@growth-labs/cms 0.6.6 → 0.6.7

package/src/engine/fronts-publish.ts

@@ -26,7 +26,15 @@
 
 import type { ContentType, FrontsPublishStatus } from '../schema/types.js'
 import type { D1Database } from './d1.js'
+import { FrontsScheduleOverflowError } from './fronts-publish-intent.js'
+import { podcastPublishBlocker } from './podcast-source.js'
 import { type PublicationReconciler, publishOne } from './publication.js'
+import {
+	assertCurrentPublicationSnapshot,
+	PublicationCurrentSnapshotError,
+	snapshotRecord,
+} from './publication-current-guard.js'
+import { getContentSnapshot } from './publisher.js'
 
 /** The five lifecycle states foundryd reports for a Fronts publish intent. */
 export const FRONTS_PUBLISH_STATUSES: readonly FrontsPublishStatus[] = [
@@ -101,12 +109,13 @@ export async function listFrontsPublishSchedule(
 			`SELECT id, type, slug, title, channel, publish_at, fronts_publish_status
 			 FROM content_items
 			 WHERE status = 'scheduled'
+			   AND deleted_at IS NULL
 			   AND publish_at IS NOT NULL
 			   AND publish_at <= ?
 			 ORDER BY publish_at ASC
 			 LIMIT ?`,
 		)
-		.bind(options.toSeconds, limit)
+		.bind(options.toSeconds, limit + 1)
 		.all<{
 			id: string
 			type: ContentType
@@ -116,6 +125,7 @@ export async function listFrontsPublishSchedule(
 			publish_at: number
 			fronts_publish_status: FrontsPublishStatus | null
 		}>()
+	if ((result.results?.length ?? 0) > limit) throw new FrontsScheduleOverflowError(limit)
 	return (result.results ?? []).map((row) => ({
 		id: row.id,
 		type: row.type,
@@ -149,6 +159,14 @@ export interface FrontsPublishCallbackInput {
 	error?: string | null
 	/** Reference time (unix seconds), for tests. Defaults to Date.now(). */
 	now?: number
+	/** Optional occurrence evidence carried by current publish workers. */
+	publishAt?: number | null
+	/** The route supplies the same host hook used by the editorial publish action. */
+	checkReadiness?: (item: {
+		id: string
+		type: ContentType
+		status: string
+	}) => Promise<{ ready: boolean; blockers?: string[]; message?: string }>
 }
 
 export interface FrontsPublishCallbackResult {
@@ -163,6 +181,8 @@ export interface FrontsPublishCallbackResult {
 	contentFound: boolean
 	/** Set when a `live` callback could not be committed through the ledger. */
 	ledgerError: string | null
+	/** A retryable hold or stale/cancelled snapshot; never consumes event_id. */
+	rejection?: { code: string; status: 404 | 409 | 503; blockers?: string[]; message: string }
 }
 
 function hasReceipt(receipt: FrontsPublishReceipt | null | undefined): boolean {
@@ -231,9 +251,117 @@ export async function applyFrontsPublishCallback(
 	let attemptId: string | null = null
 	let ledgerError: string | null = null
 	const shouldPublish = input.status === 'live' && hasReceipt(input.receipt)
+	if (shouldPublish && item.status === 'published') {
+		const current = await getContentSnapshot(db, input.contentId)
+		if (
+			!current ||
+			!(await matchesCommittedCallback(
+				db,
+				input.contentId,
+				current,
+				await hashReceiptIdentity(input.receipt),
+				input,
+			))
+		) {
+			return {
+				ok: false,
+				deduped: false,
+				status: input.status,
+				published: false,
+				attemptId: null,
+				contentFound: true,
+				ledgerError: null,
+				rejection: {
+					code: 'publish_snapshot_changed',
+					status: 409,
+					message: 'The committed publication does not match this callback.',
+				},
+			}
+		}
+	}
 	if (shouldPublish && item.status !== 'published') {
+		const reject = (
+			code: string,
+			status: 404 | 409 | 503,
+			message: string,
+			blockers?: string[],
+		): FrontsPublishCallbackResult => ({
+			ok: false,
+			deduped: false,
+			status: input.status,
+			published: false,
+			attemptId: null,
+			contentFound: true,
+			ledgerError: null,
+			rejection: { code, status, message, ...(blockers ? { blockers } : {}) },
+		})
+		const expectedSnapshot = await getContentSnapshot(db, input.contentId)
+		const expectedItem = snapshotRecord(expectedSnapshot?.item)
+		if (
+			!expectedSnapshot ||
+			expectedItem.deleted_at != null ||
+			expectedItem.status !== 'scheduled'
+		) {
+			return reject('content_not_scheduled', 404, 'Content is no longer scheduled for publication.')
+		}
+		if (
+			(input.version != null && input.version !== expectedItem.canonical_version) ||
+			(input.publishAt != null && input.publishAt !== expectedItem.publish_at)
+		) {
+			return reject(
+				'publish_snapshot_changed',
+				409,
+				'The scheduled publication has been superseded.',
+			)
+		}
+		if (
+			typeof expectedItem.publish_at !== 'number' ||
+			!Number.isFinite(expectedItem.publish_at) ||
+			expectedItem.publish_at > now
+		) {
+			return reject(
+				'publish_not_ready',
+				503,
+				'The current scheduled publication time has not arrived.',
+				['publish_not_due'],
+			)
+		}
+		const blocker =
+			expectedItem.type === 'podcast'
+				? podcastPublishBlocker(snapshotRecord(expectedSnapshot.content))
+				: null
+		if (blocker) return reject('publish_not_ready', 503, blocker.message, [blocker.code])
+		if (input.checkReadiness) {
+			let timeout: ReturnType<typeof setTimeout> | undefined
+			try {
+				const readiness = await Promise.race([
+					input.checkReadiness({
+						id: input.contentId,
+						type: expectedItem.type as ContentType,
+						status: 'scheduled',
+					}),
+					new Promise<never>((_resolve, rejectTimeout) => {
+						timeout = setTimeout(() => rejectTimeout(new Error('readiness timed out')), 10_000)
+					}),
+				])
+				if (readiness.ready !== true)
+					return reject(
+						'publish_not_ready',
+						503,
+						readiness.message || 'Content is not ready for publication.',
+						readiness.blockers,
+					)
+			} catch {
+				return reject('publish_not_ready', 503, 'Publish readiness could not be verified.', [
+					'readiness_unavailable',
+				])
+			} finally {
+				if (timeout !== undefined) clearTimeout(timeout)
+			}
+		}
+		const receiptIdentity = await hashReceiptIdentity(input.receipt)
+		const receiptSummary = summarizeReceipt(input.receipt)
 		try {
-			const receiptSummary = summarizeReceipt(input.receipt)
 			const surface: PublicationReconciler = {
 				name: 'fronts',
 				async prepare() {
@@ -250,20 +378,43 @@ export async function applyFrontsPublishCallback(
 				...(publishedAt !== null ? { publishedAt } : {}),
 				createdBy: 'foundry.fronts-publish',
 				surfaces: [surface],
+				expectedCurrentSnapshot: expectedSnapshot,
+				expectedReceiptIdentity: receiptIdentity,
 			})
 			attemptId = receipt.attemptId
 			published = true
 		} catch (error) {
-			// publishOne can throw when a concurrent/superseding publish already
-			// moved the canonical pointer (the item ends up published anyway) — treat
-			// that as success. Any other failure is recorded and surfaced loudly.
+			// A concurrently published row may belong to a newer editor/source
+			// revision. Only a matching committed snapshot and full receipt prove
+			// this callback's success; status='published' alone proves nothing.
 			const reread = await db
 				.prepare('SELECT status FROM content_items WHERE id = ? LIMIT 1')
 				.bind(input.contentId)
 				.first<{ status: string }>()
 			if (reread?.status === 'published') {
+				if (
+					!(await matchesCommittedCallback(db, input.contentId, expectedSnapshot, receiptIdentity))
+				) {
+					return reject(
+						'publish_snapshot_changed',
+						409,
+						'A different publication superseded this callback.',
+					)
+				}
 				published = true
 			} else {
+				if (error instanceof PublicationCurrentSnapshotError)
+					return reject('publish_snapshot_changed', 409, error.message)
+				const current = await getContentSnapshot(db, input.contentId)
+				try {
+					assertCurrentPublicationSnapshot(current ?? {}, expectedSnapshot)
+				} catch {
+					return reject(
+						'publish_snapshot_changed',
+						409,
+						'Scheduled content or media changed before publication.',
+					)
+				}
 				ledgerError = error instanceof Error ? error.message : String(error)
 			}
 		}
@@ -348,6 +499,73 @@ export async function applyFrontsPublishCallback(
 	}
 }
 
+async function hashReceiptIdentity(
+	receipt: FrontsPublishReceipt | null | undefined,
+): Promise<string> {
+	const bytes = new TextEncoder().encode(
+		JSON.stringify([
+			'fronts-publish-receipt.v1',
+			receipt?.published_urls ?? null,
+			receipt?.platform_post_ids ?? null,
+			receipt?.sha256 ?? null,
+		]),
+	)
+	const digest = await crypto.subtle.digest('SHA-256', bytes)
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('')
+}
+
+async function matchesCommittedCallback(
+	db: D1Database,
+	contentId: string,
+	expectedSnapshot: Record<string, unknown>,
+	receiptIdentity: string,
+	input?: Pick<FrontsPublishCallbackInput, 'version' | 'publishAt'>,
+): Promise<boolean> {
+	const current = await db
+		.prepare(`SELECT r.id AS revision_id, r.payload_json, a.receipts_json
+		FROM content_items c
+		JOIN content_revisions r ON r.id = c.published_revision_id AND r.content_id = c.id
+		JOIN content_publication_attempts a ON a.revision_id = r.id AND a.content_id = c.id
+		WHERE c.id = ? AND c.status = 'published' AND c.deleted_at IS NULL
+		AND r.created_by = 'foundry.fronts-publish' AND a.operation = 'publish' AND a.state = 'committed'
+		LIMIT 1`)
+		.bind(contentId)
+		.first<{ revision_id: string; payload_json: string; receipts_json: string }>()
+	if (!current) return false
+	try {
+		const snapshot = snapshotRecord(JSON.parse(current.payload_json))
+		if (snapshot.publication_receipt_identity !== receiptIdentity) return false
+		const committedItem = snapshotRecord(snapshot.item)
+		const expectedItem = snapshotRecord(expectedSnapshot.item)
+		if (expectedItem.status === 'published') {
+			if (
+				expectedItem.published_revision_id !== current.revision_id ||
+				expectedItem.publish_at != null ||
+				(input?.version != null && input.version !== committedItem.canonical_version) ||
+				(input?.publishAt != null && input.publishAt !== committedItem.publish_at)
+			)
+				return false
+			// Commit deliberately changes only these scheduled guard fields.
+			// Every source/editor field must still match the immutable revision.
+			expectedSnapshot = {
+				...expectedSnapshot,
+				item: { ...expectedItem, status: 'scheduled', publish_at: committedItem.publish_at },
+			}
+		}
+		assertCurrentPublicationSnapshot(snapshot, expectedSnapshot)
+		const receipts: unknown = JSON.parse(current.receipts_json)
+		return (
+			Array.isArray(receipts) &&
+			receipts.some((value) => {
+				const receipt = snapshotRecord(value)
+				return receipt.name === 'fronts' && receipt.phase === 'commit' && receipt.status === 'ok'
+			})
+		)
+	} catch {
+		return false
+	}
+}
+
 /** Replay a stored callback outcome by event_id, or null when not yet recorded. */
 async function readStoredOutcome(
 	db: D1Database,

package/src/engine/index.ts

@@ -155,6 +155,10 @@ export {
 	type OgCardSpecOpts,
 	type OgImageRenderer,
 } from './og-render.js'
+export {
+	type FrontsPodcastSourceSnapshot,
+	frontsPodcastSourceGeneration,
+} from './podcast-source.js'
 // Bounded one-item publication kernel.
 export {
 	ContentArchiveImportLimitError,

package/src/engine/podcast-source.ts

@@ -0,0 +1,82 @@
+/** Current CMS evidence used by the signed schedule and media callback guards. */
+export interface FrontsPodcastSourceSnapshot {
+	content_id: string
+	slug: string
+	canonical_version: number
+	processing_source_url: string | null
+	processing_source_kind: string | null
+	processing_trigger_token: string | null
+}
+
+/**
+ * Stable over polling, machine media callbacks and rescheduling. Canonical
+ * editor/source changes invalidate the old production. Neither the raw source
+ * token nor URL needs to appear in callback/notification identities.
+ */
+export async function frontsPodcastSourceGeneration(
+	input: FrontsPodcastSourceSnapshot,
+): Promise<string> {
+	const bytes = new TextEncoder().encode(
+		JSON.stringify([
+			'fronts-podcast-source.v1',
+			input.content_id,
+			input.slug,
+			input.canonical_version,
+			input.processing_source_url,
+			input.processing_source_kind,
+			input.processing_trigger_token,
+		]),
+	)
+	const digest = await crypto.subtle.digest('SHA-256', bytes)
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('')
+}
+
+export type PodcastPublishBlockerCode =
+	| 'missing_podcast_audio'
+	| 'podcast_transcript_pending'
+	| 'podcast_source_duration_unavailable'
+
+/** Portable minimum; hosts may enforce additional object/access checks. */
+export function podcastPublishBlocker(
+	content:
+		| {
+				audio_r2_key?: unknown
+				transcript?: unknown
+				processing_source_url?: unknown
+				duration_seconds?: unknown
+		  }
+		| null
+		| undefined,
+): { code: PodcastPublishBlockerCode; message: string } | null {
+	if (typeof content?.audio_r2_key !== 'string' || !content.audio_r2_key.trim()) {
+		return { code: 'missing_podcast_audio', message: 'Podcast audio is not ready.' }
+	}
+	if (typeof content.transcript !== 'string' || !content.transcript.trim()) {
+		return { code: 'podcast_transcript_pending', message: 'Podcast transcript is not ready.' }
+	}
+	if (
+		typeof content.processing_source_url === 'string' &&
+		content.processing_source_url.trim() &&
+		(typeof content.duration_seconds !== 'number' ||
+			!Number.isFinite(content.duration_seconds) ||
+			content.duration_seconds <= 0)
+	) {
+		return {
+			code: 'podcast_source_duration_unavailable',
+			message: 'Podcast source duration is not verified.',
+		}
+	}
+	return null
+}
+
+export function validPodcastSourceUrl(value: string | null | undefined): value is string {
+	if (!value || !/^https:\/\/\S+$/.test(value) || Array.from(value).length > 2048) return false
+	try {
+		const url = new URL(value)
+		return (
+			url.protocol === 'https:' && !!url.hostname && !url.username && !url.password && !url.hash
+		)
+	} catch {
+		return false
+	}
+}

package/src/engine/publication-current-guard.ts

@@ -0,0 +1,87 @@
+/** A guard lives with its revision, so retries retain the same editorial proof. */
+export const CURRENT_PUBLICATION_GUARD = 'cms.scheduled-publication-current.v1'
+
+export class PublicationCurrentSnapshotError extends Error {
+	constructor() {
+		super('Scheduled content or media changed before publication.')
+		this.name = 'PublicationCurrentSnapshotError'
+	}
+}
+
+export function snapshotRecord(value: unknown): Record<string, unknown> {
+	return value && typeof value === 'object' && !Array.isArray(value)
+		? (value as Record<string, unknown>)
+		: {}
+}
+
+const ITEM_FIELDS = [
+	'id',
+	'type',
+	'slug',
+	'status',
+	'deleted_at',
+	'canonical_version',
+	'publish_at',
+] as const
+const PODCAST_FIELDS = [
+	'audio_r2_key',
+	'transcript',
+	'duration_seconds',
+	'processing_source_url',
+	'processing_source_kind',
+	'processing_trigger_token',
+] as const
+const VIDEO_FIELDS = [
+	'video_id',
+	'duration_seconds',
+	'processing_source_url',
+	'processing_source_kind',
+	'processing_trigger_token',
+	'processing_correlation_id',
+	'processing_state',
+	'hls_ready',
+	'hls_manifest_url',
+	'transcript_ready',
+	'transcript_url',
+] as const
+
+export function assertCurrentPublicationSnapshot(
+	current: Record<string, unknown>,
+	expected: Record<string, unknown>,
+): void {
+	const item = snapshotRecord(current.item)
+	const expectedItem = snapshotRecord(expected.item)
+	if (
+		item.status !== 'scheduled' ||
+		item.deleted_at != null ||
+		ITEM_FIELDS.some((field) => item[field] !== expectedItem[field])
+	) {
+		throw new PublicationCurrentSnapshotError()
+	}
+	const fields =
+		item.type === 'podcast' ? PODCAST_FIELDS : item.type === 'video' ? VIDEO_FIELDS : []
+	const content = snapshotRecord(current.content)
+	const expectedContent = snapshotRecord(expected.content)
+	if (fields.some((field) => content[field] !== expectedContent[field]))
+		throw new PublicationCurrentSnapshotError()
+}
+
+/** Uses the immutable revision in the existing pointer CAS; no second write. */
+export function currentPublicationSqlGuard(revisionAlias: string): string {
+	const item = (field: string) => `json_extract(${revisionAlias}.payload_json, '$.item.${field}')`
+	const content = (field: string) =>
+		`json_extract(${revisionAlias}.payload_json, '$.content.${field}')`
+	const matches = (table: string, fields: readonly string[]) => `EXISTS (
+		SELECT 1 FROM ${table} current_media WHERE current_media.content_id = content_items.id
+		AND ${fields.map((field) => `current_media.${field} IS ${content(field)}`).join(' AND ')}
+	)`
+	return `(json_extract(${revisionAlias}.payload_json, '$.publication_guard') IS NULL OR (
+		json_extract(${revisionAlias}.payload_json, '$.publication_guard') = '${CURRENT_PUBLICATION_GUARD}'
+		AND content_items.status = 'scheduled' AND content_items.deleted_at IS NULL
+		AND ${ITEM_FIELDS.filter((field) => field !== 'deleted_at')
+			.map((field) => `content_items.${field} IS ${item(field)}`)
+			.join(' AND ')}
+		AND (${item('type')} <> 'podcast' OR ${matches('podcast_content', PODCAST_FIELDS)})
+		AND (${item('type')} <> 'video' OR ${matches('video_content', VIDEO_FIELDS)})
+	))`
+}

package/src/engine/publication.ts

@@ -11,6 +11,11 @@ import {
 	serializeContentMetadata,
 } from './content-metadata.js'
 import type { D1Database, D1Result } from './d1.js'
+import {
+	assertCurrentPublicationSnapshot,
+	CURRENT_PUBLICATION_GUARD,
+	currentPublicationSqlGuard,
+} from './publication-current-guard.js'
 import { evaluateArticleBody } from './publish-guard.js'
 import {
 	type CreateContentInput,
@@ -81,6 +86,10 @@ export interface PublishOneInput {
 	requiredSurfaceNames?: string[]
 	packageVersion?: string | null
 	surfaceHookTimeoutMs?: number
+	/** Machine publication must still describe this scheduled editorial/media snapshot. */
+	expectedCurrentSnapshot?: Record<string, unknown>
+	/** Digest of the external receipt bound to a guarded machine publication. */
+	expectedReceiptIdentity?: string
 }
 
 export interface PublishOneReceipt {
@@ -763,6 +772,8 @@ async function createRevisionAndPublicationAttempt(
 		packageVersion: string | null
 		now: number
 		createdBy?: string | null
+		expectedCurrentSnapshot?: Record<string, unknown>
+		expectedReceiptIdentity?: string
 	},
 ): Promise<{
 	revisionId: string
@@ -771,6 +782,15 @@ async function createRevisionAndPublicationAttempt(
 }> {
 	const snapshot = await getContentSnapshot(db, input.contentId)
 	if (!snapshot) throw new PublicationNotFoundError(`content not found: ${input.contentId}`)
+	if (input.expectedCurrentSnapshot) {
+		assertCurrentPublicationSnapshot(snapshot, input.expectedCurrentSnapshot)
+		snapshot.publication_guard = CURRENT_PUBLICATION_GUARD
+		if (input.expectedReceiptIdentity !== undefined) {
+			if (!/^[a-f0-9]{64}$/.test(input.expectedReceiptIdentity))
+				throw new Error('Invalid guarded publication receipt identity')
+			snapshot.publication_receipt_identity = input.expectedReceiptIdentity
+		}
+	}
 	assertPublicationSnapshotBodyValid(snapshot, input.contentId)
 	const revisionId = crypto.randomUUID()
 	const attemptId = crypto.randomUUID()
@@ -1597,6 +1617,7 @@ async function movePointerAndBeginCommit(
 		  AND target_revision.content_id = ?
 		  AND json_type(target_revision.payload_json, '$.item.slug') = 'text'
 		  AND length(json_extract(target_revision.payload_json, '$.item.slug')) BETWEEN 1 AND 512
+		  ${attempt.operation === 'publish' ? `AND ${currentPublicationSqlGuard('target_revision')}` : ''}
 		  AND NOT EXISTS (
 		    SELECT 1
 		    FROM content_items other_item
@@ -1816,6 +1837,8 @@ export async function publishOne(
 		packageVersion: input.packageVersion ?? null,
 		now,
 		createdBy: input.createdBy,
+		expectedCurrentSnapshot: input.expectedCurrentSnapshot,
+		expectedReceiptIdentity: input.expectedReceiptIdentity,
 	})
 	const reconciliationInput: PublicationReconciliationInput = {
 		operation: 'publish',

package/src/engine/publisher.ts

@@ -882,7 +882,20 @@ export async function updateContentItem(
 			const audioR2Key = hasOwn(podcastContent, 'audioR2Key')
 				? (podcastContent.audioR2Key ?? current.audio_r2_key)
 				: current.audio_r2_key
-			const sourceChanged = audioR2Key !== current.audio_r2_key
+			const audioChanged = audioR2Key !== current.audio_r2_key
+			const sourceUrl = hasOwn(podcastContent, 'processingSourceUrl')
+				? (podcastContent.processingSourceUrl ?? null)
+				: audioChanged
+					? null
+					: current.processing_source_url
+			const sourceKind = hasOwn(podcastContent, 'processingSourceKind')
+				? (podcastContent.processingSourceKind ?? null)
+				: audioChanged
+					? null
+					: current.processing_source_kind
+			const capturedSourceChanged =
+				sourceUrl !== current.processing_source_url || sourceKind !== current.processing_source_kind
+			const sourceChanged = audioChanged || capturedSourceChanged
 			const durationProvided = hasOwn(podcastContent, 'durationSeconds')
 			const reusesSavedDuration =
 				!sourceChanged &&
@@ -892,7 +905,7 @@ export async function updateContentItem(
 				: await resolveMediaDuration(
 						db,
 						'podcast',
-						audioR2Key,
+						capturedSourceChanged ? sourceUrl : audioR2Key,
 						durationProvided ? podcastContent.durationSeconds : undefined,
 					)
 			const replacementTranscriptProvided =
@@ -906,18 +919,14 @@ export async function updateContentItem(
 					: replacementTranscriptProvided
 						? (podcastContent.transcript as string)
 						: current.transcript,
-				audioR2Key,
+				audioR2Key: capturedSourceChanged && !audioChanged ? '' : audioR2Key,
 				durationSeconds:
 					durationProvided || sourceChanged
 						? resolvedDuration
 						: (resolvedDuration ?? current.duration_seconds),
 				processingTriggerToken: sourceChanged ? null : current.processing_trigger_token,
-				sourceUrl: hasOwn(podcastContent, 'processingSourceUrl')
-					? (podcastContent.processingSourceUrl ?? null)
-					: current.processing_source_url,
-				sourceKind: hasOwn(podcastContent, 'processingSourceKind')
-					? (podcastContent.processingSourceKind ?? null)
-					: current.processing_source_kind,
+				sourceUrl,
+				sourceKind,
 			}
 		} else {
 			podcastUpdatePlan = null
@@ -1146,10 +1155,9 @@ export async function updateContentItem(
 		metadata_json = ?,
         updated_at = unixepoch(),
         -- The canonical revision counter behind the Fronts publish intent id
-        -- masthead:<content_id>:<version> (migration 0027). This is the ONE seam
-        -- that advances it, so an intent identity changes exactly when the item's
-        -- canonical content does -- and never on a fronts_publish_status marker
-        -- write or a schedule poll.
+        -- masthead:<content_id>:<version> (migration 0027). Canonical edits and
+        -- actual delete/restore/archive transitions advance it; scheduling,
+        -- fronts_publish_status marker writes and polls keep it stable.
         canonical_version = canonical_version + 1
       WHERE id = ?
       `,

package/src/engine/soft-delete.ts

@@ -8,7 +8,7 @@ export async function softDeleteContent(
 	const ts = now ?? Math.floor(Date.now() / 1000)
 	const res = await db
 		.prepare(
-			'UPDATE content_items SET deleted_at = ?, updated_at = unixepoch() WHERE id = ? AND deleted_at IS NULL',
+			'UPDATE content_items SET deleted_at = ?, updated_at = unixepoch(), canonical_version = canonical_version + 1 WHERE id = ? AND deleted_at IS NULL',
 		)
 		.bind(ts, id)
 		.run()
@@ -18,7 +18,7 @@ export async function softDeleteContent(
 export async function restoreContent(db: D1Database, id: string): Promise<boolean> {
 	const res = await db
 		.prepare(
-			'UPDATE content_items SET deleted_at = NULL, updated_at = unixepoch() WHERE id = ? AND deleted_at IS NOT NULL',
+			'UPDATE content_items SET deleted_at = NULL, updated_at = unixepoch(), canonical_version = canonical_version + 1 WHERE id = ? AND deleted_at IS NOT NULL',
 		)
 		.bind(id)
 		.run()

package/src/providers/types.ts

@@ -397,8 +397,13 @@ export interface FoundryJobSpec {
 	description?: string | null
 	processingTriggerTokenHash?: string
 }
+export interface FoundryDispatchResult {
+	correlationId: string
+	/** Return source evidence; the CMS owns its atomic capture with the token. */
+	podcastSource?: { url: string; kind: 'https' }
+}
 export interface FoundryDispatch {
-	dispatchVideo(jobSpec: FoundryJobSpec): Promise<{ correlationId: string }>
+	dispatchVideo(jobSpec: FoundryJobSpec): Promise<FoundryDispatchResult>
 	getJob(correlationId: string): Promise<{ state: string } | null>
 }
 

package/src/routes/content.ts

@@ -197,6 +197,8 @@ export interface ContentRouteConfig extends CmsRouteConfig {
 	dispatchFaq?: DispatchFaqHook
 	/** Optional host-specific readiness guard. A not-ready result blocks publish. */
 	publishReadiness?: PublishReadinessHook
+	/** Host's existing production rollback control; omitted means enabled. */
+	podcastSourceProductionEnabled?: boolean
 	/** Internal machine-route constraint: atomically update only in this status. */
 	updateStatusConstraint?: ContentStatus
 	/**
@@ -1890,7 +1892,7 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			if (action === 'archive') {
 				await ctx.db
 					.prepare(
-						"UPDATE content_items SET status = 'archived', updated_at = unixepoch() WHERE id = ?",
+						"UPDATE content_items SET status = 'archived', updated_at = unixepoch(), canonical_version = canonical_version + 1 WHERE id = ? AND status <> 'archived'",
 					)
 					.bind(id)
 					.run()