create-ailk 0.5.0 → 0.6.0

package/templates/apps/api/src/routes/content/index.ts

@@ -3,93 +3,33 @@
  *
  * Read endpoints, all GET, all JSON-LD-shaped at the document root:
  *   GET /v1/content/types          — supported page types
+ *   GET /v1/content/search         — keyword search (#5831)
  *   GET /v1/content/:type          — paginated list of pages
  *   GET /v1/content/:type/:slug    — single page with resolved JSON-LD
  *
- * Write endpoints (D14a, Pro-tier gated via `requirePaidTier` preHandler):
- *   POST   /v1/content/:type             — create a new page
- *   PATCH  /v1/content/:type/:slug       — update; mandatory `If-Match`
- *   DELETE /v1/content/:type/:slug       — delete; mandatory `If-Match`
+ * READ-ONLY. There are no write endpoints at this prefix: the untenanted
+ * `POST /v1/content/:type` and `PATCH`/`DELETE /v1/content/:type/:slug` were
+ * RETIRED by #5853 and now answer Fastify's own 404 on every build. They
+ * addressed a page by `(type, slug)` with no workspace in the address at all,
+ * which is the client-supplied scope roadmap D4 rejects; the write surface
+ * that replaces them is tenant-guarded and lives at
+ * `apps/api/src/routes/workspaces/content.ts` —
+ * `/v1/workspaces/:workspaceId/content/...`, scoped from the session and never
+ * from the request.
  *
  * Rate-limit, CORS, and the OpenAPI spec are wired at server level.
- *
- * The three write handlers are content-write SLICE files, which the OSS strip
- * removes (#5182). They are reached here the same way `server.ts` reaches
- * them — behind `isModuleEnabled('content-write')` — but through a specifier
- * this module does not spell as a literal, because `tsc` resolves a literal
- * specifier whether or not the branch can run and would report TS2307 on the
- * stripped tree. Registration is unchanged when the module is present, which
- * is the default (`AILK_ENABLED_MODULES` unset means every module on).
  */
 import type { FastifyPluginAsync } from "fastify";
 
-import { isModuleEnabled } from "../../config/modules.js";
-import { loadSlice } from "../../lib/slice-load.js";
-
 import { getPageRoute } from "./get-page.js";
 import { listPagesRoute } from "./list-pages.js";
 import { listTypesRoute } from "./list-types.js";
-
-/**
- * Content-write slice entry points, as { specifier, exportName, load }.
- *
- * What defeats `tsc`'s resolution is the INDIRECTION, not the type: TypeScript
- * resolves `import("...")` only when the argument is a string-literal
- * EXPRESSION written at the call site.
- *
- * WHICH indirection matters, and #5304 is the correction. This table used to
- * hold the specifier as a string and the loop read it out per iteration — a
- * shape `@vercel/nft` cannot evaluate either, so the deploy-time tracer did not
- * emit these files and a deployed site shipped without them. A module-level
- * constant dereferenced into `import()` is unresolvable to `tsc` and traceable
- * to `nft`, so the strip and the deployment are both satisfied. `specifier` is
- * carried for the drift message below and reads the same constant as `load`, so
- * the two cannot disagree.
- */
-const CREATE_ROUTE = "./create.js";
-const UPDATE_ROUTE = "./update.js";
-const DELETE_ROUTE = "./delete.js";
-
-const WRITE_ROUTES: ReadonlyArray<{
-  specifier: string;
-  exportName: string;
-  load: () => Promise<unknown>;
-}> = [
-  {
-    specifier: CREATE_ROUTE,
-    exportName: "createPageRoute",
-    load: () => import(CREATE_ROUTE),
-  },
-  {
-    specifier: UPDATE_ROUTE,
-    exportName: "updatePageRoute",
-    load: () => import(UPDATE_ROUTE),
-  },
-  {
-    specifier: DELETE_ROUTE,
-    exportName: "deletePageRoute",
-    load: () => import(DELETE_ROUTE),
-  },
-];
+import { searchContentRoute } from "./search.js";
 
 export const contentRoutes: FastifyPluginAsync = async (fastify) => {
   await fastify.register(listTypesRoute);
+  // Before `listPagesRoute`: `search` must never be read as a `:type`.
+  await fastify.register(searchContentRoute);
   await fastify.register(listPagesRoute);
   await fastify.register(getPageRoute);
-
-  if (isModuleEnabled("content-write")) {
-    for (const { specifier, exportName, load } of WRITE_ROUTES) {
-      const mod = (await loadSlice(specifier, load)) as Record<
-        string,
-        FastifyPluginAsync | undefined
-      >;
-      const route = mod[exportName];
-      if (!route) {
-        throw new Error(
-          `content-write slice drift: '${specifier}' does not export '${exportName}'`,
-        );
-      }
-      await fastify.register(route);
-    }
-  }
 };

package/templates/apps/api/src/routes/content/list-pages.ts

@@ -5,7 +5,8 @@
  * pageSize 20; pageSize is capped at 100 to keep response payloads bounded.
  *
  * Response envelope is an `ItemList` JSON-LD document carrying the page
- * frontmatter under `items` and pagination metadata alongside.
+ * frontmatter under `items` and pagination metadata alongside. A deployment
+ * whose site cannot be resolved (#5852) answers 404, not an empty list.
  *
  * Phase 3 S3: optional `?locale=<locale>` query parameter. Validated against
  * `readLocales()` allowlist; invalid or unknown locale silently falls back to
@@ -15,8 +16,8 @@ import { SCHEMA_ORG_TYPES, type SchemaOrgType } from "@working-theory/content-ad
 import type { FastifyPluginAsync } from "fastify";
 import { z } from "zod";
 
-import { getContentAdapter } from "../../lib/content-adapter.js";
 import { resolveLocale } from "../../lib/locales.js";
+import { resolvePublicContentAdapter } from "../../services/public-site-resolver.js";
 
 const paramsSchema = z.object({
   type: z.enum(SCHEMA_ORG_TYPES),
@@ -61,7 +62,18 @@ export const listPagesRoute: FastifyPluginAsync = async (fastify) => {
     const locale = resolveLocale(query.data.locale);
 
     try {
-      const adapter = getContentAdapter();
+      // Site resolution precedes any content query (#5852). A refusal is a 404
+      // rather than an empty `ItemList`: a 200 would assert that this site
+      // exists and has no pages of this type, which is false when no site
+      // resolved.
+      const adapter = await resolvePublicContentAdapter(request);
+      if (adapter === null) {
+        return reply.status(404).send({
+          error: "Page not found",
+          type,
+        });
+      }
+
       const all = await adapter.listPages(type as SchemaOrgType, locale);
       const totalItems = all.length;
       const totalPages = Math.max(1, Math.ceil(totalItems / pageSize));

package/templates/apps/api/src/routes/content/rate-limit.ts

@@ -1,12 +1,21 @@
 /**
  * Rate-limit configuration for the public content API.
  *
- * v1: 60 req/min/IP for unauthenticated callers. Future: when an auth context
- * lands on the request (e.g. an `auth` claim from the API-token middleware),
- * the limit can be raised by reading that context inside `keyGenerator` /
- * `max`. Until then we apply the unauth ceiling globally — agents reading the
- * public API generally don't authenticate, and authenticated agents have
- * their own ceiling configurable per-token.
+ * `CONTENT_RATE_LIMIT_UNAUTH` (60 req/min/IP) is the GLOBAL ceiling
+ * `server.ts` registers — agents reading the public API generally don't
+ * authenticate.
+ *
+ * `CONTENT_RATE_LIMIT_AUTH` (600 req/min) is the SCOPE-LOCAL ceiling raised on
+ * the tenant-guarded content-write scope (#5853 D12,
+ * `routes/workspaces/content.ts`), which is the first scope in this app with an
+ * authenticated identity to hang it on. Sixty saves a minute is below what a
+ * real editing session generates, so an autosaving editor under the global
+ * ceiling would rate-limit its own user.
+ *
+ * Both limiters are in-memory and per-process (`server.ts`'s own comment), so
+ * neither is keyed on the tenant: a per-workspace key would be a fiction on a
+ * multi-instance deployment. The store swap is the change that makes one
+ * possible.
  */
 export const CONTENT_RATE_LIMIT_UNAUTH = 60;
 export const CONTENT_RATE_LIMIT_AUTH = 600;

package/templates/apps/api/src/routes/content/search.ts

@@ -0,0 +1,129 @@
+/**
+ * GET /v1/content/search
+ *
+ * Keyword search across published pages (#5831), scored by the adapter on
+ * title / description / body. The HTTP twin of the `search_content` MCP tool:
+ * same arguments, same adapter call, same result set — which is the API ↔ MCP
+ * parity contract in the root CLAUDE.md. Until this route existed the parity
+ * was one-sided, the tool having no endpoint to map to.
+ *
+ * Query:
+ *   q        required, 1..200 chars — the search string. The ceiling matches
+ *            the `search_content` MCP tool's own cap (`searchContentInputSchema`)
+ *            so the pair rejects the same inputs, and bounds the work an
+ *            unauthenticated caller can ask of the scorer per request.
+ *   type     optional — a schema.org page type
+ *   category optional — a LEAF slug from the site-category registry. Outside
+ *            the registry is a 400, not an empty result: the registry is
+ *            closed, so a bad slug is a caller mistake worth surfacing.
+ *   limit    optional, 1..50, default 10
+ *   locale   optional — BCP-47; invalid or unknown values silently fall back
+ *            to the project's default locale (AC-i18n-07), matching every
+ *            other content read.
+ *
+ * Registered BEFORE `/v1/content/:type` in `index.ts`. Fastify's radix router
+ * prefers a static segment over a parametric one regardless of order — the
+ * ordering is belt-and-braces, and `/v1/content/types` is the same shape that
+ * already proves it.
+ *
+ * The response is an `ItemList` JSON-LD document. `items` is the adapter's own
+ * `SearchResult[]`, unreshaped: a caller comparing this route against the MCP
+ * tool must see the same objects, and a projection here would be the place
+ * they silently diverged.
+ *
+ * Rate limiting is inherited: `server.ts` registers the limiter GLOBALLY with
+ * the content ceiling (`rate-limit.ts`'s `CONTENT_RATE_LIMIT_UNAUTH` /
+ * `_WINDOW`), so this route is covered without registering one of its own.
+ *
+ * Which site this read serves is resolved BEFORE any content query (#5852,
+ * #5910), through the SAME `resolvePublicContentAdapter(request)` seam
+ * `get-page.ts` and `list-pages.ts` already use — not the bare
+ * `getContentAdapter()` this route called until #5910, which threw under
+ * `CONTENT_ADAPTER=database` (no `workspaceId`) and answered every request
+ * with a 500. An unresolved site 404s rather than an empty `ItemList` — each
+ * route keeps its own 404 shape (D8), but shares the SAME `error: "Page not
+ * found"` string a missing/foreign slug gets elsewhere: a resolution failure
+ * carries no detail an unauthenticated caller could use to tell it apart
+ * from "nothing matched" (AC-WCE-05).
+ */
+import {
+  SCHEMA_ORG_TYPES,
+  type SearchOptions,
+} from "@working-theory/content-adapters";
+import { CategorySlugSchema } from "@working-theory/schema/categories";
+import type { FastifyPluginAsync } from "fastify";
+import { z } from "zod";
+
+import { resolveLocale } from "../../lib/locales.js";
+import { resolvePublicContentAdapter } from "../../services/public-site-resolver.js";
+
+const LIMIT_MAX = 50;
+const LIMIT_DEFAULT = 10;
+/** Mirrors `searchContentInputSchema`'s `query` cap — the pair rejects alike. */
+const QUERY_MAX = 200;
+
+const querySchema = z.object({
+  q: z.string().min(1).max(QUERY_MAX),
+  type: z.enum(SCHEMA_ORG_TYPES).optional(),
+  category: CategorySlugSchema.optional(),
+  limit: z.coerce.number().int().min(1).max(LIMIT_MAX).default(LIMIT_DEFAULT),
+  locale: z.string().optional(),
+});
+
+export const searchContentRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.get<{
+    Querystring: {
+      q?: string;
+      type?: string;
+      category?: string;
+      limit?: string;
+      locale?: string;
+    };
+  }>("/v1/content/search", async (request, reply) => {
+    const query = querySchema.safeParse(request.query);
+    if (!query.success) {
+      return reply.status(400).send({
+        error: "Invalid query parameters",
+        details: query.error.issues,
+      });
+    }
+
+    const { q, type, category, limit } = query.data;
+    const locale = resolveLocale(query.data.locale);
+
+    const options: SearchOptions = {
+      limit,
+      ...(type !== undefined && { type }),
+      ...(category !== undefined && { category }),
+      locale,
+    };
+
+    try {
+      // Site resolution precedes any content query (#5852, #5910). A refusal
+      // is a 404 sharing the same "Page not found" error string a
+      // missing/foreign slug gets on the other content routes (each keeps
+      // its own body shape — D8), not an empty `ItemList`: a 200 with zero
+      // items would assert that this site exists and simply matched
+      // nothing, which is false when no site resolved.
+      const adapter = await resolvePublicContentAdapter(request);
+      if (adapter === null) {
+        return reply.status(404).send({
+          error: "Page not found",
+        });
+      }
+
+      const items = await adapter.searchPages(q, options);
+
+      return reply.send({
+        "@context": "https://schema.org",
+        "@type": "ItemList",
+        query: q,
+        items,
+        totalItems: items.length,
+      });
+    } catch (error) {
+      request.log.error({ err: error }, "[Content] searchPages failed");
+      return reply.status(500).send({ error: "Internal server error" });
+    }
+  });
+};