@acms-subir/core 0.3.15 → 0.3.17

package/src/lib/sync/service.ts

@@ -0,0 +1,994 @@
+import { z } from "zod";
+import type { ContentRepository } from "../repo/types";
+import type { SqlStatement } from "../repo/sql";
+import type { MediaStore } from "../media/store";
+import { ApiError } from "../api";
+import { CONTENT } from "../content";
+import { CALENDAR } from "../calendar/config";
+import { eventInstants, normalizeEventTimes } from "../calendar/events";
+import { htmlToPlaintext } from "../plaintext";
+import { validateDesignValues } from "../design-service";
+import {
+  canonical,
+  differences,
+  hash,
+  reference,
+  transform,
+  PROTOCOL,
+} from "./protocol.mjs";
+import {
+  column,
+  draftKinds,
+  encode,
+  fields,
+  parseData,
+  schemas,
+  settingsKinds,
+  tables,
+  type Data,
+  type Kind,
+} from "./catalog";
+import { objectBytes, type Entity, type Snapshot } from "./store";
+
+const KindSchema = z.enum(Object.keys(schemas) as [Kind, ...Kind[]]);
+const Choice = z
+  .object({
+    key: z.string().min(1).max(300),
+    kind: KindSchema,
+    aliases: z.array(z.string().max(300)).max(20),
+    data: z.record(z.unknown()),
+    targetId: z.string().max(100).nullable(),
+    expected: z.string().nullable(),
+    action: z.enum(["create", "update", "skip"]),
+    sourceHash: z.string().regex(/^[a-f0-9]{64}$/),
+  })
+  .strict();
+export const PlanInput = z
+  .object({
+    sourceSite: z.string().min(1).max(100),
+    sourceUrl: z.string().max(2000),
+    destinationSite: z.string().max(100),
+    revision: z.number().int().nonnegative(),
+    mode: z.enum(["draft", "live"]).default("draft"),
+    choices: z.array(Choice).min(1).max(200),
+  })
+  .strict();
+export type Operation = {
+  key: string;
+  kind: Kind;
+  targetId: string;
+  aliases: string[];
+  data: Data | null;
+  before: Entity | null;
+  action: "create" | "update" | "skip" | "delete";
+  sourceHash: string;
+  ref: string;
+  restore?: Entity;
+};
+
+function requireRevision(snapshot: Snapshot, site: string, revision: number) {
+  if (snapshot.siteId !== site || snapshot.revision !== revision)
+    throw new ApiError(
+      409,
+      "Destination changed or is a different installation. Refresh status and plan again.",
+    );
+}
+function refMap(snapshot: Snapshot, operations: Operation[]) {
+  const map = new Map<string, string>();
+  for (const entity of snapshot.entities)
+    for (const alias of entity.aliases) map.set(reference(alias), entity.id);
+  for (const op of operations)
+    for (const alias of [op.key, ...op.aliases])
+      map.set(reference(alias), op.targetId);
+  return map;
+}
+function resolved(data: Data, map: Map<string, string>): Data {
+  const convert = (s: string): string => {
+    if (map.has(s)) return map.get(s)!;
+    if (/^\s*[\[{]/.test(s)) {
+      try {
+        return JSON.stringify(transform(JSON.parse(s), convert));
+      } catch (e) {
+        if (e instanceof ApiError) throw e;
+      }
+    }
+    if (s.startsWith("acms-sync:"))
+      throw new ApiError(
+        409,
+        `Missing dependency ${s.slice(10)}. Include it in the selection.`,
+      );
+    return s;
+  };
+  return transform(data, convert);
+}
+async function validateCompatibility(
+  repo: ContentRepository,
+  operations: Operation[],
+  snapshot: Snapshot,
+  mode: string,
+) {
+  const map = refMap(snapshot, operations);
+  const homes = new Map<string, string>();
+  const mediaPaths = new Set([
+    ...snapshot.entities
+      .filter((e) => e.kind === "media")
+      .flatMap((e) => e.data.objects.map((o: Data) => `/media/${o.key}`)),
+    ...operations
+      .filter((o) => o.kind === "media" && o.data)
+      .flatMap((o) => o.data!.objects.map((a: Data) => `/media/${a.key}`)),
+  ]);
+  for (const e of snapshot.entities.filter(
+    (e) => e.kind === "page" && e.live.isHome,
+  ))
+    homes.set(e.live.locale, e.id);
+  for (const op of operations) {
+    if (op.action === "skip") continue;
+    if (op.action === "delete") {
+      if (["event", "resource", "booking", "form"].includes(op.kind)) {
+        const table = op.kind === "form" ? "form_submissions" : "bookings",
+          col =
+            op.kind === "form"
+              ? "form_id"
+              : op.kind === "event"
+                ? "event_id"
+                : op.kind === "resource"
+                  ? "resource_id"
+                  : "link_id";
+        if (
+          (
+            await repo.sync.query(
+              `SELECT id FROM ${table} WHERE ${col}=? LIMIT 1`,
+              [op.targetId],
+            )
+          ).length
+        )
+          throw new ApiError(
+            409,
+            "Production activity prevents this rollback deletion.",
+          );
+      }
+      continue;
+    }
+    if (
+      mode === "draft" &&
+      !draftKinds.has(op.kind) &&
+      !["media", "tag"].includes(op.kind)
+    )
+      throw new ApiError(
+        409,
+        `${op.ref} has no draft mode. Use an explicit live plan.`,
+      );
+    if (
+      mode === "draft" &&
+      ["media", "tag"].includes(op.kind) &&
+      op.action === "update"
+    )
+      throw new ApiError(
+        409,
+        `${op.ref} changes live library metadata. Use an explicit live plan.`,
+      );
+    if (op.kind === "author")
+      throw new ApiError(
+        409,
+        "Bylines must map to existing destination profiles; sync never creates or edits accounts.",
+      );
+    const data = parseData(op.kind, resolved(op.data!, map));
+    const mediaRefs =
+      canonical(data).match(/\/media\/sync\/[a-f0-9]{64}\.[a-z0-9]{1,8}/g) ??
+      [];
+    if (mediaRefs.some((path) => !mediaPaths.has(path)))
+      throw new ApiError(
+        409,
+        `${op.ref} requires media that is not selected or present on the destination.`,
+      );
+    if (
+      op.kind === "form" &&
+      mode === "draft" &&
+      op.before?.live.status === "published" &&
+      ["name", "kind", "purpose"].some((k) => data[k] !== op.before!.live[k])
+    )
+      throw new ApiError(
+        409,
+        "Only a published form definition can be staged. Rename or change form metadata with an explicit live plan.",
+      );
+    if (op.kind === "post" && !CONTENT.collections[data.collection])
+      throw new ApiError(
+        409,
+        `Install collection ${data.collection} on the destination first.`,
+      );
+    const available = (kind: Kind, id: string) =>
+      snapshot.entities.some((e) => e.kind === kind && e.id === id) ||
+      operations.some(
+        (o) => o.kind === kind && o.targetId === id && o.action !== "delete",
+      );
+    const requireRef = (kind: Kind, id: string) => {
+      if (id && !available(kind, id))
+        throw new ApiError(409, `${op.ref} refers to a missing ${kind}.`);
+    };
+    if (op.kind === "post")
+      data.authorIds.forEach((id: string) => requireRef("author", id));
+    if (op.kind === "event") {
+      data.calendarIds.forEach((id: string) => requireRef("calendar", id));
+      if (data.location.placeId) requireRef("place", data.location.placeId);
+    }
+    if (op.kind === "resource") requireRef("place", data.placeId);
+    if (op.kind === "booking") requireRef("resource", data.resourceId);
+    if (op.kind === "booking-settings")
+      requireRef("calendar", data.defaultCalendarId);
+    if (["event", "calendar"].includes(op.kind) && !CALENDAR.enabled)
+      throw new ApiError(409, "Enable and deploy the calendar module first.");
+    if (
+      ["resource", "booking", "booking-settings"].includes(op.kind) &&
+      !CALENDAR.bookings
+    )
+      throw new ApiError(409, "Enable and deploy bookings first.");
+    if (
+      op.kind === "calendar" &&
+      data.kind === "feed" &&
+      op.action === "create"
+    )
+      throw new ApiError(
+        409,
+        "Create feed calendars on the destination first; private feed URLs do not transfer.",
+      );
+    if (op.kind === "page" && data.isHome) {
+      const home = homes.get(data.locale);
+      if (
+        home &&
+        home !== op.targetId &&
+        !operations.some(
+          (o) =>
+            o.targetId === home &&
+            o.kind === "page" &&
+            o.data?.isHome === false,
+        )
+      )
+        throw new ApiError(
+          409,
+          "Another page is the home for this locale. Select its change too.",
+        );
+      homes.set(data.locale, op.targetId);
+    }
+    if (
+      op.kind === "place" &&
+      data.isDefault &&
+      snapshot.entities.some(
+        (e) =>
+          e.kind === "place" &&
+          e.id !== op.targetId &&
+          e.live.isDefault &&
+          !operations.some(
+            (o) =>
+              o.kind === "place" &&
+              o.targetId === e.id &&
+              o.data?.isDefault === false,
+          ),
+      )
+    )
+      throw new ApiError(
+        409,
+        "Select the former default place change before assigning another default.",
+      );
+    if (op.kind === "event") {
+      normalizeEventTimes(data as any);
+      // Guest notifications, seat accounting and resource conflicts must go
+      // through the event editor once an event has production activity.
+      const used = await repo.sync.query(
+        "SELECT id FROM bookings WHERE event_id=? LIMIT 1",
+        [op.targetId],
+      );
+      if (used.length)
+        throw new ApiError(
+          409,
+          `${op.ref} has destination reservations. Edit that event on the destination.`,
+        );
+      if (data.roomHold?.resourceIds?.length)
+        throw new ApiError(
+          409,
+          "Events with room holds must be configured on the destination after sync.",
+        );
+    }
+    if (
+      op.kind === "resource" &&
+      op.before &&
+      canonical(op.before.data) !== canonical(op.data)
+    ) {
+      const used = await repo.sync.query(
+        "SELECT id FROM bookings WHERE resource_id=? AND status IN ('pending','confirmed') LIMIT 1",
+        [op.targetId],
+      );
+      if (used.length)
+        throw new ApiError(
+          409,
+          `${op.ref} has active reservations. Edit its configuration on the destination.`,
+        );
+    }
+    if (op.kind === "design" || (op.kind === "page" && data.layout)) {
+      const { getTheme, listThemes } = await import("../theme");
+      const { sectionIssues, ThemeTokens } = await import(
+        "../../theme-sdk/contract.mjs"
+      );
+      const settings = await repo.getSettings();
+      const themeName =
+        operations.find((o) => o.kind === "design")?.data?.activeTheme ??
+        (mode === "draft" ? settings.draftDesign?.activeTheme : null) ??
+        settings.activeTheme;
+      if (themeName && !listThemes().some((t) => t.slug === themeName))
+        throw new ApiError(
+          409,
+          "Install and deploy the selected theme code first.",
+        );
+      if (op.kind === "design") {
+        validateDesignValues(data);
+        ThemeTokens.parse({
+          ...getTheme(String(themeName)).tokens,
+          ...data.designOverrides,
+        });
+      }
+      if (op.kind === "page" && data.layout?.mode === "sections") {
+        const issues = sectionIssues(
+          data.layout,
+          getTheme(String(themeName)).sections,
+        );
+        if (issues.length)
+          throw new ApiError(
+            409,
+            `Section compatibility: ${issues.map((i: any) => i.message).join("; ")}`,
+          );
+      }
+    }
+  }
+}
+
+export async function createPlan(
+  repo: ContentRepository,
+  media: MediaStore,
+  raw: unknown,
+  actor: string,
+  persist = true,
+) {
+  const input = PlanInput.parse(raw),
+    snapshot = await repo.sync.snapshot(media);
+  requireRevision(snapshot, input.destinationSite, input.revision);
+  if (input.sourceSite === snapshot.siteId)
+    throw new ApiError(
+      400,
+      "Source and destination are the same installation.",
+    );
+  const used = new Set<string>();
+  const operations: Operation[] = input.choices.map((c) => {
+    const before = c.targetId
+      ? (snapshot.entities.find(
+          (e) => e.kind === c.kind && e.id === c.targetId,
+        ) ?? null)
+      : null;
+    if ((before?.stateHash ?? null) !== c.expected)
+      throw new ApiError(
+        409,
+        "Selected destination item changed. Refresh the plan.",
+      );
+    if ((c.action === "create" && before) || (c.action !== "create" && !before))
+      throw new ApiError(
+        409,
+        "The planned item no longer matches the destination.",
+      );
+    const targetId =
+      c.targetId ?? (settingsKinds.has(c.kind) ? "site" : crypto.randomUUID());
+    const target = `${c.kind}:${targetId}`;
+    if (used.has(target))
+      throw new ApiError(
+        400,
+        "Multiple source items target the same destination.",
+      );
+    used.add(target);
+    for (const alias of [c.key, ...c.aliases]) {
+      if (!alias.includes(`:${c.kind}:`))
+        throw new ApiError(400, "Invalid sync identity.");
+      const existing = snapshot.entities.find((e) => e.aliases.includes(alias));
+      if (existing && (existing.kind !== c.kind || existing.id !== targetId))
+        throw new ApiError(
+          409,
+          "Identity is already linked to another destination item.",
+        );
+    }
+    if (
+      c.action === "skip" &&
+      before &&
+      canonical(c.data) !== canonical(before.data)
+    )
+      throw new ApiError(409, "A skipped item differs from the destination.");
+    return {
+      ...c,
+      targetId,
+      before,
+      data: c.data,
+      ref: before?.ref ?? `${c.kind}:${c.data.slug ?? c.data.name ?? "site"}`,
+    };
+  });
+  await validateCompatibility(repo, operations, snapshot, input.mode);
+  const body = {
+    protocol: PROTOCOL,
+    sourceSite: input.sourceSite,
+    sourceUrl: input.sourceUrl,
+    destinationSite: snapshot.siteId,
+    revision: snapshot.revision,
+    mode: input.mode,
+    purpose: "transfer",
+    operations,
+    changes: operations.map((o) => ({
+      ref: o.ref,
+      action: o.action,
+      effect:
+        input.mode === "draft" && draftKinds.has(o.kind) ? "draft" : "live",
+      fields: differences(o.before?.data, o.data),
+    })),
+  };
+  return persist ? repo.sync.savePlan(body, actor) : body;
+}
+
+function upsert(
+  kind: Kind,
+  id: string,
+  data: Data,
+  exists: boolean,
+): SqlStatement {
+  const row: Data = Object.fromEntries(
+    fields(kind)
+      .filter((k) => data[k] !== undefined)
+      .map((k) => [column(k), encode(data[k])]),
+  );
+  if (kind === "post") row.author_id = data.authorIds[0] ?? null;
+  const now = Date.now();
+  if (
+    [
+      "page",
+      "post",
+      "calendar",
+      "event",
+      "resource",
+      "booking",
+      "place",
+      "form",
+    ].includes(kind)
+  ) {
+    row.updated_at = now;
+    if (!exists) row.created_at = now;
+  }
+  if (["media", "redirect"].includes(kind) && !exists) row.created_at = now;
+  if (["calendar", "resource"].includes(kind) && !exists)
+    row.feed_token = crypto.randomUUID();
+  if (kind === "form") {
+    if (!exists) row.revision = 1;
+    row.draft = null;
+  }
+  if (["page", "post", "event"].includes(kind)) row.draft = null;
+  if (kind === "event")
+    Object.assign(
+      row,
+      Object.fromEntries(
+        Object.entries(eventInstants(data as any, data.timezone || "UTC")).map(
+          ([k, v]) => [column(k), v],
+        ),
+      ),
+    );
+  const entries = Object.entries(row),
+    table = tables[kind]!;
+  return exists
+    ? {
+        sql: `UPDATE ${table} SET ${entries.map(([k]) => `${k}=?`).join(",")}${kind === "form" ? ',revision=revision+1' : ''} WHERE id=?`,
+        args: [...entries.map(([, v]) => v), id],
+      }
+    : {
+        sql: `INSERT INTO ${table} (id,${entries.map(([k]) => k).join(",")}) VALUES (${Array(
+          entries.length + 1,
+        )
+          .fill("?")
+          .join(",")})`,
+        args: [id, ...entries.map(([, v]) => v)],
+      };
+}
+function indexStatements(
+  kind: Kind,
+  id: string,
+  data: Data | null,
+): SqlStatement[] {
+  if (!["page", "post", "event"].includes(kind)) return [];
+  const statements: SqlStatement[] = [
+    {
+      sql: "DELETE FROM search_index WHERE kind=? AND ref_id=?",
+      args: [kind, id],
+    },
+  ];
+  if (data?.status === "published")
+    statements.push({
+      sql: "INSERT INTO search_index(kind,ref_id,locale,title,excerpt,plaintext,tags) VALUES(?,?,?,?,?,?,?)",
+      args: [
+        kind,
+        id,
+        data.locale ?? "",
+        data.title,
+        data.excerpt ?? data.seoDesc ?? "",
+        htmlToPlaintext(data.bodyHtml ?? "") || data.body || "",
+        (data.tags ?? []).filter((t: string) => !t.startsWith("#")).join(" "),
+      ],
+    });
+  return statements;
+}
+
+export async function applyPlan(
+  repo: ContentRepository,
+  media: MediaStore,
+  id: string,
+  digest: string,
+  actor: string,
+  allowLive: boolean,
+) {
+  const stored = await repo.sync.plan(id);
+  if (!stored || stored.digest !== digest)
+    throw new ApiError(404, "Plan not found or digest does not match.");
+  const plan = stored.body;
+  if (plan.mode === "live" && !allowLive)
+    throw new ApiError(403, "Live plans require sync:publish.");
+  if (stored.result) return stored.result;
+  const snapshot = await repo.sync.snapshot(media);
+  requireRevision(snapshot, plan.destinationSite, plan.revision);
+  const operations = plan.operations as Operation[];
+  for (const operation of operations) {
+    const current = snapshot.entities.find(
+      (e) => e.kind === operation.kind && e.id === operation.targetId,
+    );
+    if ((current?.stateHash ?? null) !== (operation.before?.stateHash ?? null))
+      throw new ApiError(
+        409,
+        `${operation.ref} changed after review. Generate a new plan.`,
+      );
+  }
+  await validateCompatibility(repo, operations, snapshot, plan.mode);
+  const map = refMap(snapshot, operations),
+    settings = await repo.sync.rawSettings();
+  let designDraft = settings.draft_design
+    ? JSON.parse(settings.draft_design)
+    : null;
+  let liveLayouts = JSON.parse(settings.section_pages || "{}");
+  let designTouched = false;
+  const statements: SqlStatement[] = [];
+  const applied: Data[] = [];
+  for (const op of operations) {
+    const data = op.data ? parseData(op.kind, resolved(op.data, map)) : null;
+    if (op.action === "delete") {
+      // Rollback only. Never delete media bytes; a later page may reuse them.
+      if (op.kind === "author" || settingsKinds.has(op.kind))
+        throw new ApiError(400, "Cannot delete that item.");
+      statements.push(
+        {
+          sql: `DELETE FROM ${tables[op.kind]} WHERE id=?`,
+          args: [op.targetId],
+        },
+        ...indexStatements(op.kind, op.targetId, null),
+      );
+      if (op.kind === "post")
+        statements.push({
+          sql: "DELETE FROM post_authors WHERE post_id=?",
+          args: [op.targetId],
+        });
+      if (op.kind === "page") {
+        delete liveLayouts[op.targetId];
+        if (designDraft?.sectionPages)
+          delete designDraft.sectionPages[op.targetId];
+        designTouched = true;
+      }
+      statements.push({
+        sql: "DELETE FROM sync_aliases WHERE kind=? AND local_id=?",
+        args: [op.kind, op.targetId],
+      });
+      applied.push({
+        key: op.key,
+        kind: op.kind,
+        id: op.targetId,
+        action: op.action,
+      });
+      continue;
+    }
+    if (op.action !== "skip" && data) {
+      if (op.kind === "media")
+        for (const object of data.objects) {
+          if (
+            (await hash(await objectBytes(media, object.key))) !== object.digest
+          )
+            throw new ApiError(
+              409,
+              "Upload and verify every required media object before applying.",
+            );
+        }
+      if (op.restore) {
+        const restoreLive = parseData(op.kind, resolved(op.restore.live, map));
+        const restoreDraft = op.restore.draft
+          ? resolved(op.restore.draft, map)
+          : null;
+        if (op.kind === "design") {
+          statements.push({
+            sql: `UPDATE settings SET ${Object.keys(restoreLive)
+              .map((k) => `${column(k)}=?`)
+              .join(",")} WHERE id=1`,
+            args: Object.values(restoreLive).map(encode),
+          });
+          designDraft = { ...designDraft };
+          for (const key of fields("design")) {
+            delete designDraft[key];
+            if (restoreDraft && key in restoreDraft)
+              designDraft[key] = restoreDraft[key];
+          }
+          designTouched = true;
+        } else if (op.kind === "settings")
+          statements.push({
+            sql: `UPDATE settings SET ${Object.keys(restoreLive)
+              .map((k) => `${column(k)}=?`)
+              .join(",")} WHERE id=1`,
+            args: Object.values(restoreLive).map(encode),
+          });
+        else if (op.kind === "booking-settings")
+          statements.push({
+            sql: "UPDATE settings SET calendar=? WHERE id=1",
+            args: [JSON.stringify(restoreLive)],
+          });
+        else {
+          statements.push(
+            upsert(op.kind, op.targetId, restoreLive, true),
+            ...indexStatements(op.kind, op.targetId, restoreLive),
+          );
+          if (["page", "post", "event", "form"].includes(op.kind))
+            statements.push({
+              sql: `UPDATE ${tables[op.kind]} SET draft=? WHERE id=?`,
+              args: [
+                restoreDraft ? JSON.stringify(restoreDraft) : null,
+                op.targetId,
+              ],
+            });
+          if (op.kind === "post") {
+            statements.push({
+              sql: "DELETE FROM post_authors WHERE post_id=?",
+              args: [op.targetId],
+            });
+            restoreLive.authorIds.forEach((aid: string, i: number) =>
+              statements.push({
+                sql: "INSERT INTO post_authors(post_id,author_id,ord) VALUES(?,?,?)",
+                args: [op.targetId, aid, i],
+              }),
+            );
+          }
+          if (op.kind === "page") {
+            if (restoreLive.layout === null) delete liveLayouts[op.targetId];
+            else liveLayouts[op.targetId] = restoreLive.layout;
+            if (
+              canonical(op.restore.data.layout) !==
+                canonical(op.restore.live.layout) ||
+              designDraft?.sectionPages
+            ) {
+              designDraft = {
+                ...designDraft,
+                sectionPages: { ...(designDraft?.sectionPages ?? liveLayouts) },
+              };
+              const layout = resolved(
+                { layout: op.restore.data.layout },
+                map,
+              ).layout;
+              if (layout === null) delete designDraft.sectionPages[op.targetId];
+              else designDraft.sectionPages[op.targetId] = layout;
+            }
+            designTouched = true;
+          }
+        }
+      } else if (op.kind === "design") {
+        if (plan.mode === "draft")
+          designDraft = {
+            ...designDraft,
+            ...data,
+            savedAt: Date.now(),
+            shareEpoch: crypto.randomUUID(),
+          };
+        else {
+          statements.push({
+            sql: `UPDATE settings SET ${Object.keys(data)
+              .map((k) => `${column(k)}=?`)
+              .join(",")} WHERE id=1`,
+            args: Object.values(data).map(encode),
+          });
+          if (designDraft)
+            for (const key of Object.keys(data)) delete designDraft[key];
+        }
+        designTouched = true;
+      } else if (op.kind === "settings")
+        statements.push({
+          sql: `UPDATE settings SET ${Object.keys(data)
+            .map((k) => `${column(k)}=?`)
+            .join(",")} WHERE id=1`,
+          args: Object.values(data).map(encode),
+        });
+      else if (op.kind === "booking-settings")
+        statements.push({
+          sql: "UPDATE settings SET calendar=? WHERE id=1",
+          args: [JSON.stringify(data)],
+        });
+      else {
+        const stage =
+          plan.mode === "draft" &&
+          draftKinds.has(op.kind) &&
+          op.before &&
+          ["published", "scheduled"].includes(op.before.live.status);
+        if (stage) {
+          let draft: Data;
+          if (op.kind === "form") draft = data.definition;
+          else {
+            draft = { ...data, savedAt: Date.now() };
+            for (const k of ["status", "publishedAt", "scheduledAt", "layout"])
+              delete draft[k];
+          }
+          statements.push({
+            sql: `UPDATE ${tables[op.kind]} SET draft=?${op.kind === "form" ? ",revision=revision+1" : ""} WHERE id=?`,
+            args: [JSON.stringify(draft), op.targetId],
+          });
+        } else {
+          const writeData = { ...data };
+          if (plan.mode === "draft" && draftKinds.has(op.kind)) {
+            writeData.status = "draft";
+            if ("scheduledAt" in writeData) writeData.scheduledAt = null;
+          }
+          if (plan.mode === "draft" && op.kind === "page")
+            writeData.isHome = op.before?.live.isHome ?? false;
+          statements.push(
+            upsert(op.kind, op.targetId, writeData, !!op.before),
+            ...indexStatements(op.kind, op.targetId, writeData),
+          );
+          if (
+            plan.mode === "draft" &&
+            op.kind === "page" &&
+            data.isHome !== writeData.isHome
+          )
+            statements.push({
+              sql: "UPDATE pages SET draft=? WHERE id=?",
+              args: [
+                JSON.stringify({ isHome: data.isHome, savedAt: Date.now() }),
+                op.targetId,
+              ],
+            });
+          if (op.kind === "post") {
+            statements.push({
+              sql: "DELETE FROM post_authors WHERE post_id=?",
+              args: [op.targetId],
+            });
+            data.authorIds.forEach((aid: string, i: number) =>
+              statements.push({
+                sql: "INSERT INTO post_authors(post_id,author_id,ord) VALUES(?,?,?)",
+                args: [op.targetId, aid, i],
+              }),
+            );
+          }
+        }
+        if (op.kind === "page") {
+          if (plan.mode === "draft") {
+            designDraft = {
+              ...designDraft,
+              sectionPages: { ...(designDraft?.sectionPages ?? liveLayouts) },
+              savedAt: Date.now(),
+              shareEpoch: crypto.randomUUID(),
+            };
+            if (data.layout === null)
+              delete designDraft.sectionPages[op.targetId];
+            else designDraft.sectionPages[op.targetId] = data.layout;
+          } else {
+            if (data.layout === null) delete liveLayouts[op.targetId];
+            else liveLayouts[op.targetId] = data.layout;
+            if (designDraft?.sectionPages) {
+              if (data.layout === null)
+                delete designDraft.sectionPages[op.targetId];
+              else designDraft.sectionPages[op.targetId] = data.layout;
+            }
+          }
+          designTouched = true;
+        }
+      }
+    }
+    for (const alias of [...new Set([op.key, ...op.aliases])])
+      statements.push({
+        sql: "INSERT INTO sync_aliases(alias,kind,local_id) VALUES(?,?,?) ON CONFLICT(alias) DO UPDATE SET kind=excluded.kind,local_id=excluded.local_id",
+        args: [alias, op.kind, op.targetId],
+      });
+    statements.push({
+      sql: "UPDATE sync_aliases SET canonical=1 WHERE alias=? AND NOT EXISTS(SELECT 1 FROM sync_aliases WHERE kind=? AND local_id=? AND canonical=1)",
+      args: [op.key, op.kind, op.targetId],
+    });
+    const predicted = { ...(op.restore?.data ?? op.data) };
+    if (
+      plan.mode === "draft" &&
+      ["page", "post", "event", "form"].includes(op.kind)
+    ) {
+      predicted.status =
+        op.before && ["published", "scheduled"].includes(op.before.live.status)
+          ? op.before.live.status
+          : "draft";
+      if (predicted.status === "draft" && "scheduledAt" in predicted)
+        predicted.scheduledAt = null;
+    }
+    applied.push({
+      key: op.key,
+      kind: op.kind,
+      id: op.targetId,
+      action: op.action,
+      sourceHash: op.sourceHash,
+      destinationHash: await hash(predicted),
+    });
+  }
+  if (designTouched)
+    statements.push({
+      sql: "UPDATE settings SET section_pages=?,draft_design=?,design_revision=design_revision+1 WHERE id=1",
+      args: [
+        JSON.stringify(liveLayouts),
+        designDraft ? JSON.stringify(designDraft) : null,
+      ],
+    });
+  const result = {
+    id,
+    actor,
+    completedAt: Date.now(),
+    mode: plan.mode,
+    purpose: plan.purpose,
+    items: applied,
+  };
+  const versionKeys = [
+    ...new Set(
+      operations.flatMap((op) => [
+        `${tables[op.kind] ?? "settings"}:${tables[op.kind] ? op.targetId : "1"}`,
+        ...(op.kind === "page" ? ["settings:1"] : []),
+        ...(op.kind === "post" ? [`post_authors:${op.targetId}`] : []),
+      ]),
+    ),
+  ];
+  await repo.sync.commit(id, plan.revision, statements, result, versionKeys);
+  return (await repo.sync.plan(id))!.result;
+}
+
+export async function followupPlan(
+  repo: ContentRepository,
+  media: MediaStore,
+  runId: string,
+  purpose: "publish" | "rollback",
+  actor: string,
+  persist = true,
+) {
+  const run = await repo.sync.plan(runId);
+  if (!run?.result) throw new ApiError(404, "Completed sync run not found.");
+  if (
+    purpose === "publish" &&
+    (run.body.mode !== "draft" || run.body.purpose === "rollback")
+  )
+    throw new ApiError(400, "Only a staged transfer can be published.");
+  const snapshot = await repo.sync.snapshot(media),
+    original = run.body.operations as Operation[];
+  const versions = Object.fromEntries(
+    (await repo.sync.query("SELECT * FROM sync_versions")).map((r) => [
+      String(r.entity),
+      Number(r.revision),
+    ]),
+  );
+  // Require the exact after-state saved atomically with the original run.
+  // The global revision recorded below also protects the review/apply gap.
+  const operations: Operation[] = [];
+  for (const old of original.filter((o) => o.action !== "skip")) {
+    const current = snapshot.entities.find(
+      (e) => e.kind === old.kind && e.id === old.targetId,
+    );
+    if (!current)
+      throw new ApiError(
+        409,
+        "A transferred item was removed. Resolve it before publishing or rollback.",
+      );
+    const guards = [
+      `${tables[old.kind] ?? "settings"}:${tables[old.kind] ? old.targetId : "1"}`,
+    ];
+    if (old.kind === "page") guards.push("settings:1");
+    if (old.kind === "post") guards.push(`post_authors:${old.targetId}`);
+    if (
+      guards.some((g) => (run.result.versions?.[g] ?? 0) !== (versions[g] ?? 0))
+    )
+      throw new ApiError(
+        409,
+        `${current.ref} changed after the transfer. Preserve those edits before continuing.`,
+      );
+    if (purpose === "publish") {
+      if (!draftKinds.has(old.kind)) continue;
+      const data = { ...current.data };
+      if (["page", "post", "event", "form"].includes(old.kind))
+        data.status = "published";
+      if (["post", "event"].includes(old.kind)) {
+        data.scheduledAt = null;
+        data.publishedAt = data.publishedAt ?? Date.now();
+      }
+      operations.push({ ...old, action: "update", before: current, data });
+    } else if (old.before)
+      operations.push({
+        ...old,
+        action: "update",
+        before: current,
+        data: old.before.data,
+        restore: old.before,
+      });
+    else {
+      if (
+        snapshot.entities.some(
+          (e) =>
+            e.key !== current.key &&
+            e.dependencies.includes(current.key) &&
+            !original.some(
+              (o) =>
+                o.targetId === e.id &&
+                o.kind === e.kind &&
+                o.action === "create",
+            ),
+        )
+      )
+        throw new ApiError(409, `${current.ref} is now used by another item.`);
+      if (["event", "resource", "booking", "form"].includes(old.kind)) {
+        const table = old.kind === "form" ? "form_submissions" : "bookings";
+        const col =
+          old.kind === "form"
+            ? "form_id"
+            : old.kind === "event"
+              ? "event_id"
+              : old.kind === "resource"
+                ? "resource_id"
+                : "link_id";
+        if (
+          (
+            await repo.sync.query(
+              `SELECT id FROM ${table} WHERE ${col}=? LIMIT 1`,
+              [old.targetId],
+            )
+          ).length
+        )
+          throw new ApiError(
+            409,
+            "New production activity prevents deleting this item.",
+          );
+      }
+      operations.push({
+        ...old,
+        action: "delete",
+        before: current,
+        data: null,
+      });
+    }
+  }
+  if (!operations.length) throw new ApiError(400, "No changes to plan.");
+  const body = {
+    ...run.body,
+    revision: snapshot.revision,
+    mode: "live",
+    purpose,
+    parent: runId,
+    operations,
+    changes: operations.map((o) => ({
+      ref: o.ref,
+      action: o.action,
+      effect: "live",
+      fields: o.restore
+        ? differences(
+            {
+              live: o.before?.live,
+              draft: o.before?.draft,
+              editable: o.before?.data,
+            },
+            {
+              live: o.restore.live,
+              draft: o.restore.draft,
+              editable: o.restore.data,
+            },
+          )
+        : differences(
+            purpose === "publish" ? o.before?.live : o.before?.data,
+            o.data,
+          ),
+    })),
+  };
+  await validateCompatibility(repo, operations, snapshot, "live");
+  return persist ? repo.sync.savePlan(body, actor) : body;
+}