@bygghammar/cms-platform 0.91.0 → 0.92.0

package/src/server/backup-core.ts

@@ -8,10 +8,25 @@ import {
   LINEAGE_KEYS,
   SCHEMA_VERSION,
   groupById,
+  readSchemaVersion,
   type ArchiveManifest,
   type ImportMode,
   type TableSpec,
 } from "../backup/datasets";
+import {
+  buildClearPlan,
+  describeReviewConflicts,
+  indexUsersByEmail,
+  needsReconciliation,
+  replaceRefusals,
+  resolveActors,
+  reviewConflicts,
+  writableColumns,
+  type ClearStep,
+  type LocalReviewState,
+  type ReviewConflict,
+  type UnlinkedActor,
+} from "../backup/restore-core";
 import {
   hasAllowedMediaExtension,
   isSafeArchivePath,
@@ -348,10 +363,9 @@ export async function analyzeArchiveCore(deps: BackupDeps, bytes: Uint8Array): P
       `Archive format ${manifest.format} does not match this site (${ARCHIVE_FORMAT_VERSION}).`,
     );
   }
-  if (manifest.schemaVersion !== SCHEMA_VERSION) {
-    problems.push(
-      `Archive was made for database version ${manifest.schemaVersion}, this site runs version ${SCHEMA_VERSION}.`,
-    );
+  const reading = readSchemaVersion(manifest.schemaVersion);
+  if (!reading.supported) {
+    problems.push(`This archive cannot be restored — ${reading.reason}.`);
   }
 
   const media = measureMedia(entries);
@@ -408,6 +422,168 @@ export async function analyzeArchiveCore(deps: BackupDeps, bytes: Uint8Array): P
   };
 }
 
+/* ------------------------------------------------- local review history */
+
+const REVIEW_LOOKUP_CHUNK = 200;
+
+/** Read rows whose key is in `values`, in chunks small enough for a URL. */
+async function selectByKey(
+  supabaseAdmin: SupabaseClient,
+  table: string,
+  columns: string,
+  keyColumn: string,
+  values: string[],
+): Promise<Record<string, unknown>[]> {
+  const out: Record<string, unknown>[] = [];
+  for (let i = 0; i < values.length; i += REVIEW_LOOKUP_CHUNK) {
+    const chunk = values.slice(i, i + REVIEW_LOOKUP_CHUNK);
+    const { data, error } = await supabaseAdmin
+      .from(table as never)
+      .select(columns as never)
+      .in(keyColumn as never, chunk as never);
+    if (error) throw new Error(`Could not read ${table} to check for conflicts: ${error.message}`);
+    out.push(...((data ?? []) as unknown as Record<string, unknown>[]));
+  }
+  return out;
+}
+
+function archivedIds(
+  entries: Record<string, Uint8Array>,
+  table: string,
+  column: string,
+): string[] {
+  const seen = new Set<string>();
+  for (const row of tableRows(entries, table)) {
+    const v = row[column];
+    if (typeof v === "string" && v) seen.add(v);
+  }
+  return [...seen];
+}
+
+/**
+ * The local review rows the archive could possibly disagree with.
+ *
+ * Scoped to the ids the archive actually mentions rather than the whole
+ * history, which on a busy site is one row per page per scan and grows without
+ * bound. A row the archive says nothing about cannot conflict with it, so
+ * reading it would cost time to learn nothing.
+ */
+async function readLocalReviewState(
+  supabaseAdmin: SupabaseClient,
+  entries: Record<string, Uint8Array>,
+): Promise<LocalReviewState> {
+  const runIds = archivedIds(entries, "cms_publication_review_runs", "id");
+  const itemRunIds = archivedIds(entries, "cms_publication_review_items", "run_id");
+  const decisionItemIds = archivedIds(entries, "cms_publication_review_decisions", "item_id");
+
+  const runs = runIds.length
+    ? await selectByKey(
+        supabaseAdmin,
+        "cms_publication_review_runs",
+        "id,input_fingerprint",
+        "id",
+        runIds,
+      )
+    : [];
+  const items = itemRunIds.length
+    ? await selectByKey(
+        supabaseAdmin,
+        "cms_publication_review_items",
+        "id,run_id,page_id,classification",
+        "run_id",
+        itemRunIds,
+      )
+    : [];
+  const decisions = decisionItemIds.length
+    ? await selectByKey(
+        supabaseAdmin,
+        "cms_publication_review_decisions",
+        "item_id,decision",
+        "item_id",
+        decisionItemIds,
+      )
+    : [];
+
+  return {
+    runs: runs.map((r) => ({
+      id: String(r["id"]),
+      input_fingerprint: r["input_fingerprint"] == null ? null : String(r["input_fingerprint"]),
+    })),
+    items: items.map((r) => ({
+      id: String(r["id"]),
+      run_id: String(r["run_id"]),
+      page_id: String(r["page_id"]),
+      classification: r["classification"] == null ? null : String(r["classification"]),
+    })),
+    decisions: decisions.map((r) => ({
+      item_id: String(r["item_id"]),
+      decision: r["decision"] == null ? null : String(r["decision"]),
+    })),
+  };
+}
+
+/**
+ * Whether this database holds any review history at all.
+ *
+ * Asked separately from `readLocalReviewState`, and about the whole table
+ * rather than the archived ids, because the Replace refusal does not turn on
+ * overlap: a Replace that empties `pages` is blocked by *any* review item
+ * pointing at any page, whether or not the archive has ever heard of it.
+ */
+async function localHasReviewHistory(supabaseAdmin: SupabaseClient): Promise<boolean> {
+  const { count, error } = await supabaseAdmin
+    .from("cms_publication_review_items" as never)
+    .select("id" as never, { count: "exact", head: true });
+  if (error) {
+    // A database without the review tables has no history to protect, and a
+    // site that has not migrated to v3 yet must still be able to restore.
+    return false;
+  }
+  return (count ?? 0) > 0;
+}
+
+/**
+ * One clear step through supabase-js.
+ *
+ * `buildClear` renders the same step as SQL for the standalone tool; this is
+ * the same plan spoken to PostgREST, which has no SQL channel. Both need a
+ * row filter — PostgREST refuses an unqualified DELETE or UPDATE, on purpose —
+ * and `pk IS NOT NULL` is the one that matches every row, since a primary key
+ * is never null.
+ */
+async function runClearStep(
+  supabaseAdmin: SupabaseClient,
+  step: ClearStep,
+  pk: string,
+): Promise<string | null> {
+  if (step.kind === "release") {
+    const patch: Record<string, unknown> = {};
+    for (const c of step.columns) patch[c] = null;
+    const { error } = await supabaseAdmin
+      .from(step.table as never)
+      .update(patch as never)
+      .not(pk, "is", null);
+    return error ? error.message : null;
+  }
+  const { error } = await supabaseAdmin
+    .from(step.table as never)
+    .delete()
+    .not(pk, "is", null);
+  return error ? error.message : null;
+}
+
+/** Address → local account id, read once and reused for every actor column. */
+async function readUsersByEmail(supabaseAdmin: SupabaseClient): Promise<Map<string, string>> {
+  const { data, error } = await supabaseAdmin.from("app_users" as never).select("id,email" as never);
+  if (error) return new Map();
+  return indexUsersByEmail(
+    ((data ?? []) as unknown as Record<string, unknown>[]).map((r) => ({
+      id: String(r["id"]),
+      email: r["email"] == null ? null : String(r["email"]),
+    })),
+  );
+}
+
 export type ImportResult = {
   /** False when any row, table or media file could not be restored. */
   ok: boolean;
@@ -429,6 +605,23 @@ export type ImportResult = {
   mediaBytesInArchive: number;
   /** Archive entries that were not media and were deliberately not restored. */
   quarantinedMedia: string[];
+  /**
+   * Actor columns whose address matched no account here. The address itself
+   * was restored — it is the part that stays readable — but the pointer back
+   * to `app_users` was dropped, and an operator may want to relink these.
+   */
+  unlinkedActors: UnlinkedActor[];
+  /**
+   * Whether a fresh publication review scan was owed after this restore, and
+   * whether it ran. A schema-2 archive carries no review history, so the
+   * content it restores has no classification until something looks at it.
+   */
+  reconciliation: {
+    needed: boolean;
+    ran: boolean;
+    /** Present when it was owed and did not run. */
+    reason?: string;
+  };
   warnings: string[];
 };
 
@@ -454,10 +647,9 @@ export async function importArchiveCore(
       `Incompatible archive — this site reads format ${ARCHIVE_FORMAT_VERSION} archives, this one is format ${manifest.format}. Re-export it from the site that produced it.`,
     );
   }
-  if (manifest.schemaVersion !== SCHEMA_VERSION) {
-    throw new Error(
-      `Incompatible archive — it was made for database version ${manifest.schemaVersion}, this site runs version ${SCHEMA_VERSION}.`,
-    );
+  const reading = readSchemaVersion(manifest.schemaVersion);
+  if (!reading.supported) {
+    throw new Error(`Incompatible archive — ${reading.reason}.`);
   }
 
   const selected = opts.groups.filter((g) => (manifest.groups ?? []).includes(g));
@@ -500,9 +692,23 @@ export async function importArchiveCore(
     }
   }
 
+  // Nothing below this point is reversible, so everything that can refuse the
+  // restore outright happens here, before the first write. The old code could
+  // report "completed with conflicts" after it had already applied half the
+  // content; there is no such outcome any more.
+  const refusals = replaceRefusals(
+    { groups: selected, mode: opts.mode },
+    await localHasReviewHistory(supabaseAdmin),
+  );
+  if (refusals.length) throw new Error(refusals.join(" "));
+
+  const conflicts = reviewConflicts(entries, await readLocalReviewState(supabaseAdmin, entries));
+  if (conflicts.length) throw new Error(describeReviewConflicts(conflicts));
+
   const applied: ImportResult["applied"] = [];
   const aborted: string[] = [];
   const warnings: string[] = [];
+  const unlinkedActors: UnlinkedActor[] = [];
   const failedTables = new Set<string>();
   const deferredWork: {
     table: string;
@@ -511,6 +717,35 @@ export async function importArchiveCore(
     cols: string[];
   }[] = [];
 
+  // Replace mode: empty the selected tables once, here, in reverse dependency
+  // order — not inside the per-table loop below, where a later table's DELETE
+  // would remove rows an earlier one had just written, and where a table the
+  // archive is silent about was skipped by `if (!rows.length) continue;` and
+  // so never cleared at all.
+  if (opts.mode === "replace") {
+    const pkOf = new Map([...specs].map(([table, e]) => [table, e.spec.pk]));
+    for (const step of buildClearPlan(selected)) {
+      const pk = pkOf.get(step.table);
+      if (!pk) continue;
+      const error = await runClearStep(supabaseAdmin, step, pk);
+      if (!error) continue;
+      // A clear that fails is not a warning. Everything downstream of it would
+      // be written into a table still holding the rows this restore was
+      // supposed to replace, so the table is marked failed and its children
+      // are aborted by the dependency check in the loop.
+      warnings.push(`Could not clear ${step.table}: ${error}`);
+      failedTables.add(step.table);
+    }
+  }
+
+  // Read at most once, and only if some selected table actually has actor
+  // columns. Most restores do not touch the review tables at all.
+  let usersByEmail: Map<string, string> | null = null;
+  const users = async (): Promise<Map<string, string>> => {
+    usersByEmail ??= await readUsersByEmail(supabaseAdmin);
+    return usersByEmail;
+  };
+
   const base = opts.rewriteMediaBase?.trim();
   const prepare = (table: string, row: Record<string, unknown>) => {
     let out = base ? rewriteMediaUrls(row, base) : row;
@@ -556,21 +791,23 @@ export async function importArchiveCore(
     const mode: ImportMode = insertOnly ? "merge" : opts.mode;
     const conflict = entry.spec.conflict ?? entry.spec.pk;
 
-    if (mode === "replace" && !insertOnly) {
-      const { error } = await supabaseAdmin
-        .from(table as never)
-        .delete()
-        .not(entry.spec.pk, "is", null);
-      if (error) {
-        warnings.push(`Could not clear ${table}: ${error.message}`);
-        failedTables.add(table);
-      }
-    }
+    // Actor pointers are settled before the insert, never after it. The review
+    // tables refuse UPDATE by trigger, so a deferred write-back would fail
+    // *after* the row was already in — a restore reporting success on a table
+    // whose every actor pointer had been rejected.
+    const resolved = (entry.spec.actors ?? []).length
+      ? resolveActors(table, entry.spec, rows, await users())
+      : { rows, unlinked: [] as UnlinkedActor[] };
+    rows = resolved.rows;
+    unlinkedActors.push(...resolved.unlinked);
 
     const deferred = entry.spec.deferred ?? [];
+    const generated = new Set(entry.spec.generated ?? []);
     const payload = rows.map((r) => {
       const copy = prepare(table, { ...r });
       for (const c of deferred) copy[c] = null;
+      // PostgreSQL rejects a write that names a generated column outright.
+      for (const c of generated) delete copy[c];
       return copy;
     });
     if (deferred.length) {
@@ -684,6 +921,36 @@ export async function importArchiveCore(
 
   const ok = failedTables.size === 0 && aborted.length === 0;
 
+  // Reconciliation. A schema-2 archive carries no review history, so the
+  // content it just restored has no classification and nothing else will ever
+  // give it one.
+  //
+  // It runs only when the restore actually finished: a run states
+  // expected_page_count, which is a claim about a database that has stopped
+  // changing, and half a restore is not that. A partial restore therefore
+  // leaves the site unclassified and the result says so, rather than recording
+  // a run that would read as "this database has been reviewed".
+  const reconciliationNeeded = needsReconciliation(manifest) && selected.includes("content");
+  let reconciliationRan = false;
+  let reconciliationReason: string | undefined;
+  if (reconciliationNeeded) {
+    if (!ok) {
+      reconciliationReason =
+        "the restore did not complete cleanly, so no review scan was recorded — " +
+        "the pages that did arrive have no publication classification until one is run.";
+    } else {
+      const { error } = await supabaseAdmin.rpc("cms_publication_review_reconcile" as never, {
+        _operator_email: caller.email,
+      } as never);
+      if (error) {
+        reconciliationReason = `the review scan could not be recorded: ${error.message}`;
+      } else {
+        reconciliationRan = true;
+      }
+    }
+    if (reconciliationReason) warnings.push(reconciliationReason);
+  }
+
   await audit(deps, caller, "backup.import", {
     groups: selected,
     mode: opts.mode,
@@ -708,6 +975,12 @@ export async function importArchiveCore(
     mediaFilesInArchive: archiveMedia.files,
     mediaBytesInArchive: archiveMedia.bytes,
     quarantinedMedia: archiveMedia.quarantined,
+    unlinkedActors,
+    reconciliation: {
+      needed: reconciliationNeeded,
+      ran: reconciliationRan,
+      ...(reconciliationReason ? { reason: reconciliationReason } : {}),
+    },
     warnings,
   };
 }

package/src/server/page-seo-core.ts

@@ -4,34 +4,80 @@
  */
 import { normalizePath } from "./redirects-core";
 import type { PageSlugRegistry } from "./redirects-core";
+import { normalizeRoutePath, servedPath, type RoutePathPolicy } from "../site/route-index";
 
-export type SlugConflict = { locale: string; pageKey: string };
+/**
+ * A page whose address is already taken.
+ *
+ * `path` is the address as the route authority spells it, and `heldBy` names
+ * the page that reached it first. "That slug is taken" is not something an
+ * editor can act on: the two pages need not look alike, and on a site that
+ * folds case or normalizes Unicode they need not even be spelled alike.
+ */
+export type SlugConflict = {
+  locale: string;
+  pageKey: string;
+  path: string;
+  heldBy: string;
+};
 
 /**
- * No two pages may resolve to the same URL in the same locale.
- * `existing` is the stored override map, `pending` the edit being saved.
+ * No two pages may resolve to the same URL.
+ *
+ * Not "in the same locale": in the same *site*. The locale prefix is part of
+ * the address, so a Swedish page whose slug is `en` and the English front page
+ * both answer at `/en`, and a comparison run once per locale calls that pair
+ * fine. Every locale's addresses go into one table here for that reason.
+ *
+ * The addresses come from `servedPath` and `normalizeRoutePath` — the two
+ * functions the site builds its own links with — so this check cannot disagree
+ * with what the site serves. It used to compare bare slug strings, which made
+ * `/Om-Oss` and `/om-oss` two pages to the editor and one page to the browser.
+ *
+ * It does not consult a list of reserved paths. The release's own claims are
+ * the authority on those, and a second list of forbidden strings kept here
+ * would be a second authority waiting to disagree with the first.
+ *
+ * `existing` is the stored override map, `slugs` the edit being saved.
  */
 export function detectSlugConflictsCore(input: {
   pages: PageSlugRegistry;
   locales: readonly string[];
+  defaultLocale: string;
   existing: Record<string, Record<string, string>>;
   pageKey: string;
   slugs: Record<string, string>;
+  policy?: RoutePathPolicy;
 }): SlugConflict[] {
   const pendingByKey = new Map<string, Record<string, string>>(Object.entries(input.existing));
   pendingByKey.set(input.pageKey, input.slugs);
 
+  // Registry pages, pages that exist only as an override row, and the page
+  // being saved. A builder-created page is in no static registry, and leaving
+  // it out of the comparison is exactly how it comes to take an address the
+  // registry already serves.
+  const keys = [...new Set([...Object.keys(input.pages), ...pendingByKey.keys()])];
+
+  const policy: RoutePathPolicy = { locales: input.locales, ...(input.policy ?? {}) };
   const conflicts: SlugConflict[] = [];
+  const seen = new Map<string, string>();
+
   for (const locale of input.locales) {
-    const seen = new Map<string, string>();
-    for (const key of Object.keys(input.pages)) {
-      const base = input.pages[key].slug[locale];
+    for (const key of keys) {
       const override = pendingByKey.get(key)?.[locale];
-      const effective = override ?? base;
+      const base = input.pages[key]?.slug[locale];
+      // A page with no slug in this locale is still served here when it has
+      // one in the default locale: path building falls back, so the address
+      // exists and can collide whether or not anyone translated the slug.
+      const fallback =
+        pendingByKey.get(key)?.[input.defaultLocale] ?? input.pages[key]?.slug[input.defaultLocale];
+      const effective = override ?? base ?? fallback;
       if (effective === undefined) continue;
-      const existing = seen.get(effective);
-      if (existing && existing !== key) conflicts.push({ locale, pageKey: key });
-      else seen.set(effective, key);
+
+      const path = normalizeRoutePath(servedPath(effective, locale, input.defaultLocale), policy);
+      const holder = seen.get(path);
+      if (holder === undefined) seen.set(path, key);
+      else if (holder !== key) conflicts.push({ locale, pageKey: key, path, heldBy: holder });
     }
   }
   return conflicts;

package/src/server/pages-core.ts

@@ -37,6 +37,8 @@ import {
   type PublicationWindow,
 } from "../cms/page-publication";
 import { resolveGlobalsDeep } from "./resolve-globals";
+import { CONTRACT_V2_MIGRATIONS, CONTRACT_V3_MIGRATIONS } from "../platform/contract";
+import { digestJson, type DigestValue } from "../platform/digest";
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
@@ -381,12 +383,6 @@ export async function getPageForEditCore({ context }: PagesDeps, key: string) {
  */
 const FUNCTION_MISSING = new Set(["PGRST202", "PGRST203", "42883", "42P01"]);
 
-/** The migrations that install the functions below, named in the error. */
-const PUBLICATION_MIGRATIONS = [
-  "20260904140000_9f2a7c41-06d5-4d6b-8b4e-1c7a5d3e9b20.sql",
-  "20260904160000_0d565000-2839-4738-aacc-537d7090398f.sql",
-] as const;
-
 /**
  * One database-function call, for the writes that change what the public sees.
  *
@@ -409,6 +405,13 @@ async function publicationRpc(
   fn: string,
   args: Record<string, unknown>,
   whenFailed: string,
+  /**
+   * Which migrations install `fn`. Defaults to the contract-v2 pair, which
+   * installs every publication function except the ones contract v3 adds —
+   * those call sites name their own, because sending an operator after the
+   * wrong file is worse than telling them nothing.
+   */
+  installedBy: readonly string[] = CONTRACT_V2_MIGRATIONS,
 ): Promise<any> {
   const { data, error } = await client.rpc(fn, args);
   if (!error) return data;
@@ -418,9 +421,12 @@ async function publicationRpc(
     FUNCTION_MISSING.has(code) ||
     /could not find the function|does not exist/i.test(message)
   ) {
+    // A slice of the generated migration manifest rather than a second copy of
+    // the names: an operator sent after a file this package has stopped
+    // shipping is worse off than one told nothing.
     throw new Error(
       `${whenFailed}: this database does not have ${fn}. Apply the migrations ` +
-        `${PUBLICATION_MIGRATIONS.join(" and ")} shipped with this package and try again.`,
+        `${installedBy.join(" and ")} shipped with this package and try again.`,
     );
   }
   throw new Error(message || whenFailed);
@@ -690,6 +696,9 @@ export async function setPageStatusCore(
   return { ok: true as const, status };
 }
 
+/** A key the database will accept as `uuid`, checked here to say why. */
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
 /**
  * Copy a page, content and all, into a new draft.
  *
@@ -698,14 +707,34 @@ export async function setPageStatusCore(
  * copied — canonical URLs, slugs and meta titles are per-page facts, and
  * duplicating them would publish two pages claiming the same canonical address.
  * The copy starts as a draft whatever the source's status is.
+ *
+ * Three reads decide what to propose, and one transaction decides whether the
+ * proposal still describes the page. The reads cannot be inside that
+ * transaction — a PostgREST client has no way to hold one open — so nothing
+ * here is trusted afterwards: the database re-checks the address, re-checks
+ * which version was on screen, and recomputes the digest of that version's
+ * content under its own lock. It has to recompute rather than compare ids,
+ * because content under a stable version id is not immutable in this schema.
+ *
+ * `idempotencyKey` is which duplication this is. A caller that wants a retry to
+ * be recognised as a retry has to supply it and reuse the same value; one is
+ * generated when it is absent, which is honest about what that buys — it makes
+ * this call unique, and it makes a second call a second copy.
  */
 export async function duplicatePageCore(
   { context }: PagesDeps,
-  input: { pageId: string; name: string; key?: string },
+  input: { pageId: string; name: string; key?: string; idempotencyKey?: string },
 ) {
   await assertStaff(context);
   const name = input.name.trim();
   if (!name) throw new Error("A name is required for the copy.");
+  const idempotencyKey = (input.idempotencyKey ?? crypto.randomUUID()).trim();
+  if (!UUID.test(idempotencyKey)) {
+    throw new Error(
+      "An idempotency key for a copy must be a UUID, so that a retry can be told " +
+        "apart from a second copy.",
+    );
+  }
 
   const { data: source, error: srcErr } = await context.supabase
     .from("pages")
@@ -722,55 +751,59 @@ export async function duplicatePageCore(
   const taken = ((existing ?? []) as Array<{ key: string }>).map((row) => row.key);
   const key = uniquePageKey(input.key?.trim() || name, taken);
 
+  // What the source holds and what the copy will hold are two different values.
+  // The digest binds the first; the second is the first with every block
+  // re-identified, so the two pages never share a block id.
   let blocks: BlockInstance[] = [];
+  let blocksDigest: string | null = null;
   if (source.current_version_id) {
-    const { data: version } = await context.supabase
+    const { data: version, error: versionReadErr } = await context.supabase
       .from("page_versions")
       .select("blocks")
       .eq("id", source.current_version_id)
       .maybeSingle();
-    blocks = duplicateBlockTree(blocksOf(version?.blocks));
+    if (versionReadErr) throw new Error(versionReadErr.message);
+    // A page pointing at a version that is not there is broken, and copying it
+    // as an empty page would invent content rather than report the breakage.
+    if (!version) throw new Error("Version not found");
+    blocksDigest = await digestJson(version.blocks as DigestValue);
+    blocks = duplicateBlockTree(blocksOf(version.blocks));
   }
 
   invalidatePublishedCache();
-  const { data: page, error } = await context.supabase
-    .from("pages")
-    .insert({ key, name, is_system: false, status: DEFAULT_PAGE_STATUS })
-    .select("id")
-    .single();
-  if (error) throw new Error(error.message);
-
-  const { data: created, error: versionErr } = await context.supabase
-    .from("page_versions")
-    .insert({
-      page_id: page.id,
-      version_no: 1,
-      blocks: blocks as unknown as any,
-      note: `Copied from "${source.name}"`,
-      created_by: context.userId,
-      created_by_email: actorEmail(context),
-    })
-    .select("id")
-    .single();
-  if (versionErr) throw new Error(versionErr.message);
-  await context.supabase
-    .from("pages")
-    .update({ current_version_id: created.id })
-    .eq("id", page.id);
-
-  await context.supabase.from("audit_logs").insert({
-    actor_id: context.userId,
-    action: "page.duplicate",
-    entity: "pages",
-    entity_id: page.id,
-    meta: {
-      key,
-      source_key: source.key,
-      description: `Duplicated the page "${source.name}" as the draft "${name}" (${key}).`,
+  const copy = await publicationRpc(
+    context.supabase,
+    "cms_duplicate_page",
+    {
+      _source_page_id: input.pageId,
+      _expected_version_id: source.current_version_id ?? null,
+      _expected_blocks_digest: blocksDigest,
+      _idempotency_key: idempotencyKey,
+      _key: key,
+      _name: name,
+      _blocks: blocks as unknown,
+      // The description is composed in the function, from the names it read
+      // under the lock, so there is nothing to say here that it does not know.
+      _audit: {},
+      _actor_email: actorEmail(context),
     },
-  });
+    "Could not copy the page",
+    CONTRACT_V3_MIGRATIONS,
+  );
 
-  return { id: page.id as string, key, name, status: DEFAULT_PAGE_STATUS };
+  const id = typeof copy?.pageId === "string" ? copy.pageId : "";
+  if (!id) throw new Error("The database made no copy of this page.");
+  return {
+    id,
+    key: String(copy.key ?? key),
+    name: String(copy.name ?? name),
+    status: String(copy.status ?? DEFAULT_PAGE_STATUS),
+    /**
+     * True when this key had already been spent, so the copy being returned is
+     * the one the first call made rather than a new one.
+     */
+    idempotent: Boolean(copy.idempotent),
+  };
 }
 
 export async function renamePageCore(