openbriefing 0.4.0 → 0.5.0

package/README.md

@@ -62,6 +62,18 @@ npx openbriefing ghost push posts/             # write the approved ones
 
 `pull` never changes Ghost and never overwrites a file. `push` writes only approved files, only between `<!-- obs:start -->` and `<!-- obs:end -->` in the post's Code injection header, and skips a post whose tags have not changed. The folder holds your posts: keep it out of public repositories.
 
+To have the tags written when a post is published, run the hook where Ghost can reach it:
+
+```bash
+export GHOST_WEBHOOK_SECRET=…                   # any long random text
+export ANTHROPIC_API_KEY=…
+export OBS_HOOK_URL=https://your-hook.example   # registers the two webhooks on start
+npx openbriefing ghost hook                     # POST /ghost, GET /healthz, on PORT or 8080
+npx openbriefing ghost draft --dry-run          # the same for posts already published
+```
+
+The hook drafts with Claude (`OBS_MODEL` picks the model), keeps only highlights it finds in the post, and stamps its block `<!-- obs:auto … -->`. Edit the tags in the post's Code injection and they are yours: the hook never writes to that post again. It leaves members-only posts and posts under 200 words alone. These tags are published before you read them; use `pull` and `push` if you would rather approve each one.
+
 ## Use the parser
 
 ```ts

package/dist/cli.js

@@ -3,6 +3,8 @@
  * openbriefing tags <file.yaml | post.md | -> [--format html | feed | json] [--marked] [--allow-draft]
  * openbriefing ghost pull <folder> [--slug <slug>]
  * openbriefing ghost push <folder> [--slug <slug>] [--dry-run]
+ * openbriefing ghost draft [--slug <slug>] [--limit <n>] [--dry-run]
+ * openbriefing ghost hook [--port <n>]
  * openbriefing check <url | file | -> [--url <page url>] [--json]
  * openbriefing check <feed url | file> --feed [--pages]
  * openbriefing check <sitemap url | file> --sitemap [--limit <n>]
@@ -30,19 +32,26 @@ const USAGE = `Usage:
   openbriefing tags <file.yaml | post.md | -> [--format html | feed | json] [--marked] [--allow-draft]
   openbriefing ghost pull <folder> [--slug <slug>]
   openbriefing ghost push <folder> [--slug <slug>] [--dry-run]
+  openbriefing ghost draft [--slug <slug>] [--limit <n>] [--dry-run]
+  openbriefing ghost hook [--port <n>]
   openbriefing check <url | file | -> [--url <page url>] [--json]
   openbriefing check <feed url | file> --feed [--pages]
   openbriefing check <sitemap url | file> --sitemap [--limit <n>]
 
 tags turns a briefing file into escaped tags. ghost pull writes one file per
 published post; ghost push writes each approved file's tags into its post
-(GHOST_URL and GHOST_ADMIN_API_KEY in the environment). check reads a page,
-a feed or a sitemap and prints what a reader sees.
+(GHOST_URL and GHOST_ADMIN_API_KEY in the environment). ghost draft writes
+tags, drafted by Claude (ANTHROPIC_API_KEY), for each published post that has
+none. ghost hook does the same when a post is published: it serves Ghost's
+webhooks (GHOST_WEBHOOK_SECRET; OBS_HOOK_URL registers them). The author edits
+the tags in the post's Code injection, and an edited post is left alone.
+check reads a page, a feed or a sitemap and prints what a reader sees.
   --format   html (meta tags, the default), feed (RSS and Atom elements) or json
   --marked   wrap the tags in the obs:start and obs:end comments
   --allow-draft  write tags for a file whose status is not approved
   --slug     with ghost: one post only
-  --dry-run  with ghost push: say what would be written, and write nothing
+  --dry-run  with ghost push or draft: say what would be written, and write nothing
+  --port     with ghost hook: the port to listen on (PORT, or 8080)
   --url      the page's address, when checking a file with no canonical link
   --feed     treat the input as an RSS or Atom feed (detected when omitted)
   --pages    with a feed: also fetch each item's page and say which one stands
@@ -84,6 +93,13 @@ function parseArgs(argv) {
             else
                 args.url = v;
         }
+        else if (a === "--port") {
+            const n = Number.parseInt(argv[++i] ?? "", 10);
+            if (!Number.isInteger(n) || n < 1 || n > 65535)
+                args.bad = "--port needs a port number";
+            else
+                args.port = n;
+        }
         else if (a === "--limit") {
             const n = Number.parseInt(argv[++i] ?? "", 10);
             if (!Number.isInteger(n) || n < 1)
@@ -379,10 +395,18 @@ function tags(args) {
         console.log(draft ? `<!-- obs: a draft, not yet approved by the author -->\n${out}` : out);
     return 0;
 }
+const printLine = (l) => console.log(`${l.state.padEnd(12)} ${safe(l.slug)}${l.note ? `  (${safe(l.note)})` : ""}`);
+function tally(lines) {
+    const count = (s) => lines.filter((l) => l.state === s).length;
+    const states = [...new Set(lines.map((l) => l.state))];
+    console.log(lines.length === 0 ? "Nothing to do." : `\n${states.map((s) => `${count(s)} ${s}`).join(", ")}`);
+    return count("error") > 0 ? 1 : 0;
+}
 async function ghost(args) {
     const action = args.target;
     const folder = args.rest[0];
-    if (args.bad || (action !== "pull" && action !== "push") || !folder)
+    const filed = action === "pull" || action === "push";
+    if (args.bad || !(filed || action === "draft" || action === "hook") || (filed && !folder))
         return usage(args);
     const url = process.env.GHOST_URL;
     const key = process.env.GHOST_ADMIN_API_KEY;
@@ -392,16 +416,39 @@ async function ghost(args) {
     }
     const { Ghost, pull, push } = await import("./ghost.js");
     const client = new Ghost({ url, key });
+    if (action === "draft" || action === "hook") {
+        const { claudeDrafter, draftAll, hookServer, registerWebhooks } = await import("./hook.js");
+        const model = process.env.OBS_MODEL;
+        const drafter = claudeDrafter(model ? { model } : {});
+        if (action === "draft") {
+            const opts = { dryRun: args.dryRun, onLine: printLine };
+            if (args.slug !== undefined)
+                opts.slug = args.slug;
+            if (args.limit !== undefined)
+                opts.limit = args.limit;
+            return tally(await draftAll(client, drafter, opts));
+        }
+        const secret = process.env.GHOST_WEBHOOK_SECRET;
+        if (!secret) {
+            console.error("Set GHOST_WEBHOOK_SECRET: any long random text. Ghost signs each webhook with it.");
+            return 2;
+        }
+        const target = process.env.OBS_HOOK_URL;
+        if (target)
+            for (const line of await registerWebhooks(client, `${target.replace(/\/+$/u, "")}/ghost`, secret))
+                console.log(line);
+        const port = args.port ?? (Number(process.env.PORT) || 8080);
+        await new Promise((done) => hookServer({ ghost: client, secret, drafter }).listen(port, done));
+        console.log(`openbriefing ghost hook is listening on ${port}`);
+        return new Promise(() => { });
+    }
     const opts = { dryRun: args.dryRun };
     if (args.slug !== undefined)
         opts.slug = args.slug;
     const lines = action === "pull" ? await pull(client, folder, args.slug) : await push(client, folder, opts);
     for (const l of lines)
-        console.log(`${l.state.padEnd(12)} ${safe(l.slug)}${l.note ? `  (${safe(l.note)})` : ""}`);
-    const count = (s) => lines.filter((l) => l.state === s).length;
-    const states = [...new Set(lines.map((l) => l.state))];
-    console.log(lines.length === 0 ? "Nothing to do." : `\n${states.map((s) => `${count(s)} ${s}`).join(", ")}`);
-    return count("error") > 0 ? 1 : 0;
+        printLine(l);
+    return tally(lines);
 }
 async function main(argv) {
     const args = parseArgs(argv);

package/dist/ghost.d.ts

@@ -7,6 +7,8 @@ export interface GhostPost {
     updated_at: string;
     codeinjection_head: string | null;
     plaintext?: string | null;
+    /** "public", or who may read it. */
+    visibility?: string;
 }
 export type FetchLike = (url: string, init: {
     method: string;
@@ -36,6 +38,8 @@ export declare class Ghost {
     private call;
     /** Every published post, with its plain text. */
     posts(slug?: string): Promise<GhostPost[]>;
+    /** Adds a webhook to the integration this key belongs to. */
+    addWebhook(event: string, target: string, secret: string): Promise<void>;
     /** Writes a post's Code injection header and nothing else. `updated_at` is Ghost's guard against overwriting a newer edit. */
     setHead(post: GhostPost, head: string): Promise<void>;
 }
@@ -47,6 +51,8 @@ export declare function briefInHead(head: string, url: string): ObsBrief | undef
  * undefined when hand-written tags remain that this cannot safely move.
  */
 export declare function headWith(head: string, block: string): string | undefined;
+/** Ghost's slug shape. Anything else is never used as a file name or in a query. */
+export declare const SLUG: RegExp;
 export interface Line {
     slug: string;
     state: "written" | "would write" | "unchanged" | "draft" | "skipped" | "pulled" | "kept" | "error";

package/dist/ghost.js

@@ -69,6 +69,10 @@ export class Ghost {
         }
         return out;
     }
+    /** Adds a webhook to the integration this key belongs to. */
+    async addWebhook(event, target, secret) {
+        await this.call("POST", "/webhooks/", { webhooks: [{ event, target_url: target, secret, name: `Open Briefing: ${event}` }] });
+    }
     /** Writes a post's Code injection header and nothing else. `updated_at` is Ghost's guard against overwriting a newer edit. */
     async setHead(post, head) {
         await this.call("PUT", `/posts/${post.id}/`, { posts: [{ codeinjection_head: head, updated_at: post.updated_at }] });
@@ -100,7 +104,7 @@ export function headWith(head, block) {
     return replaceMarked(cleaned, block);
 }
 /** Ghost's slug shape. Anything else is never used as a file name or in a query. */
-const SLUG = /^[a-z0-9][a-z0-9_-]*$/iu;
+export const SLUG = /^[a-z0-9][a-z0-9_-]*$/iu;
 const briefingFiles = (folder) => readdirSync(folder)
     .filter((f) => /\.(md|markdown|ya?ml)$/iu.test(f))
     .sort();

package/dist/hook.d.ts

@@ -0,0 +1,61 @@
+import { type Server } from "node:http";
+import { type Ghost, type GhostPost, type Line } from "./ghost.js";
+import { type ObsBrief } from "./obs.js";
+/** Writes a briefing file (YAML) for a post. */
+export type Drafter = (post: {
+    title: string;
+    url: string;
+    text: string;
+}) => Promise<string>;
+/** A post shorter than this has nothing for a 200-word summary to shorten. */
+export declare const MIN_WORDS = 200;
+/** The drafting prompt, the kit's `prompt.md`. */
+export declare function draftingPrompt(): string;
+/** A drafter that asks Claude. The key comes from ANTHROPIC_API_KEY. */
+export declare function claudeDrafter(options?: {
+    model?: string;
+}): Drafter;
+/** The marked block for a brief the hook wrote, with its stamp. */
+export declare function autoBlock(brief: ObsBrief, url: string): string;
+export type Decision = {
+    act: "draft" | "redraft";
+} | {
+    act: "leave";
+    why: string;
+};
+/** What the hook does for a post, from the post alone. */
+export declare function decide(post: GhostPost): Decision;
+/** A drafted brief for a post, with any highlight the post does not contain taken out. */
+export declare function draftBrief(post: GhostPost, drafter: Drafter): Promise<ObsBrief>;
+/** Drafts and writes one post's tags, when the post is the hook's to write. */
+export declare function autoTag(ghost: Ghost, slug: string, drafter: Drafter, options?: {
+    dryRun?: boolean;
+}): Promise<Line>;
+/** Drafts tags for every published post that has none. One post at a time. */
+export declare function draftAll(ghost: Ghost, drafter: Drafter, options?: {
+    slug?: string;
+    limit?: number;
+    dryRun?: boolean;
+    onLine?: (line: Line) => void;
+}): Promise<Line[]>;
+/** Ghost signs a webhook as `sha256=<hex HMAC of body + t>, t=<ms>`. */
+export declare function verifySignature(body: string, header: string | undefined, secret: string, now?: number): boolean;
+/** The slug a webhook is about. The payload is untrusted; the post itself is read from Ghost. */
+export declare function slugOf(body: string): string | undefined;
+export declare const HOOK_EVENTS: readonly ["post.published", "post.published.edited"];
+/** Registers the hook's webhooks on the integration the Admin API key belongs to. Safe to repeat. */
+export declare function registerWebhooks(ghost: Ghost, target: string, secret: string): Promise<string[]>;
+export interface HookOptions {
+    ghost: Ghost;
+    secret: string;
+    drafter: Drafter;
+    log?: (message: string) => void;
+    now?: () => number;
+}
+/**
+ * An HTTP server for Ghost's webhooks: POST /ghost and GET /healthz. Ghost
+ * gives up after two seconds, so the hook answers 202 and then does the work.
+ */
+export declare function hookServer(options: HookOptions): Server & {
+    idle(): Promise<void>;
+};

package/dist/hook.js

@@ -0,0 +1,272 @@
+/**
+ * `openbriefing ghost hook` and `ghost draft`: tags written for a post when it
+ * is published, with no step for the author.
+ *
+ * The hook drafts the summary with a model, checks every highlight against the
+ * post's text, and writes the marked block into the post's Code injection
+ * header. The block carries a stamp, `<!-- obs:auto <fingerprint> -->`. While
+ * the tags still match the stamp the block is the hook's; once the author
+ * edits them it is theirs, and the hook never writes to that post again.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { checkHighlights, MARK_END, MARK_START, parseBriefing, readMarked, renderTags } from "./briefing.js";
+import { briefInHead, headWith, SLUG } from "./ghost.js";
+import { countWords, fingerprint } from "./obs.js";
+/** A post shorter than this has nothing for a 200-word summary to shorten. */
+export const MIN_WORDS = 200;
+const STAMP = /<!--\s*obs:auto\s+([0-9a-f]{16})\s*-->/u;
+const MAX_AGE_MS = 5 * 60 * 1000;
+const MAX_BODY_BYTES = 5 * 1024 * 1024;
+/** The drafting prompt, the kit's `prompt.md`. */
+export function draftingPrompt() {
+    // Packed beside dist/ when published; at the repository's root when run from source.
+    for (const rel of ["../kit/prompt.md", "../../../kit/prompt.md"]) {
+        const path = new URL(rel, import.meta.url);
+        if (existsSync(path))
+            return readFileSync(path, "utf8");
+    }
+    throw new Error("The drafting prompt (kit/prompt.md) is missing from this install");
+}
+/** A drafter that asks Claude. The key comes from ANTHROPIC_API_KEY. */
+export function claudeDrafter(options = {}) {
+    const system = draftingPrompt();
+    return async (post) => {
+        const { default: Anthropic } = await import("@anthropic-ai/sdk");
+        // A key that is not tied to one workspace needs the workspace named.
+        const workspace = process.env.ANTHROPIC_WORKSPACE_ID;
+        const client = new Anthropic(workspace ? { defaultHeaders: { "anthropic-workspace-id": workspace } } : {});
+        const response = await client.beta.messages.create({
+            model: options.model ?? "claude-opus-5-5",
+            max_tokens: 16000,
+            thinking: { type: "adaptive" },
+            betas: ["server-side-fallback-2026-07-01"],
+            fallbacks: "default",
+            system,
+            messages: [{ role: "user", content: `Address: ${post.url}\nTitle: ${post.title}\n\n${post.text}` }],
+        });
+        if (response.stop_reason === "refusal")
+            throw new Error("the model declined to draft this post");
+        if (response.stop_reason === "max_tokens")
+            throw new Error("the draft was cut off");
+        return response.content.flatMap((block) => (block.type === "text" ? [block.text] : [])).join("");
+    };
+}
+/** The marked block for a brief the hook wrote, with its stamp. */
+export function autoBlock(brief, url) {
+    const tags = renderTags(brief);
+    // The stamp is taken from the tags as a reader parses them, so it holds for exactly what is on the page.
+    const read = briefInHead(tags, url);
+    return [MARK_START, `<!-- obs:auto ${fingerprint(read ?? brief)} -->`, tags, MARK_END].join("\n");
+}
+/** What the hook does for a post, from the post alone. */
+export function decide(post) {
+    if (post.visibility !== undefined && post.visibility !== "public")
+        return { act: "leave", why: "the post is not public" };
+    const text = post.plaintext ?? "";
+    if (countWords(text) < MIN_WORDS)
+        return { act: "leave", why: `the post is under ${MIN_WORDS} words` };
+    const head = post.codeinjection_head ?? "";
+    if (!/obs:/u.test(head))
+        return { act: "draft" };
+    const marked = readMarked(head);
+    const stamp = marked === undefined ? undefined : STAMP.exec(marked)?.[1];
+    const live = marked === undefined ? undefined : briefInHead(marked, post.url);
+    if (stamp === undefined || !live || fingerprint(live) !== stamp || head.replace(marked, "").includes("obs:"))
+        return { act: "leave", why: "the author's own tags" };
+    // Still the hook's block. It is redone only when the post changed under a quote.
+    checkHighlights(live, text, []);
+    if (live.highlights.some((h) => h.inContent === false))
+        return { act: "redraft" };
+    return { act: "leave", why: "the tags are current" };
+}
+const unfence = (text) => text
+    .trim()
+    .replace(/^```[a-z]*\r?\n/iu, "")
+    .replace(/\r?\n```$/u, "");
+/** A drafted brief for a post, with any highlight the post does not contain taken out. */
+export async function draftBrief(post, drafter) {
+    const text = post.plaintext ?? "";
+    let problem = "";
+    for (let attempt = 0; attempt < 2; attempt++) {
+        const briefing = parseBriefing(unfence(await drafter({ title: post.title, url: post.url, text })));
+        if (!briefing.brief) {
+            problem = briefing.errors.join("; ") || "no summary";
+            continue;
+        }
+        const brief = briefing.brief;
+        checkHighlights(brief, text, []);
+        brief.highlights = brief.highlights.filter((h) => h.inContent !== false);
+        // The address is the post's, whatever the draft said.
+        const withUrl = parseBriefing(JSON.stringify({ ...draftFields(brief), url: post.url })).brief;
+        return withUrl ?? brief;
+    }
+    throw new Error(`the draft was not usable: ${problem}`);
+}
+function draftFields(brief) {
+    const out = {};
+    if (brief.title)
+        out.title = brief.title;
+    if (brief.headline)
+        out.headline = brief.headline;
+    for (const s of brief.summaries)
+        out[s.from === "inferred" ? "summary" : `summary_${s.tier}`] = s.text;
+    if (brief.keep.length > 0)
+        out.keep = brief.keep;
+    if (brief.highlights.length > 0)
+        out.highlights = brief.highlights.map((h) => (h.label ? { text: h.text, label: h.label } : { text: h.text }));
+    return out;
+}
+/** Drafts and writes one post's tags, when the post is the hook's to write. */
+export async function autoTag(ghost, slug, drafter, options = {}) {
+    if (!SLUG.test(slug))
+        return { slug, state: "error", note: "not a post slug" };
+    try {
+        let post = (await ghost.posts(slug))[0];
+        if (!post)
+            return { slug, state: "skipped", note: "no published post has this slug" };
+        const decision = decide(post);
+        if (decision.act === "leave")
+            return { slug, state: "kept", note: decision.why };
+        if (options.dryRun)
+            return { slug, state: "would write" };
+        const brief = await draftBrief(post, drafter);
+        for (let attempt = 0;; attempt++) {
+            const next = headWith(post.codeinjection_head ?? "", autoBlock(brief, post.url));
+            if (next === undefined)
+                return { slug, state: "kept", note: "the author's own tags" };
+            try {
+                await ghost.setHead(post, next);
+                return { slug, state: "written", note: decision.act === "redraft" ? "redone, the post changed under a quote" : "drafted" };
+            }
+            catch (err) {
+                // The post was saved while the draft was being written: read it again, once.
+                if (attempt > 0 || !(err instanceof Error) || !err.message.includes("409"))
+                    throw err;
+                const fresh = (await ghost.posts(slug))[0];
+                if (!fresh || decide(fresh).act === "leave")
+                    return { slug, state: "kept", note: "the post changed while the draft was written" };
+                post = fresh;
+            }
+        }
+    }
+    catch (err) {
+        return { slug, state: "error", note: err instanceof Error ? err.message : String(err) };
+    }
+}
+/** Drafts tags for every published post that has none. One post at a time. */
+export async function draftAll(ghost, drafter, options = {}) {
+    const lines = [];
+    let written = 0;
+    for (const post of await ghost.posts(options.slug)) {
+        if (options.limit !== undefined && written >= options.limit)
+            break;
+        const opts = options.dryRun === undefined ? {} : { dryRun: options.dryRun };
+        const line = await autoTag(ghost, post.slug, drafter, opts);
+        if (line.state === "written" || line.state === "would write")
+            written++;
+        lines.push(line);
+        options.onLine?.(line);
+    }
+    return lines;
+}
+/** Ghost signs a webhook as `sha256=<hex HMAC of body + t>, t=<ms>`. */
+export function verifySignature(body, header, secret, now = Date.now()) {
+    const match = /^sha256=([0-9a-f]{64}), t=(\d+)$/u.exec(header ?? "");
+    if (!match || secret === "")
+        return false;
+    const [, sig, ts] = match;
+    if (Math.abs(now - Number(ts)) > MAX_AGE_MS)
+        return false;
+    const expected = createHmac("sha256", secret).update(`${body}${ts}`).digest();
+    return timingSafeEqual(Buffer.from(sig, "hex"), expected);
+}
+/** The slug a webhook is about. The payload is untrusted; the post itself is read from Ghost. */
+export function slugOf(body) {
+    try {
+        const slug = JSON.parse(body).post?.current?.slug;
+        return typeof slug === "string" && SLUG.test(slug) ? slug : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export const HOOK_EVENTS = ["post.published", "post.published.edited"];
+/** Registers the hook's webhooks on the integration the Admin API key belongs to. Safe to repeat. */
+export async function registerWebhooks(ghost, target, secret) {
+    const out = [];
+    for (const event of HOOK_EVENTS) {
+        try {
+            await ghost.addWebhook(event, target, secret);
+            out.push(`${event}: registered`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            // Ghost answers 422 when this address already has the event.
+            out.push(message.includes("422") ? `${event}: already registered` : `${event}: ${message}`);
+        }
+    }
+    return out;
+}
+/**
+ * An HTTP server for Ghost's webhooks: POST /ghost and GET /healthz. Ghost
+ * gives up after two seconds, so the hook answers 202 and then does the work.
+ */
+export function hookServer(options) {
+    const log = options.log ?? ((m) => console.log(m));
+    // One post at a time per slug: a publish and the edit that follows it never race.
+    const busy = new Map();
+    const run = (slug) => {
+        const next = (busy.get(slug) ?? Promise.resolve())
+            .then(() => autoTag(options.ghost, slug, options.drafter))
+            .then((line) => log(`${line.state} ${slug}${line.note ? ` (${line.note})` : ""}`))
+            .catch((err) => log(`error ${slug} (${err instanceof Error ? err.message : String(err)})`))
+            .finally(() => {
+            if (busy.get(slug) === next)
+                busy.delete(slug);
+        });
+        busy.set(slug, next);
+    };
+    const server = createServer((req, res) => {
+        if (req.method === "GET" && req.url === "/healthz") {
+            res.writeHead(200, { "content-type": "text/plain" }).end("ok");
+            return;
+        }
+        if (req.method !== "POST" || req.url !== "/ghost") {
+            res.writeHead(404).end();
+            return;
+        }
+        const chunks = [];
+        let size = 0;
+        req.on("data", (c) => {
+            size += c.length;
+            if (size > MAX_BODY_BYTES) {
+                res.writeHead(413).end();
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => {
+            if (size > MAX_BODY_BYTES)
+                return;
+            const body = Buffer.concat(chunks).toString("utf8");
+            const header = req.headers["x-ghost-signature"];
+            if (!verifySignature(body, typeof header === "string" ? header : undefined, options.secret, options.now?.() ?? Date.now())) {
+                res.writeHead(401).end();
+                return;
+            }
+            const slug = slugOf(body);
+            if (slug === undefined) {
+                res.writeHead(400).end();
+                return;
+            }
+            res.writeHead(202).end();
+            run(slug);
+        });
+    });
+    server.headersTimeout = 10_000;
+    server.requestTimeout = 15_000;
+    return Object.assign(server, { idle: async () => void (await Promise.all([...busy.values()])) });
+}

package/kit/prompt.md

@@ -0,0 +1,40 @@
+You are drafting an author's own summary of their post, in the Open Briefing Standard's briefing-file format. Tools that brief or read posts aloud will use these words in place of a summary they would otherwise write themselves, and they will credit the author. So the draft must sound like the author and say only what the post says.
+
+Return one YAML briefing file and nothing else: no preface, no code fence, no notes after it.
+
+```yaml
+url: <the post's address, if you were given it; leave the key out if not>
+headline: <one or two sentences, 40 words or fewer>
+summary: |
+  <200 to 350 words, in two to four paragraphs, with a blank line between paragraphs>
+keep:
+  - <the one sentence every shorter version must get across>
+highlights:
+  - text: <a passage copied from the post, word for word>
+    label: <what it is about, 6 words or fewer>
+status: draft
+```
+
+How to write each part:
+
+**summary.** 200 to 350 words. Use the author's own sentences where they serve, and their voice everywhere: first person if the post is first person, their vocabulary, their level of formality. Say what the post argues or reports and the reasons or evidence it gives, in the order a listener needs. The first two sentences must stand on their own, because a tool that needs something shorter will often use just those. The summary must make sense to someone who has not seen the title.
+
+**headline.** A line someone might hear before deciding whether to listen further. It carries the post's main point, not a teaser for it.
+
+**keep.** Up to three lines, most important first. The first is the post's core message in one sentence. Add a second or third only for something a shorter version must not lose, such as a number, a caveat or a name. Each line should also appear in the summary, in the same words.
+
+**highlights.** Up to four passages the author might be glad to see quoted on their own. Copy each one from the post exactly, word for word and with its punctuation, 60 words or fewer. Do not join passages from different places, trim words from the middle, or fix the author's wording. If a passage ends in the post with a comma before a closing quotation mark, end your copy before the comma. If nothing in the post reads well alone, leave `highlights` out.
+
+**title.** Leave it out, unless the post's own title is longer than 12 words. Then add `title:` with a shorter one.
+
+Rules for every line:
+
+- Plain text that works both read and heard. No Markdown, no HTML, no emoji, no bullet lists inside a value.
+- No web addresses in any line you write (the `url:` key is the one exception), and no "click here", "see below", "in this post" or "pictured above". No reference to images, tables or layout.
+- Spell out an abbreviation the first time, unless it is normally said as a word.
+- In the lines you write yourself, prefer a single quotation mark to a double one wherever either reads as well. The words end up inside an HTML attribute, where a double quotation mark has to be escaped. A highlight keeps the post's own marks.
+- Say nothing the post does not support. Do not add background, opinion, praise or a conclusion the author did not draw. If the post is unclear on a point, leave the point out.
+- Write in the post's language.
+- Always end the file with `status: draft`. Only the author approves it.
+
+The post follows.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openbriefing",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Open Briefing Standard (OBS): the reference parser, the checker and the publisher's tag tools for publishers' own summaries.",
   "keywords": [
     "open-briefing-standard",
@@ -42,6 +42,7 @@
   "files": [
     "dist",
     "fixtures",
+    "kit",
     "README.md"
   ],
   "engines": {
@@ -53,9 +54,10 @@
     "test": "vitest run",
     "fixtures": "node ../../scripts/make-fixtures.mjs",
     "expected": "tsx scripts/write-expected.ts",
-    "prepack": "rm -rf fixtures && cp -R ../../spec/fixtures fixtures && npm run build"
+    "prepack": "rm -rf fixtures kit && cp -R ../../spec/fixtures fixtures && mkdir kit && cp ../../kit/prompt.md kit/prompt.md && npm run build"
   },
   "dependencies": {
+    "@anthropic-ai/sdk": "^1.8.0",
     "jsdom": "^26.1.0",
     "yaml": "^2.9.1"
   },