@growth-labs/cms 0.1.0

package/dist/engine/slug-redirects.js

@@ -0,0 +1,26 @@
+// Slug-redirect engine (P3 Task 2).
+//
+// When a content item's slug is renamed, the old slug must be preserved as a
+// redirect so live URLs survive (spec §8 "slug editor with
+// content_slug_redirects"). This module is the write-side; the redirect lookup
+// lives at the CDN / Fronts edge layer (out of scope for this package).
+//
+// The table `content_slug_redirects` was created in migration 0007:
+//   old_slug TEXT PRIMARY KEY,
+//   content_id TEXT NOT NULL,
+//   created_at INTEGER NOT NULL DEFAULT (unixepoch())
+// ON CONFLICT(old_slug) DO NOTHING ensures idempotency.
+/**
+ * Record `oldSlug` as a redirect pointing at `contentId`.
+ * Idempotent: if `old_slug` is already in the table the row is silently kept
+ * as-is (INSERT … ON CONFLICT(old_slug) DO NOTHING).
+ */
+export async function recordSlugRedirect(db, oldSlug, contentId) {
+    await db
+        .prepare(`INSERT INTO content_slug_redirects (old_slug, content_id)
+       VALUES (?, ?)
+       ON CONFLICT(old_slug) DO NOTHING`)
+        .bind(oldSlug, contentId)
+        .run();
+}
+//# sourceMappingURL=slug-redirects.js.map

package/dist/engine/slug-redirects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug-redirects.js","sourceRoot":"","sources":["../../src/engine/slug-redirects.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,2DAA2D;AAC3D,+EAA+E;AAC/E,wEAAwE;AACxE,EAAE;AACF,oEAAoE;AACpE,+BAA+B;AAC/B,8BAA8B;AAC9B,sDAAsD;AACtD,wDAAwD;AAIxD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,EAAc,EACd,OAAe,EACf,SAAiB;IAEjB,MAAM,EAAE;SACN,OAAO,CACP;;wCAEqC,CACrC;SACA,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;SACxB,GAAG,EAAE,CAAA;AACR,CAAC"}

package/dist/engine/slug.d.ts

@@ -0,0 +1,6 @@
+export declare function slugify(input: string): string;
+export declare function normalizeSlug(input: string | null | undefined): string;
+export declare function ensureTrailingSlash(pathname: string): string;
+export declare function stripTrailingSlash(pathname: string): string;
+export declare function buildContentPath(type: 'article' | 'video' | 'podcast' | 'authors' | 'regions', slug: string): string;
+//# sourceMappingURL=slug.d.ts.map

package/dist/engine/slug.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug.d.ts","sourceRoot":"","sources":["../../src/engine/slug.ts"],"names":[],"mappings":"AAGA,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ7C;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAEtE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED,wBAAgB,gBAAgB,CAC/B,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,EAC7D,IAAI,EAAE,MAAM,GACV,MAAM,CAER"}

package/dist/engine/slug.js

@@ -0,0 +1,28 @@
+// Slug helpers ported verbatim from fulcrum-labs/fronts src/lib/slug.ts
+// (inventory §1: `slug.ts` — extract, pure). No Fronts coupling.
+export function slugify(input) {
+    return input
+        .toLowerCase()
+        .replace(/['"`]/g, '')
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .replace(/--+/g, '-')
+        .trim();
+}
+export function normalizeSlug(input) {
+    return slugify(input ?? '');
+}
+export function ensureTrailingSlash(pathname) {
+    if (!pathname)
+        return '/';
+    return pathname.endsWith('/') ? pathname : `${pathname}/`;
+}
+export function stripTrailingSlash(pathname) {
+    if (!pathname || pathname === '/')
+        return '/';
+    return pathname.replace(/\/+$/, '');
+}
+export function buildContentPath(type, slug) {
+    return ensureTrailingSlash(`/${type}/${normalizeSlug(slug)}`);
+}
+//# sourceMappingURL=slug.js.map

package/dist/engine/slug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug.js","sourceRoot":"","sources":["../../src/engine/slug.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,iEAAiE;AAEjE,MAAM,UAAU,OAAO,CAAC,KAAa;IACpC,OAAO,KAAK;SACV,WAAW,EAAE;SACb,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAA;AACT,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC7D,OAAO,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IACnD,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAA;IACzB,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IAClD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IAC7C,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC/B,IAA6D,EAC7D,IAAY;IAEZ,OAAO,mBAAmB,CAAC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC9D,CAAC"}

package/dist/engine/soft-delete.d.ts

@@ -0,0 +1,8 @@
+import type { D1Database } from './d1.js';
+export declare function softDeleteContent(db: D1Database, id: string, now?: number): Promise<boolean>;
+export declare function restoreContent(db: D1Database, id: string): Promise<boolean>;
+/** Hard delete. content_* child tables cascade via the 0001 FKs. */
+export declare function purgeContent(db: D1Database, id: string): Promise<boolean>;
+/** Ids of non-trashed content (list/board exclude deleted_at IS NOT NULL). */
+export declare function listActiveIds(db: D1Database): Promise<string[]>;
+//# sourceMappingURL=soft-delete.d.ts.map

package/dist/engine/soft-delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"soft-delete.d.ts","sourceRoot":"","sources":["../../src/engine/soft-delete.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEzC,wBAAsB,iBAAiB,CACtC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,GAAG,CAAC,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CASlB;AAED,wBAAsB,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQjF;AAED,oEAAoE;AACpE,wBAAsB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG/E;AAED,8EAA8E;AAC9E,wBAAsB,aAAa,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAOrE"}

package/dist/engine/soft-delete.js

@@ -0,0 +1,28 @@
+export async function softDeleteContent(db, id, now) {
+    const ts = now ?? Math.floor(Date.now() / 1000);
+    const res = await db
+        .prepare('UPDATE content_items SET deleted_at = ?, updated_at = unixepoch() WHERE id = ? AND deleted_at IS NULL')
+        .bind(ts, id)
+        .run();
+    return Boolean(res.meta && res.meta.changes);
+}
+export async function restoreContent(db, id) {
+    const res = await db
+        .prepare('UPDATE content_items SET deleted_at = NULL, updated_at = unixepoch() WHERE id = ? AND deleted_at IS NOT NULL')
+        .bind(id)
+        .run();
+    return Boolean(res.meta && res.meta.changes);
+}
+/** Hard delete. content_* child tables cascade via the 0001 FKs. */
+export async function purgeContent(db, id) {
+    const res = await db.prepare('DELETE FROM content_items WHERE id = ?').bind(id).run();
+    return Boolean(res.meta && res.meta.changes);
+}
+/** Ids of non-trashed content (list/board exclude deleted_at IS NOT NULL). */
+export async function listActiveIds(db) {
+    const result = await db
+        .prepare('SELECT id FROM content_items WHERE deleted_at IS NULL ORDER BY updated_at DESC, id DESC')
+        .all();
+    return (result.results || []).map((r) => r.id);
+}
+//# sourceMappingURL=soft-delete.js.map

package/dist/engine/soft-delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"soft-delete.js","sourceRoot":"","sources":["../../src/engine/soft-delete.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,EAAc,EACd,EAAU,EACV,GAAY;IAEZ,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,MAAM,EAAE;SAClB,OAAO,CACP,uGAAuG,CACvG;SACA,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;SACZ,GAAG,EAAE,CAAA;IACP,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAK,GAAG,CAAC,IAA6B,CAAC,OAAO,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAc,EAAE,EAAU;IAC9D,MAAM,GAAG,GAAG,MAAM,EAAE;SAClB,OAAO,CACP,8GAA8G,CAC9G;SACA,IAAI,CAAC,EAAE,CAAC;SACR,GAAG,EAAE,CAAA;IACP,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAK,GAAG,CAAC,IAA6B,CAAC,OAAO,CAAC,CAAA;AACvE,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAc,EAAE,EAAU;IAC5D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAA;IACrF,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAK,GAAG,CAAC,IAA6B,CAAC,OAAO,CAAC,CAAA;AACvE,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAc;IACjD,MAAM,MAAM,GAAG,MAAM,EAAE;SACrB,OAAO,CACP,yFAAyF,CACzF;SACA,GAAG,EAAkB,CAAA;IACvB,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AAC/C,CAAC"}

package/dist/engine/tags.d.ts

@@ -0,0 +1,14 @@
+import type { D1Database } from './d1.js';
+export interface TagSummary {
+    id: string;
+    slug: string;
+    label: string;
+    count: number;
+}
+export declare function getTag(db: D1Database, tagId: string): Promise<TagSummary | null>;
+export declare function createTag(db: D1Database, label: string): Promise<TagSummary | null>;
+export declare function listTags(db: D1Database): Promise<TagSummary[]>;
+export declare function searchTags(db: D1Database, q: string): Promise<TagSummary[]>;
+export declare function renameTag(db: D1Database, tagId: string, label: string): Promise<boolean>;
+export declare function deleteTag(db: D1Database, tagId: string): Promise<boolean>;
+//# sourceMappingURL=tags.d.ts.map

package/dist/engine/tags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tags.d.ts","sourceRoot":"","sources":["../../src/engine/tags.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAGzC,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACb;AAED,wBAAsB,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAYtF;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAezF;AAED,wBAAsB,QAAQ,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAUpE;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAYjF;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB9F;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/E"}

package/dist/engine/tags.js

@@ -0,0 +1,79 @@
+// Tag CRUD engine — backs the Organize-tab tag management.
+// setContentTags / ensureTags (auto-create on assign) stay in publisher.ts;
+// this module adds management over content_tags + content_tag_links.
+import { slugify } from './slug.js';
+export async function getTag(db, tagId) {
+    const row = await db
+        .prepare(`SELECT t.id, t.slug, t.label, COUNT(l.content_id) AS count
+			 FROM content_tags t
+			 LEFT JOIN content_tag_links l ON l.tag_id = t.id
+			 WHERE t.id = ?
+			 GROUP BY t.id LIMIT 1`)
+        .bind(tagId)
+        .first();
+    return row ?? null;
+}
+export async function createTag(db, label) {
+    const slug = slugify(label);
+    const trimmed = label.trim();
+    if (!slug || !trimmed)
+        return null;
+    const existing = await db
+        .prepare('SELECT id FROM content_tags WHERE slug = ? LIMIT 1')
+        .bind(slug)
+        .first();
+    if (existing)
+        return null;
+    const id = crypto.randomUUID();
+    await db
+        .prepare('INSERT INTO content_tags (id, slug, label) VALUES (?, ?, ?)')
+        .bind(id, slug, trimmed)
+        .run();
+    return { id, slug, label: trimmed, count: 0 };
+}
+export async function listTags(db) {
+    const result = await db
+        .prepare(`SELECT t.id, t.slug, t.label, COUNT(l.content_id) AS count
+			 FROM content_tags t
+			 LEFT JOIN content_tag_links l ON l.tag_id = t.id
+			 GROUP BY t.id ORDER BY count DESC, t.label ASC`)
+        .all();
+    return result.results || [];
+}
+export async function searchTags(db, q) {
+    const needle = `${slugify(q)}%`;
+    const result = await db
+        .prepare(`SELECT t.id, t.slug, t.label, COUNT(l.content_id) AS count
+			 FROM content_tags t
+			 LEFT JOIN content_tag_links l ON l.tag_id = t.id
+			 WHERE t.slug LIKE ? GROUP BY t.id ORDER BY t.label ASC LIMIT 50`)
+        .bind(needle)
+        .all();
+    return result.results || [];
+}
+export async function renameTag(db, tagId, label) {
+    const slug = slugify(label);
+    const trimmed = label.trim();
+    if (!slug || !trimmed)
+        return false;
+    // content_tags.slug is UNIQUE — a rename whose target slug is already taken by
+    // a DIFFERENT tag would throw a constraint error. Fail gracefully (the
+    // Promise<boolean> contract) instead, matching the empty-slug early return.
+    const clash = await db
+        .prepare('SELECT id FROM content_tags WHERE slug = ? AND id != ? LIMIT 1')
+        .bind(slug, tagId)
+        .first();
+    if (clash)
+        return false;
+    const res = await db
+        .prepare('UPDATE content_tags SET label = ?, slug = ? WHERE id = ?')
+        .bind(trimmed, slug, tagId)
+        .run();
+    return Boolean(res.meta && res.meta.changes);
+}
+export async function deleteTag(db, tagId) {
+    // content_tag_links has ON DELETE CASCADE on tag_id (0001), so links go too.
+    const res = await db.prepare('DELETE FROM content_tags WHERE id = ?').bind(tagId).run();
+    return Boolean(res.meta && res.meta.changes);
+}
+//# sourceMappingURL=tags.js.map

package/dist/engine/tags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tags.js","sourceRoot":"","sources":["../../src/engine/tags.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,4EAA4E;AAC5E,qEAAqE;AAGrE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AASnC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAc,EAAE,KAAa;IACzD,MAAM,GAAG,GAAG,MAAM,EAAE;SAClB,OAAO,CACP;;;;0BAIuB,CACvB;SACA,IAAI,CAAC,KAAK,CAAC;SACX,KAAK,EAAc,CAAA;IACrB,OAAO,GAAG,IAAI,IAAI,CAAA;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAc,EAAE,KAAa;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,MAAM,EAAE;SACvB,OAAO,CAAC,oDAAoD,CAAC;SAC7D,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,EAAkB,CAAA;IACzB,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAC9B,MAAM,EAAE;SACN,OAAO,CAAC,6DAA6D,CAAC;SACtE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC;SACvB,GAAG,EAAE,CAAA;IACP,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAc;IAC5C,MAAM,MAAM,GAAG,MAAM,EAAE;SACrB,OAAO,CACP;;;mDAGgD,CAChD;SACA,GAAG,EAA8D,CAAA;IACnE,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAc,EAAE,CAAS;IACzD,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,EAAE;SACrB,OAAO,CACP;;;oEAGiE,CACjE;SACA,IAAI,CAAC,MAAM,CAAC;SACZ,GAAG,EAA8D,CAAA;IACnE,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAc,EAAE,KAAa,EAAE,KAAa;IAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IACnC,+EAA+E;IAC/E,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,MAAM,EAAE;SACpB,OAAO,CAAC,gEAAgE,CAAC;SACzE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;SACjB,KAAK,EAAkB,CAAA;IACzB,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,GAAG,GAAG,MAAM,EAAE;SAClB,OAAO,CAAC,0DAA0D,CAAC;SACnE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC;SAC1B,GAAG,EAAE,CAAA;IACP,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAK,GAAG,CAAC,IAA6B,CAAC,OAAO,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAc,EAAE,KAAa;IAC5D,6EAA6E;IAC7E,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAA;IACvF,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAK,GAAG,CAAC,IAA6B,CAAC,OAAO,CAAC,CAAA;AACvE,CAAC"}

package/dist/engine/topics.d.ts

@@ -0,0 +1,10 @@
+import type { D1Database } from './d1.js';
+export interface TopicSummary {
+    slug: string;
+    label: string;
+    count: number;
+}
+export declare function listTopics(db: D1Database): Promise<TopicSummary[]>;
+export declare function createTopic(db: D1Database, label: string): Promise<TopicSummary | null>;
+export declare function renameTopic(db: D1Database, currentSlug: string, label: string): Promise<TopicSummary | null>;
+//# sourceMappingURL=topics.d.ts.map

package/dist/engine/topics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"topics.d.ts","sourceRoot":"","sources":["../../src/engine/topics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAGzC,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACb;AA4BD,wBAAsB,UAAU,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA2BxE;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAuB7F;AAED,wBAAsB,WAAW,CAChC,EAAE,EAAE,UAAU,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAgE9B"}

package/dist/engine/topics.js

@@ -0,0 +1,140 @@
+import { slugify } from './slug.js';
+function isMissingTopicsTable(error) {
+    return error instanceof Error && /no such table: cms_topics/i.test(error.message);
+}
+async function listStoredTopics(db) {
+    try {
+        const result = await db
+            .prepare('SELECT slug, label FROM cms_topics ORDER BY label ASC')
+            .all();
+        return result.results || [];
+    }
+    catch (error) {
+        if (isMissingTopicsTable(error))
+            return [];
+        throw error;
+    }
+}
+async function hasStoredTopicsTable(db) {
+    try {
+        await db.prepare('SELECT 1 FROM cms_topics LIMIT 1').first();
+        return true;
+    }
+    catch (error) {
+        if (isMissingTopicsTable(error))
+            return false;
+        throw error;
+    }
+}
+export async function listTopics(db) {
+    const result = await db
+        .prepare(`SELECT primary_topic AS slug, primary_topic AS label, COUNT(*) AS count
+			 FROM content_items
+			 WHERE deleted_at IS NULL
+				AND primary_topic IS NOT NULL
+				AND TRIM(primary_topic) != ''
+			 GROUP BY primary_topic
+			 ORDER BY count DESC, primary_topic ASC`)
+        .all();
+    const merged = new Map();
+    for (const row of result.results || []) {
+        merged.set(row.slug, { slug: row.slug, label: row.label, count: Number(row.count) || 0 });
+    }
+    for (const topic of await listStoredTopics(db)) {
+        const existing = merged.get(topic.slug);
+        merged.set(topic.slug, {
+            slug: topic.slug,
+            label: topic.label,
+            count: existing?.count ?? 0,
+        });
+    }
+    return Array.from(merged.values()).sort((a, b) => b.count - a.count || a.label.localeCompare(b.label));
+}
+export async function createTopic(db, label) {
+    const slug = slugify(label);
+    if (!slug)
+        return null;
+    if (!(await hasStoredTopicsTable(db)))
+        return null;
+    const assigned = await db
+        .prepare('SELECT 1 FROM content_items WHERE primary_topic = ? LIMIT 1')
+        .bind(slug)
+        .first();
+    if (assigned)
+        return null;
+    try {
+        await db
+            .prepare(`INSERT INTO cms_topics (slug, label, created_at, updated_at)
+				 VALUES (?, ?, unixepoch(), unixepoch())`)
+            .bind(slug, label.trim())
+            .run();
+    }
+    catch {
+        return null;
+    }
+    return { slug, label: label.trim(), count: 0 };
+}
+export async function renameTopic(db, currentSlug, label) {
+    const nextSlug = slugify(label);
+    if (!currentSlug || !nextSlug)
+        return null;
+    const nextLabel = label.trim();
+    if (nextSlug !== currentSlug) {
+        const contentClash = await db
+            .prepare('SELECT 1 FROM content_items WHERE primary_topic = ? LIMIT 1')
+            .bind(nextSlug)
+            .first();
+        if (contentClash)
+            return null;
+        try {
+            const storedClash = await db
+                .prepare('SELECT 1 FROM cms_topics WHERE slug = ? AND slug != ? LIMIT 1')
+                .bind(nextSlug, currentSlug)
+                .first();
+            if (storedClash)
+                return null;
+        }
+        catch (error) {
+            if (!isMissingTopicsTable(error))
+                throw error;
+        }
+    }
+    let hadStoredTopic = false;
+    const storedTopicsAvailable = await hasStoredTopicsTable(db);
+    if (storedTopicsAvailable) {
+        const stored = await db
+            .prepare('SELECT 1 FROM cms_topics WHERE slug = ? LIMIT 1')
+            .bind(currentSlug)
+            .first();
+        hadStoredTopic = Boolean(stored);
+        if (hadStoredTopic) {
+            await db
+                .prepare('UPDATE cms_topics SET slug = ?, label = ?, updated_at = unixepoch() WHERE slug = ?')
+                .bind(nextSlug, nextLabel, currentSlug)
+                .run();
+        }
+    }
+    const res = await db
+        .prepare(`UPDATE content_items
+			 SET primary_topic = ?, updated_at = unixepoch()
+			 WHERE deleted_at IS NULL AND primary_topic = ?`)
+        .bind(nextSlug, currentSlug)
+        .run();
+    const changes = res.meta?.changes ?? 0;
+    if (changes === 0 && !hadStoredTopic)
+        return null;
+    if (storedTopicsAvailable && !hadStoredTopic) {
+        await db
+            .prepare(`INSERT OR REPLACE INTO cms_topics (slug, label, created_at, updated_at)
+				 VALUES (
+				   ?,
+				   ?,
+				   COALESCE((SELECT created_at FROM cms_topics WHERE slug = ?), unixepoch()),
+				   unixepoch()
+				 )`)
+            .bind(nextSlug, nextLabel, nextSlug)
+            .run();
+    }
+    return { slug: nextSlug, label: nextLabel, count: changes };
+}
+//# sourceMappingURL=topics.js.map

package/dist/engine/topics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"topics.js","sourceRoot":"","sources":["../../src/engine/topics.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAQnC,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,KAAK,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AAClF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,EAAc;IAC7C,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,EAAE;aACrB,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,EAAmC,CAAA;QACxC,OAAO,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAA;QAC1C,MAAM,KAAK,CAAA;IACZ,CAAC;AACF,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,EAAc;IACjD,IAAI,CAAC;QACJ,MAAM,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC,KAAK,EAAE,CAAA;QAC5D,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,oBAAoB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC7C,MAAM,KAAK,CAAA;IACZ,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAc;IAC9C,MAAM,MAAM,GAAG,MAAM,EAAE;SACrB,OAAO,CACP;;;;;;2CAMwC,CACxC;SACA,GAAG,EAAgB,CAAA;IACrB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC9C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC1F,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC;SAC3B,CAAC,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAC7D,CAAA;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc,EAAE,KAAa;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAElD,MAAM,QAAQ,GAAG,MAAM,EAAE;SACvB,OAAO,CAAC,6DAA6D,CAAC;SACtE,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,EAAE,CAAA;IACT,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAA;IAEzB,IAAI,CAAC;QACJ,MAAM,EAAE;aACN,OAAO,CACP;6CACyC,CACzC;aACA,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;aACxB,GAAG,EAAE,CAAA;IACR,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,EAAc,EACd,WAAmB,EACnB,KAAa;IAEb,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/B,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,MAAM,EAAE;aAC3B,OAAO,CAAC,6DAA6D,CAAC;aACtE,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,EAAE,CAAA;QACT,IAAI,YAAY;YAAE,OAAO,IAAI,CAAA;QAC7B,IAAI,CAAC;YACJ,MAAM,WAAW,GAAG,MAAM,EAAE;iBAC1B,OAAO,CAAC,+DAA+D,CAAC;iBACxE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;iBAC3B,KAAK,EAAE,CAAA;YACT,IAAI,WAAW;gBAAE,OAAO,IAAI,CAAA;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAA;QAC9C,CAAC;IACF,CAAC;IAED,IAAI,cAAc,GAAG,KAAK,CAAA;IAC1B,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAA;IAC5D,IAAI,qBAAqB,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,EAAE;aACrB,OAAO,CAAC,iDAAiD,CAAC;aAC1D,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,EAAE,CAAA;QACT,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAChC,IAAI,cAAc,EAAE,CAAC;YACpB,MAAM,EAAE;iBACN,OAAO,CACP,oFAAoF,CACpF;iBACA,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC;iBACtC,GAAG,EAAE,CAAA;QACR,CAAC;IACF,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,EAAE;SAClB,OAAO,CACP;;mDAEgD,CAChD;SACA,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;SAC3B,GAAG,EAAE,CAAA;IACP,MAAM,OAAO,GAAI,GAAG,CAAC,IAAyC,EAAE,OAAO,IAAI,CAAC,CAAA;IAC5E,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,qBAAqB,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,MAAM,EAAE;aACN,OAAO,CACP;;;;;;OAMG,CACH;aACA,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC;aACnC,GAAG,EAAE,CAAA;IACR,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AAC5D,CAAC"}

package/dist/engine/url-guard.d.ts

@@ -0,0 +1,12 @@
+export interface UrlGuardResult {
+    ok: boolean;
+    reason?: string;
+}
+/**
+ * Validate a webhook URL against the SSRF policy.
+ *
+ * Returns `{ ok: true }` only for a public `https:` URL with no credentials
+ * whose host is not a loopback/link-local/private/internal target.
+ */
+export declare function validateWebhookUrl(raw: string): UrlGuardResult;
+//# sourceMappingURL=url-guard.d.ts.map

package/dist/engine/url-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-guard.d.ts","sourceRoot":"","sources":["../../src/engine/url-guard.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAyCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CA2D9D"}

package/dist/engine/url-guard.js

@@ -0,0 +1,129 @@
+// url-guard.ts — SSRF guard for outbound webhook URLs.
+//
+// The webhook `url` registered by a workspace is later fetched by
+// buildDefaultDispatchWebhook (POST with the signed envelope). Without
+// validation that is an arbitrary-outbound-POST / SSRF primitive — a member
+// could point a hook at an internal service, the cloud metadata endpoint, or a
+// loopback admin port and have the Worker make the request from inside the
+// trust boundary.
+//
+// This module is the single source of truth for "is this URL safe to register
+// and POST to". It is enforced in TWO places:
+//   1. the create/update route — reject with 400 so a bad URL never persists.
+//   2. fire time (buildDefaultDispatchWebhook) — defense in depth, in case a
+//      row predates the guard or was written out-of-band.
+//
+// Policy: require `https:`, reject credentials-in-URL, reject hosts that resolve
+// to (or are written as) loopback / link-local / cloud-metadata / RFC-1918
+// private space, and reject internal-only hostname suffixes (`.internal`,
+// `.local`) plus bare single-label hostnames (intranet-style).
+//
+// NOTE: this is a host-literal + name-suffix check, not a DNS resolution check.
+// workerd has no synchronous DNS and the fetch egress is the real boundary; this
+// blocks the obvious literal-IP and well-known-name SSRF classes. DNS-rebinding
+// to a private IP is out of scope for a package-level guard (it requires a
+// pinned-IP fetch the host owns).
+function fail(reason) {
+    return { ok: false, reason };
+}
+/** Internal-only hostname suffixes that must never receive a webhook POST. */
+const BLOCKED_HOST_SUFFIXES = ['.internal', '.local'];
+/** Decimal-octet test for an IPv4 literal. */
+function parseIpv4(host) {
+    const parts = host.split('.');
+    if (parts.length !== 4)
+        return null;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const n = Number(part);
+        if (n > 255)
+            return null;
+        octets.push(n);
+    }
+    return octets;
+}
+/** True if the IPv4 literal is in a loopback / link-local / private / unspecified range. */
+function isBlockedIpv4(octets) {
+    const [a, b] = octets;
+    // 0.0.0.0/8 — "this host" / unspecified.
+    if (a === 0)
+        return true;
+    // 127.0.0.0/8 — loopback.
+    if (a === 127)
+        return true;
+    // 10.0.0.0/8 — private.
+    if (a === 10)
+        return true;
+    // 172.16.0.0/12 — private (172.16 – 172.31).
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    // 192.168.0.0/16 — private.
+    if (a === 192 && b === 168)
+        return true;
+    // 169.254.0.0/16 — link-local (incl. 169.254.169.254 cloud metadata).
+    if (a === 169 && b === 254)
+        return true;
+    return false;
+}
+/**
+ * Validate a webhook URL against the SSRF policy.
+ *
+ * Returns `{ ok: true }` only for a public `https:` URL with no credentials
+ * whose host is not a loopback/link-local/private/internal target.
+ */
+export function validateWebhookUrl(raw) {
+    if (!raw || typeof raw !== 'string')
+        return fail('url is required');
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return fail('url is not a valid absolute URL');
+    }
+    // 1. Scheme — https only (rejects http, file, gopher, ftp, data, ...).
+    if (url.protocol !== 'https:') {
+        return fail('url must use the https scheme');
+    }
+    // 2. No credentials in the URL (user:pass@host).
+    if (url.username || url.password) {
+        return fail('url must not contain credentials');
+    }
+    // Normalize the host: strip IPv6 brackets, lowercase, drop a trailing dot.
+    let host = url.hostname.toLowerCase();
+    if (host.endsWith('.'))
+        host = host.slice(0, -1);
+    if (!host)
+        return fail('url host is empty');
+    // 3. IPv6 loopback / unspecified (URL.hostname strips the brackets).
+    if (host === '::1' || host === '::' || host === '0:0:0:0:0:0:0:1') {
+        return fail('url host is a loopback address');
+    }
+    // 4. localhost (by name).
+    if (host === 'localhost' || host.endsWith('.localhost')) {
+        return fail('url host is localhost');
+    }
+    // 5. IPv4 literal in a blocked range.
+    const ipv4 = parseIpv4(host);
+    if (ipv4) {
+        if (isBlockedIpv4(ipv4)) {
+            return fail('url host is a private, loopback, or link-local address');
+        }
+        // A public IPv4 literal is allowed.
+        return { ok: true };
+    }
+    // 6. Internal-only name suffixes (.internal, .local).
+    for (const suffix of BLOCKED_HOST_SUFFIXES) {
+        if (host.endsWith(suffix)) {
+            return fail(`url host suffix '${suffix}' is internal-only`);
+        }
+    }
+    // 7. Bare single-label hostname (no dot) — intranet-style, not public DNS.
+    if (!host.includes('.')) {
+        return fail('url host must be a fully-qualified public hostname');
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=url-guard.js.map

package/dist/engine/url-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-guard.js","sourceRoot":"","sources":["../../src/engine/url-guard.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,kEAAkE;AAClE,uEAAuE;AACvE,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,kBAAkB;AAClB,EAAE;AACF,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAC9E,6EAA6E;AAC7E,0DAA0D;AAC1D,EAAE;AACF,iFAAiF;AACjF,2EAA2E;AAC3E,0EAA0E;AAC1E,+DAA+D;AAC/D,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,2EAA2E;AAC3E,kCAAkC;AAOlC,SAAS,IAAI,CAAC,MAAc;IAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC;AAED,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;AAErD,8CAA8C;AAC9C,SAAS,SAAS,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACf,CAAC;IACD,OAAO,MAA0C,CAAA;AAClD,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,MAAwC;IAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAA;IACrB,yCAAyC;IACzC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxB,0BAA0B;IAC1B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC1B,wBAAwB;IACxB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IACzB,6CAA6C;IAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA;IAChD,4BAA4B;IAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,sEAAsE;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,KAAK,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAEnE,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC,iCAAiC,CAAC,CAAA;IAC/C,CAAC;IAED,uEAAuE;IACvE,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,+BAA+B,CAAC,CAAA;IAC7C,CAAC;IAED,iDAAiD;IACjD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAChD,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAEhD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAE3C,qEAAqE;IACrE,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,gCAAgC,CAAC,CAAA;IAC9C,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAA;IACrC,CAAC;IAED,sCAAsC;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,IAAI,EAAE,CAAC;QACV,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,wDAAwD,CAAC,CAAA;QACtE,CAAC;QACD,oCAAoC;QACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IACpB,CAAC;IAED,sDAAsD;IACtD,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,oBAAoB,MAAM,oBAAoB,CAAC,CAAA;QAC5D,CAAC;IACF,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,oDAAoD,CAAC,CAAA;IAClE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACpB,CAAC"}

package/dist/engine/validator/checks/bare-url-not-autolinked.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `bare-url-not-autolinked`
+ *
+ * Detect bare `https://…` URLs in prose that aren't wrapped in a
+ * markdown link, autolink, fenced code, inline code, or HTML
+ * attribute. The renderer auto-links them in newer markdown variants,
+ * but Fronts' renderer doesn't — so bare URLs ship as plain text.
+ *
+ * AST-aware via the shared {@link buildProtectedMask} helper so we
+ * don't flag URLs that live inside the protected regions.
+ */
+import type { ArticleBodyInput, ValidationError } from '../types.js';
+export declare function check(input: ArticleBodyInput): ValidationError[];
+/**
+ * Pure repair: wrap bare URLs in `<url>` autolinks. Only used when the
+ * operator opts in (some bodies intentionally print URLs as text in
+ * citation footnotes — the wrap changes how they render).
+ */
+export declare function repair(value: string): string;
+//# sourceMappingURL=bare-url-not-autolinked.d.ts.map

package/dist/engine/validator/checks/bare-url-not-autolinked.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bare-url-not-autolinked.d.ts","sourceRoot":"","sources":["../../../../src/engine/validator/checks/bare-url-not-autolinked.ts"],"names":[],"mappings":"AACA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AA8BpE,wBAAgB,KAAK,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,EAAE,CAgBhE;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAY5C"}

package/dist/engine/validator/checks/bare-url-not-autolinked.js

@@ -0,0 +1,54 @@
+import { buildProtectedMask, isProtectedSpan } from '../scan.js';
+import { makeError } from '../types.js';
+// Greedy URL match — everything that isn't whitespace or a clearly
+// terminal character. Trailing punctuation is trimmed in a second pass.
+const BARE_URL_RE = /\bhttps?:\/\/[^\s<>"'`)\]]+/g;
+const TRAILING_PUNCT_RE = /[.,;:!?]+$/;
+function findBareUrls(value) {
+    const out = [];
+    for (const match of value.matchAll(BARE_URL_RE)) {
+        const start = match.index ?? 0;
+        let url = match[0];
+        // Trim trailing punctuation that isn't part of the URL — `.com).` etc.
+        const trimMatch = TRAILING_PUNCT_RE.exec(url);
+        if (trimMatch) {
+            url = url.slice(0, trimMatch.index);
+        }
+        out.push({ start, end: start + url.length, url });
+    }
+    return out;
+}
+export function check(input) {
+    if (!input.body_markdown)
+        return [];
+    const source = input.body_markdown;
+    const mask = buildProtectedMask(source);
+    for (const m of findBareUrls(source)) {
+        if (isProtectedSpan(mask, m.start, m.end))
+            continue;
+        return [
+            makeError('bare-url-not-autolinked', `Bare URL '${m.url}' is not wrapped in a markdown link. Wrap as '[label](${m.url})' or '<${m.url}>'.`, { start: m.start, end: m.end }),
+        ];
+    }
+    return [];
+}
+/**
+ * Pure repair: wrap bare URLs in `<url>` autolinks. Only used when the
+ * operator opts in (some bodies intentionally print URLs as text in
+ * citation footnotes — the wrap changes how they render).
+ */
+export function repair(value) {
+    const mask = buildProtectedMask(value);
+    let out = '';
+    let cursor = 0;
+    for (const m of findBareUrls(value)) {
+        if (isProtectedSpan(mask, m.start, m.end))
+            continue;
+        out += value.slice(cursor, m.start);
+        out += `<${m.url}>`;
+        cursor = m.end;
+    }
+    out += value.slice(cursor);
+    return out;
+}
+//# sourceMappingURL=bare-url-not-autolinked.js.map

package/dist/engine/validator/checks/bare-url-not-autolinked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bare-url-not-autolinked.js","sourceRoot":"","sources":["../../../../src/engine/validator/checks/bare-url-not-autolinked.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAahE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,mEAAmE;AACnE,wEAAwE;AACxE,MAAM,WAAW,GAAG,8BAA8B,CAAA;AAElD,MAAM,iBAAiB,GAAG,YAAY,CAAA;AAQtC,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,GAAG,GAAe,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;QAC9B,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAClB,uEAAuE;QACvE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC7C,IAAI,SAAS,EAAE,CAAC;YACf,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,KAAuB;IAC5C,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,CAAA;IAClC,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAEvC,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC;YAAE,SAAQ;QACnD,OAAO;YACN,SAAS,CACR,yBAAyB,EACzB,aAAa,CAAC,CAAC,GAAG,yDAAyD,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,GAAG,KAAK,EACrG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAC9B;SACD,CAAA;IACF,CAAC;IACD,OAAO,EAAE,CAAA;AACV,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IACnC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC;YAAE,SAAQ;QACnD,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;QACnC,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,CAAA;QACnB,MAAM,GAAG,CAAC,CAAC,GAAG,CAAA;IACf,CAAC;IACD,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO,GAAG,CAAA;AACX,CAAC"}