What the fleet costs and what it returns, in the terminal (#240)

`crawlproof dashboard` (also roi, tui) is a live hqtui dashboard over three
feeds that have never been in the same place: the tracker for who arrived, the
ad network for what was delivered, and CoinPay for what the bank actually did.
Five screens — ROI, Traffic, Ads, Money, Spend — refreshing on a timer, plus
--json for the same snapshot without a terminal.

Two rules run through the arithmetic, because breaking either produces a
flattering number that is false:

  Self-deal is not revenue. We advertise on our own slots, so ad spend and ad
  earnings are one dollar moving between two pockets. They are reported under
  Internal and counted as neither cost nor revenue.

  Personal money is not fleet cost. The bank feed carries groceries next to
  servers, so cost is the business scope only, joined from each ledger row's
  account to that account's effective_scope.

Everything is normalised to a monthly rate and prorated onto the traffic
window, because burn is a rate and the traffic side can be asked for an hour
while the bank side only answers in weeks.

Two token-authed reads to feed it:

  GET /api/ads/v1/earnings — the model /dashboard/ads/earnings already builds.
  Without it a client wanting fleet totals needs one request per campaign, and
  the account is past 170 of them.

  GET /api/tracker/v1/sites — /stats already names every project, but only
  inside the 400 it returns when the caller does not say which. A client should
  not have to parse an error message to find the fleet.

loadEarnings now filters ad_campaigns, ad_slots, ad_ledger and ad_payouts by
owner_id explicitly rather than leaning on RLS. For the dashboard that is a
no-op narrowing of what RLS already allows; for the new route, which passes the
service client, it is the security boundary.

The dashboard reports what it cannot know as loudly as what it can: a site that
did not answer is missing rather than zero, a vendor list built from one page of
a longer ledger says so, and a fleet whose visits run 200x its pageviews — or
whose average is really one busy site — says that too, next to the number.


Claude-Session: https://claude.ai/code/session_01HvWJ4336pxTFRdRbvsTQeD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ralyodio

app/api/ads/v1/earnings/route.ts

@@ -0,0 +1,38 @@
+// /api/ads/v1/earnings — the account's ad money and delivery, for a token caller.
+//
+//   GET ?days=7|30|90|365
+//
+// The same model /dashboard/ads/earnings renders, for something holding an API
+// token. It exists because the alternative for a client that wants fleet totals
+// is one /campaigns/[id] request per campaign, and the account is past 170 of
+// them — see `crawlproof dashboard`, which polls this on a timer.
+//
+// Same auth as the rest of /api/ads/v1/*: `Authorization: Bearer crp_…`.
+
+import { NextResponse, type NextRequest } from "next/server";
+
+import { serviceClient } from "@/lib/supabase/service";
+import { authenticateBearer } from "@/lib/sp/apiAuth";
+import { loadEarnings } from "@/lib/ads/earnings-data";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const ALLOWED_DAYS = [7, 30, 90, 365];
+
+/** An unknown window falls back to 30 rather than reaching the query planner. */
+export function parseDays(raw: string | null): number {
+  const n = Number(raw);
+  return ALLOWED_DAYS.includes(n) ? n : 30;
+}
+
+export async function GET(req: NextRequest) {
+  const auth = await authenticateBearer(req);
+  if (!auth.ok) return NextResponse.json({ error: auth.error }, { status: auth.status });
+
+  const days = parseDays(req.nextUrl.searchParams.get("days"));
+  // The service client has no RLS. loadEarnings filters every table by
+  // owner_id itself, which is what makes passing it here safe.
+  const model = await loadEarnings(serviceClient(), auth.userId, days);
+  return NextResponse.json(model);
+}

app/api/tracker/v1/sites/route.ts

@@ -0,0 +1,33 @@
+// /api/tracker/v1/sites — the projects this token can read stats for.
+//
+//   GET → { sites: [{ id, name, url, tracker_enabled }] }
+//
+// /stats already names them, but only inside the 400 it returns when the
+// account has more than one and the caller did not say which. A client that
+// wants the whole fleet should not have to parse an error message to find it.
+
+import { NextResponse, type NextRequest } from "next/server";
+
+import { serviceClient } from "@/lib/supabase/service";
+import { authenticateBearer } from "@/lib/sp/apiAuth";
+import { listProjects } from "@/lib/tracker/apiStats";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET(req: NextRequest) {
+  const auth = await authenticateBearer(req);
+  if (!auth.ok) return NextResponse.json({ error: auth.error }, { status: auth.status });
+
+  const listed = await listProjects(serviceClient(), auth.userId);
+  if (!listed.ok) return NextResponse.json({ error: listed.error }, { status: listed.status });
+
+  return NextResponse.json({
+    sites: listed.projects.map((p) => ({
+      id: p.id,
+      name: p.name,
+      url: p.url,
+      tracker_enabled: p.tracker_enabled ?? null,
+    })),
+  });
+}