Phase 12 R2: Marketplace-Backend α + β — Authors + Deck-Init + Publish

Routes (additiv unter /api/v1/marketplace/*):
- POST/GET /authors/me — eigenes Author-Profil anlegen/updaten/lesen
- GET /authors/:slug — public Profile-Lookup (banned-reason gestrippt)
- POST /decks — Deck-Init (Slug-Validation + Pflicht-Author-Profil +
  CHECK auf paid + Pro-License)
- POST /decks/:slug/publish — Versions-Snapshot mit per-Karte
  cardContentHash aus @cards/domain, per-Version-Hash, AI-Mod-Stub-Log,
  atomarer latest_version_id-Bump in Drizzle-Transaction
- PATCH /decks/:slug — Metadaten-Update (Owner-Only)
- GET /decks/:slug — Public-Detail mit optional-auth-Middleware

Geport aus cards-decommission-base:services/cards-server/, mit
Greenfield-Anpassungen:
- Hashing über @cards/domain.cardContentHash (gemeinsame SoT
  zwischen privatem cards.cards und marketplace.deck_cards), per-
  Version-Hash als SHA-256 über sortierte Karten-Hashes mit Ord-Prefix
- AI-Moderation als R2-Stub (pass+rationale+model='stub'),
  echte mana-llm-Anbindung in späterer Welle
- Auth-Middleware-Shape an Greenfield (userId/tier/authMode in
  c.get(...) statt user-Object), optional-auth als Schwester für
  anonymen Public-Read
- Hono-typing: outer Marketplace-Decks-Router ist Partial<AuthVars>
  weil Public-GET kein JWT braucht; Auth-Subroute ist strict

Lese-Referenz:
- 3331 LOC altes cards-server-Code (routes, services, middleware,
  lib) unter docs/marketplace/archive/code/ archiviert. Read-only,
  nicht im Build-Path.

Verifikation:
- 16 neue Vitest-Tests (Slug + Version-Hash), 72 gesamt grün
- type-check 0 errors
- E2E-Smoke gegen lokale cards-api: Cardecky-Author + Deck
  r2-stoische-ethik mit 3 Karten v1.0.0 (basic + basic + cloze),
  per-Karten-Hashes geschrieben, ai_moderation_log-Row da, semver-409
  + paid-422-Errors verifiziert. Smoke-Daten danach aufgeräumt.

Verbleibend für R3+: Discovery (explore + search), Engagement (stars/
subscribe/fork), Smart-Merge mit FSRS-State-Erhalt; danach R4 PRs +
Card-Discussions, R5 Frontend-Routes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/tests/marketplace-slug.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest';
+
+import { slugify, validateSlug } from '../src/lib/marketplace/slug.ts';
+
+describe('slugify', () => {
+	it('lowercases and dasherizes', () => {
+		expect(slugify('Anna Lang!')).toBe('anna-lang');
+	});
+
+	it('strips leading/trailing dashes', () => {
+		expect(slugify('  hello world  ')).toBe('hello-world');
+	});
+
+	it('drops diacritics', () => {
+		expect(slugify('Café Crème')).toBe('cafe-creme');
+	});
+
+	it('caps at 60 chars', () => {
+		const slug = slugify('a'.repeat(120));
+		expect(slug.length).toBeLessThanOrEqual(60);
+	});
+});
+
+describe('validateSlug', () => {
+	it('accepts simple lowercase slugs', () => {
+		expect(validateSlug('anna-lang')).toEqual({ ok: true });
+	});
+
+	it('rejects too short', () => {
+		expect(validateSlug('ab')).toEqual({ ok: false, reason: 'too-short' });
+	});
+
+	it('rejects too long', () => {
+		expect(validateSlug('a'.repeat(70))).toEqual({ ok: false, reason: 'too-long' });
+	});
+
+	it('rejects uppercase', () => {
+		expect(validateSlug('Anna-Lang')).toEqual({ ok: false, reason: 'invalid-chars' });
+	});
+
+	it('rejects underscore', () => {
+		expect(validateSlug('anna_lang')).toEqual({ ok: false, reason: 'invalid-chars' });
+	});
+
+	it('rejects leading dash', () => {
+		expect(validateSlug('-anna')).toEqual({ ok: false, reason: 'invalid-chars' });
+	});
+
+	it('rejects reserved slugs', () => {
+		expect(validateSlug('admin')).toEqual({ ok: false, reason: 'reserved' });
+		expect(validateSlug('explore')).toEqual({ ok: false, reason: 'reserved' });
+		expect(validateSlug('marketplace')).toEqual({ ok: false, reason: 'reserved' });
+	});
+});

apps/api/tests/marketplace-version-hash.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest';
+
+import { cardContentHash } from '@cards/domain';
+
+import { hashVersionCards } from '../src/lib/marketplace/version-hash.ts';
+
+describe('hashVersionCards', () => {
+	const card1 = { type: 'basic', fields: { front: 'Q1', back: 'A1' }, ord: 0 };
+	const card2 = { type: 'basic', fields: { front: 'Q2', back: 'A2' }, ord: 1 };
+
+	it('is deterministic', async () => {
+		const a = await hashVersionCards([card1, card2]);
+		const b = await hashVersionCards([card1, card2]);
+		expect(a).toBe(b);
+	});
+
+	it('changes when card order changes', async () => {
+		const original = await hashVersionCards([card1, card2]);
+		const swapped = await hashVersionCards([
+			{ ...card1, ord: 1 },
+			{ ...card2, ord: 0 },
+		]);
+		expect(original).not.toBe(swapped);
+	});
+
+	it('changes when a field changes', async () => {
+		const original = await hashVersionCards([card1, card2]);
+		const tweaked = await hashVersionCards([
+			card1,
+			{ ...card2, fields: { ...card2.fields, back: 'A2-edited' } },
+		]);
+		expect(original).not.toBe(tweaked);
+	});
+
+	it('input order independent (sorts by ord)', async () => {
+		const inOrder = await hashVersionCards([card1, card2]);
+		const reversedInput = await hashVersionCards([card2, card1]);
+		expect(inOrder).toBe(reversedInput);
+	});
+
+	it('uses cardContentHash for per-card identity (consumes @cards/domain SoT)', async () => {
+		// Smoke: changing fields without changing the type must change the
+		// per-card hash (cardContentHash semantics) and therefore the
+		// version hash.
+		const a = await cardContentHash({ type: 'basic', fields: { front: 'X', back: 'Y' } });
+		const b = await cardContentHash({ type: 'basic', fields: { front: 'X', back: 'Y2' } });
+		expect(a).not.toBe(b);
+	});
+});