Social architecture and workflows

Application surfaces

The older /dashboard/studio/* routes still exist and redirect to their platform equivalents.

Data model

Ten lists are registered in features/keystone/models/index.ts.

Ownership and access

Every creator list is query-only for canUseStudio roles and filtered by rules.own* in features/keystone/access.ts (for example, items match collection.site.owner.id equal to the session user). Generic create, update, and delete are closed. All writes go through one GraphQL mutation:

mutation {
  studioCommand(command: "publishItem", input: { itemId: "...", expectedVersion: 3, expectedGeneration: 1, expectedStatus: "draft" }) {
    ok
    code
    field
    message
    value
  }
}

Each command locks the owner's site row (withPublishingSite, FOR UPDATE), checks the version the user reviewed (an optimistic fence on publishingVersion, contentVersion, publishGeneration, and status), writes, and appends a SocialEvent. A stale version returns a conflict instead of overwriting. Results never return raw rows or exception text.

Studio commands

The schema also registers older named mutations (createMyPersonalSite, publishPersonalItem, requestExternalPublication, and others) that call the same functions. onboardMyPersonalSite creates the demo site.

Workflows

Item publish lifecycle

1. Draft. createItem adds a draft to a collection. updateItem edits it and increments contentVersion. Archived items cannot be edited or published.
2. Publish. publishItem creates a new canonical Publication with destination personal_site and an immutable snapshot of the current content. A previous canonical publication for the item is cancelled.
3. Republish. Editing a published item creates unpublished changes; publishing again creates a new snapshot.
4. Unpublish. unpublishItem returns the item to draft and cancels the canonical publication.
5. Archive and restore. archiveItem works only from draft; restoreItem returns it to draft.

What a visitor sees also depends on the site and collection: the site must be published (isPublished), and the collection must be public (listed and in RSS) or unlisted (served by link, noindex). Private collections are not served. Hiding a site or moving a collection off public cancels undispatched external intents.

Collections

Create a collection, edit its name, kind, and visibility, reorder it on the profile, and remove it only when it has no items. Slugs are stable after creation.

Destinations and consent

1. addDestination creates a ConnectedAccount label with status unconfigured.
2. requestExternal records consent for the live version of an item. It requires an idempotency key and the reviewed site, collection, canonical publication, and account versions. It creates a Publication with status not_configured and one failed, zero-attempt PublishJob.
3. cancelExternal cancels an intent that was never dispatched.
4. revokeDestination blocks new intents and cancels undispatched ones.

Privacy

1. A creator files request_access, request_correction, or request_erasure from Your data (requestPrivacy). The request is a privacy.requested event.
2. A people manager sees it in privacyRequestQueue and calls reviewPrivacyRequest with Granted or Declined and a note.
3. For a granted erasure, erasePrivacyRequest deletes the creator's site, collections, items, publications, jobs, connected accounts, and media asset rows, and replaces the user's name, email, and password, removes the role, and clears the evidence on the creator's own events. The user row is kept because consent records reference it.

Creators export their records page by page through socialPrivateExport (events, privacy, items, publications, destinations), downloadable from /api/creator-export.

Start over

deleteSite removes a site only when all its publications are flagged as samples, so a demo site can be deleted and setup run again. Sites with real published versions keep their history.

GraphQL queries

Roles

The first user gets an Admin role with every capability. The creator role has dashboard, studio, and onboarding access only.