fix: unify creatives into Pipeline and hide Panel nav

Absorb client approval, month filters and editorial pieces into Pipeline; redirect /panel-cliente and remove duplicate menu entry.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/creatives/route.ts

@@ -11,7 +11,7 @@ import {
 } from '@/lib/agency';
 
 const SELECT =
-  'id,title,status,channel,placement,format,headline,primary_text,description,cta,media_url,brand_name,landing_url,storage_path,mime_type,bytes,created_at,updated_at';
+  'id,title,status,channel,placement,format,headline,primary_text,description,cta,media_url,brand_name,landing_url,storage_path,mime_type,bytes,meta,created_at,updated_at';
 
 const CHANNELS = new Set([
   'meta_ads',
@@ -39,7 +39,17 @@ const FORMATS = new Set([
   'youtube',
   'other',
 ]);
-const ALLOWED_STATUS = new Set(['draft', 'in_review', 'approved', 'rejected']);
+const ALLOWED_STATUS = new Set([
+  'draft',
+  'in_review',
+  'approved',
+  'rejected',
+  'published',
+]);
+
+const CLIENT_ALLOWED_TRANSITIONS: Record<string, string[]> = {
+  in_review: ['approved', 'rejected'],
+};
 
 async function resolveTenantId(user: {
   app_metadata?: Record<string, unknown>;
@@ -78,6 +88,23 @@ function previewFields(body: Record<string, unknown>) {
   };
 }
 
+async function fetchCurrentStatus(
+  id: string,
+  tenantId: string | null,
+  headers: Record<string, string> | null
+): Promise<string | null> {
+  if (headers && tenantId) {
+    const r = await fetch(
+      `${supabaseUrl()}/rest/v1/creatives?id=eq.${encodeURIComponent(id)}&tenant_id=eq.${encodeURIComponent(tenantId)}&select=status,meta`,
+      { headers, cache: 'no-store' }
+    );
+    if (!r.ok) return null;
+    const rows = (await r.json()) as { status?: string }[];
+    return rows[0]?.status || null;
+  }
+  return null;
+}
+
 export async function GET() {
   const supabase = await createClient();
   const {
@@ -124,6 +151,7 @@ export async function GET() {
     return NextResponse.json({
       creatives: await r.json(),
       viewTenantId: tenantId,
+      isAgency: isAgencyRole(userRole(user)),
     });
   }
 
@@ -145,12 +173,16 @@ export async function GET() {
     }
     return NextResponse.json({
       creatives: basic ?? [],
+      isAgency: isAgencyRole(userRole(user)),
       warning:
         'Aplica sql/creatives_preview.sql para canales, copy y media preview',
     });
   }
 
-  return NextResponse.json({ creatives: data ?? [] });
+  return NextResponse.json({
+    creatives: data ?? [],
+    isAgency: isAgencyRole(userRole(user)),
+  });
 }
 
 export async function POST(req: NextRequest) {
@@ -166,6 +198,12 @@ export async function POST(req: NextRequest) {
   if (!tenantId) {
     return NextResponse.json({ error: 'Usuario sin tenant_id' }, { status: 403 });
   }
+  if (!isAgencyRole(userRole(user))) {
+    return NextResponse.json(
+      { error: 'Solo el equipo de 4Ventures puede crear piezas' },
+      { status: 403 }
+    );
+  }
 
   const body = (await req.json().catch(() => ({}))) as Record<string, unknown>;
   const title = str(body.title, 300);
@@ -179,6 +217,11 @@ export async function POST(req: NextRequest) {
     status: 'draft',
     created_by: user.id,
     ...previewFields(body),
+    meta: {
+      month: str(body.month, 7),
+      notes: str(body.notes, 2000),
+      instagram_url: str(body.instagram_url, 500),
+    },
   };
 
   if (viaView) {
@@ -268,9 +311,68 @@ export async function PATCH(req: NextRequest) {
   for (const [k, v] of Object.entries(previewFields(body))) {
     if (k in body) clean[k] = v;
   }
+  if ('month' in body || 'notes' in body || 'instagram_url' in body) {
+    clean.meta = {
+      month: str(body.month, 7),
+      notes: str(body.notes, 2000),
+      instagram_url: str(body.instagram_url, 500),
+    };
+  }
 
   const agency = isAgencyRole(userRole(user));
   const headers = serviceHeaders();
+  const { tenantId } = await resolveTenantId(user);
+
+  if (!agency) {
+    const current = await fetchCurrentStatus(id, tenantId, headers);
+    const next =
+      typeof body.status === 'string' && ALLOWED_STATUS.has(body.status)
+        ? body.status
+        : '';
+    const allowed = CLIENT_ALLOWED_TRANSITIONS[current || ''] || [];
+    if (!allowed.includes(next)) {
+      return NextResponse.json(
+        {
+          error:
+            'Como cliente solo puedes aprobar o rechazar una pieza en revisión interna',
+        },
+        { status: 403 }
+      );
+    }
+    const clientPatch = {
+      status: next,
+      updated_at: new Date().toISOString(),
+    };
+    if (headers && tenantId) {
+      const r = await fetch(
+        `${supabaseUrl()}/rest/v1/creatives?id=eq.${encodeURIComponent(id)}&tenant_id=eq.${encodeURIComponent(tenantId)}`,
+        {
+          method: 'PATCH',
+          headers: {
+            ...headers,
+            'Content-Type': 'application/json',
+            Prefer: 'return=representation',
+          },
+          body: JSON.stringify(clientPatch),
+        }
+      );
+      if (!r.ok) {
+        return NextResponse.json({ error: await r.text() }, { status: 500 });
+      }
+      const data = await r.json();
+      return NextResponse.json({ creative: data[0] || data });
+    }
+    const { data, error } = await supabase
+      .from('creatives')
+      .update(clientPatch)
+      .eq('id', id)
+      .select(SELECT)
+      .single();
+    if (error) {
+      return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+    return NextResponse.json({ creative: data });
+  }
 
   if (agency && headers) {
     const r = await fetch(
@@ -319,6 +421,12 @@ export async function DELETE(req: NextRequest) {
   }
 
   const agency = isAgencyRole(userRole(user));
+  if (!agency) {
+    return NextResponse.json(
+      { error: 'Solo el equipo de 4Ventures puede borrar piezas' },
+      { status: 403 }
+    );
+  }
   const headers = serviceHeaders();
 
   if (agency && headers) {

src/app/dashboard/panel-cliente/page.tsx

@@ -1,11 +1,6 @@
-/**
- * Panel de Creatividades — pipeline editorial interno (Propuesta → Diseño →
- * Revisión interna → Aprobación), visible también para el cliente.
- */
-'use client';
+import { redirect } from 'next/navigation';
 
-import CreativePipelineBoard from '@/components/CreativePipelineBoard';
-
-export default function PanelClientePage() {
-  return <CreativePipelineBoard />;
+/** Panel absorbido por Pipeline (`/dashboard/creatives`). */
+export default function PanelClienteRedirect() {
+  redirect('/dashboard/creatives');
 }