ghost 6.55.0 → 6.57.0

package/core/frontend/services/sitemap/base-site-map-generator.js

@@ -86,15 +86,6 @@ class BaseSiteMapGenerator {
         return sitemapXml;
     }
 
-    updateURL(datum) {
-        const url = this.nodeLookup[datum.id]?.url[0].loc;
-
-        if (url) {
-            this.removeUrl(url, datum);
-            this.addUrl(url, datum);
-        }
-    }
-
     addUrl(url, datum) {
         // Computed once and threaded through: the three consumers below each
         // used to construct their own moment() from the same datum, which
@@ -110,14 +101,6 @@ class BaseSiteMapGenerator {
         }
     }
 
-    removeUrl(url, datum) {
-        this.removeFromLookups(datum);
-
-        // force regeneration of xml
-        this.siteMapContent.clear();
-        this.lastModified = Date.now();
-    }
-
     /**
      * @returns {moment.Moment}
      */
@@ -208,26 +191,16 @@ class BaseSiteMapGenerator {
         return content;
     }
 
-    /**
-     * @NOTE
-     * The url service currently has no url update event.
-     * It removes and adds the url. If the url service extends it's
-     * feature set, we can detect if a node has changed.
-     */
     updateLookups(datum, node, lastModified = this.getLastModifiedForDatum(datum)) {
         this.nodeLookup[datum.id] = node;
         this.nodeTimeLookup[datum.id] = lastModified;
     }
 
-    removeFromLookups(datum) {
-        delete this.nodeLookup[datum.id];
-        delete this.nodeTimeLookup[datum.id];
-    }
-
     reset() {
         this.nodeLookup = {};
         this.nodeTimeLookup = {};
         this.siteMapContent.clear();
+        this.lastModified = 0;
     }
 }
 

package/core/frontend/services/sitemap/site-map-manager.js

@@ -1,14 +1,12 @@
-const DomainEvents = require('@tryghost/domain-events');
 const errors = require('@tryghost/errors');
 const urlUtils = require('../../../shared/url-utils').default;
-const {URLResourceUpdatedEvent} = require('../../../shared/events');
 const IndexMapGenerator = require('./site-map-index-generator');
 const PagesMapGenerator = require('./page-map-generator');
 const PostsMapGenerator = require('./post-map-generator');
 const UsersMapGenerator = require('./user-map-generator');
 const TagsMapGenerator = require('./tags-map-generator');
 
-// Frontend-internal routing events (router.created / routers.reset)
+// Frontend-internal routing domain events (RouteRegistered / RoutesReset)
 const routingEvents = require('../routing/events');
 
 // What the sitemap XML reads off each resource, beyond the columns URL
@@ -43,9 +41,9 @@ class SiteMapManager {
         this._urlService = options.urlService || null;
 
         // Server events arrive through the proxy's narrow subscription
-        // surface (site.changed, url.added, url.removed). Injectable for
-        // tests; resolved at construction (not module load) for the same
-        // boot-order reason as the url service above.
+        // surface (site.changed). Injectable for tests; resolved at
+        // construction (not module load) for the same boot-order reason as
+        // the url service above.
         this._serverEvents = options.serverEvents || require('../proxy').serverEvents;
 
         // Index state for the build path. _indexEpoch increments on every
@@ -54,55 +52,34 @@ class SiteMapManager {
         this._indexBuilt = false;
         this._buildInFlight = null;
         this._indexEpoch = 0;
-        // Static/collection route entries only arrive via router.created,
+        // Static/collection route entries only arrive via RouteRegistered,
         // which fires at boot and routes reload. They are recorded here so
         // every rebuild can replay them after resetting the generators.
         this._routerEntries = [];
 
-        routingEvents.on('router.created', (router) => {
-            if (router.name !== 'StaticRoutesRouter' && router.name !== 'CollectionRouter') {
+        routingEvents.on('RouteRegistered', ({path, type, id}) => {
+            if (type !== 'StaticRoutesRouter' && type !== 'CollectionRouter') {
                 return;
             }
             const entry = {
-                url: router.getRoute({absolute: true}),
-                datum: {id: router.identifier, staticRoute: router.name === 'StaticRoutesRouter'}
+                url: urlUtils.createUrl(path, true),
+                datum: {id, staticRoute: type === 'StaticRoutesRouter'}
             };
             this._routerEntries.push(entry);
             this.pages.addUrl(entry.url, entry.datum);
             // A router registering after a build (routes reload re-registers
-            // them one macrotask after routers.reset) must not leave a
+            // them one macrotask after RoutesReset) must not leave a
             // zero-router index marked built — the CDN would pin it.
-            if (this._getUrlService().isLazy()) {
-                this._invalidateIndex();
-            }
+            this._invalidateIndex();
         });
 
-        // Invalidation is lazy-mode only. Everywhere the eager service runs
-        // (flag off AND compare mode) its per-URL feed below keeps the index
-        // current after the initial build, exactly as before this change —
-        // deploying is a no-op until the lazy flip. Pure lazy fires no
-        // events, so there the index empties and the next read rebuilds.
+        // Nothing feeds the index per URL, so any change to the site's content
+        // empties it and the next read rebuilds.
         this._serverEvents.on('site.changed', () => {
-            if (this._getUrlService().isLazy()) {
-                this._invalidateIndex();
-            }
+            this._invalidateIndex();
         });
 
-        // The eager URL service's per-URL feed, active in both eager-only
-        // and compare mode; under pure lazy these events never fire.
-        DomainEvents.subscribe(URLResourceUpdatedEvent, (event) => {
-            this[event.data.resourceType].updateURL(event.data);
-        });
-
-        this._serverEvents.on('url.added', (obj) => {
-            this[obj.resource.config.type].addUrl(obj.url.absolute, obj.resource.data);
-        });
-
-        this._serverEvents.on('url.removed', (obj) => {
-            this[obj.resource.config.type].removeUrl(obj.url.absolute, obj.resource.data);
-        });
-
-        routingEvents.on('routers.reset', () => {
+        routingEvents.on('RoutesReset', () => {
             this.pages && this.pages.reset();
             this.posts && this.posts.reset();
             this.users && this.users.reset();
@@ -110,9 +87,7 @@ class SiteMapManager {
             // The routers re-register right after a reset and refill the
             // list; keeping stale entries would resurrect deleted routes.
             this._routerEntries = [];
-            if (this._getUrlService().isLazy()) {
-                this._invalidateIndex();
-            }
+            this._invalidateIndex();
         });
     }
 
@@ -156,20 +131,15 @@ class SiteMapManager {
 
     /**
      * Make sure the index is ready to serve; every XML read awaits this, so
-     * no caller can render from an unbuilt index. The index is built once on
-     * first read in every mode. Wherever the eager service runs (eager-only
-     * and compare mode) the per-URL events keep it current from then on
-     * (and heal any gap in the initial snapshot, since addUrl is id-keyed);
-     * under pure lazy the invalidation signals empty it and the next read
-     * rebuilds.
+     * no caller can render from an unbuilt index. The index is built on first
+     * read; the invalidation signals empty it and the next read rebuilds.
      *
      * Concurrent readers share one build. A build whose result was
      * invalidated while it ran is discarded and the read fails — the index
      * must never serve pre-invalidation data (the CDN would pin it for the
      * full cache maxAge), and a 503 is retried by crawlers and stored by
-     * nobody. Unreachable with eager (nothing invalidates), and
-     * deliberately no retry; if SITEMAP_BUILD_SUPERSEDED shows up in the
-     * logs at any rate worth caring about, add one then.
+     * nobody. Deliberately no retry; if SITEMAP_BUILD_SUPERSEDED shows up in
+     * the logs at any rate worth caring about, add one then.
      */
     async _ensureIndexReady() {
         if (this._indexBuilt) {
@@ -231,12 +201,7 @@ class SiteMapManager {
      * Add a single resource to the index.
      */
     _applyResource(type, datum) {
-        // skipComparison: teeing every bulk row through the compare machinery
-        // would capture a stack and queue a background lazy computation per
-        // resource, per build. Enumeration parity comes from the
-        // getRoutableResources id-set comparison; per-URL parity from
-        // organic request traffic.
-        const url = this._getUrlService().getUrlForResource({...datum, type}, {absolute: true, skipComparison: true});
+        const url = this._getUrlService().getUrlForResource({...datum, type}, {absolute: true});
         // Exact match on the not-found sentinel: a real resource can carry
         // a slug like "404" (/tag/404/) and must stay in the sitemap.
         if (url && url !== this._notFoundUrl()) {
@@ -254,7 +219,7 @@ class SiteMapManager {
 
     _getUrlService() {
         if (!this._urlService) {
-            this._urlService = require('../proxy').urlService.facade;
+            this._urlService = require('../proxy').urlService;
         }
         return this._urlService;
     }

package/core/server/adapters/route-settings/utils.js

@@ -5,9 +5,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getBackupRouteSettingsFilePath = void 0;
 const path_1 = __importDefault(require("path"));
-const date_fns_1 = require("date-fns");
+const pad = (value, length = 2) => String(value).padStart(length, '0');
+const timestamp = (date) => [
+    pad(date.getFullYear(), 4),
+    pad(date.getMonth() + 1),
+    pad(date.getDate()),
+    pad(date.getHours()),
+    pad(date.getMinutes()),
+    pad(date.getSeconds())
+].join('-');
 const getBackupRouteSettingsFilePath = (filePath) => {
     const { dir, name, ext } = path_1.default.parse(filePath);
-    return path_1.default.join(dir, `${name}-${(0, date_fns_1.format)(new Date(), 'yyyy-MM-dd-HH-mm-ss')}${ext}`);
+    return path_1.default.join(dir, `${name}-${timestamp(new Date())}${ext}`);
 };
 exports.getBackupRouteSettingsFilePath = getBackupRouteSettingsFilePath;

package/core/server/adapters/route-settings/utils.ts

@@ -1,7 +1,17 @@
 import path from 'path';
-import {format} from 'date-fns';
+
+const pad = (value: number, length = 2): string => String(value).padStart(length, '0');
+
+const timestamp = (date: Date): string => [
+    pad(date.getFullYear(), 4),
+    pad(date.getMonth() + 1),
+    pad(date.getDate()),
+    pad(date.getHours()),
+    pad(date.getMinutes()),
+    pad(date.getSeconds())
+].join('-');
 
 export const getBackupRouteSettingsFilePath = (filePath: string): string => {
     const {dir, name, ext} = path.parse(filePath);
-    return path.join(dir, `${name}-${format(new Date(), 'yyyy-MM-dd-HH-mm-ss')}${ext}`);
+    return path.join(dir, `${name}-${timestamp(new Date())}${ext}`);
 };

package/core/server/api/endpoints/email-post.js

@@ -36,7 +36,7 @@ const controller = {
             }
         },
         async query(frame) {
-            urlSerializerUtils.forceUrlRelationsWhenLazy(frame, 'posts');
+            urlSerializerUtils.forceUrlRelations(frame, 'posts');
 
             const model = await models.Post.findOne(Object.assign(frame.data, {status: 'sent'}), frame.options);
 

package/core/server/api/endpoints/previews.js

@@ -82,7 +82,7 @@ const controller = {
             await _addMemberContextToFrame(frame);
 
             // previews has no input serializer, so the URL force-load happens here
-            urlSerializerUtils.forceUrlRelationsWhenLazy(frame, 'posts');
+            urlSerializerUtils.forceUrlRelations(frame, 'posts');
 
             const model = await models.Post.findOne(Object.assign({status: 'all'}, frame.data), frame.options);
             if (!model) {

package/core/server/api/endpoints/search-index-public.js

@@ -4,8 +4,8 @@ const {requiredUrlColumns} = require('./utils/serializers/input/utils/url');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
 const postsService = getPostServiceInstance();
 
-const urlRelationsWhenLazyRouting = () => {
-    const withRelated = urlService.facade.getRequiredRelations();
+const urlRelationsForRouting = () => {
+    const withRelated = urlService.getRequiredRelations();
     return withRelated.length ? {withRelated} : {};
 };
 
@@ -23,7 +23,7 @@ const controller = {
                 limit: '10000',
                 order: 'updated_at DESC',
                 columns: requiredUrlColumns('posts', ['id', 'slug', 'title', 'excerpt', 'url', 'updated_at', 'visibility']),
-                ...urlRelationsWhenLazyRouting()
+                ...urlRelationsForRouting()
             };
 
             return postsService.browsePosts(options);

package/core/server/api/endpoints/search-index.js

@@ -4,8 +4,8 @@ const {requiredUrlColumns} = require('./utils/serializers/input/utils/url');
 const getPostServiceInstance = require('../../services/posts/posts-service-instance');
 const postsService = getPostServiceInstance();
 
-const urlRelationsWhenLazyRouting = () => {
-    const withRelated = urlService.facade.getRequiredRelations();
+const urlRelationsForRouting = () => {
+    const withRelated = urlService.getRequiredRelations();
     return withRelated.length ? {withRelated} : {};
 };
 
@@ -26,7 +26,7 @@ const controller = {
                 limit: '10000',
                 order: 'updated_at DESC',
                 columns: requiredUrlColumns('posts', ['id', 'uuid', 'url', 'title', 'slug', 'status', 'published_at', 'visibility']),
-                ...urlRelationsWhenLazyRouting()
+                ...urlRelationsForRouting()
             };
 
             return postsService.browsePosts(options);
@@ -46,7 +46,7 @@ const controller = {
                 limit: '10000',
                 order: 'updated_at DESC',
                 columns: requiredUrlColumns('pages', ['id', 'uuid', 'url', 'title', 'slug', 'status', 'published_at', 'visibility']),
-                ...urlRelationsWhenLazyRouting()
+                ...urlRelationsForRouting()
             };
 
             return postsService.browsePosts(options);

package/core/server/api/endpoints/utils/serializers/input/authors.js

@@ -17,7 +17,7 @@ module.exports = {
     browse(apiConfig, frame) {
         debug('browse');
 
-        url.forceUrlColumnsWhenLazy(frame, 'authors');
+        url.forceUrlColumns(frame, 'authors');
 
         if (utils.isContentAPI(frame)) {
             setDefaultOrder(frame);
@@ -27,7 +27,7 @@ module.exports = {
     read(apiConfig, frame) {
         debug('read');
 
-        url.forceUrlColumnsWhenLazy(frame, 'authors');
+        url.forceUrlColumns(frame, 'authors');
 
         if (utils.isContentAPI(frame)) {
             setDefaultOrder(frame);

package/core/server/api/endpoints/utils/serializers/input/comments.js

@@ -24,7 +24,7 @@ module.exports = {
         });
 
         if (frame.options.withRelated.includes('post')) {
-            for (const relation of urlService.facade.getRequiredRelations()) {
+            for (const relation of urlService.getRequiredRelations()) {
                 const prefixed = `post.${relation}`;
                 if (!frame.options.withRelated.includes(prefixed)) {
                     frame.options.withRelated.push(prefixed);

package/core/server/api/endpoints/utils/serializers/input/pages.js

@@ -56,7 +56,7 @@ function defaultRelations(frame) {
         frame.options.withRelated = ['tags', 'authors', 'authors.roles', 'tiers', 'count.signups', 'count.paid_conversions'];
     }
 
-    url.forceUrlRelationsWhenLazy(frame, 'pages');
+    url.forceUrlRelations(frame, 'pages');
 }
 
 function setDefaultOrder(frame) {
@@ -126,7 +126,7 @@ module.exports = {
 
             setDefaultOrder(frame);
             forceVisibilityColumn(frame);
-            url.forceUrlRelationsWhenLazy(frame, 'pages');
+            url.forceUrlRelations(frame, 'pages');
         }
 
         if (!localUtils.isContentAPI(frame)) {
@@ -145,7 +145,7 @@ module.exports = {
             removeSourceFormats(frame);
             setDefaultOrder(frame);
             forceVisibilityColumn(frame);
-            url.forceUrlRelationsWhenLazy(frame, 'pages');
+            url.forceUrlRelations(frame, 'pages');
         }
 
         if (!localUtils.isContentAPI(frame)) {

package/core/server/api/endpoints/utils/serializers/input/posts.js

@@ -82,7 +82,7 @@ function defaultRelations(frame) {
         frame.options.withRelated = ['tags', 'authors', 'authors.roles', 'email', 'tiers', 'newsletter', 'count.clicks'];
     }
 
-    url.forceUrlRelationsWhenLazy(frame, 'posts');
+    url.forceUrlRelations(frame, 'posts');
 }
 
 function setDefaultOrder(frame) {
@@ -161,7 +161,7 @@ module.exports = {
             setDefaultOrder(frame);
             forceVisibilityColumn(frame);
             mapWithRelated(frame);
-            url.forceUrlRelationsWhenLazy(frame, 'posts');
+            url.forceUrlRelations(frame, 'posts');
         }
 
         if (!localUtils.isContentAPI(frame)) {
@@ -188,7 +188,7 @@ module.exports = {
 
             setDefaultOrder(frame);
             forceVisibilityColumn(frame);
-            url.forceUrlRelationsWhenLazy(frame, 'posts');
+            url.forceUrlRelations(frame, 'posts');
         }
 
         if (!localUtils.isContentAPI(frame)) {

package/core/server/api/endpoints/utils/serializers/input/tags.js

@@ -19,7 +19,7 @@ module.exports = {
     browse(apiConfig, frame) {
         debug('browse');
 
-        url.forceUrlColumnsWhenLazy(frame, 'tags');
+        url.forceUrlColumns(frame, 'tags');
 
         if (utils.isContentAPI(frame)) {
             setDefaultOrder(frame);

package/core/server/api/endpoints/utils/serializers/input/users.js

@@ -6,13 +6,13 @@ module.exports = {
         debug('browse');
 
         // Staff users route through the authors router types.
-        url.forceUrlColumnsWhenLazy(frame, 'authors');
+        url.forceUrlColumns(frame, 'authors');
     },
 
     read(apiConfig, frame) {
         debug('read');
 
-        url.forceUrlColumnsWhenLazy(frame, 'authors');
+        url.forceUrlColumns(frame, 'authors');
 
         if (frame.data.id === 'me' && frame.options.context && frame.options.context.user) {
             frame.data.id = frame.options.context.user;

package/core/server/api/endpoints/utils/serializers/input/utils/url.js

@@ -71,28 +71,41 @@ const forSetting = (attrs) => {
 // build a URL (e.g. status/visibility/slug), so the service would reject the
 // resource as thin. Force them back into the fetch and record them on the
 // frame — the output mapper strips them from the response after the URL is
-// built. No-op under the eager service (getRequiredFields → []).
-const forceUrlColumnsWhenLazy = (frame, routerType) => {
+// built. No-op when the routing config needs no extra columns.
+const forceUrlColumns = (frame, routerType, extraColumns = []) => {
     if (!Array.isArray(frame.options.columns) || !frame.options.columns.includes('url')) {
         return;
     }
-    const forced = urlService.facade.getRequiredFields(routerType).filter(field => !frame.options.columns.includes(field));
+    const required = new Set([...urlService.getRequiredFields(routerType), ...extraColumns]);
+    const missing = [...required].filter(field => !frame.options.columns.includes(field));
+    if (!missing.length) {
+        return;
+    }
+    // A read already carries the fields it was looked up by: `findOne` forges
+    // the model with them before the fetch, so they survive a narrowed
+    // `?fields=` list and the caller is served them today. Stripping those back
+    // out would take a field away — `posts/slug/:slug/?fields=url` still
+    // answers with its slug. They are still selected, because the lookup
+    // matches case-insensitively: the forged value can differ in case from the
+    // stored one, and the URL is built from whichever the model carries.
+    const carried = Object.keys(frame.data || {});
+    const forced = missing.filter(field => !carried.includes(field));
     if (forced.length) {
-        frame.forcedUrlColumns = forced;
-        frame.options.columns.push(...forced);
+        frame.forcedUrlColumns = {routerType, columns: forced};
     }
+    frame.options.columns.push(...missing);
 };
 
 // `url` is serialized for every post/page unless `?fields` narrows it away,
 // so the relations the lazy URL service reads (e.g. tags for a tag-filtered
 // collection) must be loaded whenever the URL will be built — not only for
 // the `?fields=url` case. Forced relations are recorded on the frame for the
-// output mapper to strip. No-op under the eager service.
-const forceUrlRelationsWhenLazy = (frame, routerType) => {
+// output mapper to strip. No-op when the routing config reads no relations.
+const forceUrlRelations = (frame, routerType) => {
     if (!localUtils.willSerializeUrl(frame)) {
         return;
     }
-    const relations = urlService.facade.getRequiredRelations();
+    const relations = urlService.getRequiredRelations();
     if (relations.length) {
         const requested = frame.options.withRelated || [];
         // a nested include covers its parent: `authors.roles` loads authors
@@ -105,13 +118,18 @@ const forceUrlRelationsWhenLazy = (frame, routerType) => {
             frame.options.withRelated = [...requested, ...forced];
         }
     }
-    forceUrlColumnsWhenLazy(frame, routerType);
+    // The URL is looked up by `model.id`, and Bookshelf matches eager-loaded
+    // rows back to their parent by the same key — so a `?fields=` list that
+    // omits it serializes /404/ and leaves the relations above unattached,
+    // silently and without a key on the model at all. A read looked up by id
+    // is covered by the carried-fields rule above.
+    forceUrlColumns(frame, routerType, ['id']);
 };
 
-// Options-object variant of forceUrlColumnsWhenLazy for endpoints that build
+// Options-object variant of forceUrlColumns for endpoints that build
 // their query options directly (search index).
 const requiredUrlColumns = (routerType, columns) => {
-    const required = urlService.facade.getRequiredFields(routerType).filter(field => !columns.includes(field));
+    const required = urlService.getRequiredFields(routerType).filter(field => !columns.includes(field));
     return required.length ? [...columns, ...required] : columns;
 };
 
@@ -120,5 +138,5 @@ module.exports.requiredUrlColumns = requiredUrlColumns;
 module.exports.forUser = forUser;
 module.exports.forTag = forTag;
 module.exports.forSetting = forSetting;
-module.exports.forceUrlColumnsWhenLazy = forceUrlColumnsWhenLazy;
-module.exports.forceUrlRelationsWhenLazy = forceUrlRelationsWhenLazy;
+module.exports.forceUrlColumns = forceUrlColumns;
+module.exports.forceUrlRelations = forceUrlRelations;

package/core/server/api/endpoints/utils/serializers/output/mappers/posts.js

@@ -136,8 +136,8 @@ module.exports = async (model, frame, options = {}) => {
     clean.post(jsonModel, frame);
 
     // Columns force-loaded for the URL computation, not requested by the caller.
-    if (frame.forcedUrlColumns) {
-        frame.forcedUrlColumns.forEach((column) => {
+    if (frame.forcedUrlColumns && frame.forcedUrlColumns.routerType === routerType) {
+        frame.forcedUrlColumns.columns.forEach((column) => {
             delete jsonModel[column];
         });
     }

package/core/server/api/endpoints/utils/serializers/output/mappers/tags.js

@@ -8,8 +8,8 @@ module.exports = (model, frame) => {
     clean.tag(jsonModel, frame);
 
     // Columns force-loaded for the URL computation, not requested by the caller.
-    if (frame.forcedUrlColumns) {
-        frame.forcedUrlColumns.forEach((column) => {
+    if (frame.forcedUrlColumns && frame.forcedUrlColumns.routerType === 'tags') {
+        frame.forcedUrlColumns.columns.forEach((column) => {
             delete jsonModel[column];
         });
     }

package/core/server/api/endpoints/utils/serializers/output/mappers/users.js

@@ -6,6 +6,14 @@ module.exports = (model, frame) => {
 
     url.forUser(model.id, jsonModel, frame.options);
 
+    // Force-loaded for the URL computation, not requested by the caller (the
+    // author permalink substitutes :slug, so `?fields=url` pulls it in).
+    if (frame.forcedUrlColumns && frame.forcedUrlColumns.routerType === 'authors') {
+        frame.forcedUrlColumns.columns.forEach((column) => {
+            delete jsonModel[column];
+        });
+    }
+
     clean.author(jsonModel, frame);
 
     return jsonModel;

package/core/server/api/endpoints/utils/serializers/output/utils/url.js

@@ -10,8 +10,9 @@ const forPost = (id, attrs, frame, type = 'posts') => {
     // type from `attrs` would silently fall back to 'posts' for pages.
     // The mapper that owns the resource always knows which it is.
     //
-    // `id` is passed separately for the same reason: without it, the eager
-    // facade's id-based fallback hits /404/ for every record.
+    // `id` is passed separately for the same reason: `?fields=url` strips it
+    // from `attrs`, and the URL service needs it for `:id` permalinks and to
+    // name the resource when it reports a problem.
     //
     // When `url` was not requested (`?fields=id,title`), don't compute it at
     // all — attrs is stripped to the requested columns, so the resource would
@@ -24,17 +25,23 @@ const forPost = (id, attrs, frame, type = 'posts') => {
         return attrs;
     }
 
-    // Diagnostic only: hand the compare-mode URL service the producing api
-    // endpoint. The parity/thin-resource logs capture a caller stack, but it
-    // truncates at the async api-framework boundary and never names the
-    // endpoint; the api-framework Frame carries it, so pass it through. Omitted
-    // for non-api callers (mentions, email) whose frame has no endpoint fields.
+    // Names the fetch that produced this resource. It matters on the degrade
+    // path: a thin resource is answered with a silent /404/, and the report is
+    // the only way back to the endpoint that under-fetched it. Ignored by URL
+    // generation itself; read only into that report.
     const options = {absolute: true};
     if (frame && (frame.docName || frame.method)) {
-        options.serializerContext = {apiType: frame.apiType, docName: frame.docName, method: frame.method};
+        options.serializerContext = {
+            apiType: frame.apiType,
+            docName: frame.docName,
+            method: frame.method,
+            withRelated: frame.options && frame.options.withRelated,
+            columns: frame.options && frame.options.columns,
+            forcedUrlRelations: frame.forcedUrlRelations
+        };
     }
 
-    attrs.url = urlService.facade.getUrlForResource({...attrs, id, type}, options);
+    attrs.url = urlService.getUrlForResource({...attrs, id, type}, options);
 
     /**
      * CASE: admin api should serve preview urls
@@ -71,7 +78,7 @@ const forPost = (id, attrs, frame, type = 'posts') => {
 
 const forUser = (id, attrs, options) => {
     if (!options.columns || (options.columns && options.columns.includes('url'))) {
-        attrs.url = urlService.facade.getUrlForResource({...attrs, id, type: 'authors'}, {absolute: true});
+        attrs.url = urlService.getUrlForResource({...attrs, id, type: 'authors'}, {absolute: true});
     }
 
     return attrs;
@@ -79,7 +86,7 @@ const forUser = (id, attrs, options) => {
 
 const forTag = (id, attrs, options) => {
     if (!options.columns || (options.columns && options.columns.includes('url'))) {
-        attrs.url = urlService.facade.getUrlForResource({...attrs, id, type: 'tags'}, {absolute: true});
+        attrs.url = urlService.getUrlForResource({...attrs, id, type: 'tags'}, {absolute: true});
     }
 
     return attrs;

package/core/server/data/migrations/versions/6.56/2026-08-03-19-27-51-add-automation-run-step-id-to-automated-email-recipients.js

@@ -0,0 +1,8 @@
+const {createAddColumnMigration} = require('../../utils');
+
+module.exports = createAddColumnMigration('automated_email_recipients', 'automation_run_step_id', {
+    type: 'string',
+    maxlength: 24,
+    nullable: true,
+    references: 'automation_run_steps.id'
+}, {algorithm: 'auto'});

package/core/server/data/migrations/versions/6.56/2026-08-04-14-42-39-restrict-notification-add-permission-to-administrators.js

@@ -0,0 +1,12 @@
+const {combineTransactionalMigrations, removePermissionFromRole} = require('../../utils');
+
+module.exports = combineTransactionalMigrations(
+    removePermissionFromRole({
+        permission: 'Add notifications',
+        role: 'Editor'
+    }),
+    removePermissionFromRole({
+        permission: 'Add notifications',
+        role: 'Super Editor'
+    })
+);