@scalemule/news-publication 0.0.34 → 0.0.36

package/README.md

@@ -111,3 +111,45 @@ The review endpoint returns the decision for the exact invited revision. Editors
 ### Publication framing for private previews (0.0.28)
 
 Pass `publicationHeader` and `publicationFooter` React nodes to `StoryReview` to reuse a publication's real navigation, masthead, and footer. The private banner remains above the publication header and the review controls remain separate from the story. The standalone masthead remains the default. The host must suppress analytics on private review routes; public article indexing and sharing features are not mounted by these slots. This patch changes presentation only; review permissions and publication gates are unchanged.
+
+### Private review sign-in and email options
+
+`StoryReview` accepts `readerAccountUrl` and a client `renderSignIn(returnTo)`
+function so the host publication can reuse its existing account and sign-in
+components. Hosts must implement the `/api/news/review/:session/account`
+server adapter to connect the authenticated, verified reader through Blog’s
+`join-account` endpoint. Never trust a browser-supplied email or verification flag.
+The private return path belongs in the host’s signed, HttpOnly OAuth flow cookie,
+not the provider’s authorization URL. Contributor access does not imply subject
+approval authority.
+
+Optional questions can be browsed and copied before identity verification.
+`feedbackEmail` enables mail-app links containing the story title, exact revision
+reference and optional answers, never the invitation credential. Configure a
+monitored mailbox; received email must be recorded by the newsroom. Online
+answers retain their existing autosave and explicit-send behavior.
+
+## Community Maps
+
+The `community-maps-server` subpath exports `createPublicationCommunityMapsHandler`.
+Supply a resolver that verifies the publication host using your existing site lookup,
+then returns its server API key, gateway origin, canonical public origin, and trusted
+reader context. Forward only the public allowlisted catch-all route. The handler
+checks POST origins, bounds uploads, signs an HttpOnly reader cookie, and applies
+no-store responses. It never proxies editorial routes or accepts a caller-selected
+application ID. Use a Node server runtime; this module imports node:crypto.
+
+The `community-maps-view` subpath exports `PublicationCommunityMapPage` and
+`CommunityMapArticleEmbeds`. Supply the publication chrome and import the React map CSS.
+The optional React peer is required only when consuming these views. Use the map
+worker asset CLI from `@scalemule/react` before building the site.
+
+Article integration uses the existing Blog metadata extension:
+
+```json
+{"community_maps":[{"collection_slug":"halloween-2026","mode":"map"}]}
+```
+
+Other modes are `cards` and `features`; optional `area_id` / `feature_ids` select live
+records. No copied feature snapshot is embedded in a story, so withdrawal takes effect
+on the next read. Publishers should apply their caption policy to public media copy.

package/dist/chunk-IMYBSG7J.js

@@ -0,0 +1,23 @@
+// src/community-maps.ts
+function communityMapEmbeds(metadata) {
+  if (!metadata || typeof metadata !== "object") return [];
+  const value = metadata.community_maps;
+  if (!Array.isArray(value)) return [];
+  return value.slice(0, 5).flatMap((entry) => {
+    if (!entry || typeof entry !== "object" || typeof entry.collection_slug !== "string" || !/^[a-z0-9-]{1,191}$/.test(entry.collection_slug) || !["map", "cards", "features"].includes(entry.mode))
+      return [];
+    const ids = Array.isArray(entry.feature_ids) ? entry.feature_ids.filter(
+      (id) => typeof id === "string" && /^[0-9a-f-]{36}$/i.test(id)
+    ).slice(0, 20) : void 0;
+    return [
+      {
+        collection_slug: entry.collection_slug,
+        mode: entry.mode,
+        feature_ids: ids,
+        area_id: typeof entry.area_id === "string" && /^[0-9a-f-]{36}$/i.test(entry.area_id) ? entry.area_id : void 0
+      }
+    ];
+  });
+}
+
+export { communityMapEmbeds };

package/dist/community-maps-DKcYhQYN.d.cts

@@ -0,0 +1,10 @@
+interface CommunityMapArticleEmbed {
+    collection_slug: string;
+    feature_ids?: string[];
+    area_id?: string;
+    mode: "map" | "cards" | "features";
+}
+/** Article metadata extension: references only; records remain in Community Maps. */
+declare function communityMapEmbeds(metadata: unknown): CommunityMapArticleEmbed[];
+
+export { type CommunityMapArticleEmbed as C, communityMapEmbeds as c };

package/dist/community-maps-DKcYhQYN.d.ts

@@ -0,0 +1,10 @@
+interface CommunityMapArticleEmbed {
+    collection_slug: string;
+    feature_ids?: string[];
+    area_id?: string;
+    mode: "map" | "cards" | "features";
+}
+/** Article metadata extension: references only; records remain in Community Maps. */
+declare function communityMapEmbeds(metadata: unknown): CommunityMapArticleEmbed[];
+
+export { type CommunityMapArticleEmbed as C, communityMapEmbeds as c };

package/dist/community-maps-server.cjs

@@ -0,0 +1,250 @@
+'use strict';
+
+var crypto = require('crypto');
+var sdk = require('@scalemule/sdk');
+
+// src/community-maps-server.ts
+var ROOT = "/v1/knowledge/community-maps";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var COOKIE = "sm_community_reader";
+var json = (data, status = 200) => Response.json(data, {
+  status,
+  headers: {
+    "cache-control": "private, no-store",
+    "x-content-type-options": "nosniff"
+  }
+});
+function identity(request, key, origin) {
+  const sign = (id2) => crypto.createHmac("sha256", key).update("community-maps-reader:" + id2).digest("base64url");
+  const raw = request.headers.get("cookie")?.split(";").map((v) => v.trim()).find((v) => v.startsWith(COOKIE + "="))?.slice(COOKIE.length + 1);
+  if (raw) {
+    const [id2, signature] = raw.split(".");
+    if (id2 && signature && UUID.test(id2) && /^[A-Za-z0-9_-]{43}$/.test(signature)) {
+      const expected = sign(id2);
+      if (expected.length === signature.length && crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)))
+        return { id: id2, cookie: null };
+    }
+  }
+  const id = crypto.randomUUID();
+  return {
+    id,
+    cookie: `${COOKIE}=${id}.${sign(id)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000${new URL(origin).protocol === "https:" ? "; Secure" : ""}`
+  };
+}
+async function boundedBody(request, max) {
+  if (Number(request.headers.get("content-length") || 0) > max)
+    throw new ProxyProblem(413, "The submission is too large.");
+  const reader = request.body?.getReader();
+  if (!reader) return new Uint8Array();
+  const chunks = [];
+  let length = 0;
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      length += value.length;
+      if (length > max) {
+        await reader.cancel();
+        throw new ProxyProblem(413, "The submission is too large.");
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks);
+}
+var ProxyProblem = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+function createPublicationCommunityMapsHandler(options) {
+  return async (request, path) => {
+    try {
+      if (path[0] !== "collections" || !path[1] || !/^[a-z0-9-]{1,191}$/.test(path[1]))
+        return json({ error: { message: "Guide not found" } }, 404);
+      const slug = path[1];
+      const rest = path.slice(2);
+      const method = request.method;
+      const read = method === "GET" && (rest.length === 0 || rest[0] === "features" && (rest.length === 1 || rest.length === 2 && UUID.test(rest[1])) || rest[0] === "media" && rest.length === 2 && UUID.test(rest[1]));
+      const upload = method === "POST" && rest.length === 3 && rest[0] === "submissions" && UUID.test(rest[1]) && rest[2] === "media";
+      const submission = method === "POST" && rest.length === 1 && rest[0] === "submissions";
+      const action = method === "POST" && rest.length === 3 && rest[0] === "features" && UUID.test(rest[1]) && ["reactions", "reports"].includes(rest[2]);
+      if (!read && !upload && !submission && !action)
+        return json({ error: { message: "Route not found" } }, 404);
+      const scope = await options.resolve(request);
+      if (method !== "GET" && request.headers.get("origin") !== new URL(scope.origin).origin)
+        return json(
+          { error: { message: "Submit from this publication\u2019s website." } },
+          403
+        );
+      const gateway = new URL(scope.gatewayUrl);
+      if (gateway.protocol !== "https:" && !(gateway.protocol === "http:" && ["127.0.0.1", "localhost"].includes(gateway.hostname)))
+        throw new ProxyProblem(503, "The guide is unavailable.");
+      if (!scope.apiKey)
+        throw new ProxyProblem(503, "The guide is unavailable.");
+      const reader = identity(request, scope.apiKey, scope.origin);
+      const clientContext = { ...scope.clientContext, anonymousId: reader.id };
+      const sdk$1 = new sdk.ScaleMule({
+        apiKey: scope.apiKey,
+        baseUrl: scope.gatewayUrl
+      });
+      const callOptions = {
+        clientContext,
+        headers: scope.accessToken ? { authorization: `Bearer ${scope.accessToken}` } : {}
+      };
+      let response;
+      if (read && rest[0] === "media") {
+        const upstream = await fetch(
+          `${gateway.origin}${ROOT}/collections/${slug}/media/${rest[1]}`,
+          {
+            headers: {
+              ...sdk.buildClientContextHeaders(clientContext),
+              "x-api-key": scope.apiKey,
+              ...callOptions.headers
+            },
+            cache: "no-store",
+            redirect: "error",
+            signal: AbortSignal.timeout(3e4)
+          }
+        );
+        response = upstream.ok ? new Response(upstream.body, {
+          headers: {
+            "content-type": "image/png",
+            "cache-control": "private, no-store",
+            "x-content-type-options": "nosniff"
+          }
+        }) : json(
+          { error: { message: "Photo unavailable" } },
+          upstream.status >= 500 ? 503 : upstream.status
+        );
+      } else {
+        let result;
+        if (read) {
+          if (!rest.length)
+            result = await sdk$1.communityMaps.getCollection(slug, callOptions);
+          else if (rest.length === 2)
+            result = await sdk$1.communityMaps.getFeature(
+              slug,
+              rest[1],
+              callOptions
+            );
+          else {
+            const query = {};
+            const params = new URL(request.url).searchParams;
+            for (const key of [
+              "after",
+              "area_id",
+              "category",
+              "geometry_type",
+              "active_at",
+              "bbox"
+            ]) {
+              const value = params.get(key);
+              if (value) query[key] = value;
+            }
+            const limit = params.get("limit");
+            if (limit)
+              query.limit = Math.min(200, Math.max(1, Number(limit) || 50));
+            const filters = { ...query };
+            for (const key of ["featured", "verified"]) {
+              const value = params.get(key);
+              if (value === "true" || value === "false")
+                filters[key] = value === "true";
+            }
+            result = await sdk$1.communityMaps.listFeatures(
+              slug,
+              filters,
+              callOptions
+            );
+          }
+        } else if (upload) {
+          const contentType = request.headers.get("content-type") || "";
+          if (!contentType.startsWith("multipart/form-data;"))
+            throw new ProxyProblem(415, "Choose a photograph to upload.");
+          const bytes = await boundedBody(request, 9 * 1024 * 1024);
+          const form = await new Response(bytes, {
+            headers: { "content-type": contentType }
+          }).formData();
+          const file = form.get("file");
+          if (!(file instanceof Blob))
+            throw new ProxyProblem(400, "Photo is required.");
+          result = await sdk$1.communityMaps.uploadPhoto(
+            slug,
+            rest[1],
+            file,
+            {
+              caption: String(form.get("caption") || ""),
+              attribution: String(form.get("attribution") || ""),
+              rights_confirmed: form.get("rights_confirmed") === "true"
+            },
+            callOptions
+          );
+        } else {
+          if (!request.headers.get("content-type")?.startsWith("application/json"))
+            throw new ProxyProblem(415, "Use the community submission form.");
+          let body;
+          try {
+            body = JSON.parse(
+              new TextDecoder().decode(await boundedBody(request, 65536))
+            );
+          } catch (e) {
+            if (e instanceof ProxyProblem) throw e;
+            throw new ProxyProblem(400, "Invalid submission.");
+          }
+          if (!body || typeof body !== "object" || Array.isArray(body))
+            throw new ProxyProblem(400, "Invalid submission.");
+          if (submission)
+            result = await sdk$1.communityMaps.createSubmission(
+              slug,
+              body,
+              callOptions
+            );
+          else if (rest[2] === "reactions")
+            result = await sdk$1.communityMaps.react(
+              slug,
+              rest[1],
+              body.reaction,
+              body.active !== false,
+              callOptions
+            );
+          else
+            result = await sdk$1.communityMaps.report(
+              slug,
+              rest[1],
+              body,
+              callOptions
+            );
+        }
+        if (result.error) {
+          const error = result.error;
+          const status = typeof error.status === "number" ? error.status : 400;
+          response = json(
+            {
+              error: {
+                message: status >= 500 ? "The guide is temporarily unavailable. Please try again." : error.message
+              }
+            },
+            status
+          );
+        } else response = json({ data: result.data });
+      }
+      if (reader.cookie) response.headers.set("set-cookie", reader.cookie);
+      return response;
+    } catch (error) {
+      return json(
+        {
+          error: {
+            message: error instanceof ProxyProblem ? error.message : "The guide is temporarily unavailable. Please try again."
+          }
+        },
+        error instanceof ProxyProblem ? error.status : 503
+      );
+    }
+  };
+}
+
+exports.createPublicationCommunityMapsHandler = createPublicationCommunityMapsHandler;

package/dist/community-maps-server.d.cts

@@ -0,0 +1,16 @@
+import { ClientContext } from '@scalemule/sdk';
+
+interface PublicationCommunityMapScope {
+    apiKey: string;
+    gatewayUrl: string;
+    origin: string;
+    clientContext: ClientContext;
+    accessToken?: string;
+}
+interface PublicationCommunityMapServerOptions {
+    resolve: (request: Request) => Promise<PublicationCommunityMapScope>;
+}
+/** Only public collection routes are accepted. The URL never selects tenant credentials. */
+declare function createPublicationCommunityMapsHandler(options: PublicationCommunityMapServerOptions): (request: Request, path: string[]) => Promise<Response>;
+
+export { type PublicationCommunityMapScope, type PublicationCommunityMapServerOptions, createPublicationCommunityMapsHandler };

package/dist/community-maps-server.d.ts

@@ -0,0 +1,16 @@
+import { ClientContext } from '@scalemule/sdk';
+
+interface PublicationCommunityMapScope {
+    apiKey: string;
+    gatewayUrl: string;
+    origin: string;
+    clientContext: ClientContext;
+    accessToken?: string;
+}
+interface PublicationCommunityMapServerOptions {
+    resolve: (request: Request) => Promise<PublicationCommunityMapScope>;
+}
+/** Only public collection routes are accepted. The URL never selects tenant credentials. */
+declare function createPublicationCommunityMapsHandler(options: PublicationCommunityMapServerOptions): (request: Request, path: string[]) => Promise<Response>;
+
+export { type PublicationCommunityMapScope, type PublicationCommunityMapServerOptions, createPublicationCommunityMapsHandler };

package/dist/community-maps-server.js

@@ -0,0 +1,248 @@
+import { timingSafeEqual, randomUUID, createHmac } from 'crypto';
+import { ScaleMule, buildClientContextHeaders } from '@scalemule/sdk';
+
+// src/community-maps-server.ts
+var ROOT = "/v1/knowledge/community-maps";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var COOKIE = "sm_community_reader";
+var json = (data, status = 200) => Response.json(data, {
+  status,
+  headers: {
+    "cache-control": "private, no-store",
+    "x-content-type-options": "nosniff"
+  }
+});
+function identity(request, key, origin) {
+  const sign = (id2) => createHmac("sha256", key).update("community-maps-reader:" + id2).digest("base64url");
+  const raw = request.headers.get("cookie")?.split(";").map((v) => v.trim()).find((v) => v.startsWith(COOKIE + "="))?.slice(COOKIE.length + 1);
+  if (raw) {
+    const [id2, signature] = raw.split(".");
+    if (id2 && signature && UUID.test(id2) && /^[A-Za-z0-9_-]{43}$/.test(signature)) {
+      const expected = sign(id2);
+      if (expected.length === signature.length && timingSafeEqual(Buffer.from(signature), Buffer.from(expected)))
+        return { id: id2, cookie: null };
+    }
+  }
+  const id = randomUUID();
+  return {
+    id,
+    cookie: `${COOKIE}=${id}.${sign(id)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=31536000${new URL(origin).protocol === "https:" ? "; Secure" : ""}`
+  };
+}
+async function boundedBody(request, max) {
+  if (Number(request.headers.get("content-length") || 0) > max)
+    throw new ProxyProblem(413, "The submission is too large.");
+  const reader = request.body?.getReader();
+  if (!reader) return new Uint8Array();
+  const chunks = [];
+  let length = 0;
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      length += value.length;
+      if (length > max) {
+        await reader.cancel();
+        throw new ProxyProblem(413, "The submission is too large.");
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks);
+}
+var ProxyProblem = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+function createPublicationCommunityMapsHandler(options) {
+  return async (request, path) => {
+    try {
+      if (path[0] !== "collections" || !path[1] || !/^[a-z0-9-]{1,191}$/.test(path[1]))
+        return json({ error: { message: "Guide not found" } }, 404);
+      const slug = path[1];
+      const rest = path.slice(2);
+      const method = request.method;
+      const read = method === "GET" && (rest.length === 0 || rest[0] === "features" && (rest.length === 1 || rest.length === 2 && UUID.test(rest[1])) || rest[0] === "media" && rest.length === 2 && UUID.test(rest[1]));
+      const upload = method === "POST" && rest.length === 3 && rest[0] === "submissions" && UUID.test(rest[1]) && rest[2] === "media";
+      const submission = method === "POST" && rest.length === 1 && rest[0] === "submissions";
+      const action = method === "POST" && rest.length === 3 && rest[0] === "features" && UUID.test(rest[1]) && ["reactions", "reports"].includes(rest[2]);
+      if (!read && !upload && !submission && !action)
+        return json({ error: { message: "Route not found" } }, 404);
+      const scope = await options.resolve(request);
+      if (method !== "GET" && request.headers.get("origin") !== new URL(scope.origin).origin)
+        return json(
+          { error: { message: "Submit from this publication\u2019s website." } },
+          403
+        );
+      const gateway = new URL(scope.gatewayUrl);
+      if (gateway.protocol !== "https:" && !(gateway.protocol === "http:" && ["127.0.0.1", "localhost"].includes(gateway.hostname)))
+        throw new ProxyProblem(503, "The guide is unavailable.");
+      if (!scope.apiKey)
+        throw new ProxyProblem(503, "The guide is unavailable.");
+      const reader = identity(request, scope.apiKey, scope.origin);
+      const clientContext = { ...scope.clientContext, anonymousId: reader.id };
+      const sdk = new ScaleMule({
+        apiKey: scope.apiKey,
+        baseUrl: scope.gatewayUrl
+      });
+      const callOptions = {
+        clientContext,
+        headers: scope.accessToken ? { authorization: `Bearer ${scope.accessToken}` } : {}
+      };
+      let response;
+      if (read && rest[0] === "media") {
+        const upstream = await fetch(
+          `${gateway.origin}${ROOT}/collections/${slug}/media/${rest[1]}`,
+          {
+            headers: {
+              ...buildClientContextHeaders(clientContext),
+              "x-api-key": scope.apiKey,
+              ...callOptions.headers
+            },
+            cache: "no-store",
+            redirect: "error",
+            signal: AbortSignal.timeout(3e4)
+          }
+        );
+        response = upstream.ok ? new Response(upstream.body, {
+          headers: {
+            "content-type": "image/png",
+            "cache-control": "private, no-store",
+            "x-content-type-options": "nosniff"
+          }
+        }) : json(
+          { error: { message: "Photo unavailable" } },
+          upstream.status >= 500 ? 503 : upstream.status
+        );
+      } else {
+        let result;
+        if (read) {
+          if (!rest.length)
+            result = await sdk.communityMaps.getCollection(slug, callOptions);
+          else if (rest.length === 2)
+            result = await sdk.communityMaps.getFeature(
+              slug,
+              rest[1],
+              callOptions
+            );
+          else {
+            const query = {};
+            const params = new URL(request.url).searchParams;
+            for (const key of [
+              "after",
+              "area_id",
+              "category",
+              "geometry_type",
+              "active_at",
+              "bbox"
+            ]) {
+              const value = params.get(key);
+              if (value) query[key] = value;
+            }
+            const limit = params.get("limit");
+            if (limit)
+              query.limit = Math.min(200, Math.max(1, Number(limit) || 50));
+            const filters = { ...query };
+            for (const key of ["featured", "verified"]) {
+              const value = params.get(key);
+              if (value === "true" || value === "false")
+                filters[key] = value === "true";
+            }
+            result = await sdk.communityMaps.listFeatures(
+              slug,
+              filters,
+              callOptions
+            );
+          }
+        } else if (upload) {
+          const contentType = request.headers.get("content-type") || "";
+          if (!contentType.startsWith("multipart/form-data;"))
+            throw new ProxyProblem(415, "Choose a photograph to upload.");
+          const bytes = await boundedBody(request, 9 * 1024 * 1024);
+          const form = await new Response(bytes, {
+            headers: { "content-type": contentType }
+          }).formData();
+          const file = form.get("file");
+          if (!(file instanceof Blob))
+            throw new ProxyProblem(400, "Photo is required.");
+          result = await sdk.communityMaps.uploadPhoto(
+            slug,
+            rest[1],
+            file,
+            {
+              caption: String(form.get("caption") || ""),
+              attribution: String(form.get("attribution") || ""),
+              rights_confirmed: form.get("rights_confirmed") === "true"
+            },
+            callOptions
+          );
+        } else {
+          if (!request.headers.get("content-type")?.startsWith("application/json"))
+            throw new ProxyProblem(415, "Use the community submission form.");
+          let body;
+          try {
+            body = JSON.parse(
+              new TextDecoder().decode(await boundedBody(request, 65536))
+            );
+          } catch (e) {
+            if (e instanceof ProxyProblem) throw e;
+            throw new ProxyProblem(400, "Invalid submission.");
+          }
+          if (!body || typeof body !== "object" || Array.isArray(body))
+            throw new ProxyProblem(400, "Invalid submission.");
+          if (submission)
+            result = await sdk.communityMaps.createSubmission(
+              slug,
+              body,
+              callOptions
+            );
+          else if (rest[2] === "reactions")
+            result = await sdk.communityMaps.react(
+              slug,
+              rest[1],
+              body.reaction,
+              body.active !== false,
+              callOptions
+            );
+          else
+            result = await sdk.communityMaps.report(
+              slug,
+              rest[1],
+              body,
+              callOptions
+            );
+        }
+        if (result.error) {
+          const error = result.error;
+          const status = typeof error.status === "number" ? error.status : 400;
+          response = json(
+            {
+              error: {
+                message: status >= 500 ? "The guide is temporarily unavailable. Please try again." : error.message
+              }
+            },
+            status
+          );
+        } else response = json({ data: result.data });
+      }
+      if (reader.cookie) response.headers.set("set-cookie", reader.cookie);
+      return response;
+    } catch (error) {
+      return json(
+        {
+          error: {
+            message: error instanceof ProxyProblem ? error.message : "The guide is temporarily unavailable. Please try again."
+          }
+        },
+        error instanceof ProxyProblem ? error.status : 503
+      );
+    }
+  };
+}
+
+export { createPublicationCommunityMapsHandler };