@growth-labs/cms 0.8.1 → 0.8.3

package/src/routes/context.ts

@@ -119,6 +119,12 @@ export interface Authz {
 export interface RouteContext {
 	/** The inbound request (standard Fetch `Request`). */
 	request: Request
+	/**
+	 * Host-supplied execution-lifetime bridge. Maintenance-capable adapters
+	 * provide this so abort cleanup can settle after the HTTP response; adapters
+	 * must bind methods that depend on their original receiver.
+	 */
+	waitUntil?: (promise: Promise<unknown>) => void
 	/** Route params (e.g. `{ id }` for `/content/[id]`). */
 	params: Record<string, string | undefined>
 	/** The site's D1 binding. */

package/src/routes/fronts-publish.ts

@@ -2,6 +2,7 @@
 // the out-of-process Fronts publish worker (foundryd) drives:
 //
 //   GET  /admin/api/fronts/schedule?window=<from>..<to>  — the poll surface.
+//   POST /admin/api/fronts/schedule                    — bounded schedule maintenance.
 //   POST /admin/api/fronts/publish-callback              — the callback receiver.
 //
 // AUTH reuses the existing M2M primitive (`verifyHmac` + `X-Foundry-Signature`
@@ -18,11 +19,12 @@
 // CONSTANT — so one captured URL+header pair would be a permanent bearer
 // credential for the pre-publication embargo schedule.
 //
-// Both endpoints ship ENABLED behind FRONTS_PUBLISH_ENABLED (a rollback lever,
+// The endpoints ship ENABLED behind FRONTS_PUBLISH_ENABLED (a rollback lever,
 // default ON). Failures are loud: bad/stale HMAC → 401 + warn log; a `live`
 // callback that cannot commit through the ledger → 500 + error log; disabled → 503.
 
 import { z } from 'zod'
+import { createDekFailureNotifications } from '../engine/ai-dek-notifications.js'
 import { verifyHmac } from '../engine/foundry-dispatch.js'
 import {
 	applyFrontsPublishCallback,
@@ -30,12 +32,19 @@ import {
 	listFrontsPublishSchedule,
 } from '../engine/fronts-publish.js'
 import {
+	backfillFrontsChannelTargets,
 	FrontsScheduleOverflowError,
+	hydrateFrontsMediaPreparations,
 	hydrateFrontsPublishIntents,
+	parseFrontsDefaultChannelTargets,
 } from '../engine/fronts-publish-intent.js'
 import { publicUrlFor } from '../ui/screens/public-url.js'
 import { resolveConfig } from './config.js'
-import type { ContentRouteConfig } from './content.js'
+import type {
+	ContentRouteConfig,
+	FrontsScheduleMaintenanceHook,
+	FrontsScheduleMaintenanceOperation,
+} from './content.js'
 import { json, type RouteContext } from './context.js'
 
 /**
@@ -44,7 +53,12 @@ import { json, type RouteContext } from './context.js'
  * (test injection / per-Worker secret) or a Secrets Store binding `{ get() }`.
  * Returns null → the route answers 500 "not configured".
  */
-async function resolveFoundryHmacSecret(
+// Exported (W1-07 PR: content/insights-inputs) so a sibling M2M route can
+// reuse the SAME timestamp+signature verification without duplicating it --
+// content-insights.ts's insightsInputs handler is a GET poll exactly like
+// `schedule` below, and belongs on the same FOUNDRY_HMAC_SECRET/verification
+// family rather than inventing a second one.
+export async function resolveFoundryHmacSecret(
 	env: Record<string, unknown> | undefined,
 ): Promise<string | null> {
 	const raw = env?.FOUNDRY_HMAC_SECRET
@@ -78,7 +92,7 @@ function parseTimestampSeconds(raw: string): number | null {
  * = HMAC over `${timestamp}\n${payload}`. Returns null when authentic, or a 401
  * Response (with a loud warn log) to short-circuit the handler.
  */
-async function verifyFoundrySignedRequest(
+export async function verifyFoundrySignedRequest(
 	request: Request,
 	secret: string,
 	payload: string,
@@ -125,9 +139,92 @@ const CallbackSchema = z
 	})
 	.strip()
 
+const ArmChannelTargetsSchema = z
+	.object({
+		operation: z.literal('arm-channel-targets'),
+		limit: z.number().int().min(1).max(50).default(50),
+	})
+	.strict()
+
+const FrontsScheduleMaintenanceSchema = z.union([
+	z
+		.object({
+			operation: z.literal('recover-video-sources'),
+			limit: z.literal(3).default(3),
+		})
+		.strict(),
+	z
+		.object({
+			operation: z.literal('reconcile-article-enrichment'),
+			limit: z.literal(5).default(5),
+		})
+		.strict(),
+])
+
+const FRONTS_SCHEDULE_MAINTENANCE_TIMEOUT_MS = 25_000
+
+class FrontsScheduleMaintenanceTimeoutError extends Error {}
+
+function isMaintenanceOperation(value: unknown): value is FrontsScheduleMaintenanceOperation {
+	return value === 'recover-video-sources' || value === 'reconcile-article-enrichment'
+}
+
+function validateMaintenanceResult(result: unknown, limit: 3 | 5): { contentIds: string[] } | null {
+	const parsed = z
+		.object({
+			contentIds: z.array(z.string().refine((id) => id.trim().length > 0)).max(limit),
+		})
+		.strict()
+		.safeParse(result)
+	if (!parsed.success || new Set(parsed.data.contentIds).size !== parsed.data.contentIds.length)
+		return null
+	return parsed.data
+}
+
+async function runScheduleMaintenance(
+	ctx: RouteContext,
+	hook: FrontsScheduleMaintenanceHook,
+	operation: FrontsScheduleMaintenanceOperation,
+	limit: 3 | 5,
+): Promise<{ contentIds: string[] }> {
+	const controller = new AbortController()
+	let rejectDeadline: (error: FrontsScheduleMaintenanceTimeoutError) => void = () => undefined
+	let deadlineReached = false
+	const deadline = new Promise<never>((_resolve, reject) => {
+		rejectDeadline = reject
+	})
+	const abort = () => {
+		if (deadlineReached) return
+		deadlineReached = true
+		rejectDeadline(new FrontsScheduleMaintenanceTimeoutError())
+		controller.abort()
+	}
+	if (ctx.request.signal.aborted) abort()
+	else ctx.request.signal.addEventListener('abort', abort, { once: true })
+	const timer = setTimeout(abort, FRONTS_SCHEDULE_MAINTENANCE_TIMEOUT_MS)
+	const work = Promise.resolve().then(() =>
+		hook({ ctx, operation, limit, signal: controller.signal }),
+	)
+	// Keep the already-running hook alive through abort cleanup while observing
+	// either settlement so a late private rejection cannot escape the runtime.
+	const observedWork = work.then(
+		() => undefined,
+		() => undefined,
+	)
+	ctx.waitUntil?.(observedWork)
+	try {
+		return await Promise.race([work, deadline])
+	} finally {
+		clearTimeout(timer)
+		ctx.request.signal.removeEventListener('abort', abort)
+	}
+}
+
 export interface FrontsPublishRouteHandlers {
 	/** GET /fronts/schedule?window=<from>..<to> — items due for foundryd to publish. */
 	schedule(ctx: RouteContext): Promise<Response>
+	/** POST /fronts/schedule — bounded target arming or host-owned maintenance. */
+	maintainSchedule(ctx: RouteContext): Promise<Response>
 	/** POST /fronts/publish-callback — foundryd's outbound lifecycle callback. */
 	publishCallback(ctx: RouteContext): Promise<Response>
 }
@@ -159,6 +256,90 @@ function parseWindow(
 export function createFrontsPublishRoutes(config: ContentRouteConfig): FrontsPublishRouteHandlers {
 	const resolved = resolveConfig(config)
 	return {
+		async maintainSchedule(ctx) {
+			let responseOperation: 'arm-channel-targets' | FrontsScheduleMaintenanceOperation =
+				'arm-channel-targets'
+			const respond = (body: Record<string, unknown>, status = 200) =>
+				json({ version: 1, operation: responseOperation, ...body }, status)
+			const hmacSecret = await resolveFoundryHmacSecret(ctx.env)
+			if (!hmacSecret)
+				return respond({ ok: false, error: 'foundry_hmac_secret_not_configured' }, 500)
+			let rawBody: string
+			try {
+				rawBody = await ctx.request.text()
+			} catch {
+				return respond({ ok: false, error: 'invalid_channel_targets_request' }, 400)
+			}
+			const denied = await verifyFoundrySignedRequest(
+				ctx.request,
+				hmacSecret,
+				rawBody,
+				'fronts/schedule.arm-channel-targets',
+			)
+			if (denied) return respond({ ok: false, error: 'invalid_foundry_signature' }, denied.status)
+			if (!isFrontsPublishEnabled(ctx.env))
+				return respond({ ok: false, error: 'fronts_publish_disabled' }, 503)
+			let raw: unknown
+			try {
+				raw = JSON.parse(rawBody)
+			} catch {
+				return respond({ ok: false, error: 'invalid_channel_targets_request' }, 400)
+			}
+			const rawOperation =
+				typeof raw === 'object' && raw !== null && 'operation' in raw
+					? (raw as { operation?: unknown }).operation
+					: undefined
+			if (isMaintenanceOperation(rawOperation)) {
+				responseOperation = rawOperation
+				const parsed = FrontsScheduleMaintenanceSchema.safeParse(raw)
+				if (!parsed.success)
+					return respond({ ok: false, error: 'invalid_fronts_schedule_maintenance_request' }, 400)
+				if (!config.frontsScheduleMaintenance)
+					return respond({ ok: false, error: 'fronts_schedule_maintenance_unconfigured' }, 503)
+				try {
+					const rawResult = await runScheduleMaintenance(
+						ctx,
+						config.frontsScheduleMaintenance,
+						parsed.data.operation,
+						parsed.data.limit,
+					)
+					const result = validateMaintenanceResult(rawResult, parsed.data.limit)
+					if (!result)
+						return respond({ ok: false, error: 'fronts_schedule_maintenance_invalid_result' }, 500)
+					return respond({
+						ok: true,
+						limit: parsed.data.limit,
+						completed: result.contentIds.length,
+						contentIds: result.contentIds,
+					})
+				} catch (error) {
+					if (error instanceof FrontsScheduleMaintenanceTimeoutError)
+						return respond({ ok: false, error: 'fronts_schedule_maintenance_timeout' }, 503)
+					console.error('[cms] fronts/schedule host maintenance failed')
+					return respond({ ok: false, error: 'fronts_schedule_maintenance_failed' }, 500)
+				}
+			}
+			const parsed = ArmChannelTargetsSchema.safeParse(raw)
+			if (!parsed.success)
+				return respond({ ok: false, error: 'invalid_channel_targets_request' }, 400)
+			const defaults = parseFrontsDefaultChannelTargets(config.frontsDefaultChannelTargets)
+			if ('error' in defaults)
+				return respond(
+					{ ok: false, error: defaults.error },
+					defaults.error === 'missing_fronts_default_channel_targets' ? 503 : 500,
+				)
+			try {
+				const result = await backfillFrontsChannelTargets(
+					ctx.db,
+					defaults.targets,
+					parsed.data.limit,
+				)
+				return respond({ ok: true, limit: parsed.data.limit, ...result })
+			} catch (error) {
+				console.error('[cms] fronts/schedule target arming failed', error)
+				return respond({ ok: false, error: 'fronts_channel_targets_backfill_failed' }, 500)
+			}
+		},
 		async schedule(ctx) {
 			const hmacSecret = await resolveFoundryHmacSecret(ctx.env)
 			if (!hmacSecret) return json({ error: 'FOUNDRY_HMAC_SECRET is not configured' }, 500)
@@ -205,6 +386,10 @@ export function createFrontsPublishRoutes(config: ContentRouteConfig): FrontsPub
 					// origin is deliberately deferred (packages-docs/cms.md).
 					resolveContentUrl: (row) => publicUrlFor(row),
 				})
+				const preparations = await hydrateFrontsMediaPreparations(ctx.db, {
+					podcastSourceProductionEnabled: config.podcastSourceProductionEnabled,
+					videoSourceProductionEnabled: config.videoSourceProductionEnabled,
+				})
 				return json({
 					ok: true,
 					now,
@@ -213,6 +398,7 @@ export function createFrontsPublishRoutes(config: ContentRouteConfig): FrontsPub
 					items,
 					intents: hydrated.intents,
 					incomplete: hydrated.incomplete,
+					preparations,
 				})
 			} catch (error) {
 				if (error instanceof FrontsScheduleOverflowError) {
@@ -274,6 +460,7 @@ export function createFrontsPublishRoutes(config: ContentRouteConfig): FrontsPub
 				occurredAt: parsed.data.occurred_at ?? null,
 				receipt: parsed.data.receipt ?? null,
 				error: parsed.data.error ?? null,
+				llm: resolved.hooks.llm,
 				checkReadiness: config.publishReadiness
 					? (item) =>
 							config.publishReadiness!({
@@ -318,6 +505,35 @@ export function createFrontsPublishRoutes(config: ContentRouteConfig): FrontsPub
 					500,
 				)
 			}
+			const newlyPublished =
+				result.ok && result.published && !result.deduped && result.attemptId !== null
+			if (newlyPublished && result.publishedItem) {
+				if (result.dekFailureReason) {
+					try {
+						await createDekFailureNotifications({
+							db: ctx.db,
+							workspaceId: config.activeWorkspaceId ?? 'default',
+							contentId: result.publishedItem.id,
+							title: result.publishedItem.title,
+							reason: result.dekFailureReason,
+							occurrenceId: `${eventId}:${result.attemptId}`,
+						})
+					} catch {
+						console.error('[cms] failed to create post-publication dek notification')
+					}
+				}
+				if (config.dispatchWebhook) {
+					try {
+						await config.dispatchWebhook(ctx, {
+							eventType: 'content.published',
+							workspaceId: config.activeWorkspaceId ?? 'default',
+							data: result.publishedItem,
+						})
+					} catch {
+						console.error('[cms] content.published webhook dispatch failed')
+					}
+				}
+			}
 
 			return json({
 				ok: true,

package/src/ui/api/_content-config.ts

@@ -8,6 +8,7 @@ import type {
 	DispatchFaqHook,
 	DispatchTakeawaysHook,
 	DispatchWebhookHook,
+	FrontsScheduleMaintenanceHook,
 	PublishReadinessHook,
 } from '../../routes/content.js'
 import type { R2BucketLike, RouteContext } from '../../routes/context.js'
@@ -20,6 +21,8 @@ import { buildSiteAuthz } from './_authz.js'
  * ContentRouteConfig so adapters can surface them without a separate locals key.
  */
 type CmsHooksLocals = ContentRouteConfig['hooks'] & {
+	frontsDefaultChannelTargets?: ContentRouteConfig['frontsDefaultChannelTargets']
+	frontsScheduleMaintenance?: FrontsScheduleMaintenanceHook
 	activeWorkspaceId?: string
 	dispatchTakeaways?: DispatchTakeawaysHook
 	dispatchFaq?: DispatchFaqHook
@@ -40,12 +43,22 @@ type CmsHooksLocals = ContentRouteConfig['hooks'] & {
  */
 export function toContentCtx(c: APIContext, params?: Record<string, string>): RouteContext {
 	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	const cfContext = (
+		c.locals as {
+			cfContext?: { waitUntil?: (promise: Promise<unknown>) => void }
+		}
+	).cfContext
+	const waitUntil =
+		cfContext && typeof cfContext.waitUntil === 'function'
+			? cfContext.waitUntil.bind(cfContext)
+			: undefined
 	const userId =
 		(c.locals as { user?: { subject?: string } }).user?.subject ??
 		(env.__identitySubject as string | undefined) ??
 		null
 	return {
 		request: c.request,
+		...(waitUntil ? { waitUntil } : {}),
 		params: params ?? (c.params as Record<string, string>),
 		db: env.SITE_DB as RouteContext['db'],
 		bucket: (env.PUBLIC_MEDIA ?? env.MEDIA) as R2BucketLike | undefined,
@@ -75,6 +88,8 @@ export function toContentConfig(c: APIContext): ContentRouteConfig {
 				: undefined,
 		requiredPrimaryTopicContentTypes: config.primaryTopic?.contentTypes,
 		activeWorkspaceId: hooks.activeWorkspaceId,
+		frontsDefaultChannelTargets: hooks.frontsDefaultChannelTargets,
+		frontsScheduleMaintenance: hooks.frontsScheduleMaintenance,
 		hooks: {
 			llm: hooks.llm,
 			foundryVideo: hooks.foundryVideo,

package/src/ui/api/content/insights-inputs.ts

@@ -0,0 +1,26 @@
+// src/ui/api/content/insights-inputs.ts
+// GET /admin/api/content/insights-inputs?site=<id> — the funnel's author
+// denylist + existing-content coverage index. Machine-to-machine poll (same
+// X-Foundry-Timestamp + X-Foundry-Signature family as fronts/schedule) for
+// foundryd's sitebrain.insights.run schedule (W1-07 PR 6). NOT behind
+// requirePublisher. Sibling of insights-ingest under /content/.
+import type { APIContext } from 'astro'
+import { createContentInsightsRoutes } from '../../../routes/content-insights.js'
+import type { RouteContext } from '../../../routes/context.js'
+import { buildSiteAuthz } from '../_authz.js'
+
+function toCtx(c: APIContext): RouteContext {
+	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	return { request: c.request, params: {}, db: env.SITE_DB as RouteContext['db'], env }
+}
+
+function siteId(c: APIContext): string {
+	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	return (env.ACTIVE_WORKSPACE_ID as string | undefined) ?? 'default'
+}
+
+export const GET = (c: APIContext) =>
+	createContentInsightsRoutes({
+		authz: buildSiteAuthz(c),
+		activeWorkspaceId: siteId(c),
+	}).insightsInputs(toCtx(c))

package/src/ui/api/fronts/schedule.ts

@@ -10,3 +10,7 @@ import { toContentConfig, toContentCtx } from '../_content-config.js'
 
 export const GET = (c: APIContext) =>
 	createFrontsPublishRoutes(toContentConfig(c)).schedule(toContentCtx(c, {}))
+
+/** Go requests one bounded maintenance operation; the GET projection never mutates. */
+export const POST = (c: APIContext) =>
+	createFrontsPublishRoutes(toContentConfig(c)).maintainSchedule(toContentCtx(c, {}))

package/src/ui/editor/ContentForm.tsx

@@ -32,7 +32,6 @@ import {
 	applyMediaSourceReadiness,
 	buildContentCreatePayload,
 	buildContentUpdatePayload,
-	type ContentDraftFields,
 	canCreateContentDraft,
 	foundryDispatchSourceForDraft,
 	initialContentMetadata,
@@ -356,7 +355,7 @@ export function ContentForm({
 	// -- Autosave logic -------------------------------------------------------
 
 	const queueFoundryProcessing = useCallback(
-		async (id: string, draft: ContentDraftFields) => {
+		async (id: string, draft: FormState) => {
 			const source = foundryDispatchSourceForDraft(contentType, draft)
 			if (!source) return
 			const durationSeconds = normalizeMediaDurationSeconds(draft.durationSeconds)
@@ -369,7 +368,7 @@ export function ContentForm({
 				}))
 				return
 			}
-			const queueKey = `${contentType}:${id}:${source}:${durationSeconds}`
+			const queueKey = `${contentType}:${id}:${source}:${durationSeconds}:${draft.slug}:${draft.premium}`
 			if (queuedVideoSources.current.has(queueKey)) return
 
 			setForm((prev) => ({
@@ -378,7 +377,7 @@ export function ContentForm({
 				videoPipelineError: null,
 			}))
 			try {
-				const res = await fetch(`/admin/api/content/${id}?action=dispatch-to-foundry`, {
+				const res = await fetch(`/admin/api/content/${id}?action=dispatch-to-foundry&capture=1`, {
 					method: 'POST',
 				})
 				if (!res.ok) {
@@ -407,7 +406,7 @@ export function ContentForm({
 	const persist = useCallback(
 		async (currentForm: FormState) => {
 			const id = currentForm.savedId
-			const draft: ContentDraftFields = currentForm
+			const draft = currentForm
 
 			if (id === null) {
 				if (