@growth-labs/cms 0.8.8 → 0.8.15

package/src/engine/fronts-publish.ts

@@ -41,7 +41,7 @@ import {
 	PublicationCurrentSnapshotError,
 	snapshotRecord,
 } from './publication-current-guard.js'
-import { getContentSnapshot } from './publisher.js'
+import { getContentSnapshot, PublishContentValidationError } from './publisher.js'
 import { getRevision } from './revisions.js'
 
 /** The five lifecycle states foundryd reports for a Fronts publish intent. */
@@ -297,6 +297,10 @@ export async function applyFrontsPublishCallback(
 	let published = item.status === 'published'
 	let attemptId: string | null = null
 	let ledgerError: string | null = null
+	// A body that fails pre-publish validation will fail again on every retry
+	// until an editor changes it. Recording that distinctly lets the marker say
+	// `failed` instead of leaving the intent to be re-admitted forever.
+	let publishRejectedDeterministically = false
 	let committedDekFailureReason: FrontsPublishCallbackResult['dekFailureReason'] = null
 	let committedPublishedItem: FrontsPublishCallbackResult['publishedItem'] = null
 	const shouldPublish = input.status === 'live' && hasReceipt(input.receipt)
@@ -561,7 +565,19 @@ export async function applyFrontsPublishCallback(
 						'Scheduled content or media changed before publication.',
 					)
 				}
-				ledgerError = error instanceof Error ? error.message : String(error)
+				publishRejectedDeterministically = error instanceof PublishContentValidationError
+				// `error.message` is the same generic sentence for every body
+				// rejection ("Article body failed pre-publish validation"), which
+				// tells an operator that something is wrong but never what. The
+				// guard already computed the violated codes; carrying its summary
+				// onto the event row is the difference between reading the answer
+				// and re-running the validator by hand against the stored body.
+				ledgerError =
+					error instanceof PublishContentValidationError
+						? error.summary
+						: error instanceof Error
+							? error.message
+							: String(error)
 			}
 		}
 	}
@@ -578,13 +594,20 @@ export async function applyFrontsPublishCallback(
 		)
 		.bind(input.contentId, input.version ?? null, input.version ?? null)
 		.first<{ latest: number | null }>()
+	// A `live` whose publication was refused for a reason no retry can change
+	// records `failed`, not `live`: the editor has to act, and `failed` is what
+	// makes that visible in Masthead and to foundryd's late evaluator.
+	const markerStatus: FrontsPublishStatus =
+		publishRejectedDeterministically && input.status === 'live' ? 'failed' : input.status
 	if (
+		publishRejectedDeterministically ||
 		shouldApplyFrontsMarker(
 			item.status,
 			item.fronts_publish_status,
 			input.status,
 			incomingOccurredAt,
 			latestSeenRow?.latest ?? null,
+			published,
 		)
 	) {
 		const marker = await db
@@ -593,7 +616,7 @@ export async function applyFrontsPublishCallback(
 				WHERE id = ? AND canonical_version = ? AND status = ? AND publish_at IS ? AND deleted_at IS NULL`,
 			)
 			.bind(
-				input.status,
+				markerStatus,
 				input.contentId,
 				item.canonical_version,
 				published ? 'published' : item.status,
@@ -752,8 +775,23 @@ async function readStoredOutcome(
 
 /**
  * Whether an incoming callback may overwrite `content_items.fronts_publish_status`.
- * `live` is the authoritative terminal-success marker (always reflected, never
- * downgraded); older-by-occurred_at callbacks may not regress a newer marker.
+ * `live` is the authoritative terminal-success marker (never downgraded once
+ * earned); older-by-occurred_at callbacks may not regress a newer marker.
+ *
+ * `live` is only EARNED by a committed publication. A `live` callback whose
+ * publish did not commit -- `publishOne` threw and left `ledgerError` set, or
+ * the callback carried no usable receipt so the publish block never ran --
+ * must not stamp success onto a row that is still `scheduled`. Doing so cost a
+ * missed publish on 2026-09-15 (`can-minilateralism-solve-europes-defense-crisis`):
+ * the marker read `live` while the item had zero revisions and zero publication
+ * attempts, and both foundryd's admission (anything past `queued` is the
+ * executor's) and its unadmitted-late evaluator (`live` means done) then treated
+ * the item as finished, so it was never retried and never paged.
+ *
+ * Leaving the marker alone is what keeps the item recoverable: it stays
+ * `queued`/`publishing`, so the next reconciler tick re-admits it and the late
+ * evaluator still sees an unfinished intent. The failure itself is not lost --
+ * it is recorded on the `fronts_publish_events` row with its `ledgerError`.
  */
 function shouldApplyFrontsMarker(
 	itemStatus: string,
@@ -761,8 +799,9 @@ function shouldApplyFrontsMarker(
 	incomingStatus: FrontsPublishStatus,
 	incomingOccurredAt: number | null,
 	latestSeenOccurredAt: number | null,
+	published: boolean,
 ): boolean {
-	if (incomingStatus === 'live') return true
+	if (incomingStatus === 'live') return published
 	if (itemStatus === 'published' || currentMarker === 'live') return false
 	if (
 		incomingOccurredAt !== null &&

package/src/engine/google-drive-source.ts

@@ -0,0 +1,99 @@
+// Google Drive share-link recognition for media sources.
+//
+// A Drive share link is an HTML viewer page, never media. The Go media plane
+// fetches a Drive file itself (with the estate's Google identity) and measures
+// its duration, so the CMS only has to recognise the link and hand over the
+// file id (and the resource key that older shared files require).
+//
+// The link stays in the editor's own column exactly as pasted: the
+// `processing_source_kind` column is CHECK-constrained to 'https', so Drive-ness
+// is DERIVED from the stored URL, here, at serve/dispatch time -- one function,
+// no second source of truth to drift.
+
+/** Google Drive file ids are URL-safe base64-ish; the Go side enforces the same. */
+const DRIVE_FILE_ID_RE = /^[A-Za-z0-9_-]{10,200}$/
+const DRIVE_RESOURCE_KEY_RE = /^[A-Za-z0-9_-]{1,200}$/
+
+const DRIVE_HOSTS = new Set(['drive.google.com', 'docs.google.com'])
+
+const NOT_A_FILE_REASON =
+	'That is a Google Doc/Sheet/Slides/folder link, not an audio file. Share the audio file itself from Google Drive.'
+const NO_FILE_ID_REASON =
+	'That Google Drive link has no valid file id. Copy the share link of the audio file itself from Google Drive.'
+
+export type GoogleDriveLink =
+	| { kind: 'drive'; fileId: string; resourceKey?: string }
+	| { kind: 'drive_invalid'; reason: string }
+	| { kind: 'not_drive' }
+
+/**
+ * Classify a pasted media-source URL.
+ *
+ * - `not_drive`: not on a Google Drive host (drive.google.com, docs.google.com,
+ *   host compared case-insensitively). The caller handles it as any other URL.
+ * - `drive`: a recognised file link carrying a valid file id.
+ * - `drive_invalid`: on a Drive host but not usable as an audio file -- a
+ *   Doc/Sheet/folder, a file link with no or a malformed id, a malformed
+ *   `resourcekey`, or a shape this function does not know. The caller must
+ *   refuse it: stored as a plain https URL it would be an HTML page.
+ *
+ * Recognised shapes (each optionally with `/u/<n>/` user segments):
+ *   /file/d/<id>[/view|/edit|/...]      /open?id=<id>
+ *   /uc?id=<id>[&export=download]       (docs.google.com/uc?id=<id> too)
+ */
+export function classifyGoogleDriveUrl(value: string): GoogleDriveLink {
+	let url: URL
+	try {
+		url = new URL(value.trim())
+	} catch {
+		return { kind: 'not_drive' }
+	}
+	if (url.protocol !== 'https:' && url.protocol !== 'http:') return { kind: 'not_drive' }
+	const host = url.hostname.toLowerCase().replace(/\.$/, '')
+	if (!DRIVE_HOSTS.has(host)) return { kind: 'not_drive' }
+
+	if (url.protocol !== 'https:') {
+		return { kind: 'drive_invalid', reason: 'Google Drive links must use https.' }
+	}
+	if (url.username || url.password || (url.port && url.port !== '443')) {
+		return { kind: 'drive_invalid', reason: 'That Google Drive link is malformed.' }
+	}
+
+	// `/u/<n>/` selects the signed-in Google account; it carries nothing else.
+	const path = url.pathname.replace(/\/u\/\d+(?=\/)/g, '').replace(/\/+$/, '')
+
+	if (
+		/^\/(?:document|spreadsheets|presentation|forms)\/d(?:\/|$)/.test(path) ||
+		/^\/(?:drive\/)?folders(?:\/|$)/.test(path) ||
+		/^\/(?:embedded)?folderview$/.test(path)
+	) {
+		return { kind: 'drive_invalid', reason: NOT_A_FILE_REASON }
+	}
+
+	let candidate: string | null = null
+	const filePath = /^\/file\/d(?:\/([^/]*))?(?:\/.*)?$/.exec(path)
+	if (filePath) {
+		candidate = filePath[1] ?? ''
+	} else if (path === '/uc' || (path === '/open' && host === 'drive.google.com')) {
+		candidate = url.searchParams.get('id') ?? ''
+	} else {
+		return {
+			kind: 'drive_invalid',
+			reason:
+				'That Google Drive link is not a file link. Copy the share link of the audio file itself from Google Drive.',
+		}
+	}
+	if (!DRIVE_FILE_ID_RE.test(candidate)) {
+		return { kind: 'drive_invalid', reason: NO_FILE_ID_REASON }
+	}
+
+	const resourceKey = url.searchParams.get('resourcekey')
+	if (resourceKey === null) return { kind: 'drive', fileId: candidate }
+	if (!DRIVE_RESOURCE_KEY_RE.test(resourceKey)) {
+		return {
+			kind: 'drive_invalid',
+			reason: 'That Google Drive link has a malformed resource key. Copy the share link again.',
+		}
+	}
+	return { kind: 'drive', fileId: candidate, resourceKey }
+}

package/src/engine/index.ts

@@ -111,6 +111,7 @@ export {
 	hydrateFrontsPublishIntents,
 	setFrontsChannelTargets,
 } from './fronts-publish-intent.js'
+export { classifyGoogleDriveUrl, type GoogleDriveLink } from './google-drive-source.js'
 // Import parsers — pure string→struct transforms for Markdown/Ghost/Substack.
 export {
 	htmlToMarkdown,

package/src/engine/publisher.ts

@@ -799,7 +799,7 @@ export async function updateContentItem(
 		const current = await db
 			.prepare(
 				`SELECT script, video_id, duration_seconds, thumbnail_image_id,
-					processing_source_url, processing_source_kind
+					processing_source_url, processing_source_kind, processing_trigger_token
 				 FROM video_content
 				 WHERE content_id = ?
 				 LIMIT 1`,
@@ -812,6 +812,7 @@ export async function updateContentItem(
 				thumbnail_image_id: string | null
 				processing_source_url: string | null
 				processing_source_kind: string | null
+				processing_trigger_token: string | null
 			}>()
 
 		if (current) {
@@ -836,14 +837,26 @@ export async function updateContentItem(
 						sourceUrl,
 						durationProvided ? videoContent.durationSeconds : undefined,
 					)
+			const mediaChanged =
+				sourceChanged ||
+				resolvedDuration !== current.duration_seconds ||
+				(input.slug !== undefined && input.slug !== existing.slug) ||
+				(input.visibility !== undefined && input.visibility !== existing.visibility)
+			const requestedVideoId = hasOwn(videoContent, 'videoId')
+				? (videoContent.videoId ?? current.video_id)
+				: current.video_id
+			// A captured source pins its media identity. The editor form re-derives
+			// videoId from the title on every save of a new video, so a title edit
+			// alone used to reset the capture; nothing re-captured it, and the video
+			// stayed scheduled but was never prepared (Fronts, 2026-09-15..17).
+			const videoId =
+				current.processing_trigger_token && !mediaChanged ? current.video_id : requestedVideoId
 
 			videoUpdatePlan = {
 				script: hasOwn(videoContent, 'script')
 					? (videoContent.script ?? current.script)
 					: current.script,
-				videoId: hasOwn(videoContent, 'videoId')
-					? (videoContent.videoId ?? current.video_id)
-					: current.video_id,
+				videoId,
 				durationSeconds:
 					durationProvided || sourceChanged
 						? resolvedDuration
@@ -853,12 +866,7 @@ export async function updateContentItem(
 					: current.thumbnail_image_id,
 				sourceUrl,
 				sourceKind,
-				sourceChanged:
-					sourceChanged ||
-					resolvedDuration !== current.duration_seconds ||
-					(input.slug !== undefined && input.slug !== existing.slug) ||
-					(input.visibility !== undefined && input.visibility !== existing.visibility) ||
-					(hasOwn(videoContent, 'videoId') && videoContent.videoId !== current.video_id),
+				sourceChanged: mediaChanged || videoId !== current.video_id,
 			}
 		} else {
 			videoUpdatePlan = null
@@ -1458,6 +1466,7 @@ export async function evaluateContentBodyForPublish(
 	db: D1Database,
 	id: string,
 	source: string,
+	options?: { requireBody?: boolean },
 ): Promise<PublishGuardOutcome | null> {
 	const row = await db
 		.prepare(
@@ -1489,7 +1498,11 @@ export async function evaluateContentBodyForPublish(
 		{
 			source,
 			contentId: id,
-			requireBody: true,
+			// Absence and corruption are different failures. Publishing requires
+			// a body; SCHEDULING does not -- an editor may legitimately claim a
+			// slot before the piece is finished -- but neither may carry a body
+			// that is already broken.
+			requireBody: options?.requireBody ?? true,
 			// #329: source-section defects block at publish, warn on save.
 			blockSourceSectionDefects: true,
 		},

package/src/migration-vendor.ts

@@ -119,26 +119,149 @@ function sequencePrefix(sequence: number): string {
 	return String(sequence).padStart(4, '0')
 }
 
+function targetSequence(target: string): number {
+	return Number.parseInt(target.slice(0, 4), 10)
+}
+
+function managedSuffix(source: string): string {
+	return `_growth_labs_cms_${source.replace(/^\d{4}_/, '')}`
+}
+
+/**
+ * Sequences already spoken for in the consumer's migrations directory.
+ *
+ * Wrangler accepts one `migrations_dir`, so a consumer's own analytics, SEO or
+ * product migrations are interleaved with the vendored package ones. Those
+ * numbers are not ours to take.
+ */
+async function occupiedSequences(migrationsDir: string): Promise<Set<number>> {
+	const names = await readdir(migrationsDir)
+	const taken = new Set<number>()
+	for (const name of names) {
+		if (!name.endsWith('.sql')) continue
+		const sequence = targetSequence(name)
+		if (Number.isSafeInteger(sequence)) taken.add(sequence)
+	}
+	return taken
+}
+
+interface PlanContext {
+	/** Recorded source -> target, the authority for anything already vendored. */
+	recorded: Map<string, CmsMigrationManifestEntry>
+	/** Existing consumer files, for sequence avoidance and hash adoption. */
+	migrationsDir?: string
+}
+
+/**
+ * Resolve each package migration to the consumer filename it must occupy.
+ *
+ * The hard invariant: a migration this consumer has ALREADY vendored keeps its
+ * exact filename forever. D1's `d1_migrations` ledger keys off that name, so
+ * renumbering an applied migration would re-run it. Every branch below either
+ * reuses a name or allocates an unused one; none ever rewrites an assigned one.
+ *
+ * Resolution order per source:
+ *   1. recorded in the receipt  -> reuse that target verbatim;
+ *   2. an on-disk file with our managed suffix whose bytes hash identical
+ *      -> adopt it (reconciles migrations vendored by hand before the receipt
+ *      existed, without creating a duplicate that would apply the same SQL
+ *      twice);
+ *   3. otherwise -> the next sequence above everything already assigned or
+ *      occupied, skipping consumer-owned numbers.
+ */
 async function planMigrations(
 	sourceDir: string,
 	startSequence: number,
+	context: PlanContext = { recorded: new Map() },
 ): Promise<PlannedMigration[]> {
 	assertStartSequence(startSequence)
 	const sourceNames = (await readdir(sourceDir)).filter((name) => MIGRATION_FILE.test(name)).sort()
 	if (sourceNames.length === 0) throw new Error('installed CMS package has no migration SQL')
-	if (startSequence + sourceNames.length - 1 > 9999) {
-		throw new Error('reserved CMS migration sequence exceeds 9999')
+
+	const occupied = context.migrationsDir
+		? await occupiedSequences(context.migrationsDir)
+		: new Set<number>()
+	const existingNames = context.migrationsDir ? await readdir(context.migrationsDir) : []
+	const assigned = new Set<number>()
+	let highWater = startSequence - 1
+	for (const sequence of occupied) {
+		if (sequence > highWater) highWater = sequence
 	}
 
-	return Promise.all(
-		sourceNames.map(async (source, index) => {
-			const sequence = startSequence + index
-			const suffix = source.replace(/^\d{4}_/, '')
-			const target = `${sequencePrefix(sequence)}_growth_labs_cms_${suffix}`
-			const bytes = new Uint8Array(await readFile(join(sourceDir, source)))
-			return { source, target, sequence, sha256: await sha256(bytes), bytes }
-		}),
-	)
+	const planned: PlannedMigration[] = []
+	for (const source of sourceNames) {
+		const bytes = new Uint8Array(await readFile(join(sourceDir, source)))
+		const hash = await sha256(bytes)
+		const suffix = managedSuffix(source)
+
+		const recorded = context.recorded.get(source)
+		if (recorded) {
+			const sequence = targetSequence(recorded.target)
+			assigned.add(sequence)
+			if (sequence > highWater) highWater = sequence
+			planned.push({ source, target: recorded.target, sequence, sha256: hash, bytes })
+			continue
+		}
+
+		const adopted = await findAdoptableTarget(
+			context.migrationsDir,
+			existingNames,
+			suffix,
+			hash,
+			assigned,
+		)
+		if (adopted) {
+			const sequence = targetSequence(adopted)
+			assigned.add(sequence)
+			if (sequence > highWater) highWater = sequence
+			planned.push({ source, target: adopted, sequence, sha256: hash, bytes })
+			continue
+		}
+
+		let sequence = Math.max(startSequence, highWater + 1)
+		while (occupied.has(sequence) || assigned.has(sequence)) sequence += 1
+		if (sequence > 9999) throw new Error('reserved CMS migration sequence exceeds 9999')
+		assigned.add(sequence)
+		highWater = sequence
+		planned.push({
+			source,
+			target: `${sequencePrefix(sequence)}${suffix}`,
+			sequence,
+			sha256: hash,
+			bytes,
+		})
+	}
+
+	return planned
+}
+
+/**
+ * An existing consumer file that IS this package migration, byte for byte.
+ *
+ * Content-addressed on purpose: adopting by filename alone would let an
+ * unrelated file with a colliding suffix be claimed as ours.
+ */
+async function findAdoptableTarget(
+	migrationsDir: string | undefined,
+	existingNames: string[],
+	suffix: string,
+	hash: string,
+	assigned: Set<number>,
+): Promise<string | null> {
+	if (!migrationsDir) return null
+	for (const name of existingNames.slice().sort()) {
+		if (!name.endsWith('.sql') || !name.endsWith(`${suffix}`)) continue
+		const sequence = targetSequence(name)
+		if (!Number.isSafeInteger(sequence) || assigned.has(sequence)) continue
+		let existingHash: string
+		try {
+			existingHash = await sha256(new Uint8Array(await readFile(join(migrationsDir, name))))
+		} catch {
+			continue
+		}
+		if (existingHash === hash) return name
+	}
+	return null
 }
 
 function manifestFor(
@@ -218,12 +341,22 @@ function assertManifestCanAdvance(
 	}
 }
 
+/**
+ * A sequence the plan is about to allocate must not already be owned by a
+ * consumer migration. A target that is already on disk -- recorded in the
+ * receipt or adopted by hash -- is a historical fact, not a reservation: it has
+ * usually been applied, D1's ledger keys off its exact filename, and the only
+ * "fix" for a consumer file sharing its number would be a rename that re-runs
+ * applied SQL. So the guard covers new targets only; pre-existing duplicates are
+ * the consumer's to live with and never block vendoring the next migration.
+ */
 async function assertNoSequenceCollisions(
 	migrationsDir: string,
 	plan: PlannedMigration[],
 ): Promise<void> {
 	const existing = await readdir(migrationsDir)
 	for (const migration of plan) {
+		if (existing.includes(migration.target)) continue
 		const prefix = `${sequencePrefix(migration.sequence)}_`
 		const collisions = existing.filter(
 			(name) => name.endsWith('.sql') && name.startsWith(prefix) && name !== migration.target,
@@ -365,9 +498,15 @@ export async function syncCmsMigrations(
 	const manifestPath = await resolveManifestPath(migrationsDir, options.manifestPath)
 	return withManifestLock(manifestPath, async () => {
 		const contract = await packageContract()
-		const plan = await planMigrations(contract.sourceDir, options.startSequence)
-		const nextManifest = manifestFor(contract.packageVersion, options.startSequence, plan)
 		const currentManifest = await readManifest(manifestPath)
+		// The receipt is the authority for anything already vendored: plan with it
+		// so recorded migrations keep their exact filenames and only genuinely new
+		// ones are allocated a sequence.
+		const plan = await planMigrations(contract.sourceDir, options.startSequence, {
+			recorded: new Map((currentManifest?.files ?? []).map((entry) => [entry.source, entry])),
+			migrationsDir,
+		})
+		const nextManifest = manifestFor(contract.packageVersion, options.startSequence, plan)
 		assertManifestCanAdvance(currentManifest, nextManifest)
 		await assertNoSequenceCollisions(migrationsDir, plan)
 		const preflight = await verifyTargets(migrationsDir, plan, true)
@@ -424,7 +563,10 @@ export async function verifyCmsMigrations(
 				`CMS migration manifest version ${manifest.packageVersion} does not match installed ${contract.packageVersion}`,
 			)
 		}
-		const plan = await planMigrations(contract.sourceDir, manifest.startSequence)
+		const plan = await planMigrations(contract.sourceDir, manifest.startSequence, {
+			recorded: new Map(manifest.files.map((entry) => [entry.source, entry])),
+			migrationsDir,
+		})
 		const expected = manifestFor(contract.packageVersion, manifest.startSequence, plan)
 		if (
 			expected.files.length !== manifest.files.length ||

package/src/providers/types.ts

@@ -391,7 +391,12 @@ export interface FoundryJobSpec {
 	sourceUrl: string
 	sourceKind?: string
 	kind: string
-	durationSeconds: number
+	/**
+	 * The authoritative media duration. `null` only for a Google Drive podcast
+	 * source (`sourceKind: 'google_drive'`): the Go plane fetches the file itself
+	 * and measures the duration, so the CMS has none to send.
+	 */
+	durationSeconds: number | null
 	videoId?: string
 	title?: string
 	description?: string | null