@cardinali-studio/adminkit 2.2.10 → 2.2.12

package/dist/functions/api/assets/move.js

@@ -14,6 +14,8 @@ import { mediaUrl } from "../../_shared/refs.js";
 import { rewriteMediaReferences } from "../../_shared/media-content.js";
 import { getBase } from "../../_shared/github.js";
 import { finalizePendingMedia, recordPendingMedia } from "../../_shared/pending-media.js";
+import { contentPersistenceMode } from "../../site.js";
+import { d1MoveMedia } from "../../_shared/d1-media.js";
 
 function mediaKey(url) {
   if (typeof url !== "string" || !url.startsWith("/media/")) return null;
@@ -128,8 +130,27 @@ async function confirmRewrittenCommit(env, commitSha) {
   }
 }
 
-export async function onRequestPost({ request, env }) {
+export async function onRequestPost({ request, env, data }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
+  let body;
+  try { body = await request.json(); } catch { return json({ ok: false, error: "JSON non valido" }, 400); }
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return json({ ok: false, error: "Corpo richiesta non valido" }, 400);
+  }
+
+  if (contentPersistenceMode() === "d1") {
+    /* The former two-step Git protocol must never become a second editorial
+     * writer after cutover. A stale browser's applyRefs call is harmless: the
+     * first D1 command already created the revisions and journal intent. */
+    if (Object.hasOwn(body, "applyRefs")) return json({ ok: true, moved: 0, pagesUpdated: [], failed: [], d1: true });
+    try {
+      const result = await d1MoveMedia({ env, data, body });
+      return json({ ok: true, ...result, pagesUpdated: result.documents.map((document) => document.kind), failed: [], warning: "Le sorgenti restano disponibili fino alla pubblicazione." });
+    } catch (error) {
+      const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_source_busy" ? "media_source_busy" : "media_operation_unavailable";
+      return json({ ok: false, code, error: code === "media_source_busy" ? "Questo Media è già in un'operazione in corso." : "Non riesco a registrare l'operazione Media D1." }, code === "unauthenticated" ? 401 : 409);
+    }
+  }
   if (!env.GITHUB_TOKEN || !env.GITHUB_REPO) {
     return json({
       ok: false,
@@ -137,11 +158,6 @@ export async function onRequestPost({ request, env }) {
       error: "Non posso spostare media senza aggiornare i riferimenti nel sito.",
     }, 503);
   }
-  let body;
-  try { body = await request.json(); } catch { return json({ ok: false, error: "JSON non valido" }, 400); }
-  if (!body || typeof body !== "object" || Array.isArray(body)) {
-    return json({ ok: false, error: "Corpo richiesta non valido" }, 400);
-  }
 
   /* Seconda fase: le copie esistono già. Prima le verifichiamo TUTTE, poi aggiorniamo il repo,
    * infine cancelliamo gli originali. */

package/dist/functions/api/assets/settings.js

@@ -0,0 +1,40 @@
+/* GET/POST /admin/api/assets/settings — preferenze condivise della libreria Media.
+ *
+ * Vivono nello stesso bucket delle immagini: sono per sito, visibili da qualunque browser e
+ * non richiedono un commit/build per cambiare un comportamento del solo pannello.
+ */
+import { json } from "../../_shared/assets.js";
+
+const KEY = "_adminkit/settings.json";
+const defaults = { autoWebp: true };
+
+async function read(env) {
+  const object = await env.MEDIA.get(KEY);
+  if (!object) return defaults;
+  try {
+    const stored = await object.json();
+    return { autoWebp: stored?.autoWebp !== false };
+  } catch {
+    return defaults;
+  }
+}
+
+export async function onRequestGet({ env }) {
+  if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
+  return json({ ok: true, settings: await read(env) });
+}
+
+export async function onRequestPost({ request, env }) {
+  if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
+  let body;
+  try { body = await request.json(); }
+  catch { return json({ ok: false, error: "JSON non valido" }, 400); }
+  if (typeof body?.autoWebp !== "boolean") {
+    return json({ ok: false, error: "autoWebp deve essere booleano" }, 400);
+  }
+  const settings = { autoWebp: body.autoWebp };
+  await env.MEDIA.put(KEY, JSON.stringify(settings), {
+    httpMetadata: { contentType: "application/json" },
+  });
+  return json({ ok: true, settings });
+}

package/dist/functions/api/assets/upload.js

@@ -22,7 +22,10 @@ export async function onRequestPost({ request, env }) {
 
   // data di scatto (EXIF) per l'ordinamento "Data scatto"
   const custom = {};
-  if (ctype === "image/jpeg") {
+  const suppliedCapturedAt = request.headers.get("X-Captured-At") || "";
+  if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}$/.test(suppliedCapturedAt)) {
+    custom.capturedAt = suppliedCapturedAt;
+  } else if (ctype === "image/jpeg") {
     const cap = extractCapturedAt(body);
     if (cap) custom.capturedAt = cap;
   }

package/dist/functions/api/assets/usage.js

@@ -7,10 +7,11 @@ import { mediaUrl } from "../../_shared/refs.js";
 import {
   readMediaSources, summarizeMediaUsage, planMediaRewrite,
 } from "../../_shared/media-content.js";
+import { contentPersistenceMode } from "../../site.js";
+import { d1MediaUsage } from "../../_shared/d1-media.js";
 
 export async function onRequestPost({ request, env }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
-  if (!env.GITHUB_TOKEN || !env.GITHUB_REPO) return json({ ok: false, error: "backend GitHub non configurato" }, 500);
   let body;
   try { body = await request.json(); } catch { return json({ ok: false, error: "JSON non valido" }, 400); }
   if (!body || typeof body !== "object" || Array.isArray(body)) {
@@ -27,6 +28,9 @@ export async function onRequestPost({ request, env }) {
       return json({ ok: true, usage: {}, pages: [], count: 0, selectedCount: 0, blockers: [] });
     }
 
+    if (contentPersistenceMode() === "d1") return json({ ok: true, ...(await d1MediaUsage(env.CONTENT_DB, keyList)) });
+    if (!env.GITHUB_TOKEN || !env.GITHUB_REPO) return json({ ok: false, error: "backend GitHub non configurato" }, 500);
+
     const { sources } = await readMediaSources(env);
     const summary = summarizeMediaUsage(sources, keyList, mediaUrl);
     const plan = planMediaRewrite(sources, { removeUrls: keyList.map(mediaUrl) });

package/dist/functions/api/assets.js

@@ -4,6 +4,8 @@
 import { isPrefix, json, listKeysUnder } from "../_shared/assets.js";
 import { sizeFromBucket } from "../_shared/imagesize.js";
 import { pendingSourceKeys } from "../_shared/pending-media.js";
+import { contentPersistenceMode } from "../site.js";
+import { d1PendingSourceKeys } from "../_shared/d1-media.js";
 
 const IMG = /\.(webp|jpe?g|png|avif|gif)$/i;
 
@@ -12,7 +14,7 @@ export async function onRequestGet({ request, env }) {
   const url = new URL(request.url);
   let prefix = (url.searchParams.get("prefix") || "").trim();
   if (!isPrefix(prefix)) return json({ ok: false, error: `prefisso non valido: ${prefix}` }, 400);
-  const pending = await pendingSourceKeys(env.MEDIA);
+  const pending = contentPersistenceMode() === "d1" ? await d1PendingSourceKeys(env.CONTENT_DB) : await pendingSourceKeys(env.MEDIA);
 
   /* `recursive=1` guarda TUTTO quello che c'è sotto, a qualunque profondità: serve a chi deve
    * spostare o cancellare una cartella intera, che altrimenti si porterebbe dietro solo il primo
@@ -23,7 +25,8 @@ export async function onRequestGet({ request, env }) {
     const subPrefixes = new Set();
     const files = [];
     for (const k of all) {
-      if (k.startsWith("_trash/") || k.startsWith("_pending-media/") || pending.has(k)) continue;
+      if (k.startsWith("_trash/") || k.startsWith("_pending-media/") ||
+          k.startsWith("_adminkit/") || pending.has(k)) continue;
       const rel = k.slice(prefix.length);
       const cut = rel.lastIndexOf("/");
       if (cut >= 0) {
@@ -46,7 +49,7 @@ export async function onRequestGet({ request, env }) {
   // suo `.keep` (vedi assets/folder.js). Chi non ce l'ha mostra lo slug, come sempre.
   const folders = await Promise.all(
     (listed.delimitedPrefixes || [])
-      .filter((p) => p !== "_trash/" && p !== "_pending-media/")
+      .filter((p) => p !== "_trash/" && p !== "_pending-media/" && p !== "_adminkit/")
       .map(async (p) => {
         const keep = await env.MEDIA.head(p + ".keep");
         return {
@@ -64,7 +67,7 @@ export async function onRequestGet({ request, env }) {
   // oggi. È un ripiego, non la strada normale: una volta ricaricate, il ramo non scatta più.
   const raw = (listed.objects || [])
     .filter((o) => o.key !== prefix && !o.key.endsWith("/.keep") && !o.key.endsWith("/") &&
-      !o.key.startsWith("_pending-media/") && !pending.has(o.key));
+      !o.key.startsWith("_pending-media/") && !o.key.startsWith("_adminkit/") && !pending.has(o.key));
 
   const files = await Promise.all(raw.map(async (o) => {
     const cm = o.customMetadata || {};

package/dist/functions/api/content-ci.js

@@ -5,6 +5,7 @@ import {
   isTerminalDeploymentPhase,
 } from "../../deployment.js";
 import { deploymentFingerprint, releaseExportFromStored } from "../../release.js";
+import { finalizeD1MediaRelease } from "../_shared/d1-media.js";
 
 const MAX_BODY_BYTES = 8_000;
 const claimLifetimeMs = 20 * 60 * 1_000;
@@ -147,7 +148,13 @@ export async function handleInternalContentCi({ request, env }) {
     }
     if (path === "/internal/deployment/finalize" && request.method === "POST") {
       await attempts.finalize({ ...identity, intentKind: attempt.intentKind, tokenChecksum: checksum, now });
-      return response({ ok: true, attempt: { ...identity, phase: "succeeded" } });
+      /* The release is already authoritative once this returns. Media cleanup
+       * is deliberately best-effort and journaled: a warning must not pretend
+       * to roll back a verified public deployment. */
+      const media = attempt.intentKind === "content"
+        ? await finalizeD1MediaRelease({ env, releaseId: identity.releaseId, now }).catch(() => ({ completed: 0, failed: 0, warning: true }))
+        : undefined;
+      return response({ ok: true, attempt: { ...identity, phase: "succeeded" }, ...(media ? { media } : {}) });
     }
     if (path === "/internal/deployment/fail" && request.method === "POST") {
       const detail = failure[input.code];

package/dist/functions/api/site-access.js

@@ -0,0 +1,78 @@
+import { canonicalChecksum } from "../../persistence.js";
+import { createSiteAccessVersion, D1SiteAccessRepository } from "../../site-access.js";
+import { siteAccessId } from "../site.js";
+import { json } from "../_shared/assets.js";
+
+const MAX_BODY_BYTES = 2_000;
+const id = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function response(data, status = 200) {
+  const result = json(data, status);
+  result.headers.set("Cache-Control", "no-store");
+  return result;
+}
+
+function editor(data, env) {
+  const payload = data?.cloudflareAccess?.JWT?.payload;
+  if (payload?.sub) return { subject: String(payload.sub), label: String(payload.email || payload.name || "Admin").slice(0, 200) };
+  if (env.ADMIN_LOCAL === "1") return { subject: "local-preview", label: "Anteprima locale" };
+  throw new Error("unauthenticated");
+}
+
+function required(env) {
+  const siteId = siteAccessId();
+  if (!env.CONTENT_DB || !siteId) throw new Error("site_access_unavailable");
+  return { siteId, repository: new D1SiteAccessRepository(env.CONTENT_DB) };
+}
+
+function publicState(state) {
+  const clean = (value) => value ? { versionId: value.versionId, enabled: value.enabled, formatVersion: value.formatVersion } : null;
+  return { active: clean(state.active), draft: clean(state.draft), effective: clean(state.draft ?? state.active) };
+}
+
+function safeError(error) {
+  const code = error?.message;
+  const status = code === "unauthenticated" ? 401 : code === "invalid_request" || code === "invalid_site_access_password" ? 400
+    : code === "stale_site_access" ? 409 : 503;
+  const message = code === "unauthenticated" ? "Sessione non valida: ricarica la pagina per rientrare."
+    : code === "invalid_site_access_password" ? "La password deve contenere almeno 8 caratteri."
+      : code === "stale_site_access" ? "La protezione è stata modificata altrove: ricarica la pagina."
+        : status === 400 ? "Richiesta non valida." : "La gestione della password non è disponibile.";
+  return response({ ok: false, code: status >= 500 ? "site_access_unavailable" : code, error: message }, status);
+}
+
+export async function onRequestGet({ env, data }) {
+  try {
+    editor(data, env);
+    const { repository } = required(env);
+    await repository.initialize(Date.now());
+    return response({ ok: true, state: publicState(await repository.state()) });
+  } catch (error) { return safeError(error); }
+}
+
+export async function onRequestPost({ request, env, data }) {
+  try {
+    const origin = request.headers.get("Origin");
+    if (!origin || new URL(origin).origin !== new URL(request.url).origin) throw new Error("invalid_request");
+    if (Number(request.headers.get("Content-Length") || 0) > MAX_BODY_BYTES) throw new Error("invalid_request");
+    const raw = await request.text();
+    if (new TextEncoder().encode(raw).byteLength > MAX_BODY_BYTES) throw new Error("invalid_request");
+    const body = JSON.parse(raw);
+    const author = editor(data, env);
+    const { siteId, repository } = required(env);
+    await repository.initialize(Date.now());
+    if (body?.action === "discard") {
+      if (!id.test(body.expectedDraftVersionId || "")) throw new Error("invalid_request");
+      await repository.discard(body.expectedDraftVersionId, Date.now());
+      return response({ ok: true, discarded: true, state: publicState(await repository.state()) });
+    }
+    if (body?.action !== "save" || typeof body.enabled !== "boolean"
+      || (body.expectedDraftVersionId !== null && !id.test(body.expectedDraftVersionId || ""))) throw new Error("invalid_request");
+    const versionId = crypto.randomUUID();
+    const access = await createSiteAccessVersion({ versionId, siteId, enabled: body.enabled, password: body.password, keyring: env.SITE_ACCESS_KEYRING });
+    const requestChecksum = await canonicalChecksum({ action: "site-access.save", versionId, enabled: access.enabled, descriptorChecksum: access.descriptorChecksum });
+    await repository.saveDraft({ access, expectedDraftVersionId: body.expectedDraftVersionId, requestChecksum,
+      authorSubject: author.subject, authorLabel: author.label, now: Date.now() });
+    return response({ ok: true, saved: true, state: publicState(await repository.state()) });
+  } catch (error) { return safeError(error); }
+}

package/dist/functions/index.js

@@ -30,7 +30,9 @@ import * as assetsDelete from "./api/assets/delete.js";
 import * as assetsFolder from "./api/assets/folder.js";
 import * as assetsFolders from "./api/assets/folders.js";
 import * as assetsMove from "./api/assets/move.js";
+import * as assetsMedia from "./api/assets/media.js";
 import * as assetsPreview from "./api/assets/preview.js";
+import * as assetsSettings from "./api/assets/settings.js";
 import * as assetsTrash from "./api/assets/trash.js";
 import * as assetsTrashDelete from "./api/assets/trash/delete.js";
 import * as assetsTrashEmpty from "./api/assets/trash/empty.js";
@@ -49,6 +51,7 @@ import * as settings from "./api/settings.js";
 import * as singleton from "./api/singleton.js";
 import * as storage from "./api/storage.js";
 import * as content from "./api/content.js";
+import * as siteAccess from "./api/site-access.js";
 
 export { adminAccess } from "./_middleware.js";
 export { setServerConfig } from "./site.js";
@@ -66,7 +69,9 @@ const ROUTES = {
   "assets/folder": { mod: null, h: assetsFolder },
   "assets/folders": { mod: null, h: assetsFolders },
   "assets/move": { mod: null, h: assetsMove },
+  "assets/media": { mod: null, h: assetsMedia },
   "assets/preview": { mod: null, h: assetsPreview },
+  "assets/settings": { mod: null, h: assetsSettings },
   "assets/trash": { mod: null, h: assetsTrash },
   "assets/trash/delete": { mod: null, h: assetsTrashDelete },
   "assets/trash/empty": { mod: null, h: assetsTrashEmpty },
@@ -88,6 +93,7 @@ const ROUTES = {
   "content/document": { mod: null, h: content },
   "content/save": { mod: null, h: content },
   "content/discard": { mod: null, h: content },
+  "content/site-access": { mod: null, h: siteAccess },
 };
 
 const PREFIX = "/admin/api/";

package/dist/functions/site.js

@@ -58,6 +58,10 @@ export function contentPersistenceMode() {
   return current?.contentPersistence === "d1" ? "d1" : "github";
 }
 
+export function siteAccessId() {
+  return typeof current?.siteAccess?.siteId === "string" && current.siteAccess.siteId ? current.siteAccess.siteId : null;
+}
+
 /** D1 owns persistence, never a site's editorial meaning. A site explicitly
  * supplies both functions before its D1 mode can accept a write: one validates
  * (and may normalize) the complete document and the other produces the

package/dist/index.d.ts

@@ -14,3 +14,4 @@ export * from "./conflict.js";
 export * from "./release.js";
 export * from "./deployment.js";
 export * from "./media.js";
+export * from "./site-access.js";

package/dist/index.js

@@ -14,3 +14,4 @@ export * from "./conflict.js";
 export * from "./release.js";
 export * from "./deployment.js";
 export * from "./media.js";
+export * from "./site-access.js";

package/dist/media.d.ts

@@ -52,6 +52,30 @@ export type CreateMediaOperation = Readonly<{
     now: number;
     entries: readonly MediaOperationEntryInput[];
 }>;
+export type BoundMediaEntry = Readonly<{
+    operationId: string;
+    type: MediaOperationType;
+    operationState: MediaOperationState;
+    entryId: string;
+    sourceKey: string;
+    destinationKey: string | null;
+    finalizationState: "pending" | "completed" | "failed" | "cancelled";
+}>;
+export type MediaOperationStatus = Readonly<{
+    operationId: string;
+    type: MediaOperationType;
+    state: MediaOperationState;
+    releaseId: string | null;
+    updatedAt: number;
+    failedEntries: number;
+}>;
+export type StoredMediaOperationEntry = Readonly<{
+    entryId: string;
+    sourceKey: string;
+    destinationKey: string | null;
+    preparationState: string;
+    finalizationState: string;
+}>;
 /** SQL journal adapter. R2 copy/delete happens around this adapter; it never
  * infers an object as removable simply because a caller stopped mentioning it. */
 export declare class D1MediaOperationRepository {
@@ -83,6 +107,34 @@ export declare class D1MediaOperationRepository {
     }): Promise<"pending" | "settled">;
     blockReintroducedSources(sourceKeys: readonly string[], now: number): Promise<number>;
     cancel(operationId: string, now: number): Promise<void>;
+    /** Sources are hidden from the normal library only while an unresolved
+     * operation owns them. The query deliberately never derives removability
+     * from this list. */
+    activeSourceKeys(): Promise<readonly string[]>;
+    /** Candidates bind every ready operation whose source has been rewritten;
+     * the release repository repeats the frozen-manifest no-source guard in the
+     * same transaction as the binding. */
+    readyOperationIds(): Promise<readonly string[]>;
+    /** A Discard block is reversible only when the current effective documents
+     * no longer contain any owned source. Re-evaluation changes journal state;
+     * it never synthesizes or rewrites content. */
+    refreshBlockedOperations(now: number): Promise<number>;
+    statuses(): Promise<readonly MediaOperationStatus[]>;
+    entries(operationId: string): Promise<readonly StoredMediaOperationEntry[]>;
+    /** Work is named by its immutable release binding: there is intentionally no
+     * "latest operation" cleanup path. */
+    finalizationWork(releaseId: string): Promise<readonly BoundMediaEntry[]>;
+    /** A warning is a live release with incomplete housekeeping. Retrying resets
+     * only failed effects, never an already-completed entry. */
+    resumeFinalization(operationId: string, releaseId: string, now: number): Promise<void>;
+    readyDeleteEntry(input: {
+        operationId: string;
+        entryId: string;
+        now: number;
+        objectChecksum: string;
+        etag: string | null;
+        metadataJson: string | null;
+    }): Promise<"pending" | "ready">;
 }
 type R2Metadata = Record<string, string>;
 export type MediaR2Object = {

package/dist/media.js

@@ -164,7 +164,7 @@ export class D1MediaOperationRepository {
     }
     async beginFinalization(operationId, releaseId, now) {
         const result = await this.db.prepare(`UPDATE media_operations SET state = 'finalizing', updated_at = ?
-      WHERE operation_id = ? AND state = 'bound' AND EXISTS (SELECT 1 FROM content_release_media_operations
+      WHERE operation_id = ? AND state IN ('bound', 'finalizing') AND EXISTS (SELECT 1 FROM content_release_media_operations
         WHERE operation_id = ? AND release_id = ?) AND EXISTS (SELECT 1 FROM content_releases
         WHERE release_id = ? AND status = 'published')`)
             .bind(now, operationId, operationId, releaseId, releaseId).run();
@@ -213,6 +213,108 @@ export class D1MediaOperationRepository {
         if (results[0]?.meta?.changes !== 1)
             throw new Error("media_operation_unavailable");
     }
+    /** Sources are hidden from the normal library only while an unresolved
+     * operation owns them. The query deliberately never derives removability
+     * from this list. */
+    async activeSourceKeys() {
+        const rows = (await this.db.prepare(`SELECT DISTINCT entry.source_key AS sourceKey
+      FROM media_operation_entries entry
+      JOIN media_operations operation ON operation.operation_id = entry.operation_id
+      WHERE operation.state IN ('ready', 'bound', 'finalizing', 'completed_with_warning')
+        AND entry.finalization_state NOT IN ('completed', 'cancelled')
+      ORDER BY entry.source_key`).all()).results ?? [];
+        return rows.map((row) => row.sourceKey);
+    }
+    /** Candidates bind every ready operation whose source has been rewritten;
+     * the release repository repeats the frozen-manifest no-source guard in the
+     * same transaction as the binding. */
+    async readyOperationIds() {
+        await this.refreshBlockedOperations(Date.now());
+        const rows = (await this.db.prepare("SELECT operation_id AS operationId FROM media_operations WHERE state = 'ready' ORDER BY operation_id")
+            .all()).results ?? [];
+        return rows.map((row) => row.operationId);
+    }
+    /** A Discard block is reversible only when the current effective documents
+     * no longer contain any owned source. Re-evaluation changes journal state;
+     * it never synthesizes or rewrites content. */
+    async refreshBlockedOperations(now) {
+        const result = await this.db.prepare(`UPDATE media_operations SET state = 'ready', updated_at = ?
+      WHERE state = 'blocked_in_use' AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+        JOIN content_documents document
+        LEFT JOIN content_revisions draft ON draft.document_id = document.document_id AND draft.revision_id = document.draft_revision_id
+        LEFT JOIN content_site_state site_state ON site_state.singleton = 1
+        LEFT JOIN content_release_entries published_entry ON published_entry.release_id = site_state.current_release_id
+          AND published_entry.document_id = document.document_id
+        LEFT JOIN content_revisions published ON published.document_id = published_entry.document_id
+          AND published.revision_id = published_entry.revision_id
+        WHERE source.operation_id = media_operations.operation_id
+          AND instr(COALESCE(draft.payload_json, published.payload_json, ''), '/media/' || source.source_key) > 0)`)
+            .bind(now).run();
+        return Number(result.meta?.changes ?? 0);
+    }
+    async statuses() {
+        return (await this.db.prepare(`SELECT operation.operation_id AS operationId, operation.type, operation.state,
+      binding.release_id AS releaseId, operation.updated_at AS updatedAt,
+      SUM(CASE WHEN entry.finalization_state = 'failed' THEN 1 ELSE 0 END) AS failedEntries
+      FROM media_operations operation
+      LEFT JOIN content_release_media_operations binding ON binding.operation_id = operation.operation_id
+      JOIN media_operation_entries entry ON entry.operation_id = operation.operation_id
+      WHERE operation.state NOT IN ('completed', 'cancelled')
+      GROUP BY operation.operation_id, operation.type, operation.state, binding.release_id, operation.updated_at
+      ORDER BY operation.updated_at DESC, operation.operation_id`).all()).results ?? [];
+    }
+    async entries(operationId) {
+        return (await this.db.prepare(`SELECT entry_id AS entryId, source_key AS sourceKey,
+      destination_key AS destinationKey, preparation_state AS preparationState,
+      finalization_state AS finalizationState
+      FROM media_operation_entries WHERE operation_id = ? ORDER BY entry_id`)
+            .bind(operationId).all()).results ?? [];
+    }
+    /** Work is named by its immutable release binding: there is intentionally no
+     * "latest operation" cleanup path. */
+    async finalizationWork(releaseId) {
+        const rows = (await this.db.prepare(`SELECT operation.operation_id AS operationId, operation.type, operation.state AS operationState,
+      entry.entry_id AS entryId, entry.source_key AS sourceKey, entry.destination_key AS destinationKey,
+      entry.finalization_state AS finalizationState
+      FROM content_release_media_operations binding
+      JOIN media_operations operation ON operation.operation_id = binding.operation_id
+      JOIN media_operation_entries entry ON entry.operation_id = operation.operation_id
+      WHERE binding.release_id = ? AND operation.state IN ('bound', 'finalizing', 'completed_with_warning')
+        AND entry.finalization_state IN ('pending', 'failed')
+      ORDER BY operation.operation_id, entry.entry_id`).bind(releaseId).all()).results ?? [];
+        return rows;
+    }
+    /** A warning is a live release with incomplete housekeeping. Retrying resets
+     * only failed effects, never an already-completed entry. */
+    async resumeFinalization(operationId, releaseId, now) {
+        const resume = this.db.prepare(`UPDATE media_operations SET state = 'finalizing', updated_at = ?, retry_count = retry_count + 1
+      WHERE operation_id = ? AND state = 'completed_with_warning'
+        AND EXISTS (SELECT 1 FROM content_release_media_operations WHERE operation_id = ? AND release_id = ?)
+        AND EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'published')`)
+            .bind(now, operationId, operationId, releaseId, releaseId);
+        const reset = this.db.prepare(`UPDATE media_operation_entries SET finalization_state = 'pending', safe_error = NULL
+      WHERE operation_id = ? AND finalization_state = 'failed'
+        AND EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'finalizing')`)
+            .bind(operationId, operationId);
+        const results = await this.db.batch([resume, reset]);
+        if (results[0]?.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+    }
+    async readyDeleteEntry(input) {
+        const entry = this.db.prepare(`UPDATE media_operation_entries
+      SET object_checksum = ?, etag = ?, metadata_json = ?, preparation_state = 'ready'
+      WHERE operation_id = ? AND entry_id = ? AND preparation_state = 'pending'
+        AND EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND type = 'delete' AND state = 'preparing')`)
+            .bind(input.objectChecksum, input.etag, input.metadataJson, input.operationId, input.entryId, input.operationId);
+        const ready = this.db.prepare(`UPDATE media_operations SET state = 'ready', updated_at = ?
+      WHERE operation_id = ? AND type = 'delete' AND state = 'preparing' AND NOT EXISTS (SELECT 1 FROM media_operation_entries
+        WHERE operation_id = ? AND preparation_state != 'ready')`)
+            .bind(input.now, input.operationId, input.operationId);
+        const results = await this.db.batch([entry, ready]);
+        if (results[0]?.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+        return results[1]?.meta?.changes === 1 ? "ready" : "pending";
+    }
 }
 const MEDIA_CHECKSUM_METADATA = "adminkit-sha256";
 async function bytesChecksum(bytes) {

package/dist/migrations/0004_site_access.sql

@@ -0,0 +1,41 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE site_access_versions (
+  version_id TEXT PRIMARY KEY,
+  state TEXT NOT NULL CHECK (state IN ('draft','active','superseded','expired','erased')),
+  enabled INTEGER NOT NULL CHECK (enabled IN (0, 1)),
+  format_version INTEGER NOT NULL CHECK (format_version = 1),
+  key_id TEXT,
+  nonce TEXT,
+  ciphertext TEXT,
+  request_checksum TEXT NOT NULL UNIQUE CHECK (length(request_checksum) = 64 AND request_checksum NOT GLOB '*[^0-9a-f]*'),
+  created_by_subject TEXT NOT NULL,
+  created_by_label TEXT NOT NULL,
+  created_at INTEGER NOT NULL,
+  activated_at INTEGER,
+  superseded_at INTEGER,
+  rollback_expires_at INTEGER,
+  erased_at INTEGER,
+  CHECK ((enabled = 0 AND key_id IS NULL AND nonce IS NULL AND ciphertext IS NULL)
+    OR (enabled = 1 AND key_id IS NOT NULL AND nonce IS NOT NULL AND ciphertext IS NOT NULL))
+);
+CREATE UNIQUE INDEX site_access_one_draft ON site_access_versions(state) WHERE state = 'draft';
+CREATE UNIQUE INDEX site_access_one_active ON site_access_versions(state) WHERE state = 'active';
+CREATE TRIGGER site_access_versions_immutable
+BEFORE UPDATE OF version_id, enabled, format_version, key_id, nonce, ciphertext, request_checksum,
+  created_by_subject, created_by_label, created_at ON site_access_versions
+BEGIN SELECT RAISE(ABORT, 'site access version fields are immutable'); END;
+
+CREATE TABLE site_access_state (
+  singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+  active_version_id TEXT REFERENCES site_access_versions(version_id) ON DELETE RESTRICT,
+  draft_version_id TEXT REFERENCES site_access_versions(version_id) ON DELETE RESTRICT,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE content_release_site_access (
+  release_id TEXT PRIMARY KEY REFERENCES content_releases(release_id) ON DELETE RESTRICT,
+  version_id TEXT NOT NULL REFERENCES site_access_versions(version_id) ON DELETE RESTRICT
+);
+CREATE TRIGGER content_release_site_access_immutable BEFORE UPDATE ON content_release_site_access
+BEGIN SELECT RAISE(ABORT, 'release site access binding is immutable'); END;

package/dist/persistence.d.ts

@@ -115,6 +115,11 @@ export type ReleaseInput = {
         documentId: string;
         revisionId: string;
     }[];
+    /** Operations are bound in the same D1 transaction as the immutable
+     * manifest. The SQL guard rejects any candidate still containing a source
+     * URL, so a caller cannot make cleanup race a public reference. */
+    mediaOperationIds?: readonly string[];
+    siteAccessVersionId?: string | null;
 };
 export type ReleaseDeploymentInput = ReleaseInput & {
     attempt: {
@@ -157,6 +162,11 @@ export declare class D1ContentRepository {
      * no "latest" variant: a deployment attempt must name what it exports. */
     getReleaseExport(releaseId: string): Promise<StoredReleaseExport | null>;
     save(input: SaveInput): Promise<"created" | "repeated">;
+    /** Multi-document editorial gestures (such as a Media rewrite) must not
+     * leave half their draft revisions behind when a later CAS discovers an
+     * editor's concurrent save. D1 batches are transactional, so we validate
+     * every identity and build every guarded statement before issuing one batch. */
+    saveMany(inputs: readonly SaveInput[]): Promise<void>;
     discard(documentId: string, expectedDraftRevisionId: string | null, baselineRevisionId: string | null, now: number): Promise<void>;
     publish(input: ReleaseInput): Promise<"created" | "repeated">;
     /** Candidate release and deployment-lane reservation are inseparable: a