,GAAG,EAAE,CAAA;IACR,CAAC;AACF,CAAC"}

package/dist/engine/cron.d.ts

@@ -0,0 +1,15 @@
+import type { D1Database } from './d1.js';
+interface RunScheduledPublishOptions {
+    createdBy?: string | null;
+    now?: number;
+}
+export interface ScheduledPublishResult {
+    published: string[];
+    failed: Array<{
+        id: string;
+        error: string;
+    }>;
+}
+export declare function runScheduledPublish(db: D1Database, options?: RunScheduledPublishOptions): Promise<ScheduledPublishResult>;
+export {};
+//# sourceMappingURL=cron.d.ts.map

package/dist/engine/cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.d.ts","sourceRoot":"","sources":["../../src/engine/cron.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAOzC,UAAU,0BAA0B;IACnC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC5C;AAMD,wBAAsB,mBAAmB,CACxC,EAAE,EAAE,UAAU,EACd,OAAO,GAAE,0BAA+B,GACtC,OAAO,CAAC,sBAAsB,CAAC,CA8BjC"}

package/dist/engine/cron.js

@@ -0,0 +1,33 @@
+import { assertContentBodyValidForPublish, claimScheduledForPublish, createRevision, } from './publisher.js';
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export async function runScheduledPublish(db, options = {}) {
+    const now = options.now ?? Math.floor(Date.now() / 1_000);
+    const scheduled = await db
+        .prepare("SELECT id FROM content_items WHERE status = 'scheduled' AND publish_at IS NOT NULL AND publish_at <= ?")
+        .bind(now)
+        .all();
+    const result = {
+        published: [],
+        failed: [],
+    };
+    for (const { id } of scheduled.results || []) {
+        try {
+            await assertContentBodyValidForPublish(db, id, 'publisher.cron');
+            // Conditional claim — only ONE concurrent run wins the scheduled→published
+            // transition. If a parallel sweep already published this row, claimed is
+            // false and we skip the duplicate publish + duplicate revision write.
+            const claimed = await claimScheduledForPublish(db, id, now);
+            if (!claimed)
+                continue;
+            await createRevision(db, id, options.createdBy ?? null);
+            result.published.push(id);
+        }
+        catch (error) {
+            result.failed.push({ id, error: getErrorMessage(error) });
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=cron.js.map

package/dist/engine/cron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.js","sourceRoot":"","sources":["../../src/engine/cron.ts"],"names":[],"mappings":"AAQA,OAAO,EACN,gCAAgC,EAChC,wBAAwB,EACxB,cAAc,GACd,MAAM,gBAAgB,CAAA;AAYvB,SAAS,eAAe,CAAC,KAAc;IACtC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,EAAc,EACd,UAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,EAAE;SACxB,OAAO,CACP,wGAAwG,CACxG;SACA,IAAI,CAAC,GAAG,CAAC;SACT,GAAG,EAAkB,CAAA;IAEvB,MAAM,MAAM,GAA2B;QACtC,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,EAAE;KACV,CAAA;IAED,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,SAAS,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC;YACJ,MAAM,gCAAgC,CAAC,EAAE,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAA;YAChE,2EAA2E;YAC3E,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YAC3D,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAA;YACvD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC1D,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAA;AACd,CAAC"}

package/dist/engine/d1.d.ts

@@ -0,0 +1,16 @@
+export interface D1Result<T = Record<string, unknown>> {
+    results?: T[];
+    success?: boolean;
+    meta?: Record<string, unknown>;
+}
+export interface D1PreparedStatement {
+    bind(...values: unknown[]): D1PreparedStatement;
+    first<T = Record<string, unknown>>(colName?: string): Promise<T | null>;
+    all<T = Record<string, unknown>>(): Promise<D1Result<T>>;
+    run<T = Record<string, unknown>>(): Promise<D1Result<T>>;
+}
+export interface D1Database {
+    prepare(query: string): D1PreparedStatement;
+    batch(statements: D1PreparedStatement[]): Promise<D1Result[]>;
+}
+//# sourceMappingURL=d1.d.ts.map

package/dist/engine/d1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.d.ts","sourceRoot":"","sources":["../../src/engine/d1.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,EAAE,CAAA;IACb,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAA;IAC/C,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACvE,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACxD,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAAA;IAC3C,KAAK,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;CAC7D"}

package/dist/engine/d1.js

@@ -0,0 +1,13 @@
+// Minimal structural D1 surface used by the publishing engine.
+//
+// The package deliberately does NOT depend on `@cloudflare/workers-types`
+// (the tsconfig pins `types: []`, matching @growth-labs/analytics): the
+// engine only needs the prepare/bind/first/all/run surface, so we declare it
+// structurally. The real workerd `D1Database` is structurally assignable to
+// this, so a site can pass `env.SITE_DB` directly with no cast.
+//
+// Keep this in sync with the subset of the D1 API the engine actually calls.
+// If a new engine function needs a method not listed here, add it here rather
+// than reaching for the full ambient types.
+export {};
+//# sourceMappingURL=d1.js.map

package/dist/engine/d1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.js","sourceRoot":"","sources":["../../src/engine/d1.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,6EAA6E;AAC7E,4EAA4E;AAC5E,gEAAgE;AAChE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,4CAA4C"}

package/dist/engine/foundry-dispatch.d.ts

@@ -0,0 +1,52 @@
+import type { FoundryDispatch } from '../providers/types.js';
+import type { D1Database } from './d1.js';
+export type ProcessingState = 'pending' | 'queued' | 'fetching' | 'transcribing' | 'transcoding' | 'ready' | 'failed';
+export interface DispatchResult {
+    correlationId: string;
+    triggerToken: string;
+}
+export interface CallbackInput {
+    eventId: string;
+    eventKind: string;
+    correlationId: string;
+    triggerToken: string;
+    nextState: ProcessingState;
+    error?: string | null;
+    transcript?: string | null;
+    durationSeconds?: number | null;
+    description?: string | null;
+    excerpt?: string | null;
+}
+/**
+ * Dispatch a video or podcast content item to Foundry via the injected hook.
+ * Mints a fresh `processing_trigger_token` (UUID), calls
+ * `hook.dispatchVideo({ contentId, sourceUrl, kind })`, and writes
+ * `processing_correlation_id` + advances to `'queued'` in either
+ * `video_content` or `podcast_content`.
+ *
+ * Throws if the item is not a video/podcast.
+ */
+export declare function dispatchToFoundry(db: D1Database, contentId: string, hook: Pick<FoundryDispatch, 'dispatchVideo'>): Promise<DispatchResult>;
+/**
+ * Apply a Foundry callback event to the state machine.
+ *
+ * - Deduplicates on `event_id`: if a row for this `event_id` already exists in
+ *   `foundry_callback_events`, returns `false` (no state change).
+ * - Verifies `triggerToken` matches the row's `processing_trigger_token`:
+ *   if it does not match, returns `false` (no state change).
+ * - On success: inserts the event row, advances `processing_state`, sets
+ *   `processing_completed_at` for terminal states, sets `processing_error`
+ *   on `failed`, returns `true`.
+ *
+ * Video callbacks advance `video_content.processing_state`. Podcast callbacks
+ * resolve by the same trigger token and hydrate the transcript/summary fields
+ * when the callback carries those values.
+ */
+export declare function applyFoundryCallback(db: D1Database, input: CallbackInput): Promise<boolean>;
+/**
+ * Verify a HMAC-SHA256 signature over `rawBody` using `secret`.
+ * The `signature` is expected as a lowercase hex string.
+ * Uses Web Crypto `crypto.subtle` and a constant-time comparison.
+ */
+export declare function verifyHmac(secret: string, rawBody: string, signature: string): Promise<boolean>;
+//# sourceMappingURL=foundry-dispatch.d.ts.map

package/dist/engine/foundry-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"foundry-dispatch.d.ts","sourceRoot":"","sources":["../../src/engine/foundry-dispatch.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC,MAAM,MAAM,eAAe,GACxB,SAAS,GACT,QAAQ,GACR,UAAU,GACV,cAAc,GACd,aAAa,GACb,OAAO,GACP,QAAQ,CAAA;AAIX,MAAM,WAAW,cAAc;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,eAAe,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACvB;AAwCD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACtC,EAAE,EAAE,UAAU,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,GAC1C,OAAO,CAAC,cAAc,CAAC,CA+GzB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAoJjG;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAmClB"}