@growth-labs/cms 0.5.29 → 0.5.31

package/src/routes/surveys.ts

@@ -28,9 +28,11 @@ export function createSurveyRoutes(config: SurveyRouteConfig): SurveyRouteHandle
 			if (denied) return withNoStoreAuthFailure(denied)
 			const surveyId = parseSurveyId(ctx)
 			if (!surveyId) return surveyErrorResponse('survey_invalid_request')
+			const offset = parseOffset(ctx)
+			if (offset === null) return surveyErrorResponse('survey_invalid_request')
 			try {
 				const parsed = SurveyResultsSchema.safeParse(
-					await providers.surveys?.getResults({ surveyId }),
+					await providers.surveys?.getResults({ surveyId, offset }),
 				)
 				if (!parsed.success || parsed.data.survey.id !== surveyId) {
 					return surveyErrorResponse('survey_provider_malformed')
@@ -70,6 +72,13 @@ async function requireSurveyAccess(authz: Authz, ctx: RouteContext): Promise<Res
 	return authz.requireRole('view_survey_responses' satisfies Capability, ctx)
 }
 
+function parseOffset(ctx: RouteContext): number | null {
+	const raw = new URL(ctx.request.url).searchParams.get('offset')
+	if (raw === null) return 0
+	const value = Number(raw)
+	return Number.isInteger(value) && value >= 0 ? value : null
+}
+
 function parseSurveyId(ctx: RouteContext): string | null {
 	const value = ctx.params.surveyId ?? ctx.params.id
 	const parsed = SurveyIdSchema.safeParse(value)
@@ -103,6 +112,8 @@ const ProviderFailureAllowlist = new Map<string, SurveyErrorCode>([
 	['404:survey_not_found', 'survey_not_found'],
 	['500:survey_internal_failure', 'survey_internal_failure'],
 	['502:survey_upstream_failure', 'survey_upstream_failure'],
+	['502:survey_upstream_auth_failed', 'survey_upstream_auth_failed'],
+	['502:survey_invalid_response', 'survey_invalid_response'],
 	['503:survey_provider_unavailable', 'survey_provider_unavailable'],
 	['503:survey_upstream_unavailable', 'survey_upstream_unavailable'],
 ])

package/src/schema/migrations.ts

@@ -841,6 +841,42 @@ ALTER TABLE article_content
   ADD COLUMN layout_json TEXT;
 	`,
 	},
+	{
+		id: '0026_fronts_publish',
+		sql: `
+ALTER TABLE content_items
+  ADD COLUMN fronts_publish_status TEXT
+  CHECK (fronts_publish_status IS NULL OR fronts_publish_status IN ('queued','publishing','live','late','failed'));
+CREATE TABLE fronts_publish_events (
+  event_id TEXT PRIMARY KEY,
+  intent_id TEXT,
+  content_id TEXT NOT NULL,
+  version INTEGER,
+  correlation_id TEXT,
+  status TEXT NOT NULL CHECK (status IN ('queued','publishing','live','late','failed')),
+  occurred_at INTEGER,
+  receipt_json TEXT,
+  error TEXT,
+  published INTEGER NOT NULL DEFAULT 0,
+  attempt_id TEXT,
+  received_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  FOREIGN KEY (content_id) REFERENCES content_items(id) ON DELETE CASCADE
+);
+CREATE INDEX idx_fronts_publish_events_content ON fronts_publish_events(content_id, received_at DESC);
+CREATE INDEX idx_fronts_publish_events_intent ON fronts_publish_events(intent_id);
+	`,
+	},
+	{
+		id: '0027_fronts_publish_intent',
+		sql: `
+ALTER TABLE content_items
+  ADD COLUMN canonical_version INTEGER NOT NULL DEFAULT 1;
+ALTER TABLE content_items
+  ADD COLUMN fronts_channel_targets TEXT;
+ALTER TABLE content_items
+  ADD COLUMN fronts_publish_trigger_token TEXT;
+	`,
+	},
 ]
 
 /**

package/src/schema/tables.ts

@@ -43,6 +43,8 @@ export const CMS_TABLES = [
 	'content_insights',
 	'content_insight_runs',
 	'content_insight_dismissals',
+	// Fronts publish-callback receiver log (migration 0026)
+	'fronts_publish_events',
 ] as const
 
 export type CmsTableName = (typeof CMS_TABLES)[number]

package/src/schema/types.ts

@@ -20,6 +20,18 @@ export type ContentStatus = 'draft' | 'scheduled' | 'review' | 'published' | 'ar
 /** content_items.visibility CHECK domain. */
 export type ContentVisibility = 'free' | 'premium'
 
+/**
+ * content_items.fronts_publish_status CHECK domain (migration 0026).
+ *
+ * The lifecycle of an item handed to the out-of-process Fronts publish worker
+ * (foundryd): it acknowledges the intent (`queued`), begins pushing to the
+ * external surfaces (`publishing`), confirms every surface is live (`live`),
+ * misses its target window (`late`), or gives up (`failed`). Only `live` (with a
+ * receipt) flips the item to `published`. NULL means the item was never routed
+ * through the additive Fronts publish path (the untouched D1 cron path owns it).
+ */
+export type FrontsPublishStatus = 'queued' | 'publishing' | 'live' | 'late' | 'failed'
+
 /** video_content.processing_state CHECK domain (bead 08 state machine). */
 export type VideoProcessingState =
 	| 'pending'
@@ -76,6 +88,55 @@ export interface ContentItemRow {
 	metadata_json: string
 	/** Optional namespaced source key used for idempotent archive imports (migration 0020). */
 	source_id: string | null
+	/**
+	 * Lifecycle marker for the additive out-of-process Fronts publish path
+	 * (migration 0026). NULL for items the legacy D1 cron path owns.
+	 */
+	fronts_publish_status: FrontsPublishStatus | null
+	/**
+	 * Monotonic integer revision of this item's canonical content (migration
+	 * 0027). 1 on create; advanced by `updateContentItem` only. This is the
+	 * `version` component of `intent_id = masthead:<content_id>:<version>`, so it
+	 * is deliberately NOT advanced by `fronts_publish_status` marker writes or by
+	 * a schedule poll.
+	 */
+	canonical_version: number
+	/**
+	 * JSON array of Fronts publish target slugs (migration 0027), or NULL when
+	 * the item has not been armed for the out-of-process publish path. NULL is a
+	 * loud hydration error, never an empty target list. Distinct from `channel`,
+	 * which is the single editorial Fronts channel slug.
+	 */
+	fronts_channel_targets: string | null
+	/**
+	 * Raw CMS-owned per-item publish trigger token (migration 0027), secret at
+	 * rest like `video_content.processing_trigger_token`. Never leaves the
+	 * package: the publish-intent contract exposes only `sha256:<hex>` of it.
+	 */
+	fronts_publish_trigger_token: string | null
+}
+
+/**
+ * Durable receiver log for foundryd's outbound publish callbacks (migration
+ * 0026). One row per `event_id` — the idempotency key. `receipt_json` stores the
+ * platform receipt (published_urls / platform_post_ids / sha256); `attempt_id`
+ * links to the `content_publication_attempts` 2PC ledger row when a confirmed
+ * `live` callback drove the publish.
+ */
+export interface FrontsPublishEventRow {
+	event_id: string
+	intent_id: string | null
+	content_id: string
+	version: number | null
+	correlation_id: string | null
+	status: FrontsPublishStatus
+	occurred_at: number | null
+	receipt_json: string | null
+	error: string | null
+	/** 1 when this callback flipped (or confirmed) the item to published. */
+	published: number
+	attempt_id: string | null
+	received_at: number
 }
 
 /** Standalone topic taxonomy row. Counts are derived from content_items.primary_topic. */

package/src/surveys/access.ts

@@ -9,3 +9,12 @@ export const SURVEY_RESPONSE_ROLES: ReadonlySet<CmsRole> = new Set([
 export function canViewSurveyResponses(role: CmsRole | null | undefined): boolean {
 	return role != null && SURVEY_RESPONSE_ROLES.has(role)
 }
+
+// Aggregates are for anyone who can open the screen; individual answers and the
+// respondent attached to them are not. Splitting these lets a team see what
+// readers said in aggregate without exposing every member's words by name.
+export const SURVEY_VERBATIM_ROLES: ReadonlySet<CmsRole> = new Set(['owner', 'senior_editor'])
+
+export function canViewSurveyVerbatims(role: CmsRole | null | undefined): boolean {
+	return role != null && SURVEY_VERBATIM_ROLES.has(role)
+}

package/src/surveys/errors.ts

@@ -29,6 +29,18 @@ export const SURVEY_ERROR_DEFINITIONS = {
 		status: 502,
 		error: 'Survey reporting could not be loaded.',
 	},
+	// Distinct causes, distinct codes. These previously collapsed into
+	// survey_upstream_failure, so the screen showed one message for an auth
+	// rejection, an upstream outage, and a payload it could not parse — which is
+	// how a broken fetch receiver in a consuming host stayed invisible for a month.
+	survey_upstream_auth_failed: {
+		status: 502,
+		error: 'Survey reporting rejected this site\u2019s credentials.',
+	},
+	survey_invalid_response: {
+		status: 502,
+		error: 'Survey reporting returned a response we could not read.',
+	},
 	survey_internal_failure: {
 		status: 500,
 		error: 'Survey reporting could not be loaded.',

package/src/surveys/schema.ts

@@ -29,6 +29,11 @@ const BoundedRecordIdSchema = z
 	.regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/)
 const IsoTimestampSchema = z.string().datetime({ offset: true })
 const CountSchema = z.number().int().nonnegative().max(MAX_COUNT)
+const AnswerValueSchema = z.union([
+	z.string().max(MAX_FREE_TEXT_LENGTH),
+	z.number().int(),
+	z.array(z.string().max(MAX_OPTION_LENGTH)).max(MAX_CHOICE_OPTIONS),
+])
 const NonemptyBoundedStringSchema = z
 	.string()
 	.min(1)
@@ -208,6 +213,35 @@ export const SurveyResultsSchema = z
 						submittedAt: IsoTimestampSchema,
 						respondentSegment: SurveyRespondentSegmentSchema,
 						anonymous: z.boolean(),
+						// Opaque upstream contact handle. The host resolves its own member
+						// record from this; no email or name crosses the reporting boundary.
+						// Optional because the reporting upstream only emits these when the
+						// caller opts in. A consumer that always required them could not
+						// read a legacy payload, and this object is strict, so a consumer
+						// that never expected them discards the whole response.
+						contactId: BoundedRecordIdSchema.nullable().optional(),
+						// Host-enriched, optional. The consuming site joins contactId to its
+						// own member record and attaches a display label here; the reporting
+						// upstream never sees it. Absent means "not resolved", not "anonymous".
+						respondent: z
+							.object({
+								label: NonemptyBoundedStringSchema,
+								detail: z.string().max(MAX_OPTION_LENGTH).nullable().optional(),
+							})
+							.strict()
+							.nullable()
+							.optional(),
+						answers: z
+							.array(
+								z
+									.object({
+										questionId: SurveyQuestionIdSchema,
+										value: AnswerValueSchema,
+									})
+									.strict(),
+							)
+							.max(MAX_QUESTIONS)
+							.optional(),
 					})
 					.strict(),
 			)
@@ -256,6 +290,19 @@ export const SurveyResultsSchema = z
 		if (results.responses.length > results.survey.responseCount) {
 			ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'Response rows exceed survey total' })
 		}
+		for (const [index, response] of results.responses.entries()) {
+			const seen = new Set<string>()
+			for (const [answerIndex, answer] of (response.answers ?? []).entries()) {
+				if (seen.has(answer.questionId)) {
+					ctx.addIssue({
+						code: z.ZodIssueCode.custom,
+						path: ['responses', index, 'answers', answerIndex, 'questionId'],
+						message: 'Answers must reference distinct questions',
+					})
+				}
+				seen.add(answer.questionId)
+			}
+		}
 		const responses = new Map<string, (typeof results.responses)[number]>()
 		for (const [index, response] of results.responses.entries()) {
 			if (responses.has(response.id)) {

package/src/ui/api/fronts/publish-callback.ts

@@ -0,0 +1,18 @@
+// src/ui/api/fronts/publish-callback.ts
+// POST /admin/api/fronts/publish-callback — receiver for foundryd's outbound
+// publish-lifecycle callbacks. Idempotent by event_id / Idempotency-Key. On a
+// confirmed `live` (with a receipt) it drives the item to published through the
+// content_publication_attempts 2PC ledger. HMAC-SHA256 (X-Foundry-Signature vs
+// env.FOUNDRY_HMAC_SECRET) only — NOT behind requirePublisher.
+import type { APIContext } from 'astro'
+import type { RouteContext } from '../../../routes/context.js'
+import { createFrontsPublishRoutes } from '../../../routes/fronts-publish.js'
+import { buildSiteAuthz } from '../_authz.js'
+
+function toCtx(c: APIContext): RouteContext {
+	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	return { request: c.request, params: {}, db: env.SITE_DB as RouteContext['db'], env }
+}
+
+export const POST = (c: APIContext) =>
+	createFrontsPublishRoutes({ authz: buildSiteAuthz(c) }).publishCallback(toCtx(c))

package/src/ui/api/fronts/schedule.ts

@@ -0,0 +1,18 @@
+// src/ui/api/fronts/schedule.ts
+// GET /admin/api/fronts/schedule?window=<from>..<to> — the machine-to-machine
+// poll surface for the out-of-process Fronts publish worker (foundryd). Returns
+// `scheduled` items due for publishing. HMAC-SHA256 (X-Foundry-Signature vs
+// env.FOUNDRY_HMAC_SECRET) only — NOT behind requirePublisher. Sibling of the
+// content foundry-callback / insights-ingest M2M routes.
+import type { APIContext } from 'astro'
+import type { RouteContext } from '../../../routes/context.js'
+import { createFrontsPublishRoutes } from '../../../routes/fronts-publish.js'
+import { buildSiteAuthz } from '../_authz.js'
+
+function toCtx(c: APIContext): RouteContext {
+	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	return { request: c.request, params: {}, db: env.SITE_DB as RouteContext['db'], env }
+}
+
+export const GET = (c: APIContext) =>
+	createFrontsPublishRoutes({ authz: buildSiteAuthz(c) }).schedule(toCtx(c))

package/src/ui/editor/ContentForm.tsx

@@ -27,6 +27,7 @@ import { Icon } from '../icons.js'
 import { uploadMediaAsset } from '../screens/media-upload.js'
 import { AiAssistPanel } from './AiAssistPanel.js'
 import { AUTOSAVE_DEBOUNCE_MS, shouldSnapshot } from './autosave.js'
+import { type BodyWarning, describeBodyWarnings, sortBodyWarnings } from './body-warnings.js'
 import {
 	buildContentCreatePayload,
 	buildContentUpdatePayload,
@@ -185,6 +186,12 @@ interface FormState {
 	lastSavedAt: number | null
 	/** Whether the AI assist panel is open. */
 	aiOpen: boolean
+	/**
+	 * Warn-severity body lint from the last save (#329). Previously the 200
+	 * payload was discarded, which is how a malformed Sources section reached a
+	 * published page — the server reported it and nothing showed the editor.
+	 */
+	bodyWarnings: BodyWarning[]
 }
 
 const EMPTY_CONTENT_METADATA_SELECTS: ContentMetadataSelectField[] = []
@@ -229,6 +236,7 @@ function createEmptyFormState(docId: string | null, metadata: ContentMetadata =
 		savedId: docId,
 		saving: false,
 		saveError: null,
+		bodyWarnings: [],
 		lastSavedAt: null,
 		aiOpen: false,
 	}
@@ -441,6 +449,17 @@ export function ContentForm({
 						return
 					}
 
+					// Carry warn-severity body lint into the editor. The server has
+					// reported these since #453; dropping the 200 payload here is what
+					// left them invisible.
+					const saved = (await res.json().catch(() => ({}))) as {
+						bodyWarnings?: BodyWarning[]
+					}
+					setForm((prev) => ({
+						...prev,
+						bodyWarnings: Array.isArray(saved.bodyWarnings) ? saved.bodyWarnings : [],
+					}))
+
 					// Snapshot cadence check
 					const now = Date.now()
 					savesSinceSnapshot.current += 1
@@ -1104,6 +1123,33 @@ export function ContentForm({
 				)}
 			</div>
 
+			{/* Body lint (#329). Shown beside the body editor so the correction is
+			    next to the text it applies to, rather than in a toast that is gone
+			    before the editor can act on it. */}
+			{form.bodyWarnings.length > 0 && (
+				<div style={bodyWarningPanel} role="status" aria-label="Body formatting warnings">
+					<div style={bodyWarningTitle}>
+						<Icon name="edit" size={12} style={{ color: 'var(--ink-faint)' }} />
+						<span>
+							{form.bodyWarnings.length}{' '}
+							{form.bodyWarnings.length === 1 ? 'formatting issue' : 'formatting issues'} — saved,
+							but these will block publishing
+						</span>
+					</div>
+					<ul style={bodyWarningList}>
+						{sortBodyWarnings(describeBodyWarnings(form.body, form.bodyWarnings)).map((warning) => (
+							<li key={`${warning.code}:${warning.line ?? 'x'}`} style={bodyWarningItem}>
+								<span style={bodyWarningLine}>
+									{warning.line === null ? 'Sources' : `Line ${warning.line}`}
+								</span>
+								<span>{warning.message}</span>
+								{warning.excerpt ? <code style={bodyWarningCode}>{warning.excerpt}</code> : null}
+							</li>
+						))}
+					</ul>
+				</div>
+			)}
+
 			{/* Footer: word count + read time (only for prose content) */}
 			{(contentType === 'article' || contentType === 'newsletter' || contentType === 'page') && (
 				<div style={footer}>
@@ -1680,6 +1726,53 @@ const dekInput: React.CSSProperties = {
 	resize: 'none',
 }
 
+const bodyWarningPanel: React.CSSProperties = {
+	marginTop: 16,
+	padding: '12px 14px',
+	borderRadius: 6,
+	border: '1px solid var(--border-soft)',
+	borderLeft: '3px solid var(--warn, #b8860b)',
+	background: 'var(--surface-sunken, rgba(0,0,0,0.02))',
+}
+
+const bodyWarningTitle: React.CSSProperties = {
+	display: 'flex',
+	alignItems: 'center',
+	gap: 8,
+	fontFamily: 'var(--mono)',
+	fontSize: 11.5,
+	color: 'var(--ink-muted)',
+	marginBottom: 8,
+}
+
+const bodyWarningList: React.CSSProperties = {
+	display: 'grid',
+	gap: 8,
+	margin: 0,
+	padding: 0,
+	listStyle: 'none',
+}
+
+const bodyWarningItem: React.CSSProperties = {
+	display: 'grid',
+	gap: 3,
+	fontSize: 13,
+	lineHeight: 1.45,
+}
+
+const bodyWarningLine: React.CSSProperties = {
+	fontFamily: 'var(--mono)',
+	fontSize: 11,
+	color: 'var(--ink-faint)',
+}
+
+const bodyWarningCode: React.CSSProperties = {
+	fontFamily: 'var(--mono)',
+	fontSize: 11.5,
+	color: 'var(--ink-muted)',
+	overflowWrap: 'anywhere',
+}
+
 const footer: React.CSSProperties = {
 	display: 'flex',
 	alignItems: 'center',

package/src/ui/editor/body-warnings.ts

@@ -0,0 +1,78 @@
+// Turn validator output into something an editor can act on (#329).
+//
+// The API returns `bodyWarnings` with character spans. An editor cannot use a
+// character offset — the design asks for "the affected line and a plain-language
+// correction" — so this maps each span onto a 1-based line number and the text
+// of that line.
+//
+// Pure on purpose: the mapping is the part worth testing, and keeping it out of
+// the component means it can be tested without rendering anything.
+
+export interface BodyWarning {
+	code: string
+	message: string
+	span?: { start: number; end: number }
+}
+
+export interface DescribedBodyWarning {
+	code: string
+	message: string
+	/** 1-based line number, or null when the warning carries no span. */
+	line: number | null
+	/** The offending line, trimmed. Null when there is no span to locate. */
+	excerpt: string | null
+}
+
+/** Longest excerpt shown inline before truncation. */
+const MAX_EXCERPT = 120
+
+function lineAt(markdown: string, offset: number): { line: number; text: string } | null {
+	if (offset < 0 || offset > markdown.length) return null
+	const before = markdown.slice(0, offset)
+	const line = before.split('\n').length
+	const lineStart = before.lastIndexOf('\n') + 1
+	const nextBreak = markdown.indexOf('\n', lineStart)
+	const text = markdown.slice(lineStart, nextBreak === -1 ? markdown.length : nextBreak)
+	return { line, text }
+}
+
+function truncate(value: string): string {
+	return value.length > MAX_EXCERPT ? `${value.slice(0, MAX_EXCERPT - 1)}…` : value
+}
+
+/**
+ * Attach a line number and excerpt to each warning.
+ *
+ * Warnings without a span keep `line: null` rather than being dropped or given
+ * a fabricated line 1 — a wrong line number sends an editor to the wrong place,
+ * which is worse than admitting the position is unknown.
+ */
+export function describeBodyWarnings(
+	markdown: string | null | undefined,
+	warnings: readonly BodyWarning[] | null | undefined,
+): DescribedBodyWarning[] {
+	if (!warnings || warnings.length === 0) return []
+	const source = markdown ?? ''
+
+	return warnings.map((warning) => {
+		const located = warning.span ? lineAt(source, warning.span.start) : null
+		return {
+			code: warning.code,
+			message: warning.message,
+			line: located ? located.line : null,
+			excerpt: located ? truncate(located.text.trim()) : null,
+		}
+	})
+}
+
+/** Stable ordering for display: by line, then by code. Unlocated ones last. */
+export function sortBodyWarnings(
+	warnings: readonly DescribedBodyWarning[],
+): DescribedBodyWarning[] {
+	return [...warnings].sort((a, b) => {
+		if (a.line === b.line) return a.code.localeCompare(b.code)
+		if (a.line === null) return 1
+		if (b.line === null) return -1
+		return a.line - b.line
+	})
+}