@growth-labs/cms 0.1.0

package/src/engine/revisions.ts

@@ -0,0 +1,292 @@
+// Revision engine — createRevisionWithDelta / listRevisions / getRevision / restoreRevision.
+//
+// Backs the History tab (spec §4 "ContentRevisionPayload"). Builds on the
+// existing content_revisions table (0001 baseline) + the 0005 delta columns
+// (words_added, words_removed, tag). Snapshot shape is formalized as
+// ContentRevisionPayload, aligned to getContentSnapshot's output.
+
+import type { D1Database } from './d1.js'
+import { countWords, getContentItem, getContentSnapshot, updateContentItem } from './publisher.js'
+
+/** The one canonical revision snapshot shape (spec §4 "ContentRevisionPayload"). */
+export interface ContentRevisionPayload {
+	item: Record<string, unknown>
+	content: Record<string, unknown> | null
+	tags: string[]
+	related: Array<{ related_id: string; rank: number; reason: string | null }>
+}
+
+export interface RevisionSummary {
+	id: string
+	contentId: string
+	createdAt: number
+	createdBy: string | null
+	wordsAdded: number | null
+	wordsRemoved: number | null
+	tag: string | null
+}
+
+function bodyWordCount(payload: ContentRevisionPayload | null): number {
+	const md =
+		payload?.content && typeof payload.content.body_markdown === 'string'
+			? (payload.content.body_markdown as string)
+			: ''
+	return countWords(md)
+}
+
+async function latestRevisionPayload(
+	db: D1Database,
+	contentId: string,
+): Promise<ContentRevisionPayload | null> {
+	const row = await db
+		.prepare(
+			'SELECT payload_json FROM content_revisions WHERE content_id = ? ORDER BY created_at DESC, rowid DESC LIMIT 1',
+		)
+		.bind(contentId)
+		.first<{ payload_json: string }>()
+	if (!row) return null
+	try {
+		return JSON.parse(row.payload_json) as ContentRevisionPayload
+	} catch {
+		return null
+	}
+}
+
+/** Snapshot the item now, computing word deltas vs the previous revision. */
+export async function createRevisionWithDelta(
+	db: D1Database,
+	contentId: string,
+	opts: { createdBy?: string | null; tag?: string | null } = {},
+): Promise<RevisionSummary | null> {
+	const snapshot = (await getContentSnapshot(db, contentId)) as ContentRevisionPayload | null
+	if (!snapshot) return null
+	const prev = await latestRevisionPayload(db, contentId)
+	const prevWc = bodyWordCount(prev)
+	const nextWc = bodyWordCount(snapshot)
+	const wordsAdded = Math.max(0, nextWc - prevWc)
+	const wordsRemoved = Math.max(0, prevWc - nextWc)
+	const id = crypto.randomUUID()
+	await db
+		.prepare(
+			'INSERT INTO content_revisions (id, content_id, payload_json, created_at, created_by, words_added, words_removed, tag) VALUES (?, ?, ?, unixepoch(), ?, ?, ?, ?)',
+		)
+		.bind(
+			id,
+			contentId,
+			JSON.stringify(snapshot),
+			opts.createdBy ?? null,
+			wordsAdded,
+			wordsRemoved,
+			opts.tag ?? null,
+		)
+		.run()
+	// NOTE: this is the autosave/History trigger (fired on a debounce while
+	// editing a draft, and by restoreRevision). It must NOT move
+	// content_items.published_revision_id — that pointer tracks the PUBLISHED
+	// snapshot and is only advanced by the publish path (createRevision in
+	// publisher.ts).
+	const row = await db
+		.prepare('SELECT created_at FROM content_revisions WHERE id = ?')
+		.bind(id)
+		.first<{ created_at: number }>()
+	return {
+		id,
+		contentId,
+		createdAt: row?.created_at ?? 0,
+		createdBy: opts.createdBy ?? null,
+		wordsAdded,
+		wordsRemoved,
+		tag: opts.tag ?? null,
+	}
+}
+
+export async function listRevisions(db: D1Database, contentId: string): Promise<RevisionSummary[]> {
+	const result = await db
+		.prepare(
+			'SELECT id, content_id, created_at, created_by, words_added, words_removed, tag FROM content_revisions WHERE content_id = ? ORDER BY created_at DESC, rowid DESC',
+		)
+		.bind(contentId)
+		.all<{
+			id: string
+			content_id: string
+			created_at: number
+			created_by: string | null
+			words_added: number | null
+			words_removed: number | null
+			tag: string | null
+		}>()
+	return (result.results || []).map((r) => ({
+		id: r.id,
+		contentId: r.content_id,
+		createdAt: r.created_at,
+		createdBy: r.created_by,
+		wordsAdded: r.words_added,
+		wordsRemoved: r.words_removed,
+		tag: r.tag,
+	}))
+}
+
+export async function getRevision(
+	db: D1Database,
+	contentId: string,
+	revisionId: string,
+): Promise<{ summary: RevisionSummary; payload: ContentRevisionPayload } | null> {
+	const row = await db
+		.prepare(
+			'SELECT id, content_id, payload_json, created_at, created_by, words_added, words_removed, tag FROM content_revisions WHERE id = ? AND content_id = ? LIMIT 1',
+		)
+		.bind(revisionId, contentId)
+		.first<{
+			id: string
+			content_id: string
+			payload_json: string
+			created_at: number
+			created_by: string | null
+			words_added: number | null
+			words_removed: number | null
+			tag: string | null
+		}>()
+	if (!row) return null
+	let payload: ContentRevisionPayload
+	try {
+		payload = JSON.parse(row.payload_json) as ContentRevisionPayload
+	} catch {
+		return null
+	}
+	return {
+		summary: {
+			id: row.id,
+			contentId: row.content_id,
+			createdAt: row.created_at,
+			createdBy: row.created_by,
+			wordsAdded: row.words_added,
+			wordsRemoved: row.words_removed,
+			tag: row.tag,
+		},
+		payload,
+	}
+}
+
+/**
+ * Restore: replay the revision's item+body+tags+relations through updateContentItem,
+ * then snapshot the restore as a new revision tagged 'restore'.
+ */
+export async function restoreRevision(
+	db: D1Database,
+	contentId: string,
+	revisionId: string,
+	opts: { createdBy?: string | null } = {},
+): Promise<boolean> {
+	const target = await getRevision(db, contentId, revisionId)
+	if (!target) return false
+	const existing = await getContentItem(db, contentId)
+	if (!existing) return false
+	const item = target.payload.item as Record<string, unknown>
+	const content = target.payload.content as Record<string, unknown> | null
+	// Map the snapshot's snake_case row back onto the updateContentItem camelCase input.
+	const body = content as {
+		body_markdown?: string
+		body_html?: string | null
+		subtitle?: string | null
+		script?: string
+		video_id?: string
+		duration_seconds?: number | null
+		thumbnail_image_id?: string | null
+		transcript?: string
+		audio_r2_key?: string
+		editor_takeaways?: string | null
+		faq_json?: string | null
+	} | null
+
+	// Editor takeaways are stored as a JSON-encoded string array on article_content.
+	// updateContentItem takes them as a string[] via content.editorTakeaways, so
+	// parse the snapshot's stored JSON back into an array for a faithful restore.
+	function parseTakeaways(raw: string | null | undefined): string[] | null {
+		if (!raw) return null
+		try {
+			const parsed = JSON.parse(raw)
+			return Array.isArray(parsed) ? (parsed as string[]) : null
+		} catch {
+			return null
+		}
+	}
+	const restoredTakeaways = parseTakeaways(body?.editor_takeaways)
+	// Restore intentionally rolls back CONTENT fields (title/body/tags/relations/
+	// featured/seo/hero/etc.) to the snapshot, but NOT publication state
+	// (status / publish_at / published_at / published_revision_id) — that is by
+	// design: restoring an old draft must not silently re-publish or un-publish.
+	await updateContentItem(db, contentId, {
+		title: (item.title as string) ?? existing.title,
+		featured: Boolean(item.featured),
+		seoTitle: (item.seo_title as string | null) ?? null,
+		description: (item.description as string | null) ?? null,
+		excerpt: (item.excerpt as string | null) ?? null,
+		byline: (item.byline as string | null) ?? null,
+		primaryCategory: (item.channel as string | null) ?? null,
+		primaryTopic: (item.primary_topic as string | null) ?? null,
+		visibility: (item.visibility as 'free' | 'premium') ?? existing.visibility,
+		authorId: (item.author_id as string | null) ?? null,
+		heroImageId: (item.hero_image_id as string | null) ?? null,
+		heroImageAlt: (item.hero_image_alt as string | null) ?? null,
+		heroImageCaption: (item.hero_image_caption as string | null) ?? null,
+		socialImageId: (item.social_image_id as string | null) ?? null,
+		canonicalUrl: (item.canonical_url as string | null) ?? null,
+		// SEO focus keyword is part of the snapshot — restore it too.
+		seoFocusKeyword: (item.seo_focus_keyword as string | null) ?? null,
+		tags: target.payload.tags,
+		relations: target.payload.related.map((r) => ({
+			relatedId: r.related_id,
+			rank: r.rank,
+			reason: r.reason,
+		})),
+		content:
+			existing.type === 'article' || existing.type === 'newsletter'
+				? {
+						bodyMarkdown: body?.body_markdown ?? '',
+						bodyHtml: body?.body_html ?? null,
+						subtitle: body?.subtitle ?? null,
+						// Editor takeaways were captured in the snapshot — roll them back.
+						editorTakeaways: restoredTakeaways,
+					}
+				: existing.type === 'video'
+					? {
+							script: body?.script ?? '',
+							videoId: body?.video_id ?? '',
+							durationSeconds: body?.duration_seconds ?? null,
+							thumbnailImageId: body?.thumbnail_image_id ?? null,
+						}
+					: {
+							transcript: body?.transcript ?? '',
+							audioR2Key: body?.audio_r2_key ?? '',
+							durationSeconds: body?.duration_seconds ?? null,
+						},
+	})
+
+	// updateContentItem does not carry seo_score / ai_og_image_id (these are set
+	// by SEO scoring + AI-OG generation, not the editor form) or faq_json. They
+	// ARE captured in the snapshot, so restore them directly for fidelity — a
+	// restore must reproduce the snapshot, not silently drop SEO/AI metadata.
+	await db
+		.prepare(
+			'UPDATE content_items SET seo_score = ?, ai_og_image_id = ?, updated_at = unixepoch() WHERE id = ?',
+		)
+		.bind(
+			(item.seo_score as number | null) ?? null,
+			(item.ai_og_image_id as string | null) ?? null,
+			contentId,
+		)
+		.run()
+
+	if (existing.type === 'article' || existing.type === 'newsletter') {
+		await db
+			.prepare('UPDATE article_content SET faq_json = ? WHERE content_id = ?')
+			.bind(body?.faq_json ?? null, contentId)
+			.run()
+	}
+
+	await createRevisionWithDelta(db, contentId, {
+		createdBy: opts.createdBy ?? null,
+		tag: 'restore',
+	})
+	return true
+}

package/src/engine/sanitize.ts

@@ -0,0 +1,183 @@
+/**
+ * sanitize.ts
+ *
+ * Shared L2 sanitization passes that run AFTER the validator has emitted
+ * its report. A site's renderers (article, podcast, video) consume these
+ * so they never drift on what counts as "safe stored body".
+ *
+ * Ported verbatim from fulcrum-labs/fronts src/lib/content-sanitize.ts
+ * (inventory §1: extract — the sanitize helper). Each pass is pure and
+ * composable; the default {@link sanitizeBody} orchestration is
+ * idempotent. It reuses the validator checks' `repair` functions so the
+ * detector and the fixer can never diverge.
+ *
+ * Negative invariants:
+ *  - Fenced code blocks are preserved unchanged.
+ *  - Inline code spans are preserved unchanged.
+ *  - URLs inside `[label](url)` are preserved unchanged.
+ *  - Podcast/video speaker prefixes (`Alice:`, `[00:01:23] Bob:`) are
+ *    preserved unchanged — no pass strips the colon or numeric label.
+ *  - Legitimate markdown escapes (`\*emphasis\*`, `\[brackets\]`) are
+ *    preserved unchanged.
+ */
+import { repair as repairBrokenFootnoteLabel } from './validator/checks/broken-footnote-label.js'
+import { repair as repairDoubleEncodedEntities } from './validator/checks/double-encoded-entities.js'
+import { repair as repairHtmlCommentLeak } from './validator/checks/html-comment-leak.js'
+import { repair as repairInvisibleControl } from './validator/checks/invisible-control-chars.js'
+import { repair as repairPaywallMarker } from './validator/checks/paywall-marker-leak.js'
+import { repair as repairRawBlockHtml } from './validator/checks/raw-block-html.js'
+import { repair as repairWordGdocs } from './validator/checks/word-gdocs-paste-artifacts.js'
+
+/* -------------------------------------------------------------------------- */
+/*                              Mirror with validator                         */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * Mirror of the legit-escape set in `./validator/index.ts`. If you
+ * change one, change the other.
+ */
+const LEGIT_ESCAPE_CHARS = '*_[]{}|`#+!>\\-'
+
+/**
+ * Phase 1 strip: drop the leading backslash before any character that
+ * is not a legitimate markdown escape. Mirror of
+ * {@link checkBackslashOverEscape}'s detector.
+ *
+ * Also drops HTML-entity-encoded backslashes (`\`, `\`,
+ * `\`) that bypass the literal-backslash strip.
+ */
+export function stripOverEscapes(value: string): string {
+	const literal = value.replace(/\\(.)/g, (match, ch: string) =>
+		LEGIT_ESCAPE_CHARS.includes(ch) ? match : ch,
+	)
+	return literal.replace(/(?:\|&#x5[Cc];|\)(.)/g, (match, ch: string) =>
+		LEGIT_ESCAPE_CHARS.includes(ch) ? match : ch,
+	)
+}
+
+/**
+ * Phase 1 strip (heading-scoped): decode HTML entities only inside
+ * heading lines. Entities inside paragraph prose are intentionally
+ * left alone — they're sometimes part of legitimate publication
+ * names (`Tools & Trade`).
+ */
+export function decodeHeadingEntities(value: string): string {
+	const ENTITY_MAP: Record<string, string> = {
+		'&quot;': '"',
+		'&apos;': "'",
+		'&#39;': "'",
+		'&amp;': '&',
+		'&lt;': '<',
+		'&gt;': '>',
+	}
+	return value
+		.split('\n')
+		.map((line) => {
+			if (!/^\s*#{1,6}\s+/.test(line)) return line
+			return line.replace(
+				/&(?:quot|apos|amp|lt|gt|#\d+);/g,
+				(entity) => ENTITY_MAP[entity] ?? entity,
+			)
+		})
+		.join('\n')
+}
+
+/* -------------------------------------------------------------------------- */
+/*                             Phase 2 — sanitize passes                      */
+/* -------------------------------------------------------------------------- */
+
+export interface SanitizeOptions {
+	/**
+	 * When true, the speaker-aware passes leave podcast/video speaker
+	 * prefixes alone. Default true (the safe option for all callers).
+	 */
+	preserveSpeakerPrefixes: boolean
+}
+
+export const DEFAULT_SANITIZE_OPTIONS: SanitizeOptions = {
+	preserveSpeakerPrefixes: true,
+}
+
+/**
+ * Phase 2 strip composition. Order matters in a few places — see the
+ * inline comments. The composition is idempotent.
+ *
+ * Order:
+ *   1. Word/Gdocs paste artifacts (strip BEFORE we look for HTML
+ *      comments, because Word paste residue is itself a comment).
+ *   2. HTML comment leak (whitelisted-only).
+ *   3. Paywall marker leak (defensive — even though the splitter
+ *      should have eaten these already).
+ *   4. Double-encoded entities (`&amp;quot;` → `&quot;` — must run
+ *      BEFORE the heading entity decode so it sees the decoded form).
+ *   5. Backslash over-escape (Phase 1 strip). CODE-AWARE: fenced and
+ *      inline code regions are protected.
+ *   6. Heading-entity decode (Phase 1 strip).
+ *   7. Broken footnote label `[[N]](#a)` → `[N](#a)`.
+ *   8. Invisible control chars (last — they're invisible in raw text
+ *      so order vs other passes doesn't matter, but doing it last
+ *      means subsequent regex passes can't get tripped up by them).
+ *   9. `<br>` lines → blank line (raw-block-html repair).
+ */
+export function sanitizeBody(
+	value: string,
+	_options: SanitizeOptions = DEFAULT_SANITIZE_OPTIONS,
+): string {
+	let out = value
+	out = repairWordGdocs(out)
+	out = repairHtmlCommentLeak(out)
+	out = repairPaywallMarker(out)
+	out = repairDoubleEncodedEntities(out)
+	out = stripOverEscapesPreservingCode(out)
+	out = decodeHeadingEntities(out)
+	out = repairBrokenFootnoteLabel(out)
+	out = repairInvisibleControl(out)
+	out = repairRawBlockHtml(out)
+	return out
+}
+
+/**
+ * Code-aware variant of {@link stripOverEscapes}. Fenced (` ``` `) and
+ * inline (` ` `) code regions are extracted, the strip runs on the
+ * surrounding prose, and the code regions are spliced back in
+ * verbatim. This preserves intentional escape sequences in code
+ * examples (`'\, \.'` etc.) while still cleaning prose.
+ */
+function stripOverEscapesPreservingCode(value: string): string {
+	const segments: Array<{ kind: 'prose' | 'code'; text: string }> = []
+	const fenceRe = /(^|\n)([ \t]*)(`{3,}|~{3,})[^\n]*\n[\s\S]*?\n\2\3/g
+	const inlineRe = /`[^`\n]+`/g
+	type Span = { start: number; end: number }
+	const protectedSpans: Span[] = []
+	for (const m of value.matchAll(fenceRe)) {
+		protectedSpans.push({
+			start: m.index ?? 0,
+			end: (m.index ?? 0) + m[0].length,
+		})
+	}
+	for (const m of value.matchAll(inlineRe)) {
+		const start = m.index ?? 0
+		const end = start + m[0].length
+		if (protectedSpans.some((s) => start >= s.start && end <= s.end)) continue
+		protectedSpans.push({ start, end })
+	}
+	protectedSpans.sort((a, b) => a.start - b.start)
+	let cursor = 0
+	for (const span of protectedSpans) {
+		if (span.start > cursor) {
+			segments.push({ kind: 'prose', text: value.slice(cursor, span.start) })
+		}
+		segments.push({ kind: 'code', text: value.slice(span.start, span.end) })
+		cursor = span.end
+	}
+	if (cursor < value.length) {
+		segments.push({ kind: 'prose', text: value.slice(cursor) })
+	}
+	return segments.map((s) => (s.kind === 'prose' ? stripOverEscapes(s.text) : s.text)).join('')
+}
+
+/**
+ * Convenience export — the renderer side of the same module. Returns
+ * the input cleaned via every pass once.
+ */
+export const sanitize = sanitizeBody

package/src/engine/seed-membership.ts

@@ -0,0 +1,92 @@
+// seed-membership.ts — Parameterized membership pre-seed helper (P7 Task 6).
+//
+// PRE-SEED IS AN OPERATOR/CUTOVER STEP.
+//
+// Look up each person's REAL subject in the Fulcrum issuer D1 by email —
+// subjects are minted + stable in the issuer before first login. NEVER
+// hardcode subjects or emails; pass them at call time.
+//
+//   A placeholder id → no membership match → 403 on every request.
+//   A placeholder email on the UNIQUE masthead_users.email column → 500 on the
+//   real person's first login (the exact inbox-platform bug, §16 risk 10).
+//
+// Usage (at cutover, after looking up real subjects in the issuer D1):
+//
+//   await seedMembership(db, { workspaceId: 'ws-prod', subject: 'user:<real-uuid>', email, name, role: 'owner' })
+//
+// This helper is idempotent: calling it twice with the same (workspaceId,
+// subject) pair updates the membership and user profile in place — it does NOT
+// insert a duplicate or fail silently.
+
+import type { CmsRole } from '../schema/types.js'
+import type { D1Database } from './d1.js'
+import { upsertMastheadUser } from './members.js'
+
+// ---------------------------------------------------------------------------
+// Input type
+// ---------------------------------------------------------------------------
+
+export interface SeedMembershipInput {
+	workspaceId: string
+	/**
+	 * The REAL OpenAuth subject from the Fulcrum issuer — MUST start with
+	 * 'user:'. Never pass a locally-minted or placeholder id here.
+	 */
+	subject: string
+	email: string
+	name: string | null
+	role: CmsRole
+}
+
+// ---------------------------------------------------------------------------
+// seedMembership
+// ---------------------------------------------------------------------------
+
+/**
+ * Seed a workspace membership from a known real OpenAuth subject.
+ *
+ * Validates that the subject starts with 'user:' (rejects placeholder ids).
+ * Upserts `masthead_users` (id = subject) and `workspace_memberships` with
+ * `accepted_at` set — a seeded member is pre-accepted (no invite required).
+ *
+ * Idempotent: safe to run multiple times; the second call updates in place.
+ *
+ * Throws if:
+ *   - subject does not start with 'user:' (placeholder guard)
+ *   - a different id already holds the same email (UNIQUE collision on
+ *     masthead_users.email — surfaces as an error, never a silent 500)
+ */
+export async function seedMembership(db: D1Database, input: SeedMembershipInput): Promise<void> {
+	if (!input.subject?.startsWith('user:')) {
+		throw new Error(
+			`seedMembership: subject must start with 'user:' — received: ${JSON.stringify(input.subject)}. ` +
+				'Look up the real subject in the Fulcrum issuer D1 by email before seeding. ' +
+				'A placeholder id causes 403 on every request (§16 risk 10).',
+		)
+	}
+
+	const now = Math.floor(Date.now() / 1000)
+
+	// Upsert masthead_users — will throw a UNIQUE constraint error if a
+	// DIFFERENT id already holds this email (the §16 risk-10 collision surface).
+	// We deliberately do NOT silence that error here.
+	await upsertMastheadUser(db, {
+		id: input.subject,
+		email: input.email,
+		name: input.name,
+		image: null,
+	})
+
+	// Upsert the membership row with accepted_at set (pre-accepted seed).
+	await db
+		.prepare(
+			`INSERT INTO workspace_memberships (workspace_id, user_id, role, invited_by, accepted_at, created_at, updated_at)
+			 VALUES (?, ?, ?, NULL, ?, ?, ?)
+			 ON CONFLICT(workspace_id, user_id) DO UPDATE SET
+			   role = excluded.role,
+			   accepted_at = COALESCE(workspace_memberships.accepted_at, excluded.accepted_at),
+			   updated_at = excluded.updated_at`,
+		)
+		.bind(input.workspaceId, input.subject, input.role, now, now, now)
+		.run()
+}

package/src/engine/seo.ts

@@ -0,0 +1,72 @@
+import { countWords } from './publisher.js'
+
+export interface SeoScoreInput {
+	title: string
+	seoTitle?: string | null
+	description?: string | null
+	focusKeyword?: string | null
+	bodyMarkdown?: string | null
+}
+
+export interface SeoCheck {
+	id: string
+	label: string
+	pass: boolean
+	hint: string
+}
+
+export interface SeoScoreResult {
+	score: number
+	checks: SeoCheck[]
+}
+
+const MIN_DESC = 50
+const MAX_DESC = 160
+const MIN_TITLE = 15
+const MAX_TITLE = 60
+const MIN_BODY_WORDS = 300
+
+/** The in-package default SeoProvider scorer: 5 checks × 20 pts (spec §8). */
+export function scoreDraft(input: SeoScoreInput): SeoScoreResult {
+	const title = (input.seoTitle || input.title || '').trim()
+	const description = (input.description || '').trim()
+	const keyword = (input.focusKeyword || '').trim().toLowerCase()
+	const bodyWords = countWords(input.bodyMarkdown || '')
+	const lcTitle = title.toLowerCase()
+	const lcBody = (input.bodyMarkdown || '').toLowerCase()
+
+	const checks: SeoCheck[] = [
+		{
+			id: 'title-length',
+			label: 'Title length',
+			pass: title.length >= MIN_TITLE && title.length <= MAX_TITLE,
+			hint: `Keep the title between ${MIN_TITLE} and ${MAX_TITLE} characters.`,
+		},
+		{
+			id: 'meta-description',
+			label: 'Meta description',
+			pass: description.length >= MIN_DESC && description.length <= MAX_DESC,
+			hint: `Write a meta description ${MIN_DESC}–${MAX_DESC} characters long.`,
+		},
+		{
+			id: 'keyword-in-title',
+			label: 'Focus keyword in title',
+			pass: keyword.length > 0 && lcTitle.includes(keyword),
+			hint: 'Include the focus keyword in the title.',
+		},
+		{
+			id: 'keyword-in-body',
+			label: 'Focus keyword in body',
+			pass: keyword.length > 0 && lcBody.includes(keyword),
+			hint: 'Mention the focus keyword in the body.',
+		},
+		{
+			id: 'body-length',
+			label: 'Body length',
+			pass: bodyWords >= MIN_BODY_WORDS,
+			hint: `Write at least ${MIN_BODY_WORDS} words (currently ${bodyWords}).`,
+		},
+	]
+	const score = checks.reduce((sum, c) => sum + (c.pass ? 20 : 0), 0)
+	return { score, checks }
+}

package/src/engine/slug-redirects.ts

@@ -0,0 +1,34 @@
+// Slug-redirect engine (P3 Task 2).
+//
+// When a content item's slug is renamed, the old slug must be preserved as a
+// redirect so live URLs survive (spec §8 "slug editor with
+// content_slug_redirects"). This module is the write-side; the redirect lookup
+// lives at the CDN / Fronts edge layer (out of scope for this package).
+//
+// The table `content_slug_redirects` was created in migration 0007:
+//   old_slug TEXT PRIMARY KEY,
+//   content_id TEXT NOT NULL,
+//   created_at INTEGER NOT NULL DEFAULT (unixepoch())
+// ON CONFLICT(old_slug) DO NOTHING ensures idempotency.
+
+import type { D1Database } from './d1.js'
+
+/**
+ * Record `oldSlug` as a redirect pointing at `contentId`.
+ * Idempotent: if `old_slug` is already in the table the row is silently kept
+ * as-is (INSERT … ON CONFLICT(old_slug) DO NOTHING).
+ */
+export async function recordSlugRedirect(
+	db: D1Database,
+	oldSlug: string,
+	contentId: string,
+): Promise<void> {
+	await db
+		.prepare(
+			`INSERT INTO content_slug_redirects (old_slug, content_id)
+       VALUES (?, ?)
+       ON CONFLICT(old_slug) DO NOTHING`,
+		)
+		.bind(oldSlug, contentId)
+		.run()
+}