@cardinali-studio/adminkit 2.1.0 → 2.2.0

package/dist/media.d.ts

@@ -0,0 +1,136 @@
+import type { D1DatabaseLike } from "./persistence.js";
+export declare const mediaOperationStates: readonly ["preparing", "ready", "blocked_in_use", "bound", "finalizing", "completed", "completed_with_warning", "cancelled", "failed"];
+export type MediaOperationState = typeof mediaOperationStates[number];
+export type MediaOperationType = "move" | "delete";
+export type MediaOperation = Readonly<{
+    operationId: string;
+    requestChecksum: string;
+    type: MediaOperationType;
+    state: MediaOperationState;
+    sourceKeys: readonly string[];
+    boundReleaseId: string | null;
+}>;
+export declare function assertMediaTransition(from: MediaOperationState, to: MediaOperationState): void;
+/** Pure durable-intent model. Object storage effects deliberately live outside
+ * it: an R2 copy may be retried, but no state transition may make a public
+ * release point at a source key that has already been removed. */
+export declare class MediaOperationKernel {
+    readonly operations: Map<string, Readonly<{
+        operationId: string;
+        requestChecksum: string;
+        type: MediaOperationType;
+        state: MediaOperationState;
+        sourceKeys: readonly string[];
+        boundReleaseId: string | null;
+    }>>;
+    readonly sourceOwners: Map<string, string>;
+    create(input: Omit<MediaOperation, "state" | "boundReleaseId">): MediaOperation;
+    transition(operationId: string, to: MediaOperationState): MediaOperation;
+    bind(operationId: string, releaseId: string): MediaOperation;
+    /** Discard never rolls content backwards. It only makes a pending destructive
+     * operation visibly unsafe until a later release removes that source again. */
+    markBlockedWhenReintroduced(sourceKeys: Iterable<string>): readonly MediaOperation[];
+    cancel(operationId: string): MediaOperation;
+    private required;
+    private releaseSources;
+}
+export type MediaOperationEntryInput = Readonly<{
+    entryId: string;
+    sourceKey: string;
+    destinationKey?: string | null;
+    objectChecksum?: string | null;
+    etag?: string | null;
+    metadataJson?: string | null;
+}>;
+export type CreateMediaOperation = Readonly<{
+    operationId: string;
+    requestChecksum: string;
+    type: MediaOperationType;
+    sourcePrefix?: string | null;
+    destinationPrefix?: string | null;
+    authorSubject: string;
+    now: number;
+    entries: readonly MediaOperationEntryInput[];
+}>;
+/** SQL journal adapter. R2 copy/delete happens around this adapter; it never
+ * infers an object as removable simply because a caller stopped mentioning it. */
+export declare class D1MediaOperationRepository {
+    private readonly db;
+    constructor(db: D1DatabaseLike);
+    create(input: CreateMediaOperation): Promise<"created" | "repeated">;
+    bind(operationId: string, releaseId: string, now: number): Promise<void>;
+    /** Called only after a copy-first R2 effect has been checksum-verified. A
+     * destination is therefore durable before an operation ever becomes ready
+     * for a release binding. */
+    recordPreparedEntry(input: {
+        operationId: string;
+        entryId: string;
+        now: number;
+        objectChecksum: string;
+        etag: string | null;
+        metadataJson: string | null;
+    }): Promise<"pending" | "ready">;
+    beginFinalization(operationId: string, releaseId: string, now: number): Promise<void>;
+    /** Individual cleanup writes are retryable. A single failed entry reaches
+     * `completed_with_warning` only after every entry has a terminal result;
+     * the already-live release is never rolled back. */
+    recordFinalizedEntry(input: {
+        operationId: string;
+        entryId: string;
+        now: number;
+        outcome: "completed" | "failed";
+        safeError?: string | null;
+    }): Promise<"pending" | "settled">;
+    blockReintroducedSources(sourceKeys: readonly string[], now: number): Promise<number>;
+    cancel(operationId: string, now: number): Promise<void>;
+}
+type R2Metadata = Record<string, string>;
+export type MediaR2Object = {
+    arrayBuffer(): Promise<ArrayBuffer>;
+    httpMetadata?: Record<string, string | number | boolean | undefined>;
+    customMetadata?: R2Metadata;
+    etag?: string;
+};
+export type MediaR2Head = {
+    customMetadata?: R2Metadata;
+    etag?: string;
+} | null;
+export type MediaR2Bucket = {
+    get(key: string): Promise<MediaR2Object | null>;
+    head(key: string): Promise<MediaR2Head>;
+    put(key: string, value: ArrayBuffer, options: {
+        httpMetadata?: MediaR2Object["httpMetadata"];
+        customMetadata?: R2Metadata;
+    }): Promise<unknown>;
+    delete(key: string): Promise<unknown>;
+};
+export type MediaPreparationJournal = Pick<D1MediaOperationRepository, "recordPreparedEntry">;
+export type MediaFinalizationJournal = Pick<D1MediaOperationRepository, "beginFinalization" | "recordFinalizedEntry">;
+/** Copy-first R2 effect. No existing destination is overwritten: an identical
+ * prior copy is an idempotent retry, while any opaque collision stops safely. */
+export declare function prepareMediaCopy(input: {
+    bucket: MediaR2Bucket;
+    journal: MediaPreparationJournal;
+    operationId: string;
+    entryId: string;
+    sourceKey: string;
+    destinationKey: string;
+    now: number;
+}): Promise<"pending" | "ready">;
+/** Cleanup starts only after the release is published. Failures are recorded as
+ * safe per-entry warnings, preserving the public source URL for a later retry. */
+export declare function finalizeMediaSources(input: {
+    bucket: MediaR2Bucket;
+    journal: MediaFinalizationJournal;
+    operationId: string;
+    releaseId: string;
+    now: number;
+    entries: readonly {
+        entryId: string;
+        sourceKey: string;
+    }[];
+}): Promise<{
+    completed: number;
+    failed: number;
+}>;
+export {};

package/dist/media.js

@@ -0,0 +1,270 @@
+import { canonicalJson } from "./persistence.js";
+export const mediaOperationStates = [
+    "preparing", "ready", "blocked_in_use", "bound", "finalizing", "completed", "completed_with_warning", "cancelled", "failed",
+];
+const terminal = new Set(["completed", "cancelled"]);
+const transitions = {
+    preparing: ["ready", "failed", "cancelled"],
+    ready: ["blocked_in_use", "bound", "failed", "cancelled"],
+    blocked_in_use: ["ready", "failed", "cancelled"],
+    bound: ["finalizing", "failed"],
+    finalizing: ["completed", "completed_with_warning", "failed"],
+    completed_with_warning: ["finalizing"],
+    failed: ["preparing", "cancelled"],
+};
+export function assertMediaTransition(from, to) {
+    if (!transitions[from]?.includes(to))
+        throw new Error("invalid_media_transition");
+}
+/** Pure durable-intent model. Object storage effects deliberately live outside
+ * it: an R2 copy may be retried, but no state transition may make a public
+ * release point at a source key that has already been removed. */
+export class MediaOperationKernel {
+    operations = new Map();
+    sourceOwners = new Map();
+    create(input) {
+        const existing = this.operations.get(input.operationId);
+        if (existing) {
+            if (existing.requestChecksum !== input.requestChecksum)
+                throw new Error("duplicate_request");
+            return existing;
+        }
+        if (!input.sourceKeys.length || new Set(input.sourceKeys).size !== input.sourceKeys.length || input.sourceKeys.some((key) => !key)) {
+            throw new Error("invalid_media_operation");
+        }
+        if (input.sourceKeys.some((key) => this.sourceOwners.has(key)))
+            throw new Error("media_source_busy");
+        const operation = { ...input, sourceKeys: [...input.sourceKeys], state: "preparing", boundReleaseId: null };
+        this.operations.set(operation.operationId, operation);
+        for (const key of operation.sourceKeys)
+            this.sourceOwners.set(key, operation.operationId);
+        return operation;
+    }
+    transition(operationId, to) {
+        const operation = this.required(operationId);
+        assertMediaTransition(operation.state, to);
+        const updated = { ...operation, state: to };
+        this.operations.set(operationId, updated);
+        if (terminal.has(to))
+            this.releaseSources(updated);
+        return updated;
+    }
+    bind(operationId, releaseId) {
+        const operation = this.required(operationId);
+        if (!releaseId || operation.state !== "ready" || operation.boundReleaseId)
+            throw new Error("media_operation_unavailable");
+        const updated = { ...operation, state: "bound", boundReleaseId: releaseId };
+        this.operations.set(operationId, updated);
+        return updated;
+    }
+    /** Discard never rolls content backwards. It only makes a pending destructive
+     * operation visibly unsafe until a later release removes that source again. */
+    markBlockedWhenReintroduced(sourceKeys) {
+        const affected = new Set();
+        for (const key of sourceKeys) {
+            const owner = this.sourceOwners.get(key);
+            if (owner)
+                affected.add(owner);
+        }
+        const blocked = [];
+        for (const operationId of affected) {
+            const operation = this.required(operationId);
+            if (operation.state === "ready")
+                blocked.push(this.transition(operationId, "blocked_in_use"));
+        }
+        return blocked;
+    }
+    cancel(operationId) {
+        const operation = this.required(operationId);
+        if (operation.boundReleaseId || !["preparing", "ready", "blocked_in_use", "failed"].includes(operation.state)) {
+            throw new Error("media_operation_unavailable");
+        }
+        return this.transition(operationId, "cancelled");
+    }
+    required(operationId) {
+        const operation = this.operations.get(operationId);
+        if (!operation)
+            throw new Error("media_operation_not_found");
+        return operation;
+    }
+    releaseSources(operation) {
+        for (const key of operation.sourceKeys) {
+            if (this.sourceOwners.get(key) === operation.operationId)
+                this.sourceOwners.delete(key);
+        }
+    }
+}
+/** SQL journal adapter. R2 copy/delete happens around this adapter; it never
+ * infers an object as removable simply because a caller stopped mentioning it. */
+export class D1MediaOperationRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async create(input) {
+        if (!input.entries.length || new Set(input.entries.map((entry) => entry.entryId)).size !== input.entries.length
+            || new Set(input.entries.map((entry) => entry.sourceKey)).size !== input.entries.length)
+            throw new Error("invalid_media_operation");
+        const existing = await this.db.prepare("SELECT request_checksum AS requestChecksum FROM media_operations WHERE operation_id = ?")
+            .bind(input.operationId).first();
+        if (existing) {
+            if (existing.requestChecksum !== input.requestChecksum)
+                throw new Error("duplicate_request");
+            return "repeated";
+        }
+        const statements = [this.db.prepare(`INSERT INTO media_operations
+      (operation_id, request_checksum, type, state, source_prefix, destination_prefix, created_by_subject, created_at, updated_at)
+      VALUES (?, ?, ?, 'preparing', ?, ?, ?, ?, ?)`)
+                .bind(input.operationId, input.requestChecksum, input.type, input.sourcePrefix ?? null, input.destinationPrefix ?? null, input.authorSubject, input.now, input.now)];
+        for (const entry of input.entries) {
+            statements.push(this.db.prepare(`INSERT INTO media_operation_entries
+        (operation_id, entry_id, source_key, destination_key, object_checksum, etag, metadata_json, preparation_state, finalization_state)
+        VALUES (?, ?, ?, ?, ?, ?, ?, 'pending', 'pending')`)
+                .bind(input.operationId, entry.entryId, entry.sourceKey, entry.destinationKey ?? null, entry.objectChecksum ?? null, entry.etag ?? null, entry.metadataJson ?? null));
+        }
+        const results = await this.db.batch(statements);
+        if (results.some((result) => result.meta?.changes !== 1))
+            throw new Error("media_operation_unavailable");
+        return "created";
+    }
+    async bind(operationId, releaseId, now) {
+        /* A D1 batch is transactional. The first statement cannot change anything
+         * unless the candidate release is still publishing; the second can only
+         * observe that guarded `bound` state from the same transaction. */
+        const claim = this.db.prepare(`UPDATE media_operations SET state = 'bound', updated_at = ?
+      WHERE operation_id = ? AND state = 'ready'
+        AND EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'publishing')
+        AND NOT EXISTS (SELECT 1 FROM content_release_media_operations WHERE operation_id = ?)`)
+            .bind(now, operationId, releaseId, operationId);
+        const binding = this.db.prepare(`INSERT INTO content_release_media_operations (release_id, operation_id)
+      SELECT ?, ? WHERE EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'bound')
+        AND EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'publishing')`)
+            .bind(releaseId, operationId, operationId, releaseId);
+        const results = await this.db.batch([claim, binding]);
+        if (results[0]?.meta?.changes !== 1 || results[1]?.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+    }
+    /** Called only after a copy-first R2 effect has been checksum-verified. A
+     * destination is therefore durable before an operation ever becomes ready
+     * for a release binding. */
+    async recordPreparedEntry(input) {
+        const entry = this.db.prepare(`UPDATE media_operation_entries
+      SET object_checksum = ?, etag = ?, metadata_json = ?, preparation_state = 'ready'
+      WHERE operation_id = ? AND entry_id = ? AND preparation_state = 'pending'
+        AND EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'preparing')`)
+            .bind(input.objectChecksum, input.etag, input.metadataJson, input.operationId, input.entryId, input.operationId);
+        const ready = this.db.prepare(`UPDATE media_operations SET state = 'ready', updated_at = ?
+      WHERE operation_id = ? AND state = 'preparing' AND NOT EXISTS (SELECT 1 FROM media_operation_entries
+        WHERE operation_id = ? AND preparation_state != 'ready')`)
+            .bind(input.now, input.operationId, input.operationId);
+        const results = await this.db.batch([entry, ready]);
+        if (results[0]?.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+        return results[1]?.meta?.changes === 1 ? "ready" : "pending";
+    }
+    async beginFinalization(operationId, releaseId, now) {
+        const result = await this.db.prepare(`UPDATE media_operations SET state = 'finalizing', updated_at = ?
+      WHERE operation_id = ? AND state = 'bound' AND EXISTS (SELECT 1 FROM content_release_media_operations
+        WHERE operation_id = ? AND release_id = ?) AND EXISTS (SELECT 1 FROM content_releases
+        WHERE release_id = ? AND status = 'published')`)
+            .bind(now, operationId, operationId, releaseId, releaseId).run();
+        if (result.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+    }
+    /** Individual cleanup writes are retryable. A single failed entry reaches
+     * `completed_with_warning` only after every entry has a terminal result;
+     * the already-live release is never rolled back. */
+    async recordFinalizedEntry(input) {
+        const entry = this.db.prepare(`UPDATE media_operation_entries SET finalization_state = ?, safe_error = ?
+      WHERE operation_id = ? AND entry_id = ? AND finalization_state = 'pending'
+        AND EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'finalizing')`)
+            .bind(input.outcome, input.safeError ?? null, input.operationId, input.entryId, input.operationId);
+        const finish = this.db.prepare(`UPDATE media_operations SET state = CASE WHEN EXISTS (SELECT 1 FROM media_operation_entries
+        WHERE operation_id = ? AND finalization_state = 'failed') THEN 'completed_with_warning' ELSE 'completed' END,
+      updated_at = ? WHERE operation_id = ? AND state = 'finalizing' AND NOT EXISTS (SELECT 1 FROM media_operation_entries
+        WHERE operation_id = ? AND finalization_state = 'pending')`)
+            .bind(input.operationId, input.now, input.operationId, input.operationId);
+        const results = await this.db.batch([entry, finish]);
+        if (results[0]?.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+        if (results[1]?.meta?.changes !== 1)
+            return "pending";
+        return "settled";
+    }
+    async blockReintroducedSources(sourceKeys, now) {
+        if (!sourceKeys.length || sourceKeys.some((key) => !key))
+            return 0;
+        const statements = sourceKeys.map((sourceKey) => this.db.prepare(`UPDATE media_operations SET state = 'blocked_in_use', updated_at = ?
+      WHERE state = 'ready' AND EXISTS (SELECT 1 FROM media_operation_entries
+        WHERE operation_id = media_operations.operation_id AND source_key = ? AND finalization_state = 'pending')`)
+            .bind(now, sourceKey));
+        const results = await this.db.batch(statements);
+        return results.reduce((count, result) => count + Number(result.meta?.changes ?? 0), 0);
+    }
+    async cancel(operationId, now) {
+        const cancel = this.db.prepare(`UPDATE media_operations SET state = 'cancelled', updated_at = ?
+      WHERE operation_id = ? AND state IN ('preparing', 'ready', 'blocked_in_use', 'failed')
+        AND NOT EXISTS (SELECT 1 FROM content_release_media_operations WHERE operation_id = ?)`)
+            .bind(now, operationId, operationId);
+        const entries = this.db.prepare(`UPDATE media_operation_entries SET finalization_state = 'cancelled'
+      WHERE operation_id = ? AND EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'cancelled')`)
+            .bind(operationId, operationId);
+        const results = await this.db.batch([cancel, entries]);
+        if (results[0]?.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+    }
+}
+const MEDIA_CHECKSUM_METADATA = "adminkit-sha256";
+async function bytesChecksum(bytes) {
+    const digest = await crypto.subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** Copy-first R2 effect. No existing destination is overwritten: an identical
+ * prior copy is an idempotent retry, while any opaque collision stops safely. */
+export async function prepareMediaCopy(input) {
+    const source = await input.bucket.get(input.sourceKey);
+    if (!source)
+        throw new Error("media_source_missing");
+    const bytes = await source.arrayBuffer();
+    const checksum = await bytesChecksum(bytes);
+    const destination = await input.bucket.head(input.destinationKey);
+    if (destination && destination.customMetadata?.[MEDIA_CHECKSUM_METADATA] !== checksum) {
+        throw new Error("media_destination_collision");
+    }
+    if (!destination) {
+        await input.bucket.put(input.destinationKey, bytes, {
+            httpMetadata: source.httpMetadata,
+            customMetadata: { ...(source.customMetadata ?? {}), [MEDIA_CHECKSUM_METADATA]: checksum },
+        });
+    }
+    const verified = await input.bucket.head(input.destinationKey);
+    if (!verified || verified.customMetadata?.[MEDIA_CHECKSUM_METADATA] !== checksum)
+        throw new Error("media_copy_unverified");
+    return input.journal.recordPreparedEntry({
+        operationId: input.operationId, entryId: input.entryId, now: input.now, objectChecksum: checksum,
+        etag: verified.etag ?? null,
+        metadataJson: canonicalJson({ httpMetadata: source.httpMetadata ?? {}, customMetadata: source.customMetadata ?? {} }),
+    });
+}
+/** Cleanup starts only after the release is published. Failures are recorded as
+ * safe per-entry warnings, preserving the public source URL for a later retry. */
+export async function finalizeMediaSources(input) {
+    await input.journal.beginFinalization(input.operationId, input.releaseId, input.now);
+    let completed = 0;
+    let failed = 0;
+    for (const entry of input.entries) {
+        try {
+            await input.bucket.delete(entry.sourceKey);
+            await input.journal.recordFinalizedEntry({ operationId: input.operationId, entryId: entry.entryId, now: input.now, outcome: "completed" });
+            completed += 1;
+        }
+        catch {
+            await input.journal.recordFinalizedEntry({
+                operationId: input.operationId, entryId: entry.entryId, now: input.now, outcome: "failed",
+                safeError: "La pulizia del Media verrà ritentata.",
+            });
+            failed += 1;
+        }
+    }
+    return { completed, failed };
+}

package/dist/migrations/0001_content_persistence.sql

@@ -0,0 +1,128 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE content_documents (
+  document_id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL,
+  locale TEXT NOT NULL,
+  translation_group_id TEXT,
+  legacy_key TEXT UNIQUE,
+  draft_revision_id TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  abandoned_at INTEGER,
+  FOREIGN KEY (document_id, draft_revision_id) REFERENCES content_revisions(document_id, revision_id) DEFERRABLE INITIALLY DEFERRED
+);
+CREATE INDEX content_documents_kind_locale_live ON content_documents(kind, locale, abandoned_at);
+CREATE INDEX content_documents_translation_group ON content_documents(translation_group_id);
+
+CREATE TABLE content_revisions (
+  revision_id TEXT PRIMARY KEY,
+  document_id TEXT NOT NULL REFERENCES content_documents(document_id) ON DELETE RESTRICT,
+  base_revision_id TEXT,
+  payload_json TEXT,
+  is_tombstone INTEGER NOT NULL DEFAULT 0 CHECK (is_tombstone IN (0, 1)),
+  schema_version INTEGER NOT NULL CHECK (schema_version >= 1),
+  payload_checksum TEXT NOT NULL CHECK (length(payload_checksum) = 64 AND payload_checksum NOT GLOB '*[^0-9a-f]*'),
+  request_checksum TEXT NOT NULL CHECK (length(request_checksum) = 64 AND request_checksum NOT GLOB '*[^0-9a-f]*'),
+  author_subject TEXT NOT NULL,
+  author_label TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  UNIQUE (document_id, revision_id),
+  FOREIGN KEY (document_id, base_revision_id) REFERENCES content_revisions(document_id, revision_id) DEFERRABLE INITIALLY DEFERRED,
+  CHECK ((payload_json IS NOT NULL AND is_tombstone = 0) OR (payload_json IS NULL AND is_tombstone = 1))
+);
+CREATE INDEX content_revisions_document_created ON content_revisions(document_id, created_at);
+CREATE INDEX content_revisions_payload_checksum ON content_revisions(payload_checksum);
+CREATE TRIGGER content_revisions_immutable BEFORE UPDATE ON content_revisions
+BEGIN SELECT RAISE(ABORT, 'content revisions are immutable'); END;
+
+CREATE TABLE content_releases (
+  release_id TEXT PRIMARY KEY,
+  base_release_id TEXT REFERENCES content_releases(release_id) ON DELETE RESTRICT,
+  request_checksum TEXT NOT NULL UNIQUE,
+  status TEXT NOT NULL CHECK (status IN ('publishing', 'published', 'failed', 'superseded')),
+  active_slot INTEGER UNIQUE CHECK ((status = 'publishing' AND active_slot = 1) OR (status != 'publishing' AND active_slot IS NULL)),
+  manifest_checksum TEXT NOT NULL CHECK (length(manifest_checksum) = 64 AND manifest_checksum NOT GLOB '*[^0-9a-f]*'),
+  schema_package_version TEXT NOT NULL,
+  materializer_version TEXT NOT NULL,
+  created_by_subject TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  finished_at INTEGER,
+  error_code TEXT,
+  error_stage TEXT,
+  safe_message TEXT,
+  diagnostic_id TEXT
+);
+CREATE TABLE content_release_entries (
+  release_id TEXT NOT NULL REFERENCES content_releases(release_id) ON DELETE RESTRICT,
+  document_id TEXT NOT NULL,
+  revision_id TEXT NOT NULL,
+  PRIMARY KEY (release_id, document_id),
+  FOREIGN KEY (document_id, revision_id) REFERENCES content_revisions(document_id, revision_id) ON DELETE RESTRICT
+);
+CREATE TRIGGER content_releases_candidate_immutable
+BEFORE UPDATE OF base_release_id, request_checksum, manifest_checksum, schema_package_version, materializer_version, created_by_subject, created_at ON content_releases
+BEGIN SELECT RAISE(ABORT, 'release candidate fields are immutable'); END;
+CREATE TRIGGER content_release_entries_immutable BEFORE UPDATE ON content_release_entries
+BEGIN SELECT RAISE(ABORT, 'release entries are immutable'); END;
+CREATE TABLE content_site_state (
+  singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+  current_release_id TEXT REFERENCES content_releases(release_id) ON DELETE RESTRICT,
+  current_code_sha TEXT,
+  current_pages_deployment_id TEXT,
+  current_fingerprint TEXT,
+  schema_generation INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE production_deployment_attempts (
+  attempt_id TEXT PRIMARY KEY,
+  intent_kind TEXT NOT NULL CHECK (intent_kind IN ('content', 'code')),
+  requested_release_id TEXT REFERENCES content_releases(release_id) ON DELETE RESTRICT,
+  requested_code_sha TEXT,
+  code_sha TEXT,
+  release_id TEXT REFERENCES content_releases(release_id) ON DELETE RESTRICT,
+  github_run_id TEXT, github_attempt INTEGER,
+  pages_project TEXT, pages_deployment_id TEXT, deployment_url TEXT, canonical_hostname TEXT, expected_fingerprint TEXT,
+  phase TEXT NOT NULL CHECK (phase IN ('waiting','validating','materializing','building','deploying','verifying_deployment_url','verifying_canonical','succeeded','failed','ambiguous','superseded')),
+  error_code TEXT, error_stage TEXT, safe_message TEXT, diagnostic_id TEXT,
+  created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, finished_at INTEGER
+);
+CREATE INDEX deployment_attempts_release ON production_deployment_attempts(release_id);
+CREATE INDEX deployment_attempts_phase ON production_deployment_attempts(phase);
+
+CREATE TABLE media_operations (
+  operation_id TEXT PRIMARY KEY, request_checksum TEXT NOT NULL UNIQUE,
+  type TEXT NOT NULL CHECK (type IN ('move','delete')),
+  state TEXT NOT NULL CHECK (state IN ('preparing','ready','blocked_in_use','bound','finalizing','completed','completed_with_warning','cancelled','failed')),
+  source_prefix TEXT, destination_prefix TEXT, created_by_subject TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL,
+  error_code TEXT, error_stage TEXT, safe_message TEXT, diagnostic_id TEXT, retry_count INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE media_operation_entries (
+  operation_id TEXT NOT NULL REFERENCES media_operations(operation_id) ON DELETE RESTRICT,
+  entry_id TEXT NOT NULL, source_key TEXT NOT NULL, destination_key TEXT, object_checksum TEXT, etag TEXT, metadata_json TEXT,
+  preparation_state TEXT NOT NULL, finalization_state TEXT NOT NULL, safe_error TEXT,
+  PRIMARY KEY (operation_id, entry_id)
+);
+CREATE UNIQUE INDEX media_operation_entries_active_source ON media_operation_entries(source_key)
+  WHERE finalization_state NOT IN ('completed', 'cancelled');
+CREATE TABLE content_release_media_operations (
+  release_id TEXT NOT NULL REFERENCES content_releases(release_id) ON DELETE RESTRICT,
+  operation_id TEXT NOT NULL REFERENCES media_operations(operation_id) ON DELETE RESTRICT,
+  PRIMARY KEY (release_id, operation_id)
+);
+
+CREATE TABLE content_import_runs (
+  import_id TEXT PRIMARY KEY, request_checksum TEXT NOT NULL UNIQUE, source_main_sha TEXT NOT NULL, source_draft_sha TEXT NOT NULL,
+  importer_version TEXT NOT NULL, schema_version TEXT NOT NULL, canonical_checksum TEXT NOT NULL, counts_json TEXT NOT NULL,
+  result TEXT NOT NULL, diagnostic_id TEXT, created_at INTEGER NOT NULL
+);
+CREATE TABLE erasure_jobs (
+  job_id TEXT PRIMARY KEY, request_checksum TEXT NOT NULL UNIQUE, scope_hash TEXT NOT NULL, confirmations_json TEXT NOT NULL,
+  application_erased_at INTEGER, provider_recovery_expiry_not_before INTEGER, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL
+);
+CREATE TABLE erasure_job_steps (
+  job_id TEXT NOT NULL REFERENCES erasure_jobs(job_id) ON DELETE RESTRICT, step_id TEXT NOT NULL,
+  system TEXT NOT NULL, result TEXT NOT NULL, counts_json TEXT NOT NULL, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL,
+  PRIMARY KEY (job_id, step_id)
+);

package/dist/migrations/0002_content_ci_claims.sql

@@ -0,0 +1,6 @@
+ALTER TABLE production_deployment_attempts ADD COLUMN ci_claim_token_checksum TEXT
+  CHECK (ci_claim_token_checksum IS NULL OR (length(ci_claim_token_checksum) = 64 AND ci_claim_token_checksum NOT GLOB '*[^0-9a-f]*'));
+ALTER TABLE production_deployment_attempts ADD COLUMN ci_claimed_at INTEGER;
+ALTER TABLE production_deployment_attempts ADD COLUMN ci_claim_expires_at INTEGER;
+CREATE INDEX deployment_attempts_claim_expiry ON production_deployment_attempts(ci_claim_expires_at)
+  WHERE ci_claim_expires_at IS NOT NULL;

package/dist/migrations/0003_deployment_lane.sql

@@ -0,0 +1,5 @@
+ALTER TABLE production_deployment_attempts ADD COLUMN active_slot INTEGER
+  CHECK ((phase IN ('waiting','validating','materializing','building','deploying','verifying_deployment_url','verifying_canonical') AND active_slot = 1)
+    OR (phase IN ('succeeded','failed','ambiguous','superseded') AND active_slot IS NULL));
+CREATE UNIQUE INDEX deployment_attempts_one_active_lane ON production_deployment_attempts(active_slot)
+  WHERE active_slot = 1;