@happyvertical/smrt-content 0.57.46 → 0.57.47

package/AGENTS.md

@@ -22,8 +22,9 @@ you are editing. This file keeps what holds across the package.
 - **ContentGovernancePolicy**: Persisted review policy (key, label, kind, instructions)
 - **ContentGovernanceProfile**: Persisted review profile (key, label, requirements array)
 - **ContentGovernanceAssignment**: Governs content type/variant → profile mapping, feature flags
+- Governance policies/profiles/assignments are keyed `(tenant_id, key)` (#3305 M1): NULL-tenant rows are the global layer, a tenant row overrides its key. `getByKey()` / `resolveForContent()` return the tenant's row (explicit `tenantId`, else the context), else the global one; a system context reads the global layer only. Model reference checks run in the row's own scope
 - **ContentContribution**: Held inbound submission with status lifecycle (submitted → approved/rejected/withdrawn → promoted)
-- **ContentContributor**: Contributor profile resolved by email, with trust level (standard/trusted/blocked)
+- **ContentContributor**: Contributor profile resolved by email, with trust level (standard/trusted/blocked). Keyed `(tenant_id, email)` on the lowercased, trimmed email (normalized on every save, #3305 M1); `getByEmail()` / `findOrCreateByEmail()` resolve within one tenant (explicit `tenantId`, else the context; neither → global) with no global fallback, and link a profile of the same tenant
 - **ContentContributionType**: Configures intake channels, rules, and promotion mapping. Keyed per tenant (`tenant_id`, `key`); NULL-tenant rows are the global defaults each tenant can override by key
 - **ContentContributionRevision**: Revision history for held submissions
 - **ContentContributionAttachment**: Held file metadata; becomes an `Asset` on promotion
@@ -210,5 +211,6 @@ import {
 - **`pnpm typecheck` regenerates package-owned routes safely**: Svelte's analysis may load dependent package Vite configs, but those configs anchor their root to their own package. Content's generated API routes therefore remain under `src/routes/api/v1` and the bounded `.gitignore` block stays stable (#2199).
 - **Tests import generated routes and that is fine**: `contents-api.test.ts` imports `contents/+server.ts` and `contents/[id]/+server.ts` to exercise the generated CRUD handlers against a real SQLite database. The `test` script runs `svelte-kit sync` first, which regenerates the whole route tree, so those files exist by the time Vitest loads — no committed copy needed. Run `pnpm test`, never bare `vitest`, or the imports fail to resolve
 - **`generate:test` exists for the callers that bypass `test`**: `scripts/check-coverage.mjs` runs bare `vitest --coverage`, so without a `generate:test` hook the route imports above fail and the Coverage Gate reports `no coverage produced` rather than a real percentage. It is `cache: false` in `packages/content/turbo.json` — the root task's `outputs` describe core's manifest, so a turbo cache hit would restore nothing and silently skip `svelte-kit sync`
+- **Tenant-local keys rollout (#3305 M1)**: `smrt db:migrate` adds `<table>_tenant_id_{email,key}_idx` and drops the superseded `<table>_{email,key}_idx` in one migration; rows are untouched (every row satisfies the wider key). Old code upserts on the old arbiter, so deploy the code and the migration together in a writer-drained window; reverting afterwards needs collision analysis, since tenants may then share a key
 - **Chat tables**: chat endpoint requires `@happyvertical/smrt-chat` tables; dev server handles missing tables gracefully
 - **Dev server bootstraps all classes**: `hooks.server.ts` generates schemas for all 13 local `@smrt()` classes plus cross-package manifests

package/README.md

@@ -394,7 +394,7 @@ Key behavior:
 - web and email intake normalize into the same contribution package
 - one contribution can contain one primary text submission plus zero or more held files
 - asset-only submissions are allowed when the type permits empty text
-- contributors are resolved by email and linked to a `Profile`
+- contributors are resolved by email within one tenant (`(tenant_id, email)`) and linked to a `Profile` of the same tenant
 - trust levels are `standard`, `trusted`, or `blocked`
 - intake rules can accept, quarantine, or reject before editorial review
 - approval promotes into normal draft `Content` and `Asset` records with provenance metadata
@@ -607,7 +607,7 @@ reassemble into a live tag.
 | `ContentContribution` | Held inbound submission with approval, rejection, withdrawal, and promotion actions |
 | `ContentContributions` | Contribution collection with web intake, email ingestion, inbox, and contributor views |
 | `ContentContributionType` | Persisted contribution-type override for app-defined intake rules and promotion mapping |
-| `ContentContributor` | Contributor profile/trust record resolved by email |
+| `ContentContributor` | Contributor profile/trust record resolved by email within its tenant |
 | `ContentContributionRevision` | Revision history for held submissions |
 | `ContentContributionAttachment` | Held file metadata that only becomes an `Asset` on promotion |
 | `ContentGovernancePolicy` | Persisted review policy definition |