CampaignOS

-- Workspace hierarchy
workspaces    (id uuid PK, name, slug, plan, created_at)
  users       (id, workspace_id FK, role, email, oauth_tokens_enc)
  brands      (id, workspace_id FK, url, brand_snapshot jsonb)
    personas  (id, brand_id FK, name, traits jsonb, platform_affinity jsonb, budget_pct)
    campaigns (id, brand_id FK, status, budget, platform, flight_start, flight_end)
      ad_drafts   (id, campaign_id FK, variant, copy jsonb, targeting jsonb, consent_at)
      performance (id, campaign_id FK, date, impressions, clicks, spend, conversions)
  audit_log   (id, workspace_id, user_id, action, resource_id, metadata jsonb)

-- Row Level Security enforced at DB layer
CREATE POLICY workspace_isolation ON campaigns
  USING (workspace_id = current_setting('app.workspace_id')::uuid);

You are a brand strategist AI. When given a website URL/domain, infer likely
brand characteristics. Respond ONLY with a valid JSON object — no markdown,
no backticks, no explanation. Shape:
{
  "industry": "...",
  "tone":     "...",
  "colors":   ["#hex1", "#hex2"],
  "audience": "...",
  "usp":      "...",
  "keywords": ["k1", "k2", "k3"]
}

You are an audience strategy expert. Respond ONLY with a JSON array.
Generate 4 personas with this shape:
[{
  "name":          "...",
  "age":           "25–35",
  "role":          "...",
  "platforms":    ["..."],
  "budgetPct":     25,          // must sum to 100
  "painPoint":    "...",
  "messagingHook": "...",
  "icon":          "◈"         // one of: ◈ ⬡ ◇ △
}]

You are a performance marketing strategist. Respond ONLY with a JSON array.
One item per persona×platform combination:
[{
  "persona":       "...",
  "platform":      "...",
  "format":        "...",
  "monthlyBudget": 500,
  "headline":      "...",  // max 40 chars
  "primaryCopy":   "...",  // max 90 chars
  "cta":           "...",  // max 20 chars
  "targeting": { "age": "...", "interests": ["..."] },
  "kpis": { "ctr": "2.1%", "cpc": "$1.20", "reach": "45K" }
}]

You are a world-class copywriter. Respond ONLY with a JSON object.
{
  "variants": [
    { "label": "Direct",       "headline": "...", "body": "...", "cta": "..." },
    { "label": "Curiosity",    "headline": "...", "body": "...", "cta": "..." },
    { "label": "Social Proof", "headline": "...", "body": "...", "cta": "..." }
  ]
}
Variants must be meaningfully different in angle and approach.
Headlines: max 40 chars. Body: max 90 chars. CTA: max 20 chars.

# Claude API
ANTHROPIC_API_KEY=sk-ant-...

# Supabase
NEXT_PUBLIC_SUPABASE_URL=https://xxx.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJ...
SUPABASE_SERVICE_ROLE_KEY=eyJ...

# Auth
NEXTAUTH_SECRET=your-secret-here
NEXTAUTH_URL=https://yourdomain.com

# Redis
REDIS_URL=redis://...

# Ad Platform OAuth
GOOGLE_ADS_CLIENT_ID=...
GOOGLE_ADS_CLIENT_SECRET=...
META_APP_ID=...
META_APP_SECRET=...
LINKEDIN_CLIENT_ID=...
LINKEDIN_CLIENT_SECRET=...

import { NextRequest, NextResponse } from 'next/server';
import { getServerSession } from 'next-auth';
import { ratelimit } from '@/lib/redis';

export async function POST(req: NextRequest) {
  // 1. Auth check
  const session = await getServerSession(authOptions);
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });

  // 2. Rate limit per workspace
  const { success } = await ratelimit.limit(session.user.workspaceId);
  if (!success) return NextResponse.json({ error: 'Rate limited' }, { status: 429 });

  // 3. Proxy with server-side key — key never touches the browser
  const body = await req.json();
  const response = await fetch('https://api.anthropic.com/v1/messages', {
    method: 'POST',
    headers: {
      'Content-Type':      'application/json',
      'x-api-key':        process.env.ANTHROPIC_API_KEY!,
      'anthropic-version': '2023-06-01',
    },
    body: JSON.stringify(body),
  });
  return NextResponse.json(await response.json());
}

npm i -g vercel
vercel deploy
vercel env add ANTHROPIC_API_KEY
vercel env add NEXT_PUBLIC_SUPABASE_URL
# add remaining env vars, then promote
vercel --prod

export const publishCampaign = {
  handler: async (args) => {
    // 1. Consent record MUST exist before any publish action
    const consent = await db.query(
      `SELECT * FROM audit_log
       WHERE resource_id = $1 AND action = 'consent_given'
       ORDER BY created_at DESC LIMIT 1`,
      [args.campaign_id]
    );
    if (!consent.rows.length) {
      return { error: 'CONSENT_REQUIRED',
        message: 'User must explicitly authorize before publishing.' };
    }

    // 2. Publish via platform SDK (not raw API call)
    const draft  = await db.getApprovedDraft(args.campaign_id);
    const result = await platformSDK[args.platform].publishDraft(draft.platform_draft_id);

    // 3. Write immutable audit record
    await db.query(
      `INSERT INTO audit_log (workspace_id, action, resource_id, metadata)
       VALUES ($1, 'campaign_published', $2, $3)`,
      [args.workspace_id, args.campaign_id, { platform: args.platform, result }]
    );
    return { success: true, platform_campaign_id: result.id, status: 'live' };
  }
};