@yourbright/emdash-analytics-plugin 0.1.1 → 0.1.2

package/dist/index.js

@@ -0,0 +1,1560 @@
+// src/index.ts
+import {
+  PluginRouteError as PluginRouteError2,
+  definePlugin
+} from "emdash";
+import { z as z2 } from "astro/zod";
+
+// src/constants.ts
+var PLUGIN_ID = "emdash-google-analytics-dashboard";
+var PLUGIN_VERSION = "0.1.0";
+var AGENT_KEY_PREFIX = "yb_ins_";
+var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
+var GOOGLE_GA_BASE_URL = "https://analyticsdata.googleapis.com/v1beta";
+var GOOGLE_GSC_BASE_URL = "https://www.googleapis.com/webmasters/v3";
+var GSC_SCOPE = "https://www.googleapis.com/auth/webmasters.readonly";
+var GA_SCOPE = "https://www.googleapis.com/auth/analytics.readonly";
+var GSC_DATA_DELAY_DAYS = 3;
+var QUERY_REFRESH_STALE_HOURS = 48;
+var GSC_QUERY_PAGE_LIMIT = 50;
+var GSC_QUERY_ROW_LIMIT = 25;
+var SITE_SUMMARY_KEY = "state:site-summary";
+var FRESHNESS_KEY = "state:freshness";
+var CONFIG_SITE_ORIGIN_KEY = "settings:siteOrigin";
+var CONFIG_GA4_PROPERTY_ID_KEY = "settings:ga4PropertyId";
+var CONFIG_GSC_SITE_URL_KEY = "settings:gscSiteUrl";
+var CONFIG_SERVICE_ACCOUNT_KEY = "settings:serviceAccountCiphertext";
+var CRON_SYNC_BASE = "sync-base";
+var CRON_ENRICH_MANAGED = "enrich-managed-queries";
+var PUBLIC_AGENT_ROUTES = {
+  SITE_SUMMARY: "agent/v1/site-summary",
+  OPPORTUNITIES: "agent/v1/opportunities",
+  CONTENT_CONTEXT: "agent/v1/content-context"
+};
+var ADMIN_ROUTES = {
+  STATUS: "admin/status",
+  OVERVIEW: "admin/overview",
+  LIST_PAGES: "admin/pages/list",
+  CONTENT_CONTEXT: "admin/content/get",
+  CONFIG_GET: "admin/config/get",
+  CONFIG_SAVE: "admin/config/save",
+  CONNECTION_TEST: "admin/connection/test",
+  SYNC_NOW: "admin/sync-now",
+  AGENT_KEYS_LIST: "admin/agent-keys/list",
+  AGENT_KEYS_CREATE: "admin/agent-keys/create",
+  AGENT_KEYS_REVOKE: "admin/agent-keys/revoke"
+};
+
+// src/config-validation.ts
+import { z } from "astro/zod";
+var serviceAccountSchema = z.object({
+  client_email: z.string().email("Service Account JSON must include a valid client_email"),
+  private_key: z.string().min(1, "Service Account JSON must include a private_key"),
+  token_uri: z.string().url().optional()
+});
+var savedConfigSchema = z.object({
+  siteOrigin: z.string().min(1, "Canonical Site Origin is required").refine(isHttpUrl, "Canonical Site Origin must be a valid http(s) URL"),
+  ga4PropertyId: z.string().min(1, "GA4 Property ID is required").regex(/^[0-9]+$/, "GA4 Property ID must be numeric"),
+  gscSiteUrl: z.string().min(1, "Search Console Property is required").refine(isValidSearchConsoleProperty, "Search Console Property must be a valid URL or sc-domain property"),
+  serviceAccountJson: z.string().min(1, "Service Account JSON is required").superRefine((value, ctx) => {
+    const parsed = parseServiceAccountSafe(value);
+    if (!parsed.success) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: parsed.message
+      });
+    }
+  })
+});
+function resolveConfigInput(input, current = null) {
+  const candidate = {
+    siteOrigin: resolveField(input?.siteOrigin, current?.siteOrigin),
+    ga4PropertyId: resolveField(input?.ga4PropertyId, current?.ga4PropertyId),
+    gscSiteUrl: resolveField(input?.gscSiteUrl, current?.gscSiteUrl),
+    serviceAccountJson: resolveServiceAccountField(input?.serviceAccountJson, current?.serviceAccountJson)
+  };
+  const parsed = savedConfigSchema.safeParse(candidate);
+  if (!parsed.success) {
+    return {
+      success: false,
+      message: formatValidationError(parsed.error)
+    };
+  }
+  return {
+    success: true,
+    data: {
+      ...parsed.data,
+      siteOrigin: normalizeOrigin(parsed.data.siteOrigin)
+    }
+  };
+}
+function parseServiceAccount(json) {
+  const result = parseServiceAccountSafe(json);
+  if (!result.success) {
+    throw new Error(result.message);
+  }
+  return result.data;
+}
+function normalizeOrigin(origin) {
+  const url = new URL(origin);
+  url.pathname = "/";
+  url.search = "";
+  url.hash = "";
+  return url.origin;
+}
+function parseServiceAccountSafe(json) {
+  let parsedJson;
+  try {
+    parsedJson = JSON.parse(json);
+  } catch {
+    return {
+      success: false,
+      message: "Service Account JSON must be valid JSON"
+    };
+  }
+  const parsed = serviceAccountSchema.safeParse(parsedJson);
+  if (!parsed.success) {
+    return {
+      success: false,
+      message: formatValidationError(parsed.error)
+    };
+  }
+  return {
+    success: true,
+    data: parsed.data
+  };
+}
+function resolveField(value, fallback) {
+  if (value === void 0) {
+    return fallback ?? "";
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : fallback ?? "";
+}
+function resolveServiceAccountField(value, fallback) {
+  if (value === void 0) {
+    return fallback ?? "";
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : fallback ?? "";
+}
+function isHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function isValidSearchConsoleProperty(value) {
+  if (value.startsWith("sc-domain:")) {
+    return value.slice("sc-domain:".length).trim().length > 0;
+  }
+  return isHttpUrl(value);
+}
+function formatValidationError(error) {
+  const messages = Array.from(new Set(error.issues.map((issue) => issue.message).filter(Boolean)));
+  return messages[0] || "Invalid settings";
+}
+
+// src/config.ts
+import { decrypt, encrypt } from "@emdash-cms/auth";
+async function loadConfig(ctx) {
+  const [siteOrigin, ga4PropertyId, gscSiteUrl, serviceAccountCiphertext] = await Promise.all([
+    ctx.kv.get(CONFIG_SITE_ORIGIN_KEY),
+    ctx.kv.get(CONFIG_GA4_PROPERTY_ID_KEY),
+    ctx.kv.get(CONFIG_GSC_SITE_URL_KEY),
+    ctx.kv.get(CONFIG_SERVICE_ACCOUNT_KEY)
+  ]);
+  if (!siteOrigin || !ga4PropertyId || !gscSiteUrl || !serviceAccountCiphertext) {
+    return null;
+  }
+  const authSecret = getAuthSecret();
+  const serviceAccountJson = await decrypt(serviceAccountCiphertext, authSecret);
+  const resolved = resolveConfigInput({
+    siteOrigin,
+    ga4PropertyId,
+    gscSiteUrl,
+    serviceAccountJson
+  });
+  if (!resolved.success) {
+    throw new Error(resolved.message);
+  }
+  return resolved.data;
+}
+async function saveConfig(ctx, input) {
+  const resolved = resolveConfigInput(input);
+  if (!resolved.success) {
+    throw new Error(resolved.message);
+  }
+  const parsed = resolved.data;
+  const authSecret = getAuthSecret();
+  const serviceAccountCiphertext = await encrypt(parsed.serviceAccountJson, authSecret);
+  await Promise.all([
+    ctx.kv.set(CONFIG_SITE_ORIGIN_KEY, normalizeOrigin(parsed.siteOrigin)),
+    ctx.kv.set(CONFIG_GA4_PROPERTY_ID_KEY, parsed.ga4PropertyId),
+    ctx.kv.set(CONFIG_GSC_SITE_URL_KEY, parsed.gscSiteUrl),
+    ctx.kv.set(CONFIG_SERVICE_ACCOUNT_KEY, serviceAccountCiphertext)
+  ]);
+  return summarizeConfig(parsed);
+}
+async function getConfigSummary(ctx) {
+  const config = await loadConfig(ctx);
+  if (!config) {
+    return {
+      siteOrigin: "",
+      ga4PropertyId: "",
+      gscSiteUrl: "",
+      hasServiceAccount: false
+    };
+  }
+  return summarizeConfig(config);
+}
+function getAuthSecret() {
+  const value = process.env.EMDASH_AUTH_SECRET || process.env.AUTH_SECRET || "";
+  if (!value) {
+    throw new Error("EMDASH_AUTH_SECRET is required to store analytics credentials");
+  }
+  return value;
+}
+function summarizeConfig(config) {
+  const serviceAccount = parseServiceAccount(config.serviceAccountJson);
+  return {
+    siteOrigin: normalizeOrigin(config.siteOrigin),
+    ga4PropertyId: config.ga4PropertyId,
+    gscSiteUrl: config.gscSiteUrl,
+    hasServiceAccount: true,
+    serviceAccountEmail: serviceAccount.client_email
+  };
+}
+
+// src/sync.ts
+import { generatePrefixedToken, hashPrefixedToken } from "@emdash-cms/auth";
+import { PluginRouteError } from "emdash";
+import { ulid } from "ulidx";
+
+// src/content.ts
+import { getEmDashCollection, getEmDashEntry } from "emdash";
+function classifyPageKind(urlPath) {
+  if (/^\/blog\/[^/]+\/$/.test(urlPath)) return "blog_post";
+  if (urlPath === "/blog/" || /^\/blog\/[^/]+\/$/.test(urlPath)) return "blog_archive";
+  if (urlPath.startsWith("/tag/")) return "tag";
+  if (urlPath.startsWith("/author/")) return "author";
+  if (urlPath === "/" || urlPath.startsWith("/company/") || urlPath.startsWith("/contact/") || urlPath.startsWith("/download/") || urlPath.startsWith("/foreignworkers/") || urlPath.startsWith("/jirei/") || urlPath.startsWith("/kaigo/") || urlPath.startsWith("/pr/") || urlPath.startsWith("/seminar/")) {
+    return "landing";
+  }
+  return "other";
+}
+function normalizePath(pathOrUrl, expectedHost) {
+  try {
+    const parsed = pathOrUrl.startsWith("http://") || pathOrUrl.startsWith("https://") ? new URL(pathOrUrl) : new URL(pathOrUrl, "https://placeholder.invalid");
+    if (expectedHost && parsed.hostname !== "placeholder.invalid" && parsed.hostname !== expectedHost) {
+      return null;
+    }
+    let pathname = parsed.pathname || "/";
+    if (!pathname.startsWith("/")) pathname = `/${pathname}`;
+    pathname = pathname.replace(/\/{2,}/g, "/");
+    if (pathname !== "/" && !pathname.endsWith("/")) pathname = `${pathname}/`;
+    return pathname;
+  } catch {
+    return null;
+  }
+}
+function buildContentUrl(siteOrigin, urlPath) {
+  return new URL(urlPath, `${siteOrigin}/`).toString();
+}
+async function getManagedContentMap(siteOrigin) {
+  const result = await getEmDashCollection("posts", {
+    status: "published",
+    limit: 1e3,
+    orderBy: { updatedAt: "desc" }
+  });
+  const managed = /* @__PURE__ */ new Map();
+  for (const entry of result.entries) {
+    const id = typeof entry.id === "string" ? entry.id : "";
+    if (!id) continue;
+    const slug = typeof entry.slug === "string" ? entry.slug : null;
+    const data = entry.data ?? {};
+    const title = typeof data.title === "string" ? data.title : slug || id;
+    const excerpt = typeof data.excerpt === "string" ? data.excerpt : void 0;
+    const seoDescription = typeof data.seo_description === "string" ? data.seo_description : void 0;
+    const urlPath = `/blog/${slug || id}/`;
+    managed.set(urlPath, {
+      collection: "posts",
+      id,
+      slug,
+      urlPath,
+      title,
+      excerpt,
+      seoDescription
+    });
+  }
+  void siteOrigin;
+  return managed;
+}
+function pageStorageId(urlPath) {
+  return stableStorageId(urlPath);
+}
+function pageQueryStorageId(urlPath, query) {
+  return stableStorageId(`${urlPath}::${query}`);
+}
+function dailyMetricStorageId(source, scope, date) {
+  return stableStorageId(`${source}::${scope}::${date}`);
+}
+function stableStorageId(input) {
+  let hash = 5381;
+  for (let index = 0; index < input.length; index += 1) {
+    hash = hash * 33 ^ input.charCodeAt(index);
+  }
+  return `ybci_${(hash >>> 0).toString(16)}`;
+}
+
+// src/google.ts
+var accessTokenCache = /* @__PURE__ */ new Map();
+function buildWindows(now = /* @__PURE__ */ new Date()) {
+  const gaCurrentEnd = addDaysUtc(now, -1);
+  const gaCurrentStart = addDaysUtc(gaCurrentEnd, -27);
+  const gaPreviousEnd = addDaysUtc(gaCurrentStart, -1);
+  const gaPreviousStart = addDaysUtc(gaPreviousEnd, -27);
+  const gscCurrentEnd = addDaysUtc(now, -GSC_DATA_DELAY_DAYS);
+  const gscCurrentStart = addDaysUtc(gscCurrentEnd, -27);
+  const gscPreviousEnd = addDaysUtc(gscCurrentStart, -1);
+  const gscPreviousStart = addDaysUtc(gscPreviousEnd, -27);
+  return {
+    gscCurrent: { startDate: formatDate(gscCurrentStart), endDate: formatDate(gscCurrentEnd) },
+    gscPrevious: { startDate: formatDate(gscPreviousStart), endDate: formatDate(gscPreviousEnd) },
+    gaCurrent: { startDate: formatDate(gaCurrentStart), endDate: formatDate(gaCurrentEnd) },
+    gaPrevious: { startDate: formatDate(gaPreviousStart), endDate: formatDate(gaPreviousEnd) }
+  };
+}
+async function runConnectionTest(http, config, serviceAccount) {
+  const gaToken = await getGoogleAccessToken(http, serviceAccount, [GA_SCOPE]);
+  const gscToken = await getGoogleAccessToken(http, serviceAccount, [GSC_SCOPE]);
+  const windows = buildWindows();
+  const ga = await postJson(
+    http,
+    `${GOOGLE_GA_BASE_URL}/properties/${config.ga4PropertyId}:runReport`,
+    gaToken,
+    {
+      dateRanges: [windows.gaCurrent],
+      dimensions: [{ name: "date" }],
+      metrics: [{ name: "sessions" }],
+      limit: 1
+    }
+  );
+  const gsc = await postJson(
+    http,
+    `${GOOGLE_GSC_BASE_URL}/sites/${encodeURIComponent(config.gscSiteUrl)}/searchAnalytics/query`,
+    gscToken,
+    {
+      startDate: windows.gscCurrent.startDate,
+      endDate: windows.gscCurrent.endDate,
+      dimensions: ["date"],
+      rowLimit: 1,
+      startRow: 0
+    }
+  );
+  return {
+    ga: {
+      rowCount: numberOrZero(ga.rowCount),
+      sample: Array.isArray(ga.rows) ? ga.rows[0] ?? null : null
+    },
+    gsc: {
+      rowCount: Array.isArray(gsc.rows) ? gsc.rows.length : 0,
+      sample: Array.isArray(gsc.rows) ? gsc.rows[0] ?? null : null
+    }
+  };
+}
+async function fetchGscPageMetrics(http, config, serviceAccount, window) {
+  const token = await getGoogleAccessToken(http, serviceAccount, [GSC_SCOPE]);
+  const rows = [];
+  const canonicalHost = new URL(config.siteOrigin).hostname;
+  let startRow = 0;
+  while (true) {
+    const body = await postJson(
+      http,
+      `${GOOGLE_GSC_BASE_URL}/sites/${encodeURIComponent(config.gscSiteUrl)}/searchAnalytics/query`,
+      token,
+      {
+        startDate: window.startDate,
+        endDate: window.endDate,
+        dimensions: ["page"],
+        rowLimit: 25e3,
+        startRow,
+        type: "web"
+      }
+    );
+    const pageRows = Array.isArray(body.rows) ? body.rows : [];
+    for (const row of pageRows) {
+      const rawUrl = stringValue(row.keys?.[0]);
+      if (!rawUrl) continue;
+      const urlPath = normalizePath(rawUrl, canonicalHost);
+      if (!urlPath) continue;
+      rows.push({
+        urlPath,
+        clicks: numberOrZero(row.clicks),
+        impressions: numberOrZero(row.impressions),
+        ctr: numberOrZero(row.ctr),
+        position: numberOrZero(row.position)
+      });
+    }
+    if (pageRows.length < 25e3) break;
+    startRow += 25e3;
+  }
+  return rows;
+}
+async function fetchGscDailyTrend(http, config, serviceAccount, window) {
+  const token = await getGoogleAccessToken(http, serviceAccount, [GSC_SCOPE]);
+  const body = await postJson(
+    http,
+    `${GOOGLE_GSC_BASE_URL}/sites/${encodeURIComponent(config.gscSiteUrl)}/searchAnalytics/query`,
+    token,
+    {
+      startDate: window.startDate,
+      endDate: window.endDate,
+      dimensions: ["date"],
+      rowLimit: 1e3,
+      startRow: 0,
+      type: "web"
+    }
+  );
+  return (Array.isArray(body.rows) ? body.rows : []).map((row) => ({
+    date: stringValue(row.keys?.[0]) || window.startDate,
+    clicks: numberOrZero(row.clicks),
+    impressions: numberOrZero(row.impressions),
+    views: 0,
+    sessions: 0,
+    users: 0
+  }));
+}
+async function fetchGscPageQueries(http, config, serviceAccount, urlPath, window, limit) {
+  const token = await getGoogleAccessToken(http, serviceAccount, [GSC_SCOPE]);
+  const pageUrl = buildContentUrl(config.siteOrigin, urlPath);
+  const body = await postJson(
+    http,
+    `${GOOGLE_GSC_BASE_URL}/sites/${encodeURIComponent(config.gscSiteUrl)}/searchAnalytics/query`,
+    token,
+    {
+      startDate: window.startDate,
+      endDate: window.endDate,
+      dimensions: ["query"],
+      rowLimit: limit,
+      startRow: 0,
+      type: "web",
+      dimensionFilterGroups: [
+        {
+          filters: [
+            {
+              dimension: "page",
+              operator: "equals",
+              expression: pageUrl
+            }
+          ]
+        }
+      ]
+    }
+  );
+  return (Array.isArray(body.rows) ? body.rows : []).map((row) => ({
+    query: stringValue(row.keys?.[0]) || "",
+    clicks: numberOrZero(row.clicks),
+    impressions: numberOrZero(row.impressions),
+    ctr: numberOrZero(row.ctr),
+    position: numberOrZero(row.position)
+  })).filter((row) => row.query.length > 0);
+}
+async function fetchGaPageMetrics(http, config, serviceAccount, window) {
+  const token = await getGoogleAccessToken(http, serviceAccount, [GA_SCOPE]);
+  const rows = [];
+  let offset = 0;
+  const limit = 1e4;
+  while (true) {
+    const body = await postJson(
+      http,
+      `${GOOGLE_GA_BASE_URL}/properties/${config.ga4PropertyId}:runReport`,
+      token,
+      {
+        dateRanges: [window],
+        dimensions: [{ name: "pagePath" }],
+        metrics: [
+          { name: "screenPageViews" },
+          { name: "activeUsers" },
+          { name: "sessions" },
+          { name: "engagementRate" },
+          { name: "bounceRate" },
+          { name: "averageSessionDuration" }
+        ],
+        dimensionFilter: {
+          filter: {
+            fieldName: "hostName",
+            stringFilter: {
+              matchType: "EXACT",
+              value: new URL(config.siteOrigin).hostname
+            }
+          }
+        },
+        limit,
+        offset
+      }
+    );
+    const pageRows = Array.isArray(body.rows) ? body.rows : [];
+    for (const row of pageRows) {
+      const urlPath = normalizePath(stringValue(row.dimensionValues?.[0]?.value) || "/");
+      if (!urlPath) continue;
+      rows.push({
+        urlPath,
+        views: numberOrZero(row.metricValues?.[0]?.value),
+        users: numberOrZero(row.metricValues?.[1]?.value),
+        sessions: numberOrZero(row.metricValues?.[2]?.value),
+        engagementRate: numberOrZero(row.metricValues?.[3]?.value),
+        bounceRate: numberOrZero(row.metricValues?.[4]?.value),
+        averageSessionDuration: numberOrZero(row.metricValues?.[5]?.value)
+      });
+    }
+    if (pageRows.length < limit) break;
+    offset += limit;
+  }
+  return rows;
+}
+async function fetchGaDailyTrend(http, config, serviceAccount, window) {
+  const token = await getGoogleAccessToken(http, serviceAccount, [GA_SCOPE]);
+  const body = await postJson(
+    http,
+    `${GOOGLE_GA_BASE_URL}/properties/${config.ga4PropertyId}:runReport`,
+    token,
+    {
+      dateRanges: [window],
+      dimensions: [{ name: "date" }],
+      metrics: [
+        { name: "screenPageViews" },
+        { name: "activeUsers" },
+        { name: "sessions" }
+      ],
+      dimensionFilter: {
+        filter: {
+          fieldName: "hostName",
+          stringFilter: {
+            matchType: "EXACT",
+            value: new URL(config.siteOrigin).hostname
+          }
+        }
+      },
+      limit: 1e3
+    }
+  );
+  return (Array.isArray(body.rows) ? body.rows : []).map((row) => ({
+    date: parseGaDate(stringValue(row.dimensionValues?.[0]?.value) || window.startDate),
+    clicks: 0,
+    impressions: 0,
+    views: numberOrZero(row.metricValues?.[0]?.value),
+    users: numberOrZero(row.metricValues?.[1]?.value),
+    sessions: numberOrZero(row.metricValues?.[2]?.value)
+  }));
+}
+async function getGoogleAccessToken(http, serviceAccount, scopes) {
+  const cacheKey = `${serviceAccount.client_email}:${scopes.join(" ")}`;
+  const cached = accessTokenCache.get(cacheKey);
+  if (cached && cached.expiresAt > Date.now() + 6e4) {
+    return cached.token;
+  }
+  const assertion = await createJwtAssertion(serviceAccount, scopes);
+  const response = await http.fetch(GOOGLE_TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+      assertion
+    }).toString()
+  });
+  const body = await parseJson(response);
+  if (!response.ok) {
+    throw new Error(`Failed to obtain Google access token: ${body.error_description || body.error || response.status}`);
+  }
+  const token = stringValue(body.access_token);
+  const expiresIn = numberOrZero(body.expires_in) || 3600;
+  if (!token) {
+    throw new Error("Google token response did not include access_token");
+  }
+  accessTokenCache.set(cacheKey, {
+    token,
+    expiresAt: Date.now() + expiresIn * 1e3
+  });
+  return token;
+}
+async function createJwtAssertion(serviceAccount, scopes) {
+  const now = Math.floor(Date.now() / 1e3);
+  const header = { alg: "RS256", typ: "JWT" };
+  const claims = {
+    iss: serviceAccount.client_email,
+    scope: scopes.join(" "),
+    aud: serviceAccount.token_uri || GOOGLE_TOKEN_URL,
+    exp: now + 3600,
+    iat: now
+  };
+  const encodedHeader = base64url(JSON.stringify(header));
+  const encodedClaims = base64url(JSON.stringify(claims));
+  const payload = `${encodedHeader}.${encodedClaims}`;
+  const key = await crypto.subtle.importKey(
+    "pkcs8",
+    pemToArrayBuffer(serviceAccount.private_key),
+    {
+      name: "RSASSA-PKCS1-v1_5",
+      hash: "SHA-256"
+    },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign(
+    "RSASSA-PKCS1-v1_5",
+    key,
+    new TextEncoder().encode(payload)
+  );
+  return `${payload}.${base64urlBytes(new Uint8Array(signature))}`;
+}
+async function postJson(http, url, accessToken, payload) {
+  const response = await http.fetch(url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify(payload)
+  });
+  const body = await parseJson(response);
+  if (!response.ok) {
+    const message = body.error?.message || body.error_description || response.statusText;
+    throw new Error(`Google API request failed: ${message}`);
+  }
+  return body;
+}
+async function parseJson(response) {
+  const text = await response.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { rawText: text };
+  }
+}
+function pemToArrayBuffer(pem) {
+  const normalized = pem.replace(/-----BEGIN PRIVATE KEY-----/g, "").replace(/-----END PRIVATE KEY-----/g, "").replace(/\s+/g, "");
+  const binary = atob(normalized);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes.buffer;
+}
+function base64url(value) {
+  return base64urlBytes(new TextEncoder().encode(value));
+}
+function base64urlBytes(value) {
+  let binary = "";
+  for (const byte of value) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function parseGaDate(value) {
+  if (/^\d{8}$/.test(value)) {
+    return `${value.slice(0, 4)}-${value.slice(4, 6)}-${value.slice(6, 8)}`;
+  }
+  return value;
+}
+function addDaysUtc(date, delta) {
+  const next = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));
+  next.setUTCDate(next.getUTCDate() + delta);
+  return next;
+}
+function formatDate(date) {
+  return date.toISOString().slice(0, 10);
+}
+function stringValue(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function numberOrZero(value) {
+  if (typeof value === "number") return value;
+  if (typeof value === "string" && value.length > 0) {
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : 0;
+  }
+  return 0;
+}
+
+// src/scoring.ts
+function scorePage(page, queries = []) {
+  let score = 0;
+  const tags = [];
+  const evidence = [];
+  if (page.gscImpressions28d >= 1e3 && page.gscCtr28d < 0.03) {
+    score += 35;
+    tags.push("high-impression-low-ctr");
+    evidence.push({
+      tag: "high-impression-low-ctr",
+      reason: `CTR ${toPercent(page.gscCtr28d)} with ${page.gscImpressions28d} impressions`
+    });
+  }
+  if (page.gscPosition28d >= 4 && page.gscPosition28d <= 15 && page.gscImpressions28d >= 300) {
+    score += 20;
+    tags.push("ranking-near-page-1");
+    evidence.push({
+      tag: "ranking-near-page-1",
+      reason: `Average position ${page.gscPosition28d.toFixed(1)} with meaningful impressions`
+    });
+  }
+  if (page.gscClicksPrev28d > 0 && page.gscClicks28d <= page.gscClicksPrev28d * 0.8 || page.gaViewsPrev28d > 0 && page.gaViews28d <= page.gaViewsPrev28d * 0.8) {
+    score += 20;
+    tags.push("traffic-decline");
+    evidence.push({
+      tag: "traffic-decline",
+      reason: `Traffic declined versus previous window`
+    });
+  }
+  if (page.gaViews28d >= 200 && (page.gaEngagementRate28d < 0.5 || page.gaBounceRate28d > 0.6)) {
+    score += 15;
+    tags.push("weak-engagement");
+    evidence.push({
+      tag: "weak-engagement",
+      reason: `Engagement ${toPercent(page.gaEngagementRate28d)}, bounce ${toPercent(page.gaBounceRate28d)}`
+    });
+  }
+  const hasQueryGap = queries.some((query) => query.impressions28d >= 100 && query.ctr28d < 0.02);
+  if (hasQueryGap) {
+    score += 10;
+    tags.push("query-capture-gap");
+    evidence.push({
+      tag: "query-capture-gap",
+      reason: "One or more high-impression queries have weak CTR"
+    });
+  }
+  return { score, tags, evidence };
+}
+function toPercent(value) {
+  return `${(value * 100).toFixed(1)}%`;
+}
+
+// src/sync.ts
+async function getStatus(ctx) {
+  const config = await loadConfig(ctx);
+  return {
+    config: config ? {
+      siteOrigin: config.siteOrigin,
+      ga4PropertyId: config.ga4PropertyId,
+      gscSiteUrl: config.gscSiteUrl,
+      hasServiceAccount: true,
+      serviceAccountEmail: parseServiceAccount(config.serviceAccountJson).client_email
+    } : null,
+    summary: await ctx.kv.get(SITE_SUMMARY_KEY),
+    freshness: await getFreshness(ctx)
+  };
+}
+async function testConnection(ctx, draftConfig) {
+  const config = draftConfig ?? await loadConfig(ctx);
+  if (!config) {
+    throw new PluginRouteError("BAD_REQUEST", "Analytics connection is not configured", 400);
+  }
+  if (!ctx.http) {
+    throw new PluginRouteError("INTERNAL_ERROR", "HTTP capability is unavailable", 500);
+  }
+  return runConnectionTest(ctx.http, config, parseServiceAccount(config.serviceAccountJson));
+}
+async function syncBase(ctx, jobType) {
+  const config = await requireConfig(ctx);
+  if (!ctx.http) {
+    throw new PluginRouteError("INTERNAL_ERROR", "HTTP capability is unavailable", 500);
+  }
+  const serviceAccount = parseServiceAccount(config.serviceAccountJson);
+  const windows = buildWindows();
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const managedMap = await getManagedContentMap(config.siteOrigin);
+  const [gscCurrent, gscPrevious, gscTrend, gaCurrent, gaPrevious, gaTrend] = await Promise.all([
+    fetchGscPageMetrics(ctx.http, config, serviceAccount, windows.gscCurrent),
+    fetchGscPageMetrics(ctx.http, config, serviceAccount, windows.gscPrevious),
+    fetchGscDailyTrend(ctx.http, config, serviceAccount, windows.gscCurrent),
+    fetchGaPageMetrics(ctx.http, config, serviceAccount, windows.gaCurrent),
+    fetchGaPageMetrics(ctx.http, config, serviceAccount, windows.gaPrevious),
+    fetchGaDailyTrend(ctx.http, config, serviceAccount, windows.gaCurrent)
+  ]);
+  const host = new URL(config.siteOrigin).hostname;
+  const pages = /* @__PURE__ */ new Map();
+  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+  const ensurePage = (urlPath) => {
+    const existing = pages.get(urlPath);
+    if (existing) return existing;
+    const managed = managedMap.get(urlPath) ?? null;
+    const created = {
+      urlPath,
+      host,
+      pageKind: classifyPageKind(urlPath),
+      managed: !!managed,
+      title: managed?.title || urlPath,
+      contentCollection: managed?.collection || null,
+      contentId: managed?.id || null,
+      contentSlug: managed?.slug || null,
+      gscClicks28d: 0,
+      gscImpressions28d: 0,
+      gscCtr28d: 0,
+      gscPosition28d: 0,
+      gscClicksPrev28d: 0,
+      gscImpressionsPrev28d: 0,
+      gaViews28d: 0,
+      gaUsers28d: 0,
+      gaSessions28d: 0,
+      gaEngagementRate28d: 0,
+      gaBounceRate28d: 0,
+      gaAvgSessionDuration28d: 0,
+      gaViewsPrev28d: 0,
+      gaUsersPrev28d: 0,
+      gaSessionsPrev28d: 0,
+      opportunityScore: 0,
+      opportunityTags: [],
+      lastSyncedAt: nowIso,
+      lastGscDate: windows.gscCurrent.endDate,
+      lastGaDate: windows.gaCurrent.endDate
+    };
+    pages.set(urlPath, created);
+    return created;
+  };
+  for (const metric of gscCurrent) {
+    const page = ensurePage(metric.urlPath);
+    page.gscClicks28d = metric.clicks;
+    page.gscImpressions28d = metric.impressions;
+    page.gscCtr28d = metric.ctr;
+    page.gscPosition28d = metric.position;
+  }
+  for (const metric of gscPrevious) {
+    const page = ensurePage(metric.urlPath);
+    page.gscClicksPrev28d = metric.clicks;
+    page.gscImpressionsPrev28d = metric.impressions;
+  }
+  for (const metric of gaCurrent) {
+    const page = ensurePage(metric.urlPath);
+    page.gaViews28d = metric.views;
+    page.gaUsers28d = metric.users;
+    page.gaSessions28d = metric.sessions;
+    page.gaEngagementRate28d = metric.engagementRate;
+    page.gaBounceRate28d = metric.bounceRate;
+    page.gaAvgSessionDuration28d = metric.averageSessionDuration;
+  }
+  for (const metric of gaPrevious) {
+    const page = ensurePage(metric.urlPath);
+    page.gaViewsPrev28d = metric.views;
+    page.gaUsersPrev28d = metric.users;
+    page.gaSessionsPrev28d = metric.sessions;
+  }
+  for (const page of pages.values()) {
+    const score = scorePage(page, []);
+    page.opportunityScore = score.score;
+    page.opportunityTags = score.tags;
+  }
+  await ctx.storage.pages.putMany(
+    Array.from(pages.values()).map((page) => ({
+      id: pageStorageId(page.urlPath),
+      data: page
+    }))
+  );
+  const combinedTrend = mergeTrend(gscTrend, gaTrend);
+  await ctx.storage.daily_metrics.putMany(
+    combinedTrend.flatMap((row) => [
+      {
+        id: dailyMetricStorageId("gsc", "all_public", row.date),
+        data: {
+          source: "gsc",
+          scope: "all_public",
+          date: row.date,
+          clicks: row.clicks,
+          impressions: row.impressions,
+          views: 0,
+          sessions: 0,
+          users: 0
+        }
+      },
+      {
+        id: dailyMetricStorageId("ga", "all_public", row.date),
+        data: {
+          source: "ga",
+          scope: "all_public",
+          date: row.date,
+          clicks: 0,
+          impressions: 0,
+          views: row.views,
+          sessions: row.sessions,
+          users: row.users
+        }
+      }
+    ])
+  );
+  const freshness = {
+    lastSyncedAt: nowIso,
+    lastGscDate: windows.gscCurrent.endDate,
+    lastGaDate: windows.gaCurrent.endDate,
+    lastStatus: "success"
+  };
+  const summary = buildSummary(Array.from(pages.values()), combinedTrend, windows);
+  await Promise.all([
+    ctx.kv.set(FRESHNESS_KEY, freshness),
+    ctx.kv.set(SITE_SUMMARY_KEY, summary),
+    writeSyncRun(ctx, {
+      jobType,
+      status: "success",
+      startedAt,
+      finishedAt: nowIso,
+      summary: {
+        trackedPages: pages.size,
+        managedPages: Array.from(pages.values()).filter((page) => page.managed).length
+      },
+      error: null
+    })
+  ]);
+  return {
+    trackedPages: pages.size,
+    managedPages: Array.from(pages.values()).filter((page) => page.managed).length
+  };
+}
+async function enrichManagedQueries(ctx) {
+  const config = await requireConfig(ctx);
+  if (!ctx.http) {
+    throw new PluginRouteError("INTERNAL_ERROR", "HTTP capability is unavailable", 500);
+  }
+  const serviceAccount = parseServiceAccount(config.serviceAccountJson);
+  const windows = buildWindows();
+  const candidateResult = await ctx.storage.pages.query({
+    where: {
+      managed: true,
+      opportunityScore: { gt: 0 }
+    },
+    orderBy: { opportunityScore: "desc" },
+    limit: GSC_QUERY_PAGE_LIMIT
+  });
+  let refreshedPages = 0;
+  for (const item of candidateResult.items) {
+    const page = item.data;
+    const queries = await fetchGscPageQueries(
+      ctx.http,
+      config,
+      serviceAccount,
+      page.urlPath,
+      windows.gscCurrent,
+      GSC_QUERY_ROW_LIMIT
+    );
+    const existing = await ctx.storage.page_queries.query({
+      where: { urlPath: page.urlPath },
+      limit: 100
+    });
+    if (existing.items.length > 0) {
+      await ctx.storage.page_queries.deleteMany(existing.items.map((entry) => entry.id));
+    }
+    if (queries.length > 0) {
+      await ctx.storage.page_queries.putMany(
+        queries.map((query) => ({
+          id: pageQueryStorageId(page.urlPath, query.query),
+          data: {
+            urlPath: page.urlPath,
+            query: query.query,
+            clicks28d: query.clicks,
+            impressions28d: query.impressions,
+            ctr28d: query.ctr,
+            position28d: query.position,
+            updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        }))
+      );
+    }
+    const queryRows = await getPageQueries(ctx, page.urlPath);
+    const rescored = scorePage(page, queryRows);
+    page.opportunityScore = rescored.score;
+    page.opportunityTags = rescored.tags;
+    page.lastSyncedAt = (/* @__PURE__ */ new Date()).toISOString();
+    await ctx.storage.pages.put(pageStorageId(page.urlPath), page);
+    refreshedPages += 1;
+  }
+  await refreshSummaryFromStorage(ctx);
+  await writeSyncRun(ctx, {
+    jobType: CRON_ENRICH_MANAGED,
+    status: "success",
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    summary: { refreshedPages },
+    error: null
+  });
+  return { refreshedPages };
+}
+async function listPages(ctx, filters) {
+  const where = {};
+  if (filters.managed === "managed") where.managed = true;
+  if (filters.managed === "unmanaged") where.managed = false;
+  if (filters.pageKind && filters.pageKind !== "all") where.pageKind = filters.pageKind;
+  if (filters.hasOpportunity) where.opportunityScore = { gt: 0 };
+  const result = await ctx.storage.pages.query({
+    where,
+    orderBy: { opportunityScore: "desc" },
+    limit: filters.limit ?? 50,
+    cursor: filters.cursor
+  });
+  return {
+    items: result.items.map((item) => item.data),
+    cursor: result.cursor,
+    hasMore: result.hasMore
+  };
+}
+async function getOverview(ctx) {
+  const [summary, freshness, topOpportunities, topUnmanaged] = await Promise.all([
+    ctx.kv.get(SITE_SUMMARY_KEY),
+    getFreshness(ctx),
+    ctx.storage.pages.query({
+      where: { managed: true, opportunityScore: { gt: 0 } },
+      orderBy: { opportunityScore: "desc" },
+      limit: 5
+    }),
+    ctx.storage.pages.query({
+      where: { managed: false },
+      orderBy: { gaViews28d: "desc" },
+      limit: 5
+    })
+  ]);
+  return {
+    summary,
+    freshness,
+    topOpportunities: topOpportunities.items.map((item) => item.data),
+    topUnmanaged: topUnmanaged.items.map((item) => item.data)
+  };
+}
+async function getContentContext(ctx, collection, id, slug) {
+  const config = await requireConfig(ctx);
+  const managedMap = await getManagedContentMap(config.siteOrigin);
+  let contentRef = null;
+  if (id) {
+    contentRef = Array.from(managedMap.values()).find(
+      (entry) => entry.collection === collection && entry.id === id
+    ) || null;
+  }
+  if (!contentRef && slug) {
+    contentRef = Array.from(managedMap.values()).find(
+      (entry) => entry.collection === collection && entry.slug === slug
+    ) || null;
+  }
+  if (!contentRef) {
+    throw new PluginRouteError("NOT_FOUND", "Managed content not found", 404);
+  }
+  const page = await loadPage(ctx, contentRef.urlPath);
+  if (!page) {
+    throw new PluginRouteError("NOT_FOUND", "Analytics data not found for content", 404);
+  }
+  const queries = await getFreshQueriesForPage(ctx, config, contentRef.urlPath);
+  const windows = buildWindows();
+  const score = scorePage(page, queries);
+  const freshness = await getFreshness(ctx);
+  return {
+    content: {
+      collection: "posts",
+      id: contentRef.id,
+      slug: contentRef.slug,
+      title: contentRef.title,
+      urlPath: contentRef.urlPath,
+      url: buildContentUrl(config.siteOrigin, contentRef.urlPath),
+      excerpt: contentRef.excerpt ?? null,
+      seoDescription: contentRef.seoDescription ?? null
+    },
+    analytics: {
+      window: windows,
+      page: {
+        ...page,
+        gscClicksDelta: page.gscClicks28d - page.gscClicksPrev28d,
+        gscImpressionsDelta: page.gscImpressions28d - page.gscImpressionsPrev28d,
+        gaViewsDelta: page.gaViews28d - page.gaViewsPrev28d,
+        gaUsersDelta: page.gaUsers28d - page.gaUsersPrev28d,
+        gaSessionsDelta: page.gaSessions28d - page.gaSessionsPrev28d
+      },
+      searchQueries: queries,
+      opportunities: score.evidence,
+      freshness
+    }
+  };
+}
+async function listAgentKeys(ctx) {
+  const result = await ctx.storage.agent_keys.query({
+    orderBy: { createdAt: "desc" },
+    limit: 100
+  });
+  return result.items.map((item) => {
+    const record = item.data;
+    return {
+      prefix: record.prefix,
+      label: record.label,
+      createdAt: record.createdAt,
+      lastUsedAt: record.lastUsedAt,
+      revokedAt: record.revokedAt
+    };
+  });
+}
+async function createAgentKey(ctx, label) {
+  const created = generatePrefixedToken(AGENT_KEY_PREFIX);
+  const key = created.raw;
+  const hash = hashPrefixedToken(key);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const record = {
+    prefix: created.prefix,
+    hash,
+    label,
+    createdAt: now,
+    lastUsedAt: null,
+    revokedAt: null
+  };
+  await ctx.storage.agent_keys.put(hash, record);
+  return {
+    key,
+    metadata: {
+      prefix: record.prefix,
+      label: record.label,
+      createdAt: record.createdAt,
+      lastUsedAt: null,
+      revokedAt: null
+    }
+  };
+}
+async function revokeAgentKey(ctx, prefix) {
+  const result = await ctx.storage.agent_keys.query({
+    where: { prefix },
+    limit: 1
+  });
+  const item = result.items[0];
+  if (!item) {
+    throw new PluginRouteError("NOT_FOUND", "Agent key not found", 404);
+  }
+  const record = item.data;
+  record.revokedAt = (/* @__PURE__ */ new Date()).toISOString();
+  await ctx.storage.agent_keys.put(item.id, record);
+}
+async function authenticateAgentRequest(ctx, request) {
+  const token = extractAgentToken(request);
+  if (!token.startsWith(AGENT_KEY_PREFIX)) {
+    throw new PluginRouteError("UNAUTHORIZED", "Missing or invalid agent key", 401);
+  }
+  const hash = hashPrefixedToken(token);
+  const record = await ctx.storage.agent_keys.get(hash);
+  const keyRecord = record;
+  if (!keyRecord || keyRecord.revokedAt) {
+    throw new PluginRouteError("UNAUTHORIZED", "Missing or invalid agent key", 401);
+  }
+  keyRecord.lastUsedAt = (/* @__PURE__ */ new Date()).toISOString();
+  await ctx.storage.agent_keys.put(hash, keyRecord);
+}
+function extractAgentToken(request) {
+  const authHeader = request.headers.get("Authorization") || "";
+  if (authHeader.startsWith("AgentKey ")) {
+    return authHeader.slice("AgentKey ".length).trim();
+  }
+  const headerToken = request.headers.get("X-Emdash-Agent-Key") || "";
+  if (headerToken.trim()) {
+    return headerToken.trim();
+  }
+  return "";
+}
+async function handleCron(ctx, eventName) {
+  if (eventName === CRON_SYNC_BASE) {
+    await syncBase(ctx, CRON_SYNC_BASE);
+    return;
+  }
+  if (eventName === CRON_ENRICH_MANAGED) {
+    await enrichManagedQueries(ctx);
+  }
+}
+async function requireConfig(ctx) {
+  const config = await loadConfig(ctx);
+  if (!config) {
+    throw new PluginRouteError("BAD_REQUEST", "Analytics connection is not configured", 400);
+  }
+  return config;
+}
+async function loadPage(ctx, urlPath) {
+  const page = await ctx.storage.pages.get(pageStorageId(urlPath));
+  return page ?? null;
+}
+async function getFreshQueriesForPage(ctx, config, urlPath) {
+  let queries = await getPageQueries(ctx, urlPath);
+  const updatedAt = queries[0]?.updatedAt ? Date.parse(queries[0].updatedAt) : 0;
+  const isStale = !updatedAt || Date.now() - updatedAt > QUERY_REFRESH_STALE_HOURS * 60 * 60 * 1e3;
+  if (!isStale || !ctx.http) return queries;
+  const serviceAccount = parseServiceAccount(config.serviceAccountJson);
+  const windows = buildWindows();
+  const refreshed = await fetchGscPageQueries(
+    ctx.http,
+    config,
+    serviceAccount,
+    urlPath,
+    windows.gscCurrent,
+    GSC_QUERY_ROW_LIMIT
+  );
+  const existing = await ctx.storage.page_queries.query({
+    where: { urlPath },
+    limit: 100
+  });
+  if (existing.items.length > 0) {
+    await ctx.storage.page_queries.deleteMany(existing.items.map((entry) => entry.id));
+  }
+  if (refreshed.length > 0) {
+    const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+    await ctx.storage.page_queries.putMany(
+      refreshed.map((query) => ({
+        id: pageQueryStorageId(urlPath, query.query),
+        data: {
+          urlPath,
+          query: query.query,
+          clicks28d: query.clicks,
+          impressions28d: query.impressions,
+          ctr28d: query.ctr,
+          position28d: query.position,
+          updatedAt: nowIso
+        }
+      }))
+    );
+  }
+  queries = await getPageQueries(ctx, urlPath);
+  const page = await loadPage(ctx, urlPath);
+  if (page) {
+    const rescored = scorePage(page, queries);
+    page.opportunityScore = rescored.score;
+    page.opportunityTags = rescored.tags;
+    page.lastSyncedAt = (/* @__PURE__ */ new Date()).toISOString();
+    await ctx.storage.pages.put(pageStorageId(urlPath), page);
+  }
+  return queries;
+}
+async function getPageQueries(ctx, urlPath) {
+  const result = await ctx.storage.page_queries.query({
+    where: { urlPath },
+    orderBy: { impressions28d: "desc" },
+    limit: 50
+  });
+  return result.items.map((item) => item.data);
+}
+async function getFreshness(ctx) {
+  return await ctx.kv.get(FRESHNESS_KEY) || {
+    lastSyncedAt: null,
+    lastGscDate: null,
+    lastGaDate: null,
+    lastStatus: "idle"
+  };
+}
+async function refreshSummaryFromStorage(ctx) {
+  const windows = buildWindows();
+  const allPages = [];
+  let cursor;
+  do {
+    const pageBatch = await ctx.storage.pages.query({
+      limit: 500,
+      cursor
+    });
+    cursor = pageBatch.cursor;
+    allPages.push(...pageBatch.items.map((item) => item.data));
+  } while (cursor);
+  const trendMap = /* @__PURE__ */ new Map();
+  let dailyCursor;
+  do {
+    const batch = await ctx.storage.daily_metrics.query({
+      limit: 1e3,
+      cursor: dailyCursor
+    });
+    dailyCursor = batch.cursor;
+    for (const item of batch.items) {
+      const row = item.data;
+      let existing = trendMap.get(row.date);
+      if (!existing) {
+        existing = { date: row.date, clicks: 0, impressions: 0, views: 0, sessions: 0, users: 0 };
+        trendMap.set(row.date, existing);
+      }
+      existing.clicks += row.clicks;
+      existing.impressions += row.impressions;
+      existing.views += row.views;
+      existing.sessions += row.sessions;
+      existing.users += row.users;
+    }
+  } while (dailyCursor);
+  await ctx.kv.set(
+    SITE_SUMMARY_KEY,
+    buildSummary(allPages, Array.from(trendMap.values()).sort((a, b) => a.date.localeCompare(b.date)), windows)
+  );
+}
+async function writeSyncRun(ctx, record) {
+  await ctx.storage.sync_runs.put(ulid(), record);
+}
+function buildSummary(pages, trend, windows) {
+  return {
+    window: windows,
+    totals: {
+      gscClicks28d: pages.reduce((total, page) => total + page.gscClicks28d, 0),
+      gscImpressions28d: pages.reduce((total, page) => total + page.gscImpressions28d, 0),
+      gaViews28d: pages.reduce((total, page) => total + page.gaViews28d, 0),
+      gaUsers28d: pages.reduce((total, page) => total + page.gaUsers28d, 0),
+      gaSessions28d: pages.reduce((total, page) => total + page.gaSessions28d, 0),
+      managedOpportunities: pages.filter((page) => page.managed && page.opportunityScore > 0).length,
+      trackedPages: pages.length
+    },
+    trend: trend.map((row) => ({
+      date: row.date,
+      gscClicks: row.clicks,
+      gscImpressions: row.impressions,
+      gaViews: row.views,
+      gaSessions: row.sessions,
+      gaUsers: row.users
+    }))
+  };
+}
+function mergeTrend(gscTrend, gaTrend) {
+  const map = /* @__PURE__ */ new Map();
+  for (const row of gscTrend) {
+    map.set(row.date, {
+      date: row.date,
+      clicks: row.clicks,
+      impressions: row.impressions,
+      views: 0,
+      sessions: 0,
+      users: 0
+    });
+  }
+  for (const row of gaTrend) {
+    const existing = map.get(row.date) || {
+      date: row.date,
+      clicks: 0,
+      impressions: 0,
+      views: 0,
+      sessions: 0,
+      users: 0
+    };
+    existing.views = row.views;
+    existing.sessions = row.sessions;
+    existing.users = row.users;
+    map.set(row.date, existing);
+  }
+  return Array.from(map.values()).sort((left, right) => left.date.localeCompare(right.date));
+}
+
+// src/index.ts
+var configSaveSchema = z2.object({
+  siteOrigin: z2.string().optional(),
+  ga4PropertyId: z2.string().optional(),
+  gscSiteUrl: z2.string().optional(),
+  serviceAccountJson: z2.string().optional()
+});
+var pageListSchema = z2.object({
+  managed: z2.enum(["all", "managed", "unmanaged"]).optional(),
+  hasOpportunity: z2.boolean().optional(),
+  pageKind: z2.enum(["all", "blog_post", "blog_archive", "tag", "author", "landing", "other"]).optional(),
+  limit: z2.number().int().min(1).max(100).optional(),
+  cursor: z2.string().optional()
+});
+var contentContextSchema = z2.object({
+  collection: z2.string().default("posts"),
+  id: z2.string().optional(),
+  slug: z2.string().optional()
+});
+var agentKeyCreateSchema = z2.object({
+  label: z2.string().min(1).max(200)
+});
+var agentKeyRevokeSchema = z2.object({
+  prefix: z2.string().min(1)
+});
+function contentInsightsPlugin() {
+  return {
+    id: PLUGIN_ID,
+    version: PLUGIN_VERSION,
+    entrypoint: "@yourbright/emdash-analytics-plugin",
+    adminEntry: "@yourbright/emdash-analytics-plugin/admin",
+    capabilities: ["network:fetch", "read:content"],
+    allowedHosts: [
+      "oauth2.googleapis.com",
+      "analyticsdata.googleapis.com",
+      "www.googleapis.com"
+    ],
+    adminPages: [
+      { path: "/", label: "Overview", icon: "chart-bar" },
+      { path: "/pages", label: "Pages", icon: "list" },
+      { path: "/settings", label: "Analytics", icon: "gear" }
+    ],
+    adminWidgets: [
+      { id: "content-opportunities", title: "Content Opportunities", size: "full" }
+    ],
+    options: {}
+  };
+}
+function createPlugin() {
+  return definePlugin({
+    id: PLUGIN_ID,
+    version: PLUGIN_VERSION,
+    capabilities: ["network:fetch", "read:content"],
+    allowedHosts: [
+      "oauth2.googleapis.com",
+      "analyticsdata.googleapis.com",
+      "www.googleapis.com"
+    ],
+    storage: {
+      pages: {
+        indexes: [
+          "managed",
+          "pageKind",
+          "opportunityScore",
+          "gaViews28d",
+          "urlPath",
+          "contentCollection",
+          "contentId",
+          "contentSlug"
+        ],
+        uniqueIndexes: ["urlPath"]
+      },
+      page_queries: {
+        indexes: ["urlPath", "impressions28d", "updatedAt"],
+        uniqueIndexes: [["urlPath", "query"]]
+      },
+      daily_metrics: {
+        indexes: ["source", "scope", "date"],
+        uniqueIndexes: [["source", "scope", "date"]]
+      },
+      sync_runs: {
+        indexes: ["jobType", "status", "startedAt"]
+      },
+      agent_keys: {
+        indexes: ["prefix", "createdAt", "revokedAt"],
+        uniqueIndexes: ["hash", "prefix"]
+      }
+    },
+    hooks: {
+      "plugin:activate": {
+        handler: async (_event, ctx) => {
+          if (ctx.cron) {
+            await ctx.cron.schedule(CRON_SYNC_BASE, { schedule: "0 */6 * * *" });
+            await ctx.cron.schedule(CRON_ENRICH_MANAGED, { schedule: "0 2 * * *" });
+          }
+        }
+      },
+      cron: {
+        handler: async (event, ctx) => {
+          await handleCron(ctx, event.name);
+        }
+      }
+    },
+    routes: {
+      [ADMIN_ROUTES.STATUS]: {
+        handler: async (ctx) => getStatus(ctx)
+      },
+      [ADMIN_ROUTES.OVERVIEW]: {
+        handler: async (ctx) => getOverview(ctx)
+      },
+      [ADMIN_ROUTES.LIST_PAGES]: {
+        input: pageListSchema,
+        handler: async (ctx) => listPages(ctx, ctx.input)
+      },
+      [ADMIN_ROUTES.CONTENT_CONTEXT]: {
+        input: contentContextSchema,
+        handler: async (ctx) => {
+          const input = ctx.input;
+          return getContentContext(ctx, input.collection, input.id, input.slug);
+        }
+      },
+      [ADMIN_ROUTES.CONFIG_GET]: {
+        handler: async (ctx) => getConfigSummary(ctx)
+      },
+      [ADMIN_ROUTES.CONFIG_SAVE]: {
+        input: configSaveSchema,
+        handler: async (ctx) => {
+          const input = ctx.input;
+          const current = await loadConfig(ctx);
+          const resolved = resolveConfigInput(input, current);
+          if (!resolved.success) {
+            throw new PluginRouteError2("BAD_REQUEST", resolved.message, 400);
+          }
+          return saveConfig(ctx, resolved.data);
+        }
+      },
+      [ADMIN_ROUTES.CONNECTION_TEST]: {
+        input: configSaveSchema,
+        handler: async (ctx) => {
+          const input = ctx.input;
+          const current = await loadConfig(ctx);
+          const resolved = resolveConfigInput(input, current);
+          if (!resolved.success) {
+            throw new PluginRouteError2("BAD_REQUEST", resolved.message, 400);
+          }
+          return testConnection(ctx, resolved.data);
+        }
+      },
+      [ADMIN_ROUTES.SYNC_NOW]: {
+        handler: async (ctx) => {
+          const base = await syncBase(ctx, "manual");
+          const enriched = await enrichManagedQueries(ctx);
+          return { ...base, ...enriched };
+        }
+      },
+      [ADMIN_ROUTES.AGENT_KEYS_LIST]: {
+        handler: async (ctx) => listAgentKeys(ctx)
+      },
+      [ADMIN_ROUTES.AGENT_KEYS_CREATE]: {
+        input: agentKeyCreateSchema,
+        handler: async (ctx) => createAgentKey(ctx, ctx.input.label)
+      },
+      [ADMIN_ROUTES.AGENT_KEYS_REVOKE]: {
+        input: agentKeyRevokeSchema,
+        handler: async (ctx) => {
+          await revokeAgentKey(ctx, ctx.input.prefix);
+          return { success: true };
+        }
+      },
+      [PUBLIC_AGENT_ROUTES.SITE_SUMMARY]: {
+        public: true,
+        handler: async (ctx) => {
+          await authenticateAgentRequest(ctx, ctx.request);
+          const overview = await getOverview(ctx);
+          return {
+            summary: overview.summary,
+            freshness: overview.freshness
+          };
+        }
+      },
+      [PUBLIC_AGENT_ROUTES.OPPORTUNITIES]: {
+        public: true,
+        handler: async (ctx) => {
+          await authenticateAgentRequest(ctx, ctx.request);
+          return listPages(ctx, {
+            managed: "managed",
+            hasOpportunity: true,
+            limit: parsePositiveInt(new URL(ctx.request.url).searchParams.get("limit")) || 50,
+            cursor: new URL(ctx.request.url).searchParams.get("cursor") || void 0
+          });
+        }
+      },
+      [PUBLIC_AGENT_ROUTES.CONTENT_CONTEXT]: {
+        public: true,
+        handler: async (ctx) => {
+          await authenticateAgentRequest(ctx, ctx.request);
+          const params = new URL(ctx.request.url).searchParams;
+          const collection = params.get("collection") || "posts";
+          const id = params.get("id") || void 0;
+          const slug = params.get("slug") || void 0;
+          if (!id && !slug) {
+            throw new PluginRouteError2("BAD_REQUEST", "id or slug is required", 400);
+          }
+          return getContentContext(ctx, collection, id, slug);
+        }
+      }
+    },
+    admin: {
+      pages: [
+        { path: "/", label: "Overview", icon: "chart-bar" },
+        { path: "/pages", label: "Pages", icon: "list" },
+        { path: "/settings", label: "Analytics", icon: "gear" }
+      ],
+      widgets: [
+        { id: "content-opportunities", title: "Content Opportunities", size: "full" }
+      ]
+    }
+  });
+}
+var src_default = createPlugin;
+function parsePositiveInt(value) {
+  if (!value) return void 0;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : void 0;
+}
+export {
+  contentInsightsPlugin,
+  createPlugin,
+  src_default as default
+};