@growth-labs/cms 0.5.6 → 0.5.7

package/src/routes/ai.ts

@@ -14,6 +14,7 @@
 //   apply the ai_locked_fields gate, persist when allowed, and return the result.
 // - OG-image generation lands in Task 5.
 
+import { generateContentDek } from '../engine/ai-dek.js'
 import {
 	headlinesPrompt,
 	metaDescriptionPrompt,
@@ -24,6 +25,7 @@ import { applyAiWrite, parseLockedFields } from '../engine/ai-writeback.js'
 import { buildOgCardSpec } from '../engine/og-render.js'
 import { type ContentItemRecord, getContentItem } from '../engine/publisher.js'
 import type { LlmDispatchResult } from '../providers/types.js'
+import { canPerformContentAction } from './authz-matrix.js'
 import type { CmsRouteConfig } from './config.js'
 import { resolveConfig } from './config.js'
 import { type Authz, type Capability, json, type RouteContext, requireId } from './context.js'
@@ -45,6 +47,8 @@ async function aiGuard(authz: Authz, ctx: RouteContext): Promise<Response | null
 }
 
 export interface AiRouteHandlers {
+	/** POST /content/:id/ai/dek — sync: generate + persist a display subheading. */
+	suggestDek(ctx: RouteContext): Promise<Response>
 	/** POST /content/:id/ai/proofread — SSE streaming proofread & tighten. */
 	proofreadAndTighten(ctx: RouteContext): Promise<Response>
 	/** POST /content/:id/ai/headlines — SSE streaming 5-headline suggestions. */
@@ -171,6 +175,45 @@ async function loadArticleBody(
 export function createAiRoutes(config: CmsRouteConfig): AiRouteHandlers {
 	const resolved = resolveConfig(config)
 
+	async function suggestDek(ctx: RouteContext): Promise<Response> {
+		const idResult = requireId(ctx)
+		if ('error' in idResult) return idResult.error
+		const item = await getContentItem(ctx.db, idResult.id)
+		if (!item) return json({ error: 'Not found' }, 404)
+
+		if (resolved.authz.getUser) {
+			const user = await resolved.authz.getUser(ctx)
+			if (!user) return json({ error: 'Unauthorized' }, 401)
+			const allowed = canPerformContentAction(
+				user.role,
+				{ actorSubject: user.subject, contentAuthorId: item.author_id },
+				item.status === 'published' ? 'write_published' : 'write',
+			)
+			if (!allowed) return json({ error: 'Forbidden', role: user.role }, 403)
+		} else {
+			const authGuard = await aiGuard(resolved.authz, ctx)
+			if (authGuard) return authGuard
+		}
+		if (!resolved.hooks.llm) {
+			return json({ error: 'AI generation is not configured' }, 501)
+		}
+
+		const result = await generateContentDek({
+			db: ctx.db,
+			contentId: idResult.id,
+			llm: resolved.hooks.llm,
+		})
+		if (result.status === 'not_found') return json({ error: 'Not found' }, 404)
+		if (result.status === 'unavailable') {
+			return llmUnavailableResponse({ reason: result.reason }, { dek: null, written: false })
+		}
+		return json({
+			dek: result.dek,
+			written: result.written,
+			...(result.status === 'locked' ? { locked: true } : {}),
+		})
+	}
+
 	async function proofreadAndTighten(ctx: RouteContext): Promise<Response> {
 		// Guard: edit_own_draft capability (any member; ownership-aware write-back).
 		const authGuard = await aiGuard(resolved.authz, ctx)
@@ -452,6 +495,7 @@ export function createAiRoutes(config: CmsRouteConfig): AiRouteHandlers {
 	}
 
 	return {
+		suggestDek,
 		proofreadAndTighten,
 		suggestHeadlines,
 		generateKeyTakeaways,

package/src/routes/authz-matrix.ts

@@ -54,6 +54,7 @@ export const CAPABILITY_MATRIX: Record<Capability, ReadonlySet<CmsRole>> = {
 	publish_article: new Set<CmsRole>(['owner', 'senior_editor', 'editor']),
 	publish_video: new Set<CmsRole>(['owner', 'senior_editor', 'editor', 'producer']),
 	edit_own_draft: new Set<CmsRole>(['owner', 'senior_editor', 'editor', 'contributor', 'producer']),
+	edit_published: new Set<CmsRole>(['owner', 'senior_editor', 'editor']),
 	publish_others_draft: new Set<CmsRole>(['owner', 'senior_editor', 'editor']),
 	submit_for_review: new Set<CmsRole>([
 		'owner',
@@ -150,6 +151,7 @@ export function canActOnContent(
  *   - 'write'    — create / update / save a draft, set-status, snapshot,
  *                  contributors edit. Lowest bar: edit_own_draft (any member;
  *                  contributor/producer gated to OWN content by canActOnContent).
+ *   - 'write_published' — update published copy. Explicitly editorial-only.
  *   - 'publish'  — publish/unpublish/archive/unschedule an article. Requires
  *                  publish_others_draft (owner/senior_editor/editor); on OWN
  *                  content publish_article suffices (still excludes contributor).
@@ -158,7 +160,14 @@ export function canActOnContent(
  *   - 'trash'    — soft-delete / bulk-trash. Destructive → publish_others_draft.
  *   - 'media'    — dispatch-to-foundry / regenerate AI artefacts. media_pipeline.
  */
-export type ContentAction = 'write' | 'publish' | 'publish_video' | 'schedule' | 'trash' | 'media'
+export type ContentAction =
+	| 'write'
+	| 'write_published'
+	| 'publish'
+	| 'publish_video'
+	| 'schedule'
+	| 'trash'
+	| 'media'
 
 /**
  * Resolve whether `role` may perform a content `action` on an item authored by
@@ -180,6 +189,8 @@ export function canPerformContentAction(
 	switch (action) {
 		case 'write':
 			return canActOnContent(role, ownership, 'edit_own_draft')
+		case 'write_published':
+			return canActOnContent(role, ownership, 'edit_published')
 		case 'media':
 			return canActOnContent(role, ownership, 'media_pipeline')
 		case 'publish_video':

package/src/routes/content.ts

@@ -16,6 +16,8 @@
 
 import { z } from 'zod'
 import { logActivity } from '../engine/activity-log.js'
+import { generateContentDek } from '../engine/ai-dek.js'
+import { createDekFailureNotifications } from '../engine/ai-dek-notifications.js'
 import { listContributors, setContributors } from '../engine/contributors.js'
 import type { D1Database } from '../engine/d1.js'
 import {
@@ -1126,7 +1128,11 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			if (!existing) return json({ error: 'Not found' }, 404)
 
 			// Edit = write; contributor/producer gated to their own content.
-			const denied = await requireContentAction(ctx, 'write', existing.author_id)
+			const denied = await requireContentAction(
+				ctx,
+				existing.status === 'published' ? 'write_published' : 'write',
+				existing.author_id,
+			)
 			if (denied) return denied
 
 			const parsed = UpdateSchema.safeParse(await readJson(ctx))
@@ -1320,6 +1326,44 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 						422,
 					)
 				}
+
+				if (!existing.excerpt?.trim()) {
+					let failureReason: string | null = null
+					if (!resolved.hooks.llm) {
+						failureReason = 'AI generation is not configured'
+					} else {
+						try {
+							const generated = await generateContentDek({
+								db: ctx.db,
+								contentId: id,
+								llm: resolved.hooks.llm,
+							})
+							if (generated.status === 'unavailable' || generated.status === 'not_found') {
+								failureReason = generated.reason
+							}
+						} catch (error) {
+							failureReason = error instanceof Error ? error.message : String(error)
+						}
+					}
+					if (failureReason) {
+						console.error('[cms] dek generation failed; publishing without a subheading', {
+							contentId: id,
+							reason: failureReason,
+						})
+						try {
+							await createDekFailureNotifications({
+								db: ctx.db,
+								workspaceId: activeWorkspaceId,
+								contentId: id,
+								title: existing.title,
+								reason: failureReason,
+								userId: ctx.userId,
+							})
+						} catch (notificationError) {
+							console.error('[cms] failed to create dek generation notification', notificationError)
+						}
+					}
+				}
 				await publishContent(ctx.db, id, now)
 				await createRevision(ctx.db, id, ctx.userId || null)
 

package/src/routes/context.ts

@@ -25,6 +25,7 @@ export type Capability =
 	| 'publish_article'
 	| 'publish_video'
 	| 'edit_own_draft'
+	| 'edit_published'
 	| 'publish_others_draft'
 	| 'submit_for_review'
 	| 'media_pipeline'

package/src/ui/api/_content-config.ts

@@ -19,6 +19,7 @@ import { buildSiteAuthz } from './_authz.js'
  * ContentRouteConfig so adapters can surface them without a separate locals key.
  */
 type CmsHooksLocals = ContentRouteConfig['hooks'] & {
+	activeWorkspaceId?: string
 	dispatchTakeaways?: DispatchTakeawaysHook
 	dispatchFaq?: DispatchFaqHook
 	dispatchWebhook?: DispatchWebhookHook
@@ -62,6 +63,7 @@ export function toContentConfig(c: APIContext): ContentRouteConfig {
 	const hooks = locals.cmsHooks ?? {}
 	return {
 		authz: buildSiteAuthz(c),
+		activeWorkspaceId: hooks.activeWorkspaceId,
 		hooks: {
 			llm: hooks.llm,
 			foundryVideo: hooks.foundryVideo,

package/src/ui/api/content/[id]/ai/dek.ts

@@ -0,0 +1,8 @@
+// POST /admin/api/content/:id/ai/dek — generate and persist a display subheading.
+
+import type { APIContext } from 'astro'
+import { createAiRoutes } from '../../../../../routes/ai.js'
+import { toContentConfig, toContentCtx } from '../../../_content-config.js'
+
+export const POST = (c: APIContext) =>
+	createAiRoutes(toContentConfig(c)).suggestDek(toContentCtx(c, { id: c.params.id ?? '' }))

package/src/ui/editor/AiAssistPanel.tsx

@@ -27,6 +27,13 @@ interface ActionMeta {
 }
 
 const ACTIONS: ActionMeta[] = [
+	{
+		action: 'dek',
+		icon: 'sparkle',
+		title: 'Suggest subheading',
+		description: 'Display copy in house voice',
+		kind: 'sync',
+	},
 	{
 		action: 'proofread',
 		icon: 'wand',
@@ -74,6 +81,10 @@ interface PanelState {
 	headlines: string[]
 	/** Meta description text from the sync result (for the "Apply" button). */
 	metaDescription: string | null
+	/** Generated display subheading. */
+	dek: string | null
+	/** Whether the generated subheading was applied to the controlled form. */
+	dekApplied: boolean
 	/** Whether the meta was applied/written. */
 	metaApplied: boolean
 	/** Whether the takeaways were written (server-side). */
@@ -89,6 +100,8 @@ const INITIAL_STATE: PanelState = {
 	activeAction: null,
 	headlines: [],
 	metaDescription: null,
+	dek: null,
+	dekApplied: false,
 	metaApplied: false,
 	takeawaysWritten: false,
 	locked: false,
@@ -103,9 +116,11 @@ export interface AiAssistPanelProps {
 	docId: string
 	/** Called when the meta description should be applied to the SEO description field. */
 	onMetaApplied?: (description: string) => void
+	/** Called after an unlocked generated dek is stored, keeping the form in sync. */
+	onDekApplied?: (dek: string) => void
 }
 
-export function AiAssistPanel({ docId, onMetaApplied }: AiAssistPanelProps) {
+export function AiAssistPanel({ docId, onMetaApplied, onDekApplied }: AiAssistPanelProps) {
 	const [state, setState] = useState<PanelState>(INITIAL_STATE)
 
 	const handleAction = useCallback(
@@ -118,6 +133,8 @@ export function AiAssistPanel({ docId, onMetaApplied }: AiAssistPanelProps) {
 				activeAction: meta.action,
 				headlines: [],
 				metaDescription: null,
+				dek: null,
+				dekApplied: false,
 				metaApplied: false,
 				takeawaysWritten: false,
 				locked: false,
@@ -142,7 +159,18 @@ export function AiAssistPanel({ docId, onMetaApplied }: AiAssistPanelProps) {
 				} else {
 					// Sync: takeaways or meta-description
 					const data = (await syncAi(meta.action, docId)) as Record<string, unknown>
-					if (meta.action === 'meta-description') {
+					if (meta.action === 'dek') {
+						const dek = typeof data.dek === 'string' ? data.dek : null
+						const written = data.written === true
+						if (dek && written) onDekApplied?.(dek)
+						setState((prev) => ({
+							...prev,
+							running: null,
+							dek,
+							dekApplied: Boolean(dek && written),
+							locked: data.locked === true,
+						}))
+					} else if (meta.action === 'meta-description') {
 						setState((prev) => ({
 							...prev,
 							running: null,
@@ -167,7 +195,7 @@ export function AiAssistPanel({ docId, onMetaApplied }: AiAssistPanelProps) {
 				}))
 			}
 		},
-		[docId],
+		[docId, onDekApplied],
 	)
 
 	const applyMeta = useCallback(async () => {
@@ -262,6 +290,30 @@ export function AiAssistPanel({ docId, onMetaApplied }: AiAssistPanelProps) {
 				)}
 
 			{/* Result pane — sync: meta description */}
+			{state.activeAction === 'dek' && state.dek !== null && (
+				<div style={resultPane}>
+					<div style={resultHeader}>
+						<span style={{ fontSize: 12, fontWeight: 600, color: 'var(--ink-soft)' }}>
+							Suggested subheading
+						</span>
+						{state.locked && (
+							<span style={{ fontSize: 11, color: 'var(--amber)', marginLeft: 6 }}>
+								field locked — not written
+							</span>
+						)}
+					</div>
+					<p style={{ fontSize: 13, color: 'var(--ink)', lineHeight: 1.5, margin: '6px 0' }}>
+						{state.dek}
+					</p>
+					{state.dekApplied && (
+						<span style={{ fontSize: 12, color: 'var(--green)' }}>
+							<Icon name="checkCircle" size={13} style={{ marginRight: 4 }} />
+							Applied to subheading
+						</span>
+					)}
+				</div>
+			)}
+
 			{state.activeAction === 'meta-description' && state.metaDescription !== null && (
 				<div style={resultPane}>
 					<div style={resultHeader}>

package/src/ui/editor/ContentForm.tsx

@@ -795,7 +795,9 @@ export function ContentForm({
 			</div>
 
 			{/* AI assist panel — shown when toggle is on and doc is saved */}
-			{form.aiOpen && form.savedId !== null && <AiAssistPanel docId={form.savedId} />}
+			{form.aiOpen && form.savedId !== null && (
+				<AiAssistPanel docId={form.savedId} onDekApplied={handleDekChange} />
+			)}
 
 			{/* Title */}
 			<div style={fieldGroup}>

package/src/ui/editor/ai-assist.ts

@@ -10,8 +10,8 @@
 //   streamAi(action, docId, onChunk) → reads SSE body incrementally
 //   syncAi(action, docId)            → POSTs and returns parsed JSON
 
-/** The four AI actions supported by the panel. */
-export type AiAction = 'proofread' | 'headlines' | 'takeaways' | 'meta-description'
+/** The AI actions supported by the panel. */
+export type AiAction = 'dek' | 'proofread' | 'headlines' | 'takeaways' | 'meta-description'
 
 /**
  * Build the URL for a given AI action + doc id.