@growth-labs/cms 0.8.2 → 0.8.4

package/src/engine/publisher.ts

@@ -22,7 +22,6 @@
 import type { ContentStatus, ContentType, FrontsPublishStatus } from '../schema/types.js'
 import { type ContentMetadata, serializeContentMetadata } from './content-metadata.js'
 import type { D1Database } from './d1.js'
-import { armFrontsPublishTriggerToken } from './fronts-publish-intent.js'
 import { evaluateArticleBody, type PublishGuardOutcome } from './publish-guard.js'
 import { slugify } from './slug.js'
 import {
@@ -793,7 +792,10 @@ export async function updateContentItem(
 	// Resolve all media identity/duration invariants before the base content row,
 	// tags, or relations can be mutated. D1 does not provide a transaction on the
 	// structural surface used here, so validation must be a strict preflight.
-	if (input.content && existing.type === 'video') {
+	if (
+		(input.content || input.slug !== undefined || input.visibility !== undefined) &&
+		existing.type === 'video'
+	) {
 		const current = await db
 			.prepare(
 				`SELECT script, video_id, duration_seconds, thumbnail_image_id,
@@ -813,7 +815,7 @@ export async function updateContentItem(
 			}>()
 
 		if (current) {
-			const videoContent = input.content as Partial<VideoInput['content']>
+			const videoContent = (input.content ?? {}) as Partial<VideoInput['content']>
 			const sourceUrl = hasOwn(videoContent, 'processingSourceUrl')
 				? (videoContent.processingSourceUrl ?? null)
 				: current.processing_source_url
@@ -851,14 +853,19 @@ export async function updateContentItem(
 					: current.thumbnail_image_id,
 				sourceUrl,
 				sourceKind,
-				sourceChanged,
+				sourceChanged:
+					sourceChanged ||
+					resolvedDuration !== current.duration_seconds ||
+					(input.slug !== undefined && input.slug !== existing.slug) ||
+					(input.visibility !== undefined && input.visibility !== existing.visibility) ||
+					(hasOwn(videoContent, 'videoId') && videoContent.videoId !== current.video_id),
 			}
 		} else {
 			videoUpdatePlan = null
 		}
 	}
 
-	if (input.content && existing.type === 'podcast') {
+	if ((input.content || input.slug !== undefined) && existing.type === 'podcast') {
 		const current = await db
 			.prepare(
 				`SELECT transcript, audio_r2_key, duration_seconds, processing_trigger_token,
@@ -878,7 +885,7 @@ export async function updateContentItem(
 			}>()
 
 		if (current) {
-			const podcastContent = input.content as Partial<PodcastInput['content']>
+			const podcastContent = (input.content ?? {}) as Partial<PodcastInput['content']>
 			const audioR2Key = hasOwn(podcastContent, 'audioR2Key')
 				? (podcastContent.audioR2Key ?? current.audio_r2_key)
 				: current.audio_r2_key
@@ -910,9 +917,13 @@ export async function updateContentItem(
 					)
 			const replacementTranscriptProvided =
 				hasOwn(podcastContent, 'transcript') && typeof podcastContent.transcript === 'string'
+			const preparationChanged =
+				sourceChanged ||
+				resolvedDuration !== current.duration_seconds ||
+				(input.slug !== undefined && input.slug !== existing.slug)
 
 			podcastUpdatePlan = {
-				transcript: sourceChanged
+				transcript: preparationChanged
 					? replacementTranscriptProvided
 						? (podcastContent.transcript as string)
 						: ''
@@ -924,7 +935,7 @@ export async function updateContentItem(
 					durationProvided || sourceChanged
 						? resolvedDuration
 						: (resolvedDuration ?? current.duration_seconds),
-				processingTriggerToken: sourceChanged ? null : current.processing_trigger_token,
+				processingTriggerToken: preparationChanged ? null : current.processing_trigger_token,
 				sourceUrl,
 				sourceKind,
 			}
@@ -1196,7 +1207,7 @@ export async function updateContentItem(
 	}
 	if (!options.expectedMediaSource) await updateBaseContent()
 
-	if (input.content) {
+	if (input.content || videoUpdatePlan || podcastUpdatePlan) {
 		if (isBodyBackedContentType(existing.type)) {
 			const current = await db
 				.prepare(
@@ -1307,6 +1318,7 @@ export async function updateContentItem(
             processing_state = CASE WHEN ? THEN 'pending' ELSE processing_state END,
             processing_correlation_id = CASE WHEN ? THEN NULL ELSE processing_correlation_id END,
             processing_trigger_token = CASE WHEN ? THEN NULL ELSE processing_trigger_token END,
+            processing_publication_guard = CASE WHEN ? THEN NULL ELSE processing_publication_guard END,
             processing_started_at = CASE WHEN ? THEN NULL ELSE processing_started_at END,
             processing_completed_at = CASE WHEN ? THEN NULL ELSE processing_completed_at END,
             processing_last_event_at = CASE WHEN ? THEN NULL ELSE processing_last_event_at END,
@@ -1341,6 +1353,7 @@ export async function updateContentItem(
 					videoUpdatePlan.sourceChanged ? 1 : 0,
 					videoUpdatePlan.sourceChanged ? 1 : 0,
 					videoUpdatePlan.sourceChanged ? 1 : 0,
+					videoUpdatePlan.sourceChanged ? 1 : 0,
 					id,
 					options.expectedMediaSource ? 1 : 0,
 					options.expectedMediaSource?.sourceUrl ?? null,
@@ -1362,6 +1375,8 @@ export async function updateContentItem(
 		    audio_r2_key = ?,
 		    duration_seconds = ?,
 		    processing_trigger_token = ?,
+		    processing_publication_guard = CASE WHEN ? IS processing_trigger_token THEN processing_publication_guard ELSE NULL END,
+		    processing_state = CASE WHEN ? IS processing_trigger_token THEN processing_state ELSE NULL END,
 		    processing_source_url = ?,
 		    processing_source_kind = ?
 		  WHERE content_id = ?
@@ -1373,6 +1388,8 @@ export async function updateContentItem(
 					podcastUpdatePlan.audioR2Key,
 					podcastUpdatePlan.durationSeconds,
 					podcastUpdatePlan.processingTriggerToken,
+					podcastUpdatePlan.processingTriggerToken,
+					podcastUpdatePlan.processingTriggerToken,
 					podcastUpdatePlan.sourceUrl,
 					podcastUpdatePlan.sourceKind,
 					id,
@@ -1399,16 +1416,19 @@ export async function scheduleContent(
 ): Promise<void> {
 	await db
 		.prepare(
-			`UPDATE content_items SET status = 'scheduled', publish_at = ?, publish_tz = ?, updated_at = unixepoch() WHERE id = ?`,
+			`UPDATE content_items SET status = 'scheduled', publish_at = ?, publish_tz = ?,
+			 canonical_version = canonical_version + CASE WHEN status = 'published' OR fronts_publish_status = 'live' THEN 1 ELSE 0 END,
+			 fronts_publish_status = CASE WHEN status = 'published' OR fronts_publish_status = 'live'
+			   THEN 'queued' ELSE fronts_publish_status END,
+			 fronts_publish_trigger_token = CASE WHEN status = 'published' OR fronts_publish_status = 'live'
+			   OR fronts_publish_trigger_token IS NULL THEN ? ELSE fronts_publish_trigger_token END,
+			 updated_at = unixepoch() WHERE id = ?`,
 		)
-		.bind(publishAt, publishTz, id)
+		.bind(publishAt, publishTz, crypto.randomUUID(), id)
 		.run()
-	// Arming an item for the additive Fronts publish path happens HERE — the one
-	// seam through which an item becomes `scheduled` with a `publish_at`. The mint
-	// is compare-and-set and never rotates an existing token, so an item's
-	// `trigger_token_hash` is stable across reschedules and across every poll.
-	// The raw token stays in D1; only `sha256:<hex>` is ever exposed.
-	await armFrontsPublishTriggerToken(db, id)
+	// Slot, terminal-ledger reset and token are one atomic transition. Moving an
+	// already scheduled occurrence preserves its identity; scheduling a completed
+	// publication creates a fresh occurrence without recapturing its media.
 }
 
 export async function evaluateContentBodyForPublish(

package/src/engine/soft-delete.ts

@@ -1,4 +1,21 @@
-import type { D1Database } from './d1.js'
+import type { D1Database, D1PreparedStatement } from './d1.js'
+
+/** V2 metadata-stable captures must not survive an invalidating lifecycle transition. */
+export function invalidateMediaCaptureStatements(
+	db: D1Database,
+	id: string,
+): D1PreparedStatement[] {
+	return [
+		db
+			.prepare(`UPDATE video_content SET processing_trigger_token = NULL, processing_correlation_id = NULL
+			WHERE content_id = ? AND processing_trigger_token LIKE 'fronts-source-v2:%'`)
+			.bind(id),
+		db
+			.prepare(`UPDATE podcast_content SET processing_trigger_token = NULL
+			WHERE content_id = ? AND processing_trigger_token LIKE 'fronts-source-v2:%'`)
+			.bind(id),
+	]
+}
 
 export async function softDeleteContent(
 	db: D1Database,
@@ -6,13 +23,16 @@ export async function softDeleteContent(
 	now?: number,
 ): Promise<boolean> {
 	const ts = now ?? Math.floor(Date.now() / 1000)
-	const res = await db
-		.prepare(
-			'UPDATE content_items SET deleted_at = ?, updated_at = unixepoch(), canonical_version = canonical_version + 1 WHERE id = ? AND deleted_at IS NULL',
-		)
-		.bind(ts, id)
-		.run()
-	return Boolean(res.meta && (res.meta as { changes?: number }).changes)
+	const results = await db.batch([
+		...invalidateMediaCaptureStatements(db, id),
+		db
+			.prepare(
+				'UPDATE content_items SET deleted_at = ?, updated_at = unixepoch(), canonical_version = canonical_version + 1 WHERE id = ? AND deleted_at IS NULL',
+			)
+			.bind(ts, id),
+	])
+	const res = results[2]
+	return Boolean(res?.meta && (res.meta as { changes?: number }).changes)
 }
 
 export async function restoreContent(db: D1Database, id: string): Promise<boolean> {

package/src/engine/video-source.ts

@@ -9,8 +9,10 @@ export interface FrontsVideoSourceSnapshot {
 }
 
 /**
- * Stable over polling, machine media callbacks and rescheduling; canonical
- * editor/source changes invalidate the old production. The raw trigger token
+ * V1 captures retain their original canonical-version binding. New v2 capture
+ * tokens separate media identity from editorial revisions: a title/body edit
+ * or reschedule cannot cancel useful media work. Slug/source/token changes
+ * still change the generation. The raw trigger token
  * and URL never need to appear in callback or notification identities. The
  * Go consumer's contract is `fronts-video-source.v1` (foundry
  * `publishplane/masthead/videosource.schema.json`, exported by
@@ -19,12 +21,13 @@ export interface FrontsVideoSourceSnapshot {
 export async function frontsVideoSourceGeneration(
 	input: FrontsVideoSourceSnapshot,
 ): Promise<string> {
+	const version = input.processing_trigger_token?.startsWith('fronts-source-v2:') ? 2 : 1
 	const bytes = new TextEncoder().encode(
 		JSON.stringify([
-			'fronts-video-source.v1',
+			`fronts-video-source.v${version}`,
 			input.content_id,
 			input.slug,
-			input.canonical_version,
+			...(version === 1 ? [input.canonical_version] : []),
 			input.processing_source_url,
 			input.processing_source_kind,
 			input.processing_trigger_token,

package/src/routes/content.ts

@@ -33,6 +33,10 @@ import {
 	type ProcessingState,
 	verifyHmac,
 } from '../engine/foundry-dispatch.js'
+import {
+	parseFrontsDefaultChannelTargets,
+	setFrontsChannelTargets,
+} from '../engine/fronts-publish-intent.js'
 import { evaluateArticleBody } from '../engine/publish-guard.js'
 import {
 	createContent,
@@ -55,7 +59,7 @@ import {
 	restoreRevision,
 } from '../engine/revisions.js'
 import { applySlugRenameRedirects } from '../engine/slug-redirects.js'
-import { softDeleteContent } from '../engine/soft-delete.js'
+import { invalidateMediaCaptureStatements, softDeleteContent } from '../engine/soft-delete.js'
 import { normalizeSourceSections } from '../engine/source-sections.js'
 import { TagInputError } from '../engine/taxonomy.js'
 import type { ValidationError } from '../engine/validator/index.js'
@@ -190,7 +194,23 @@ export type PublishReadinessHook = (input: {
 	status: string
 }) => Promise<PublishReadinessOutcome>
 
+export type FrontsScheduleMaintenanceOperation =
+	| 'recover-video-sources'
+	| 'reconcile-article-enrichment'
+
+/** Host-owned bounded recovery/repair work invoked by the signed Fronts schedule route. */
+export type FrontsScheduleMaintenanceHook = (input: {
+	ctx: RouteContext
+	operation: FrontsScheduleMaintenanceOperation
+	limit: 3 | 5
+	signal: AbortSignal
+}) => Promise<{ contentIds: string[] }>
+
 export interface ContentRouteConfig extends CmsRouteConfig {
+	/** Host-configured publish destinations; only absent stored targets are armed. No global default. */
+	frontsDefaultChannelTargets?: readonly string[]
+	/** Optional host-owned bounded recovery/repair hook for the signed schedule POST. */
+	frontsScheduleMaintenance?: FrontsScheduleMaintenanceHook
 	/** Optional Foundry takeaways dispatcher (bead 08). Omit to disable. */
 	dispatchTakeaways?: DispatchTakeawaysHook
 	/** Optional FAQ enrichment dispatcher (P4 Task 7). Omit to disable. */
@@ -369,6 +389,24 @@ const ContentMetadataSchema = z
 	})
 	.transform((metadata) => metadata as ContentMetadata)
 
+// Known Nextcloud share pages are HTML, never ingestable media. The editor
+// must save the direct-download URL so the existing provider validates bytes.
+const MediaSourceUrlSchema = z
+	.string()
+	.url()
+	.refine(
+		(value) => {
+			let url: URL
+			try {
+				url = new URL(value)
+			} catch {
+				return false
+			}
+			return !(url.hostname === 'drive.fulcrum-portal.com' && /^\/s\/[^/]+\/?$/.test(url.pathname))
+		},
+		{ message: 'Use the Nextcloud direct-download URL ending in /download, not its share page.' },
+	)
+
 function buildSchemas(resolved: ReturnType<typeof resolveConfig>) {
 	const category = slugEnum(resolved.primaryCategorySlugs)
 	const topic = slugEnum(resolved.primaryTopicSlugs)
@@ -410,7 +448,7 @@ function buildSchemas(resolved: ReturnType<typeof resolveConfig>) {
 				videoId: z.string().min(1),
 				durationSeconds: z.number().int().positive().optional().nullable(),
 				thumbnailImageId: z.string().optional().nullable(),
-				processingSourceUrl: z.string().url().optional().nullable(),
+				processingSourceUrl: MediaSourceUrlSchema.optional().nullable(),
 				processingSourceKind: z.string().min(1).optional().nullable(),
 			}),
 		}),
@@ -430,7 +468,7 @@ function buildSchemas(resolved: ReturnType<typeof resolveConfig>) {
 				// there because a video always has a slug-derived identity up front.
 				audioR2Key: z.string().default(''),
 				durationSeconds: z.number().int().positive().optional().nullable(),
-				processingSourceUrl: z.string().url().optional().nullable(),
+				processingSourceUrl: MediaSourceUrlSchema.optional().nullable(),
 				processingSourceKind: z.string().min(1).optional().nullable(),
 			}),
 		}),
@@ -495,7 +533,7 @@ const VideoContentUpdateSchema = z.object({
 	videoId: z.string().optional(),
 	durationSeconds: z.number().int().positive().optional().nullable(),
 	thumbnailImageId: z.string().optional().nullable(),
-	processingSourceUrl: z.string().url().optional().nullable(),
+	processingSourceUrl: MediaSourceUrlSchema.optional().nullable(),
 	processingSourceKind: z.string().min(1).optional().nullable(),
 })
 
@@ -503,7 +541,7 @@ const PodcastContentUpdateSchema = z.object({
 	transcript: z.string().optional(),
 	audioR2Key: z.string().optional(),
 	durationSeconds: z.number().int().positive().optional().nullable(),
-	processingSourceUrl: z.string().url().optional().nullable(),
+	processingSourceUrl: MediaSourceUrlSchema.optional().nullable(),
 	processingSourceKind: z.string().min(1).optional().nullable(),
 })
 
@@ -836,6 +874,17 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 	const dispatchWebhook = config.dispatchWebhook
 	const publishReadiness = config.publishReadiness
 	const activeWorkspaceId = config.activeWorkspaceId ?? 'default'
+	const targetDefaults =
+		config.frontsDefaultChannelTargets === undefined
+			? null
+			: parseFrontsDefaultChannelTargets(config.frontsDefaultChannelTargets)
+	const defaultTargetsError = () =>
+		targetDefaults && 'error' in targetDefaults ? json({ error: targetDefaults.error }, 500) : null
+	async function armDefaultTargets(ctx: RouteContext, contentId: string): Promise<void> {
+		if (targetDefaults && 'targets' in targetDefaults) {
+			await setFrontsChannelTargets(ctx.db, contentId, targetDefaults.targets, { onlyIfNull: true })
+		}
+	}
 
 	async function loadStoredMediaSource(
 		db: D1Database,
@@ -1305,6 +1354,8 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			}
 
 			if (op === 'schedule') {
+				const configError = defaultTargetsError()
+				if (configError) return configError
 				const { publishAt } = parsed.data
 				const publishAtMs = Date.parse(publishAt)
 				if (!Number.isFinite(publishAtMs)) {
@@ -1313,6 +1364,7 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				const publishAtSeconds = Math.floor(publishAtMs / 1000)
 				for (const id of ids) {
 					await scheduleContent(ctx.db, id, publishAtSeconds)
+					await armDefaultTargets(ctx, id)
 				}
 				return json({ scheduled: ids })
 			}
@@ -1329,6 +1381,8 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			const ownAuthor = actor?.subject ?? ctx.userId ?? null
 			const denied = await requireContentAction(ctx, 'write', ownAuthor)
 			if (denied) return denied
+			const configError = defaultTargetsError()
+			if (configError) return configError
 
 			const parsed = CreateSchema.safeParse(await readJson(ctx))
 			if (!parsed.success) {
@@ -1360,6 +1414,7 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				if (conflict) return conflict
 				throw error
 			}
+			await armDefaultTargets(ctx, created.id)
 			const podcastAttempt: PodcastFoundryAttempt =
 				parsed.data.type === 'podcast'
 					? await dispatchPodcastAfterSave(ctx, created.id)
@@ -1484,6 +1539,8 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			if (config.updateStatusConstraint && existing.status !== config.updateStatusConstraint) {
 				return json({ error: 'update_status_conflict', state: existing.status }, 409)
 			}
+			const configError = defaultTargetsError()
+			if (configError) return configError
 
 			const parsed = UpdateSchema.safeParse(await readJson(ctx))
 			if (!parsed.success) {
@@ -1607,6 +1664,7 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			if (updated.mediaSourceConflict) {
 				return json({ error: 'media_source_conflict' }, 409)
 			}
+			await armDefaultTargets(ctx, id)
 			const podcastAttempt: PodcastFoundryAttempt =
 				existing.type === 'podcast'
 					? await dispatchPodcastAfterSave(ctx, id)
@@ -1649,6 +1707,8 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			if (denied) return denied
 
 			if (action === 'schedule') {
+				const configError = defaultTargetsError()
+				if (configError) return configError
 				const parsed = ScheduleSchema.safeParse(await readJson(ctx))
 				if (!parsed.success) {
 					return json({ error: 'Invalid request', details: parsed.error.flatten() }, 400)
@@ -1680,6 +1740,7 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				}
 
 				await scheduleContent(ctx.db, id, publishAtSeconds as number, publishTimeZone)
+				await armDefaultTargets(ctx, id)
 
 				// Fire content.scheduled webhook.
 				await fireWebhook(ctx, 'content.scheduled', {
@@ -1895,12 +1956,14 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			}
 
 			if (action === 'archive') {
-				await ctx.db
-					.prepare(
-						"UPDATE content_items SET status = 'archived', updated_at = unixepoch(), canonical_version = canonical_version + 1 WHERE id = ? AND status <> 'archived'",
-					)
-					.bind(id)
-					.run()
+				await ctx.db.batch([
+					...invalidateMediaCaptureStatements(ctx.db, id),
+					ctx.db
+						.prepare(
+							"UPDATE content_items SET status = 'archived', updated_at = unixepoch(), canonical_version = canonical_version + 1 WHERE id = ? AND status <> 'archived'",
+						)
+						.bind(id),
+				])
 
 				// Fire content.deleted (archive = soft delete lifecycle) webhook.
 				await fireWebhook(ctx, 'content.deleted', {
@@ -2005,36 +2068,16 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				if (!resolved.hooks.foundryVideo) {
 					return json({ error: 'Foundry video dispatch is not configured' }, 501)
 				}
-				if (existing.type === 'podcast') {
-					const row = await ctx.db
-						.prepare(
-							`SELECT processing_trigger_token
-							FROM podcast_content
-							WHERE content_id = ?
-							LIMIT 1`,
-						)
-						.bind(id)
-						.first<{ processing_trigger_token: string | null }>()
-					const existingToken = row?.processing_trigger_token?.trim() ?? ''
-					if (existingToken) {
-						return json(
-							{
-								status: 'queued',
-								correlationId: null,
-								triggerToken: existingToken,
-								skipped: true,
-							},
-							202,
-						)
-					}
-				}
 				try {
-					const result = await dispatchToFoundry(ctx.db, id, resolved.hooks.foundryVideo)
+					const result = await dispatchToFoundry(ctx.db, id, resolved.hooks.foundryVideo, {
+						ifUncaptured: url.searchParams.get('capture') === '1',
+					})
 					return json(
 						{
 							status: 'queued',
 							correlationId: result.correlationId,
 							triggerToken: result.triggerToken,
+							...(result.skipped ? { skipped: true } : {}),
 						},
 						202,
 					)

package/src/routes/context.ts

@@ -119,6 +119,12 @@ export interface Authz {
 export interface RouteContext {
 	/** The inbound request (standard Fetch `Request`). */
 	request: Request
+	/**
+	 * Host-supplied execution-lifetime bridge. Maintenance-capable adapters
+	 * provide this so abort cleanup can settle after the HTTP response; adapters
+	 * must bind methods that depend on their original receiver.
+	 */
+	waitUntil?: (promise: Promise<unknown>) => void
 	/** Route params (e.g. `{ id }` for `/content/[id]`). */
 	params: Record<string, string | undefined>
 	/** The site's D1 binding. */