@growth-labs/cms 0.8.28 → 0.8.32

package/src/engine/publisher.ts

@@ -1665,13 +1665,58 @@ END`
  * the second disjunct keeps unpublish→republish correct, since `unpublishContent`
  * clears `published_at` but the article did go live once.
  */
-export const PUBLISH_METADATA_STAMP_SQL = `metadata_json = CASE
+const PUBLISH_METADATA_STAMP_EXPRESSION = `CASE
 	WHEN published_at IS NOT NULL
 		OR json_extract(${METADATA_OBJECT_SQL}, '$.adaptedAt') IS NOT NULL
 	THEN json_set(${METADATA_WITH_ADAPTED_AT_SQL}, '$.updatedAt', date(?, 'unixepoch'))
 	ELSE ${METADATA_WITH_ADAPTED_AT_SQL}
 END`
 
+export const PUBLISH_METADATA_STAMP_SQL = `metadata_json = ${PUBLISH_METADATA_STAMP_EXPRESSION}`
+
+/** Project the same publish stamp onto the immutable snapshot's captured row. */
+export async function publicationMetadataForSnapshot(
+	db: D1Database,
+	item: {
+		id?: unknown
+		published_revision_id?: unknown
+		metadata_json?: unknown
+		published_at?: unknown
+		created_at?: unknown
+	},
+	now: number,
+): Promise<string> {
+	// A draft metadata edit can remove adaptedAt. The previous immutable native
+	// revision retains the actual first publication day; creation time may be
+	// earlier and published_at may be the source video's historical date.
+	let priorAdaptedAt: string | null = null
+	if (typeof item.id === 'string' && typeof item.published_revision_id === 'string') {
+		const prior = await db
+			.prepare(`SELECT
+			json_extract(json_extract(payload_json, '$.item.metadata_json'), '$.adaptedAt') AS adapted_at
+			FROM content_revisions WHERE id = ? AND content_id = ?`)
+			.bind(item.published_revision_id, item.id)
+			.first<{ adapted_at: string | null }>()
+		priorAdaptedAt = prior?.adapted_at ?? null
+	}
+	const projected = await db
+		.prepare(`SELECT ${PUBLISH_METADATA_STAMP_EXPRESSION} AS metadata_json
+	 FROM (SELECT CASE WHEN ? IS NOT NULL THEN json_set(COALESCE(?, '{}'), '$.adaptedAt', ?)
+	 ELSE ? END AS metadata_json, ? AS published_at, ? AS created_at)`)
+		.bind(
+			...publishMetadataStampBinds(now),
+			priorAdaptedAt,
+			item.metadata_json ?? null,
+			priorAdaptedAt,
+			item.metadata_json ?? null,
+			item.published_at ?? null,
+			item.created_at ?? null,
+		)
+		.first<{ metadata_json: string }>()
+	if (!projected) throw new Error('publication metadata projection failed')
+	return projected.metadata_json
+}
+
 /** Placeholder count in {@link PUBLISH_METADATA_STAMP_SQL}, derived so it cannot drift. */
 const PUBLISH_METADATA_STAMP_PLACEHOLDERS = (PUBLISH_METADATA_STAMP_SQL.match(/\?/g) ?? []).length
 

package/src/foundry-emit.ts

@@ -9,6 +9,7 @@
 
 import { sha256Hex } from '@growth-labs/foundry-signing'
 import { z } from 'zod'
+import { ContentMetadataSchema } from './engine/content-metadata.js'
 import type { ContentArchiveItem } from './engine/publication.js'
 import { slugify } from './engine/slug.js'
 
@@ -58,6 +59,7 @@ export const FoundryArticleV2Schema = z
 		tags: z.array(z.string().trim().min(1).max(100)).max(50).optional(),
 		description: z.string().trim().min(1).optional(),
 		visibility: z.enum(['free', 'premium']).optional(),
+		metadata: ContentMetadataSchema.optional(),
 		adoptSourceId: z
 			.string()
 			.min(1)
@@ -147,6 +149,7 @@ export function toFoundryArticleV2(
 		...(item.tags && item.tags.length > 0 ? { tags: [...item.tags] } : {}),
 		...(description ? { description } : {}),
 		...(item.visibility ? { visibility: item.visibility } : {}),
+		...(item.metadata != null ? { metadata: item.metadata } : {}),
 		...(present(item.sourceId) ? { adoptSourceId: item.sourceId } : {}),
 	}
 	return FoundryArticleV2Schema.parse(body)

package/src/routes/content-insights.ts

@@ -6,6 +6,7 @@ import {
 	isMissingInsightPublicationSchema,
 	isMissingInsightsTable,
 	listInsightBoard,
+	readSelectedClusterMembership,
 	replaceInsightsBoard,
 	undismissInsight,
 } from '../engine/content-insights.js'
@@ -312,7 +313,11 @@ export function createContentInsightsRoutes(
 			} catch (error) {
 				if (isMissingInsightPublicationSchema(error))
 					return json({ error: 'schema_not_ready' }, 409)
-				if (error instanceof InsightPublicationError) return json({ error: error.code }, 409)
+				if (error instanceof InsightPublicationError)
+					return json(
+						{ error: error.code },
+						error.code === 'selected_membership_replacement_refused' ? 422 : 409,
+					)
 				throw error
 			}
 		},
@@ -321,7 +326,13 @@ export function createContentInsightsRoutes(
 		// family as fronts/schedule (timestamp-bound signature over the query
 		// string; a GET has no body to bind freshness to instead).
 		async insightsInputs(ctx) {
-			const hmacSecret = await resolveFoundryHmacSecretForInputs(ctx.env)
+			// Channel publications use the existing shared CMS binding. An explicit
+			// legacy binding retains precedence, including loud failure if unreadable.
+			const binding =
+				ctx.env?.FOUNDRY_HMAC_SECRET === undefined
+					? 'CMS_FOUNDRY_HMAC_SECRET'
+					: 'FOUNDRY_HMAC_SECRET'
+			const hmacSecret = await resolveFoundryHmacSecretForInputs(ctx.env, binding)
 			if (!hmacSecret) return json({ error: 'FOUNDRY_HMAC_SECRET is not configured' }, 500)
 
 			const url = new URL(ctx.request.url)
@@ -344,11 +355,38 @@ export function createContentInsightsRoutes(
 				title: string
 				slug: string
 			}>()
+			let selected: Awaited<ReturnType<typeof readSelectedClusterMembership>> | null = null
+			// Membership cannot ride the historical requested-site echo: it is
+			// returned only for this configured publication's signed request.
+			if (siteId !== 'default' && requestedSite === siteId) {
+				try {
+					selected = await readSelectedClusterMembership(ctx.db, siteId)
+				} catch (error) {
+					if (
+						!(error instanceof Error && error.message.startsWith('cluster_membership_unknown:')) &&
+						!isMissingInsightsTable(error)
+					)
+						throw error
+				}
+			}
 			return json({
 				ok: true,
 				site: requestedSite ?? siteId,
 				authors: authorsResult.results ?? [],
 				existing: existingResult.results ?? [],
+				cluster_membership: selected ? 'selected' : 'unknown',
+				cluster_selections:
+					selected?.map((membership) => ({
+						site_id: membership.site_id,
+						intent_key: membership.intent_key,
+						desk: membership.desk,
+						decision_ref: membership.decision_ref,
+						taxonomy_ref: membership.taxonomy_ref,
+						hub_content_id: membership.hub.content_id,
+						hub_revision_id: membership.hub.revision_id,
+						child_content_ids: membership.children.map((page) => page.content_id),
+						child_revision_ids: membership.children.map((page) => page.revision_id),
+					})) ?? null,
 			})
 		},
 	}

package/src/routes/content.ts

@@ -18,11 +18,7 @@ import { z } from 'zod'
 import { logActivity } from '../engine/activity-log.js'
 import { generateContentDek } from '../engine/ai-dek.js'
 import { createDekFailureNotifications } from '../engine/ai-dek-notifications.js'
-import {
-	type ContentMetadata,
-	ContentMetadataError,
-	serializeContentMetadata,
-} from '../engine/content-metadata.js'
+import { ContentMetadataSchema } from '../engine/content-metadata.js'
 import { listContributors, setContributors } from '../engine/contributors.js'
 import type { D1Database } from '../engine/d1.js'
 import {
@@ -410,21 +406,6 @@ const BodyContentCreateSchema = z.object({
 	editorTakeaways: z.array(z.string().min(1)).max(4).optional().nullable(),
 })
 
-const ContentMetadataSchema = z
-	.record(z.string(), z.unknown())
-	.superRefine((metadata, ctx) => {
-		try {
-			serializeContentMetadata(metadata as ContentMetadata)
-		} catch (error) {
-			ctx.addIssue({
-				code: 'custom',
-				message:
-					error instanceof ContentMetadataError ? error.message : 'content metadata is invalid',
-			})
-		}
-	})
-	.transform((metadata) => metadata as ContentMetadata)
-
 // A Nextcloud share PAGE is HTML, never ingestable media, so the stored source
 // must be the direct-download URL. Editors paste the share link -- that is what
 // Nextcloud's "Copy link" button yields -- so normalise it here instead of

package/src/routes/foundry-publish.ts

@@ -671,6 +671,7 @@ async function putV2(
 		...(body.desk !== undefined ? { primaryCategory: body.desk } : {}),
 		...(body.tags !== undefined ? { tags: body.tags } : {}),
 		...(body.visibility !== undefined ? { visibility: body.visibility } : {}),
+		...(body.metadata !== undefined ? { metadata: body.metadata } : {}),
 		content: { bodyMarkdown: body.body_html, bodyHtml: body.body_html },
 	}
 

package/src/routes/fronts-publish.ts

@@ -60,8 +60,9 @@ import { json, type RouteContext } from './context.js'
 // family rather than inventing a second one.
 export async function resolveFoundryHmacSecret(
 	env: Record<string, unknown> | undefined,
+	binding: 'FOUNDRY_HMAC_SECRET' | 'CMS_FOUNDRY_HMAC_SECRET' = 'FOUNDRY_HMAC_SECRET',
 ): Promise<string | null> {
-	const raw = env?.FOUNDRY_HMAC_SECRET
+	const raw = env?.[binding]
 	if (typeof raw === 'string') return raw || null
 	if (raw && typeof (raw as { get?: unknown }).get === 'function') {
 		try {

package/src/schema/insights-ingest.ts

@@ -115,12 +115,42 @@ export const InsightCompetitorArticleSchema = z.object({
 	covered: z.boolean().optional(),
 })
 
+const PublishedClusterPageSchema = z
+	.object({
+		content_id: z.string().min(1),
+		revision_id: z.string().min(1),
+		url: z.string().url(),
+		title: z.string().min(1),
+	})
+	.strict()
+
+export const InsightSelectedClusterMembershipSchema = z
+	.object({
+		site_id: z.string().min(1),
+		run_id: z.string().min(1),
+		intent_key: z.string().min(1),
+		desk: z.string().min(1),
+		decision_ref: z.string().min(1),
+		taxonomy_ref: z.string().min(1),
+		hub: PublishedClusterPageSchema,
+		children: z.array(PublishedClusterPageSchema).min(4),
+	})
+	.strict()
+	.refine((membership) => {
+		const members = [membership.hub, ...membership.children]
+		return (
+			new Set(members.map((page) => page.content_id)).size === members.length &&
+			new Set(members.map((page) => page.url)).size === members.length
+		)
+	}, 'selected hub and children must be distinct published pages')
+
 export const InsightBriefSchema = z.object({
 	why_now: z.string().min(1),
 	angle: z.string().min(1),
 	cluster: z.object({
 		canonical: z.string().min(1),
 		spokes: z.array(z.string().min(1)),
+		selected: InsightSelectedClusterMembershipSchema.optional(),
 	}),
 	sources: z.array(
 		z.object({
@@ -200,6 +230,21 @@ export const InsightsIngestPayloadSchema = z
 	// replace DELETE by meta.site_id + meta.run_date — never run_date alone).
 	.superRefine((payload, ctx) => {
 		for (const [i, row] of payload.rows.entries()) {
+			const selected = row.brief.cluster.selected
+			if (
+				selected &&
+				(selected.site_id !== row.site_id ||
+					selected.run_id !== payload.meta.run_id ||
+					selected.intent_key !== row.intent_key ||
+					selected.desk !== row.desk)
+			) {
+				ctx.addIssue({
+					code: z.ZodIssueCode.custom,
+					path: ['rows', i, 'brief', 'cluster', 'selected'],
+					message:
+						'selected membership must bind the same site, run, desk and intent as its signed row',
+				})
+			}
 			if (row.site_id !== payload.meta.site_id || row.run_date !== payload.meta.run_date) {
 				ctx.addIssue({
 					code: z.ZodIssueCode.custom,

package/src/schema/types.ts

@@ -611,6 +611,16 @@ export interface InsightBrief {
 	cluster: {
 		canonical: string
 		spokes: string[]
+		selected?: {
+			site_id: string
+			run_id: string
+			intent_key: string
+			desk: string
+			decision_ref: string
+			taxonomy_ref: string
+			hub: { content_id: string; revision_id: string; url: string; title: string }
+			children: Array<{ content_id: string; revision_id: string; url: string; title: string }>
+		}
 	}
 	sources: Array<{ title: string; url: string }>
 	format?: 'cornerstone' | 'pillar' | 'standalone'

package/src/ui/api/content/insights-ingest.ts

@@ -2,19 +2,26 @@
 // POST /admin/api/content/insights-ingest — machine ingest (replay-safe replace).
 // HMAC-SHA256 (X-Foundry-Signature vs env.INSIGHTS_INGEST_HMAC_SECRET) only —
 // NOT behind requirePublisher. Sibling of foundry-callback under /content/.
+import { env as cloudflareEnv } from 'cloudflare:workers'
+import { config } from 'virtual:growth-labs/cms/config'
 import type { APIContext } from 'astro'
 import { createContentInsightsRoutes } from '../../../routes/content-insights.js'
 import type { RouteContext } from '../../../routes/context.js'
 import { buildSiteAuthz } from '../_authz.js'
+import { toContentConfig } from '../_content-config.js'
 
 function toCtx(c: APIContext): RouteContext {
-	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	const env = cloudflareEnv as Record<string, unknown>
 	return { request: c.request, params: {}, db: env.SITE_DB as RouteContext['db'], env }
 }
 
 function siteId(c: APIContext): string {
-	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
-	return (env.ACTIVE_WORKSPACE_ID as string | undefined) ?? 'default'
+	const env = cloudflareEnv as Record<string, unknown>
+	return (
+		toContentConfig(c).activeWorkspaceId ??
+		(env.ACTIVE_WORKSPACE_ID as string | undefined) ??
+		(config.workspaces?.length === 1 ? config.workspaces[0]!.id : 'default')
+	)
 }
 
 export const POST = (c: APIContext) =>

package/src/ui/api/content/insights-inputs.ts

@@ -5,6 +5,7 @@
 // foundryd's sitebrain.insights.run schedule (W1-07 PR 6). NOT behind
 // requirePublisher. Sibling of insights-ingest under /content/.
 
+import { env as cloudflareEnv } from 'cloudflare:workers'
 import { config } from 'virtual:growth-labs/cms/config'
 import type { APIContext } from 'astro'
 import { createContentInsightsRoutes } from '../../../routes/content-insights.js'
@@ -13,12 +14,12 @@ import { buildSiteAuthz } from '../_authz.js'
 import { toContentConfig } from '../_content-config.js'
 
 function toCtx(c: APIContext): RouteContext {
-	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	const env = cloudflareEnv as Record<string, unknown>
 	return { request: c.request, params: {}, db: env.SITE_DB as RouteContext['db'], env }
 }
 
 function siteId(c: APIContext): string {
-	const env = (c.locals as { cmsEnv?: Record<string, unknown> }).cmsEnv ?? {}
+	const env = cloudflareEnv as Record<string, unknown>
 	return (
 		toContentConfig(c).activeWorkspaceId ??
 		(env.ACTIVE_WORKSPACE_ID as string | undefined) ??