Magnus Hedemarkandfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> cc7e61ed30 docs(ghost): thicken Admin API skill ...

Full lastfm-model rebuild of the ghost skill against current docs.ghost.org
research:

- Fix JWT signer correctness: hex-decode the secret half before HMAC-SHA256
  signing (official contract; literal-hex signing produced invalid tokens),
  document HS256 + kid header + aud /admin/ + 5-minute token window, add
  admin_api_audience() derivation and Ghost-scheme error handling with
  researched signatures (409 UPDATE_COLLISION, 404 non-public guidance,
  INVALID_AUTH_HEADER hint, 204 delete tolerance).
- Extend CLI surface: get-post, update-post (updated_at collision guard),
  delete-post, create-page, create-tag, posts pagination (--page/--order,
  meta.pagination surfaced), scheduled posting with --published-at guard;
  dry-run now previews method/URL/payload exactly as executed.
- Add 5 cited reference files (auth/basics, content-vs-admin split incl.
  draft-visibility asymmetry, endpoint guide, worked recipes, gotchas).
- Add scripts/test_ghost.py: 28 offline tests incl. fixed-vector JWT
  known-answer checks and jq-executed pipeline-consumability chains.
- Add evals/evals.json (6 cases incl. npm ghost-cli negative probe).
- Rewrite SKILL.md (155-line body) and README in lastfm model.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

2026-08-26 21:24:20 -04:00

..

evals.json

docs(ghost): thicken Admin API skill

2026-08-26 21:24:20 -04:00