@growth-labs/cms 0.5.27 → 0.5.30

package/src/engine/validator/checks/source-section-diagnostics.ts

@@ -0,0 +1,187 @@
+/**
+ * Source-section diagnostics (#329).
+ *
+ * These run against markdown that has ALREADY been through
+ * `normalizeSourceSections()`. That ordering is the whole point: the
+ * normalizer fixes everything mechanically fixable, so anything still present
+ * here needs an editor's judgement rather than another rewrite — and each of
+ * these is a proven render breaker, which is why they block publish.
+ *
+ * Draft autosave stays allowed regardless; an editor must never lose work to a
+ * formatting complaint.
+ */
+import { normalizeSourceSections } from '../../source-sections.js'
+import type {
+	ArticleBodyInput,
+	ValidationError,
+	ValidationErrorCode,
+	ValidationSpan,
+} from '../types.js'
+import { makeError } from '../types.js'
+
+export interface SourceSectionOptions {
+	/** Escalate these diagnostics from warn to block. Publish sets this. */
+	blockSourceSectionDefects?: boolean
+}
+
+const NBSP = ' '
+const MANUAL_BULLET = /^\s*[●•▪]/u
+const LINK = /\[([^\]]*)\]\(([^)]*)\)/g
+
+interface SectionLine {
+	text: string
+	/** Byte offset of this line in the source document. */
+	start: number
+}
+
+/** Lines inside every Sources/References section, with document offsets. */
+function collectSectionLines(source: string): SectionLine[] {
+	const lines = source.split('\n')
+	const collected: SectionLine[] = []
+	let offset = 0
+	let sectionLevel: number | null = null
+
+	for (const text of lines) {
+		const heading = /^(#{1,6})\s+(.*)$/.exec(text)
+		const level = heading ? (heading[1]?.length ?? 0) : null
+
+		if (sectionLevel !== null && level !== null && level <= sectionLevel) {
+			sectionLevel = null
+		}
+
+		if (sectionLevel !== null) {
+			collected.push({ text, start: offset })
+		} else if (level !== null) {
+			const word = (heading?.[2] ?? '')
+				.replace(/[*_]/g, '')
+				.replace(/\s*:\s*$/, '')
+				.trim()
+			if (/^(sources|references)$/i.test(word)) sectionLevel = level
+		}
+
+		offset += text.length + 1
+	}
+
+	return collected
+}
+
+function isFormattingOnly(text: string): boolean {
+	if (text.trim() === '') return false
+	return (
+		text
+			.replaceAll(NBSP, ' ')
+			.replace(/[*_~`#]/g, '')
+			.trim() === ''
+	)
+}
+
+/** Emphasis delimiters wrapping the entire label, e.g. `[**t**](u)`. */
+function hasWholeLabelEmphasis(label: string): boolean {
+	const match = /^(\*\*|__|\*|_)([\s\S]+)\1$/.exec(label.trim())
+	if (!match) return false
+	return !(match[2] ?? '').includes(match[1] as string)
+}
+
+/** An odd number of `**` or `*` runs — ambiguous, so the normalizer left it. */
+function hasUnbalancedEmphasis(label: string): boolean {
+	const strong = (label.match(/\*\*/g) ?? []).length
+	if (strong % 2 !== 0) return true
+	const em = (label.replace(/\*\*/g, '').match(/\*/g) ?? []).length
+	if (em % 2 !== 0) return true
+	const under = (label.match(/__/g) ?? []).length
+	return under % 2 !== 0
+}
+
+export function check(
+	input: ArticleBodyInput,
+	options: SourceSectionOptions = {},
+): ValidationError[] {
+	// Warn on save, block on publish. The design keeps draft autosave working
+	// so an editor cannot lose work to a formatting complaint, while still
+	// refusing to publish a section that is a proven render breaker.
+	const escalate = options.blockSourceSectionDefects === true
+	const report = (
+		code: ValidationErrorCode,
+		message: string,
+		span?: ValidationSpan,
+	): ValidationError => {
+		const error = makeError(code, message, span)
+		return escalate ? { ...error, severity: 'block' } : error
+	}
+
+	if (!input.body_markdown) return []
+
+	// Report against normalized text so a defect the normalizer would have
+	// fixed is never surfaced to the editor as their problem.
+	const source = normalizeSourceSections(input.body_markdown).markdown
+	const errors: ValidationError[] = []
+	const lines = collectSectionLines(source)
+
+	let linkLike = 0
+	let listItems = 0
+
+	for (const { text, start } of lines) {
+		const span = { start, end: start + text.length }
+
+		if (MANUAL_BULLET.test(text)) {
+			errors.push(
+				report(
+					'source-section-manual-bullet',
+					`This source line still starts with a manual bullet character. Replace it with "- " so it renders as one list, not separate paragraphs.`,
+					span,
+				),
+			)
+		}
+
+		if (isFormattingOnly(text)) {
+			errors.push(
+				report(
+					'source-section-formatting-only-line',
+					`This line contains only formatting characters and renders as an empty heading. Delete it.`,
+					span,
+				),
+			)
+		}
+
+		if (/^\s*[-*+]\s+/.test(text)) listItems++
+
+		for (const link of text.matchAll(LINK)) {
+			const label = link[1] ?? ''
+			if (label.trim() !== '') linkLike++
+
+			if (hasWholeLabelEmphasis(label)) {
+				errors.push(
+					report(
+						'source-section-wrapped-link-label',
+						`The link title "${label.trim()}" is wrapped in emphasis markers, which stay visible inside the link. Remove the surrounding * or _ characters.`,
+						span,
+					),
+				)
+			} else if (hasUnbalancedEmphasis(label)) {
+				errors.push(
+					report(
+						'source-section-unbalanced-emphasis',
+						`The link title "${label.trim()}" has an unmatched emphasis marker. Close it or remove it — it cannot be corrected automatically without changing the title.`,
+						span,
+					),
+				)
+			}
+		}
+	}
+
+	// A section that reads as a list of sources but has no list items at all
+	// renders as a run of paragraphs. Only claim this when there is something
+	// list-shaped to talk about.
+	if (listItems === 0 && linkLike > 1) {
+		const first = lines[0]
+		errors.push(
+			report(
+				'source-section-unlistable',
+				`This source section has ${linkLike} links but no list items, so it renders as separate paragraphs. Start each source line with "- ".`,
+				first ? { start: first.start, end: first.start + first.text.length } : undefined,
+			),
+		)
+	}
+
+	return errors
+}

package/src/engine/validator/index.ts

@@ -21,6 +21,7 @@ import * as iframeMissingDims from './checks/iframe-missing-dims-and-wrapper.js'
 import * as invisibleControl from './checks/invisible-control-chars.js'
 import * as paywallMarker from './checks/paywall-marker-leak.js'
 import * as rawBlockHtml from './checks/raw-block-html.js'
+import * as sourceSectionDiagnostics from './checks/source-section-diagnostics.js'
 import * as unresolvedAnchor from './checks/unresolved-footnote-anchor.js'
 import * as wordGdocs from './checks/word-gdocs-paste-artifacts.js'
 
@@ -302,6 +303,7 @@ export const checkBareUrlNotAutolinked = bareUrl.check
 export const checkEmptyAltText = emptyAlt.check
 export const checkIframeMissingDimsAndWrapper = iframeMissingDims.check
 export const checkHeadingHierarchySkip = headingHierarchy.check
+export const checkSourceSectionDiagnostics = sourceSectionDiagnostics.check
 export const checkPaywallMarkerLeak = paywallMarker.check
 
 /* -------------------------------------------------------------------------- */
@@ -310,11 +312,20 @@ export const checkPaywallMarkerLeak = paywallMarker.check
 
 export interface RunOptions extends ValidatorOptions {
 	requireBody: boolean
+	/**
+	 * Escalate source-section diagnostics (#329) from warn to block.
+	 *
+	 * Defaults to false so a draft save is never rejected for formatting — the
+	 * PATCH route returns 422 on any block-severity error. Publish call sites
+	 * set it to true, which is where the design wants these enforced.
+	 */
+	blockSourceSectionDefects: boolean
 }
 
 export const DEFAULT_RUN_OPTIONS: RunOptions = {
 	...DEFAULT_OPTIONS,
 	requireBody: true,
+	blockSourceSectionDefects: false,
 }
 
 /**
@@ -349,6 +360,7 @@ export function validateArticleBody(
 	errors.push(...checkEmptyAltText(input))
 	errors.push(...checkIframeMissingDimsAndWrapper(input))
 	errors.push(...checkHeadingHierarchySkip(input))
+	errors.push(...checkSourceSectionDiagnostics(input, opts))
 	errors.push(...checkPaywallMarkerLeak(input))
 	// Heuristic.
 	errors.push(...checkUnbalancedMarkdownEmphasis(input))

package/src/engine/validator/types.ts

@@ -55,6 +55,15 @@ export type ValidationErrorCode =
 	| 'heading-hierarchy-skip'
 	| 'paywall-marker-leak'
 	| 'stale-body-html'
+	// Source-section diagnostics (#329). Reported only for defects that
+	// SURVIVE normalizeSourceSections() — the normalizer already fixed
+	// everything mechanically fixable, so what is left needs an editor's
+	// judgement. Warn on save, block on publish; see SEVERITY below.
+	| 'source-section-manual-bullet'
+	| 'source-section-formatting-only-line'
+	| 'source-section-wrapped-link-label'
+	| 'source-section-unbalanced-emphasis'
+	| 'source-section-unlistable'
 
 export type ValidationResult = { ok: true } | { ok: false; errors: ValidationError[] }
 
@@ -88,6 +97,16 @@ export const SEVERITY: Readonly<Record<ValidationErrorCode, Severity>> = {
 	'heading-hierarchy-skip': 'warn',
 	'paywall-marker-leak': 'block',
 	'stale-body-html': 'block',
+	// #329. WARN by default so a draft save is never rejected — the design is
+	// explicit that an editor must not lose work to a formatting complaint, and
+	// the PATCH route returns 422 on any block-severity error. Publish call
+	// sites pass `blockSourceSectionDefects` to escalate these to block, which
+	// is where the design wants them enforced.
+	'source-section-manual-bullet': 'warn',
+	'source-section-formatting-only-line': 'warn',
+	'source-section-wrapped-link-label': 'warn',
+	'source-section-unbalanced-emphasis': 'warn',
+	'source-section-unlistable': 'warn',
 }
 
 export interface ValidatorOptions {

package/src/integration/options.ts

@@ -13,6 +13,74 @@ const primaryCategorySchema = z.object({
 	label: z.string().min(1),
 })
 
+const contentMetadataKeySchema = z
+	.string()
+	.regex(/^[a-z][a-z0-9_]{0,63}$/, 'metadata keys must be lowercase snake_case')
+
+const contentMetadataSelectFieldSchema = z
+	.object({
+		key: contentMetadataKeySchema,
+		label: z.string().trim().min(1).max(100),
+		helpText: z.string().trim().min(1).max(500).optional(),
+		contentTypes: z.array(z.enum(['article', 'video', 'podcast', 'newsletter', 'page'])).min(1),
+		options: z
+			.array(
+				z
+					.object({
+						value: z.string().trim().min(1).max(100),
+						label: z.string().trim().min(1).max(100),
+					})
+					.strict(),
+			)
+			.min(1),
+		defaultValue: z.string().trim().min(1).max(100).optional(),
+		inferenceMarkerKey: contentMetadataKeySchema.optional(),
+	})
+	.strict()
+	.superRefine((field, ctx) => {
+		const values = field.options.map(({ value }) => value)
+		if (new Set(values).size !== values.length) {
+			ctx.addIssue({
+				code: 'custom',
+				path: ['options'],
+				message: 'metadata select option values must be unique',
+			})
+		}
+		if (field.defaultValue && !values.includes(field.defaultValue)) {
+			ctx.addIssue({
+				code: 'custom',
+				path: ['defaultValue'],
+				message: 'metadata select defaultValue must match a declared option',
+			})
+		}
+		if (field.inferenceMarkerKey === field.key) {
+			ctx.addIssue({
+				code: 'custom',
+				path: ['inferenceMarkerKey'],
+				message: 'metadata select inference marker must use a separate key',
+			})
+		}
+	})
+
+const contentMetadataSelectsSchema = z
+	.array(contentMetadataSelectFieldSchema)
+	.superRefine((fields, ctx) => {
+		const keys = new Set<string>()
+		for (const [index, field] of fields.entries()) {
+			if (keys.has(field.key)) {
+				ctx.addIssue({
+					code: 'custom',
+					path: [index, 'key'],
+					message: 'metadata select keys must be unique',
+				})
+			}
+			keys.add(field.key)
+		}
+	})
+	.default([])
+
+export type ContentMetadataSelectField = z.output<typeof contentMetadataSelectFieldSchema>
+
 const themeSchema = z
 	.object({
 		mode: z.enum(['light', 'dark']).default('dark'),
@@ -38,6 +106,7 @@ export const cmsIntegrationOptionsSchema = z
 	.object({
 		workspaces: z.array(workspaceSchema).min(1, 'at least one workspace is required'),
 		primaryCategories: z.array(primaryCategorySchema).default([]),
+		contentMetadataSelects: contentMetadataSelectsSchema,
 		activeWorkspaceId: z.string().optional(),
 		adminBasePath: z.string().default('/admin'),
 		searchEnabled: z.boolean().default(true),

package/src/providers/types.ts

@@ -430,7 +430,7 @@ export interface SettingsProvider {
 }
 
 export interface SurveyProvider {
-	getResults(input: { surveyId: string }): Promise<SurveyResults>
+	getResults(input: { surveyId: string; offset?: number }): Promise<SurveyResults>
 	getCsv(input: { surveyId: string }): Promise<SurveyCsvResult>
 }
 

package/src/routes/content.ts

@@ -18,6 +18,11 @@ import { z } from 'zod'
 import { logActivity } from '../engine/activity-log.js'
 import { generateContentDek } from '../engine/ai-dek.js'
 import { createDekFailureNotifications } from '../engine/ai-dek-notifications.js'
+import {
+	type ContentMetadata,
+	ContentMetadataError,
+	serializeContentMetadata,
+} from '../engine/content-metadata.js'
 import { listContributors, setContributors } from '../engine/contributors.js'
 import type { D1Database } from '../engine/d1.js'
 import {
@@ -51,7 +56,9 @@ import {
 } from '../engine/revisions.js'
 import { applySlugRenameRedirects } from '../engine/slug-redirects.js'
 import { softDeleteContent } from '../engine/soft-delete.js'
+import { normalizeSourceSections } from '../engine/source-sections.js'
 import { TagInputError } from '../engine/taxonomy.js'
+import type { ValidationError } from '../engine/validator/index.js'
 import { parseLayoutEnvelope } from '../schema/layout.js'
 import { parsePortableTextEnvelope } from '../schema/portable-text.js'
 import type { ContentStatus } from '../schema/types.js'
@@ -284,6 +291,21 @@ const BodyContentCreateSchema = z.object({
 	editorTakeaways: z.array(z.string().min(1)).max(4).optional().nullable(),
 })
 
+const ContentMetadataSchema = z
+	.record(z.string(), z.unknown())
+	.superRefine((metadata, ctx) => {
+		try {
+			serializeContentMetadata(metadata as ContentMetadata)
+		} catch (error) {
+			ctx.addIssue({
+				code: 'custom',
+				message:
+					error instanceof ContentMetadataError ? error.message : 'content metadata is invalid',
+			})
+		}
+	})
+	.transform((metadata) => metadata as ContentMetadata)
+
 function buildSchemas(resolved: ReturnType<typeof resolveConfig>) {
 	const category = slugEnum(resolved.primaryCategorySlugs)
 	const topic = slugEnum(resolved.primaryTopicSlugs)
@@ -306,6 +328,7 @@ function buildSchemas(resolved: ReturnType<typeof resolveConfig>) {
 		socialImageId: z.string().optional().nullable(),
 		canonicalUrl: z.string().url().optional().nullable(),
 		tags: z.array(z.string()).optional(),
+		metadata: ContentMetadataSchema.optional(),
 	})
 
 	const CreateSchema = z.discriminatedUnion('type', [
@@ -370,6 +393,7 @@ function buildSchemas(resolved: ReturnType<typeof resolveConfig>) {
 		socialImageId: z.string().optional().nullable(),
 		canonicalUrl: z.string().url().optional().nullable(),
 		tags: z.array(z.string()).optional(),
+		metadata: ContentMetadataSchema.optional(),
 		content: z.record(z.string(), z.any()).optional(),
 		relations: z.array(RelationSchema).optional(),
 		aiLockedFields: z.array(z.string()).optional(),
@@ -1205,6 +1229,12 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				return json({ error: 'Invalid request', details: parsed.error.flatten() }, 400)
 			}
 
+			// Warn-severity body-lint results. Declared here so the success payload
+			// below can carry them: they do not block the save, but an editor who is
+			// never told is how a malformed Sources section reached a published page
+			// (packages#329).
+			let bodyWarnings: ValidationError[] = []
+
 			if (parsed.data.content !== undefined) {
 				const contentSchema = getContentUpdateSchema(existing.type)
 				if (!contentSchema) return json({ error: 'Invalid content type' }, 400)
@@ -1229,9 +1259,29 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 						bodyMarkdown?: string
 						bodyHtml?: string | null
 					}
-					const bodyMarkdown = articleContent.bodyMarkdown
-					const bodyHtml = articleContent.bodyHtml
+					let bodyMarkdown = articleContent.bodyMarkdown
+					let bodyHtml = articleContent.bodyHtml
 					const isDraft = existing.status === 'draft'
+
+					// Safe, deterministic Sources/References cleanup is applied before
+					// the body is persisted, so the stored Markdown is canonical and the
+					// editor's next read shows what will actually render (#329).
+					//
+					// When normalization changes the Markdown, any body_html the client
+					// sent alongside it was rendered from the pre-normalization text and
+					// is stale by construction. Persisting it would let the exact defect
+					// this fixes survive in the rendered output, which is how the
+					// original incident reached a published page — so it is dropped and
+					// re-rendered downstream.
+					if (typeof bodyMarkdown === 'string') {
+						const normalized = normalizeSourceSections(bodyMarkdown)
+						if (normalized.changed) {
+							bodyMarkdown = normalized.markdown
+							bodyHtml = null
+							articleContent.bodyMarkdown = normalized.markdown
+							articleContent.bodyHtml = null
+						}
+					}
 					if (bodyMarkdown !== undefined || bodyHtml !== undefined) {
 						const guard = evaluateArticleBody(
 							{ body_markdown: bodyMarkdown ?? null, body_html: bodyHtml ?? null },
@@ -1243,6 +1293,11 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 								422,
 							)
 						}
+						// Warn-severity violations do not block the save, but the editor
+						// has to be told: an unreported warning is why a malformed Sources
+						// section reached a published page (packages#329). Carried into
+						// the 200 payload below rather than only console.warn'd.
+						bodyWarnings = guard.warnings
 					}
 				}
 			}
@@ -1276,6 +1331,9 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				podcastFoundryQueued: Boolean(podcastAttempt.result),
 				podcastFoundryCorrelationId: podcastAttempt.result?.correlationId ?? null,
 				podcastFoundryReason: podcastAttempt.reason,
+				// Present and empty when the body linted clean, so a client can
+				// distinguish "no warnings" from "this build does not report them".
+				bodyWarnings,
 			})
 		},
 

package/src/routes/surveys.ts

@@ -28,9 +28,11 @@ export function createSurveyRoutes(config: SurveyRouteConfig): SurveyRouteHandle
 			if (denied) return withNoStoreAuthFailure(denied)
 			const surveyId = parseSurveyId(ctx)
 			if (!surveyId) return surveyErrorResponse('survey_invalid_request')
+			const offset = parseOffset(ctx)
+			if (offset === null) return surveyErrorResponse('survey_invalid_request')
 			try {
 				const parsed = SurveyResultsSchema.safeParse(
-					await providers.surveys?.getResults({ surveyId }),
+					await providers.surveys?.getResults({ surveyId, offset }),
 				)
 				if (!parsed.success || parsed.data.survey.id !== surveyId) {
 					return surveyErrorResponse('survey_provider_malformed')
@@ -70,6 +72,13 @@ async function requireSurveyAccess(authz: Authz, ctx: RouteContext): Promise<Res
 	return authz.requireRole('view_survey_responses' satisfies Capability, ctx)
 }
 
+function parseOffset(ctx: RouteContext): number | null {
+	const raw = new URL(ctx.request.url).searchParams.get('offset')
+	if (raw === null) return 0
+	const value = Number(raw)
+	return Number.isInteger(value) && value >= 0 ? value : null
+}
+
 function parseSurveyId(ctx: RouteContext): string | null {
 	const value = ctx.params.surveyId ?? ctx.params.id
 	const parsed = SurveyIdSchema.safeParse(value)
@@ -103,6 +112,8 @@ const ProviderFailureAllowlist = new Map<string, SurveyErrorCode>([
 	['404:survey_not_found', 'survey_not_found'],
 	['500:survey_internal_failure', 'survey_internal_failure'],
 	['502:survey_upstream_failure', 'survey_upstream_failure'],
+	['502:survey_upstream_auth_failed', 'survey_upstream_auth_failed'],
+	['502:survey_invalid_response', 'survey_invalid_response'],
 	['503:survey_provider_unavailable', 'survey_provider_unavailable'],
 	['503:survey_upstream_unavailable', 'survey_upstream_unavailable'],
 ])

package/src/surveys/access.ts

@@ -9,3 +9,12 @@ export const SURVEY_RESPONSE_ROLES: ReadonlySet<CmsRole> = new Set([
 export function canViewSurveyResponses(role: CmsRole | null | undefined): boolean {
 	return role != null && SURVEY_RESPONSE_ROLES.has(role)
 }
+
+// Aggregates are for anyone who can open the screen; individual answers and the
+// respondent attached to them are not. Splitting these lets a team see what
+// readers said in aggregate without exposing every member's words by name.
+export const SURVEY_VERBATIM_ROLES: ReadonlySet<CmsRole> = new Set(['owner', 'senior_editor'])
+
+export function canViewSurveyVerbatims(role: CmsRole | null | undefined): boolean {
+	return role != null && SURVEY_VERBATIM_ROLES.has(role)
+}

package/src/surveys/errors.ts

@@ -29,6 +29,18 @@ export const SURVEY_ERROR_DEFINITIONS = {
 		status: 502,
 		error: 'Survey reporting could not be loaded.',
 	},
+	// Distinct causes, distinct codes. These previously collapsed into
+	// survey_upstream_failure, so the screen showed one message for an auth
+	// rejection, an upstream outage, and a payload it could not parse — which is
+	// how a broken fetch receiver in a consuming host stayed invisible for a month.
+	survey_upstream_auth_failed: {
+		status: 502,
+		error: 'Survey reporting rejected this site\u2019s credentials.',
+	},
+	survey_invalid_response: {
+		status: 502,
+		error: 'Survey reporting returned a response we could not read.',
+	},
 	survey_internal_failure: {
 		status: 500,
 		error: 'Survey reporting could not be loaded.',

package/src/surveys/schema.ts

@@ -29,6 +29,11 @@ const BoundedRecordIdSchema = z
 	.regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/)
 const IsoTimestampSchema = z.string().datetime({ offset: true })
 const CountSchema = z.number().int().nonnegative().max(MAX_COUNT)
+const AnswerValueSchema = z.union([
+	z.string().max(MAX_FREE_TEXT_LENGTH),
+	z.number().int(),
+	z.array(z.string().max(MAX_OPTION_LENGTH)).max(MAX_CHOICE_OPTIONS),
+])
 const NonemptyBoundedStringSchema = z
 	.string()
 	.min(1)
@@ -208,6 +213,35 @@ export const SurveyResultsSchema = z
 						submittedAt: IsoTimestampSchema,
 						respondentSegment: SurveyRespondentSegmentSchema,
 						anonymous: z.boolean(),
+						// Opaque upstream contact handle. The host resolves its own member
+						// record from this; no email or name crosses the reporting boundary.
+						// Optional because the reporting upstream only emits these when the
+						// caller opts in. A consumer that always required them could not
+						// read a legacy payload, and this object is strict, so a consumer
+						// that never expected them discards the whole response.
+						contactId: BoundedRecordIdSchema.nullable().optional(),
+						// Host-enriched, optional. The consuming site joins contactId to its
+						// own member record and attaches a display label here; the reporting
+						// upstream never sees it. Absent means "not resolved", not "anonymous".
+						respondent: z
+							.object({
+								label: NonemptyBoundedStringSchema,
+								detail: z.string().max(MAX_OPTION_LENGTH).nullable().optional(),
+							})
+							.strict()
+							.nullable()
+							.optional(),
+						answers: z
+							.array(
+								z
+									.object({
+										questionId: SurveyQuestionIdSchema,
+										value: AnswerValueSchema,
+									})
+									.strict(),
+							)
+							.max(MAX_QUESTIONS)
+							.optional(),
 					})
 					.strict(),
 			)
@@ -256,6 +290,19 @@ export const SurveyResultsSchema = z
 		if (results.responses.length > results.survey.responseCount) {
 			ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Response rows exceed survey total' })
 		}
+		for (const [index, response] of results.responses.entries()) {
+			const seen = new Set<string>()
+			for (const [answerIndex, answer] of (response.answers ?? []).entries()) {
+				if (seen.has(answer.questionId)) {
+					ctx.addIssue({
+						code: z.ZodIssueCode.custom,
+						path: ['responses', index, 'answers', answerIndex, 'questionId'],
+						message: 'Answers must reference distinct questions',
+					})
+				}
+				seen.add(answer.questionId)
+			}
+		}
 		const responses = new Map<string, (typeof results.responses)[number]>()
 		for (const [index, response] of results.responses.entries()) {
 			if (responses.has(response.id)) {

package/src/ui/client/mount.tsx

@@ -39,6 +39,7 @@ export async function mount(elementId = 'masthead-root') {
 	const screens = createCmsScreens({
 		allowInlineAuthorCreation: config.socialSharing.allowInlineAuthorCreation,
 		primaryCategories: config.primaryCategories,
+		contentMetadataSelects: config.contentMetadataSelects,
 		surveyId: config.surveyResults?.surveyId,
 	})
 	createRoot(el).render(<CmsApp initial={initial} screens={screens} boot={boot} />)