feat: deliver AutoBlog 2.0 editorial CMS

.claude/CLAUDE.md

@@ -0,0 +1,3 @@
+<!-- sinapsi:start v0.2.6 — auto-generated by `sinapsi init`; do not edit between these markers (re-run to update) -->
+@../AGENTS.md
+<!-- sinapsi:end -->

.claude/settings.json

@@ -0,0 +1,52 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "hooks": [
+          {
+            "command": "C:\\Users\\Patrick\\.cargo\\bin\\sinapsi.exe hook post-tool-use",
+            "type": "command"
+          }
+        ],
+        "matcher": "Edit|Write|MultiEdit"
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "command": "C:\\Users\\Patrick\\.cargo\\bin\\sinapsi.exe hook session-start",
+            "type": "command"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "command": "C:\\Users\\Patrick\\.cargo\\bin\\sinapsi.exe hook stop",
+            "type": "command"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "command": "C:\\Users\\Patrick\\.cargo\\bin\\sinapsi.exe hook user-prompt-submit",
+            "type": "command"
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "allow": [
+      "Bash(sinapsi:*)",
+      "mcp__sinapsi__*",
+      "Read(.sinapsi/**)"
+    ]
+  }
+}

.env.example

@@ -0,0 +1,19 @@
+# Application
+NEXT_PUBLIC_APP_URL=http://localhost:3000
+DATABASE_URL=file:./data/autoblog.db
+DATABASE_AUTH_TOKEN=
+BETTER_AUTH_SECRET=replace-with-at-least-32-random-characters
+AUTH_SIGN_IN_RATE_LIMIT=8
+DEMO_ENABLED=true
+
+# AI: mock is deterministic and makes no provider call
+AI_MODE=mock
+GEMINI_API_KEY=
+GEMINI_MODEL=gemini-2.5-flash
+
+# Durable job runner / deployment scheduler
+CRON_SECRET=replace-with-a-distinct-random-secret
+
+# Limits
+AI_MONTHLY_CHARACTER_QUOTA=200000
+MEDIA_MAX_BYTES=5242880

.github/copilot-instructions.md

@@ -0,0 +1,44 @@
+<!-- sinapsi:start v0.2.6 — auto-generated by `sinapsi init`; do not edit between these markers (re-run to update) -->
+This project uses Sinapsi for code context engineering.
+
+Read `.sinapsi/AGENT_INSTRUCTIONS.md` first — it defines the workflow for this repository.
+
+Before you think, plan or open any source file, read one file:
+
+- `.sinapsi/summary.md` — directory tree, the last 10 sessions, and a short recap
+
+That is the cardinal rule. `.sinapsi/session.md` (what happened) and
+`.sinapsi/handoff.md` (current working state) are the sources it is built from — open
+them only when the summary leaves your actual question unanswered.
+
+The last action of every patch, in this order: append `session.md`, rewrite `handoff.md`
+(≤ 150 lines), then update `summary.md` from both — leaving its mechanical tree block
+untouched. A patch that leaves any of the three stale is incomplete.
+
+Start code exploration with Sinapsi MCP — it is the cheaper first move, not a rule
+against searching. Pick the tool by what you already know:
+
+- behaviour only → `query_graph`
+- exact symbol → `get_node`
+- exact symbol + impact → `get_neighbors`
+- project shape → `graph_stats` (once)
+
+The graph is a derived index built from the source: it lags edits and drops what its
+extractors cannot see. The filesystem is the authority — confirm with `grep`/`rg`
+whenever you want to.
+
+Every pack carries four lines. Read them independently; none implies another:
+
+- `RELEVANCE` → how much of your question the top result explains
+- `COVERAGE` → the token budget only, never what was not nominated
+- `STRUCTURE` → compiler-resolved relationships
+- `FRESHNESS` → index staleness
+
+`RELEVANCE: weak` means the answering symbol may be absent: retry with project
+vocabulary, then search the filesystem.
+
+`COVERAGE: partial` means the budget cut something: raise it, narrow the scope, or
+search — `complete` is not a promise that the answer is present.
+
+`STRUCTURE: absent` means relationships are unknown, not absent.
+<!-- sinapsi:end -->

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule: { interval: weekly }
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule: { interval: monthly }
+    open-pull-requests-limit: 3

.github/workflows/quality.yml

@@ -0,0 +1,143 @@
+name: Quality gates
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+env:
+  BUN_VERSION: 1.3.12
+  DATABASE_URL: file:./data/ci.db
+  BETTER_AUTH_SECRET: ci-only-secret-with-at-least-thirty-two-characters
+  NEXT_PUBLIC_APP_URL: http://127.0.0.1:3000
+  DEMO_ENABLED: "true"
+  AI_MODE: mock
+  CRON_SECRET: ci-only-distinct-cron-secret-000000000000
+
+jobs:
+  dependency-integrity:
+    name: Frozen install
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bun run typecheck
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bun run lint
+
+  unit-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bun run test
+
+  integration-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bun run test:integration
+
+  e2e:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bunx playwright install --with-deps chromium
+      - run: bun run test:e2e
+
+  accessibility:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bunx playwright install --with-deps chromium
+      - run: bun run test:a11y
+
+  visual-regression:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bunx playwright install chromium
+      - run: bun run test:visual
+
+  performance-budgets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: "22.19.0" }
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bunx playwright install --with-deps chromium
+      - run: bun run build
+      - run: bun run test:performance
+      - run: bun run test:lighthouse
+      - name: Preserve Lighthouse and bundle reports
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: performance-reports
+          path: |
+            .lighthouse/
+            .performance/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 7
+
+  production-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bun run build
+
+  security-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with: { fetch-depth: 0 }
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with: { bun-version: "1.3.12" }
+      - run: bun install --frozen-lockfile
+      - run: bun run audit
+      - run: bun run security:secrets
+      - name: Scan Git history without exposing values
+        uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
+        with:
+          extra_args: --results=verified,unknown

.gitignore

@@ -38,4 +38,21 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 
-CMS blog.code-workspace
+CMS blog.code-workspace
+.sinapsi/graph.json
+.sinapsi/.watcher
+.sinapsi/journal
+
+# environment and durable local state
+.env
+.env.*
+!.env.example
+data/
+
+# test and quality artifacts
+coverage/
+playwright-report/
+test-results/
+tests/visual/surfaces.spec.ts-snapshots/*-chromium-win32.png
+.lighthouse/
+.performance/

.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "sinapsi": {
+      "args": [
+        "serve",
+        ".sinapsi/graph.json"
+      ],
+      "command": "C:\\Users\\Patrick\\.cargo\\bin\\sinapsi.exe"
+    }
+  }
+}