@cardinali-studio/adminkit 2.2.10 → 2.2.12

package/dist/persistence.js

@@ -135,20 +135,31 @@ export class D1ContentRepository {
       release.schema_package_version AS schemaPackageVersion, release.materializer_version AS materializerVersion,
       release.manifest_checksum AS manifestChecksum, entry.document_id AS documentId, entry.revision_id AS revisionId,
       document.kind, document.locale, revision.schema_version AS schemaVersion, revision.is_tombstone AS tombstone,
-      revision.payload_json AS payloadJson, revision.payload_checksum AS payloadChecksum
+      revision.payload_json AS payloadJson, revision.payload_checksum AS payloadChecksum,
+      access.version_id AS accessVersionId, access.enabled AS accessEnabled, access.format_version AS accessFormatVersion,
+      access.key_id AS accessKeyId, access.nonce AS accessNonce, access.ciphertext AS accessCiphertext
       FROM content_releases release
       JOIN content_release_entries entry ON entry.release_id = release.release_id
       JOIN content_documents document ON document.document_id = entry.document_id
       JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
+      LEFT JOIN content_release_site_access release_access ON release_access.release_id = release.release_id
+      LEFT JOIN site_access_versions access ON access.version_id = release_access.version_id
       WHERE release.release_id = ? AND release.status IN ('publishing', 'published')
       ORDER BY entry.document_id`).bind(releaseId).all()).results ?? [];
         if (!rows.length)
             return null;
         const [first] = rows;
+        let siteAccess = null;
+        if (first.accessVersionId && first.accessFormatVersion === 1) {
+            const covered = { versionId: first.accessVersionId, enabled: Boolean(first.accessEnabled), formatVersion: 1,
+                keyId: first.accessKeyId, nonce: first.accessNonce, ciphertext: first.accessCiphertext };
+            siteAccess = { ...covered, descriptorChecksum: await canonicalChecksum(covered) };
+        }
         return {
             releaseId: first.releaseId, status: first.status, schemaPackageVersion: first.schemaPackageVersion,
             materializerVersion: first.materializerVersion, manifestChecksum: first.manifestChecksum,
             entries: rows.map(({ documentId, revisionId, kind, locale, schemaVersion, tombstone, payloadJson, payloadChecksum }) => ({ documentId, revisionId, kind, locale, schemaVersion, tombstone: Boolean(tombstone), payloadJson, payloadChecksum })),
+            siteAccess,
         };
     }
     async save(input) {
@@ -183,12 +194,79 @@ export class D1ContentRepository {
             throw new Error("stale_revision");
         return "created";
     }
+    /** Multi-document editorial gestures (such as a Media rewrite) must not
+     * leave half their draft revisions behind when a later CAS discovers an
+     * editor's concurrent save. D1 batches are transactional, so we validate
+     * every identity and build every guarded statement before issuing one batch. */
+    async saveMany(inputs) {
+        if (!inputs.length || new Set(inputs.map((input) => input.documentId)).size !== inputs.length
+            || new Set(inputs.map((input) => input.revisionId)).size !== inputs.length)
+            throw new Error("invalid_document");
+        const statements = [];
+        const guards = [];
+        for (const input of inputs) {
+            const existing = await this.db.prepare("SELECT revision_id, request_checksum FROM content_revisions WHERE revision_id = ?").bind(input.revisionId).first();
+            if (existing) {
+                assertIdempotent({ requestChecksum: existing.request_checksum }, input.requestChecksum);
+                continue;
+            }
+            if ((input.payload === null) === !input.tombstone)
+                throw new Error("invalid_document");
+            const document = await this.db.prepare("SELECT document_id, kind, locale, draft_revision_id, abandoned_at FROM content_documents WHERE document_id = ?").bind(input.documentId).first();
+            if (document && (document.kind !== input.kind || document.locale !== input.locale))
+                throw new Error("invalid_document");
+            const expectedDraftRevisionId = input.expectedDraftRevisionId === undefined ? input.baseRevisionId : input.expectedDraftRevisionId;
+            if (document && document.draft_revision_id !== expectedDraftRevisionId)
+                throw new Error("stale_revision");
+            const payload = input.payload === null ? null : canonicalJson(input.payload);
+            guards.push({ documentId: input.documentId, kind: input.kind, locale: input.locale, expectedDraftRevisionId, revisionId: input.revisionId });
+            const hasBase = expectedDraftRevisionId !== null;
+            const guard = hasBase ? "draft_revision_id = ?" : "draft_revision_id IS NULL";
+            statements.push(this.db.prepare(`INSERT INTO content_documents (document_id, kind, locale, translation_group_id, draft_revision_id, created_at, updated_at)
+        SELECT ?, ?, ?, ?, NULL, ?, ? WHERE NOT EXISTS (SELECT 1 FROM content_documents WHERE document_id = ?)`)
+                .bind(input.documentId, input.kind, input.locale, input.translationGroupId ?? null, input.now, input.now, input.documentId));
+            statements.push(this.db.prepare(`INSERT INTO content_revisions (revision_id, document_id, base_revision_id, payload_json, is_tombstone, schema_version, payload_checksum, request_checksum, author_subject, author_label, created_at)
+        SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM content_documents WHERE document_id = ? AND ${guard}`)
+                .bind(input.revisionId, input.documentId, input.baseRevisionId, payload, Number(input.tombstone), input.schemaVersion, input.payloadChecksum, input.requestChecksum, input.authorSubject, input.authorLabel, input.now, input.documentId, ...(hasBase ? [expectedDraftRevisionId] : [])));
+            statements.push(this.db.prepare(`UPDATE content_documents SET draft_revision_id = ?, updated_at = ?, abandoned_at = NULL WHERE document_id = ? AND ${guard}`)
+                .bind(input.revisionId, input.now, input.documentId, ...(hasBase ? [expectedDraftRevisionId] : [])));
+        }
+        if (!statements.length)
+            return;
+        const guardSql = guards.map(() => `(NOT EXISTS (SELECT 1 FROM content_documents WHERE document_id = ?) AND ? IS NULL
+      OR EXISTS (SELECT 1 FROM content_documents WHERE document_id = ? AND kind = ? AND locale = ? AND draft_revision_id IS ?))
+      AND NOT EXISTS (SELECT 1 FROM content_revisions WHERE revision_id = ?)`).join(" AND ");
+        /* A zero-row CAS is not a SQL error and therefore would not roll a D1
+         * batch back. This statement turns any stale precondition into a CHECK
+         * violation before the first revision write; singleton=2 can never be a
+         * valid site-state row. */
+        const abortOnStale = this.db.prepare(`INSERT INTO content_site_state
+      (singleton, current_release_id, schema_generation, updated_at)
+      SELECT 2, NULL, 0, ? WHERE NOT (${guardSql})`)
+            .bind(inputs[0].now, ...guards.flatMap((guard) => [guard.documentId, guard.expectedDraftRevisionId,
+            guard.documentId, guard.kind, guard.locale, guard.expectedDraftRevisionId, guard.revisionId]));
+        const results = await this.db.batch([abortOnStale, ...statements]);
+        for (let index = 1; index < results.length; index += 3) {
+            if (results[index + 1]?.meta?.changes !== 1 || results[index + 2]?.meta?.changes !== 1)
+                throw new Error("stale_revision");
+        }
+    }
     async discard(documentId, expectedDraftRevisionId, baselineRevisionId, now) {
         const expected = expectedDraftRevisionId === null ? "draft_revision_id IS NULL" : "draft_revision_id = ?";
         const set = baselineRevisionId === null ? null : baselineRevisionId;
         const update = this.db.prepare(`UPDATE content_documents SET draft_revision_id = ?, abandoned_at = CASE WHEN ? IS NULL THEN ? ELSE NULL END, updated_at = ? WHERE document_id = ? AND ${expected}`)
             .bind(set, set, now, now, documentId, ...(expectedDraftRevisionId === null ? [] : [expectedDraftRevisionId]));
-        const [result] = await this.db.batch([update]);
+        /* Restoring a baseline can reintroduce a source that a ready destructive
+         * operation was about to remove. This lives in the same transaction as the
+         * pointer CAS: Discard still succeeds, but the operation becomes visibly
+         * blocked rather than deleting a newly referenced public asset. */
+        const blockReintroduced = this.db.prepare(`UPDATE media_operations SET state = 'blocked_in_use', updated_at = ?
+      WHERE state = 'ready' AND ? IS NOT NULL AND EXISTS (SELECT 1 FROM media_operation_entries entry
+        JOIN content_revisions baseline ON baseline.revision_id = ? AND baseline.document_id = ?
+        WHERE entry.operation_id = media_operations.operation_id AND baseline.payload_json IS NOT NULL
+          AND instr(baseline.payload_json, '/media/' || entry.source_key) > 0)`)
+            .bind(now, baselineRevisionId, baselineRevisionId, documentId);
+        const [result] = await this.db.batch([update, blockReintroduced]);
         if (result?.meta?.changes === 1)
             return;
         const current = await this.db.prepare("SELECT document_id, draft_revision_id, abandoned_at FROM content_documents WHERE document_id = ?").bind(documentId).first();
@@ -252,20 +330,63 @@ export class D1ContentRepository {
             : [];
         const manifest = new Map(inherited.map((entry) => [entry.document_id, entry.revision_id]));
         const selected = [...input.entries];
-        if (!selected.length)
+        const mediaOperationIds = [...new Set(input.mediaOperationIds ?? [])];
+        if (!selected.length && !mediaOperationIds.length && !input.siteAccessVersionId)
             throw new Error("invalid_document");
         for (const entry of selected)
             manifest.set(entry.documentId, entry.revisionId);
-        const selectionGuard = selected.map(() => "EXISTS (SELECT 1 FROM content_documents WHERE document_id = ? AND draft_revision_id = ?)").join(" AND ");
+        const selectionGuard = selected.length ? selected.map(() => "EXISTS (SELECT 1 FROM content_documents WHERE document_id = ? AND draft_revision_id = ?)").join(" AND ") : "1 = 1";
+        const accessGuard = input.siteAccessVersionId ? `AND EXISTS (SELECT 1 FROM site_access_versions version JOIN site_access_state access_state ON access_state.singleton = 1
+      WHERE version.version_id = ? AND version.state IN ('draft','active') AND version.version_id IN (access_state.draft_version_id, access_state.active_version_id))` : "";
         const candidate = this.db.prepare(`INSERT INTO content_releases (release_id, base_release_id, request_checksum, status, active_slot, manifest_checksum, schema_package_version, materializer_version, created_by_subject, created_at)
       SELECT ?, current_release_id, ?, 'publishing', 1, ?, ?, ?, ?, ? FROM content_site_state
       WHERE singleton = 1 AND current_release_id IS ? AND NOT EXISTS (SELECT 1 FROM content_releases WHERE active_slot = 1)
-        AND NOT EXISTS (SELECT 1 FROM production_deployment_attempts WHERE active_slot = 1) AND ${selectionGuard}`)
-            .bind(input.releaseId, input.requestChecksum, input.manifestChecksum, input.schemaPackageVersion, input.materializerVersion, input.authorSubject, input.now, state.current_release_id, ...selected.flatMap((entry) => [entry.documentId, entry.revisionId]));
-        const statements = [candidate];
+        AND NOT EXISTS (SELECT 1 FROM production_deployment_attempts WHERE active_slot = 1) AND ${selectionGuard} ${accessGuard}`)
+            .bind(input.releaseId, input.requestChecksum, input.manifestChecksum, input.schemaPackageVersion, input.materializerVersion, input.authorSubject, input.now, state.current_release_id, ...selected.flatMap((entry) => [entry.documentId, entry.revisionId]), ...(input.siteAccessVersionId ? [input.siteAccessVersionId] : []));
+        const statements = [];
+        if (mediaOperationIds.length) {
+            const revisionIds = [...manifest.values()];
+            const eligible = mediaOperationIds.map(() => `(
+        EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'ready')
+        AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+          JOIN content_revisions revision ON revision.revision_id IN (${revisionIds.map(() => "?").join(",")})
+          WHERE source.operation_id = ? AND revision.payload_json IS NOT NULL
+            AND instr(revision.payload_json, '/media/' || source.source_key) > 0))`).join(" AND ");
+            /* As with multi-document Save, zero affected rows do not abort a D1
+             * batch. Convert an ineligible Media binding into a CHECK violation
+             * before the candidate exists, so no release/attempt can commit alone. */
+            statements.push(this.db.prepare(`INSERT INTO content_site_state
+        (singleton, current_release_id, schema_generation, updated_at)
+        SELECT 2, NULL, 0, ? WHERE NOT (${eligible})`)
+                .bind(input.now, ...mediaOperationIds.flatMap((operationId) => [operationId, ...revisionIds, operationId])));
+        }
+        const candidateIndex = statements.length;
+        statements.push(candidate);
         for (const [documentId, revisionId] of manifest)
             statements.push(this.db.prepare("INSERT INTO content_release_entries (release_id, document_id, revision_id) SELECT ?, ?, ? WHERE EXISTS (SELECT 1 FROM content_revisions WHERE document_id = ? AND revision_id = ?)")
                 .bind(input.releaseId, documentId, revisionId, documentId, revisionId));
+        if (input.siteAccessVersionId)
+            statements.push(this.db.prepare(`INSERT INTO content_release_site_access (release_id, version_id)
+      SELECT ?, ? WHERE EXISTS (SELECT 1 FROM site_access_versions version JOIN site_access_state access_state ON access_state.singleton = 1
+        WHERE version.version_id = ? AND version.state IN ('draft','active') AND version.version_id IN (access_state.draft_version_id, access_state.active_version_id))`)
+                .bind(input.releaseId, input.siteAccessVersionId, input.siteAccessVersionId));
+        for (const operationId of mediaOperationIds) {
+            /* `instr` is intentionally evaluated against the frozen release entries,
+             * not drafts or a mutable current pointer. A URL is JSON-escaped neither
+             * by `/` nor by the canonical serializer, so the exact R2 public prefix
+             * remains a reliable conservative guard. */
+            statements.push(this.db.prepare(`UPDATE media_operations SET state = 'bound', updated_at = ?
+        WHERE operation_id = ? AND state = 'ready'
+          AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+            JOIN content_release_entries entry ON entry.release_id = ?
+            JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
+            WHERE source.operation_id = media_operations.operation_id
+              AND revision.payload_json IS NOT NULL AND instr(revision.payload_json, '/media/' || source.source_key) > 0)`)
+                .bind(input.now, operationId, input.releaseId));
+            statements.push(this.db.prepare(`INSERT INTO content_release_media_operations (release_id, operation_id)
+        SELECT ?, ? WHERE EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'bound')`)
+                .bind(input.releaseId, operationId, operationId));
+        }
         statements.push(this.db.prepare(`INSERT INTO production_deployment_attempts
       (attempt_id, intent_kind, requested_release_id, requested_code_sha, code_sha, release_id, expected_fingerprint, phase, active_slot, created_at, updated_at)
       SELECT ?, ?, ?, ?, ?, ?, ?, 'waiting', 1, ?, ?
@@ -273,7 +394,7 @@ export class D1ContentRepository {
         AND EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'publishing')`)
             .bind(input.attempt.attemptId, input.attempt.intentKind, input.attempt.requestedReleaseId, input.attempt.requestedCodeSha, input.attempt.codeSha, input.releaseId, input.attempt.expectedFingerprint, input.now, input.now, input.releaseId));
         const results = await this.db.batch(statements);
-        if (results[0]?.meta?.changes !== 1 || results.slice(1, -1).some((result) => result.meta?.changes !== 1)
+        if (results[candidateIndex]?.meta?.changes !== 1 || results.slice(candidateIndex + 1, -1).some((result) => result.meta?.changes !== 1)
             || results.at(-1)?.meta?.changes !== 1)
             throw new Error("deployment_lane_busy");
         return "created";

package/dist/release.d.ts

@@ -1,4 +1,5 @@
 import { type JsonValue } from "./persistence.js";
+import type { SiteAccessReleaseDescriptor } from "./site-access.js";
 export type ReleaseExportEntry = {
     documentId: string;
     revisionId: string;
@@ -15,6 +16,7 @@ export type ImmutableReleaseExport = {
     materializerVersion: string;
     manifestChecksum: string;
     entries: readonly ReleaseExportEntry[];
+    siteAccess?: SiteAccessReleaseDescriptor | null;
 };
 /** Raw D1 snapshot. The repository returns this exact release only; converting
  * it to an export revalidates every payload/checksum before a CI consumer sees
@@ -28,6 +30,7 @@ export type StoredReleaseExport = {
     entries: readonly (Omit<ReleaseExportEntry, "payload"> & {
         payloadJson: string | null;
     })[];
+    siteAccess?: SiteAccessReleaseDescriptor | null;
 };
 /** A release export is an immutable, sorted full snapshot. It is never a
  * convenience view of current drafts, so a CI attempt can reproduce exactly

package/dist/release.js

@@ -17,10 +17,16 @@ export async function createReleaseExport(input) {
         if (entry.payloadChecksum !== await canonicalChecksum(entry.payload))
             throw new Error("invalid_release_export");
     }
+    if (input.siteAccess) {
+        const { descriptorChecksum, ...covered } = input.siteAccess;
+        if (descriptorChecksum !== await canonicalChecksum(covered))
+            throw new Error("invalid_release_export");
+    }
     const manifestChecksum = await canonicalChecksum({
         schemaPackageVersion: input.schemaPackageVersion,
         materializerVersion: input.materializerVersion,
         entries: entries.map(({ documentId, revisionId, kind, locale, schemaVersion, tombstone, payloadChecksum }) => ({ documentId, revisionId, kind, locale, schemaVersion, tombstone, payloadChecksum })),
+        siteAccess: input.siteAccess ? { versionId: input.siteAccess.versionId, descriptorChecksum: input.siteAccess.descriptorChecksum } : null,
     });
     return { ...input, entries, manifestChecksum };
 }
@@ -34,6 +40,7 @@ export async function releaseExportFromStored(snapshot) {
             schemaVersion: entry.schemaVersion, tombstone: entry.tombstone,
             payload: entry.payloadJson === null ? null : JSON.parse(entry.payloadJson), payloadChecksum: entry.payloadChecksum,
         })),
+        ...(snapshot.siteAccess ? { siteAccess: snapshot.siteAccess } : {}),
     });
     if (release.manifestChecksum !== snapshot.manifestChecksum)
         throw new Error("invalid_release_export");

package/dist/site-access.d.ts

@@ -0,0 +1,48 @@
+import { type D1DatabaseLike } from "./persistence.js";
+export declare const siteAccessPbkdf2Iterations = 100000;
+export type SiteAccessReleaseDescriptor = Readonly<{
+    versionId: string;
+    enabled: boolean;
+    formatVersion: 1;
+    keyId: string | null;
+    nonce: string | null;
+    ciphertext: string | null;
+    descriptorChecksum: string;
+}>;
+export type SiteAccessState = Readonly<{
+    active: SiteAccessReleaseDescriptor | null;
+    draft: SiteAccessReleaseDescriptor | null;
+}>;
+export declare function createSiteAccessVersion(input: {
+    versionId: string;
+    siteId: string;
+    enabled: boolean;
+    password?: string;
+    keyring?: unknown;
+}): Promise<SiteAccessReleaseDescriptor>;
+export declare function verifySiteAccessPassword(input: {
+    siteId: string;
+    access: SiteAccessReleaseDescriptor;
+    keyring: unknown;
+    password: string;
+}): Promise<boolean>;
+export declare function siteAccessSessionToken(input: {
+    siteId: string;
+    access: SiteAccessReleaseDescriptor;
+    keyring: unknown;
+}): Promise<string>;
+export declare class D1SiteAccessRepository {
+    private readonly db;
+    constructor(db: D1DatabaseLike);
+    initialize(now: number): Promise<void>;
+    state(): Promise<SiteAccessState>;
+    saveDraft(input: {
+        access: SiteAccessReleaseDescriptor;
+        expectedDraftVersionId: string | null;
+        requestChecksum: string;
+        authorSubject: string;
+        authorLabel: string;
+        now: number;
+    }): Promise<void>;
+    discard(expectedDraftVersionId: string, now: number): Promise<void>;
+}

package/dist/site-access.js

@@ -0,0 +1,180 @@
+import { canonicalChecksum, canonicalJson } from "./persistence.js";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const keyIdPattern = /^[A-Za-z0-9._-]{1,80}$/;
+export const siteAccessPbkdf2Iterations = 100_000;
+function asBuffer(bytes) {
+    return Uint8Array.from(bytes).buffer;
+}
+function bytesToBase64url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/g, "");
+}
+function base64urlToBytes(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value || ""))
+        throw new Error("site_access_unavailable");
+    const padded = value.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - value.length % 4) % 4);
+    try {
+        const binary = atob(padded);
+        return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    }
+    catch {
+        throw new Error("site_access_unavailable");
+    }
+}
+function parseKeyring(raw) {
+    let parsed;
+    try {
+        parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+    }
+    catch {
+        throw new Error("site_access_unavailable");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error("site_access_unavailable");
+    const value = parsed;
+    if (typeof value.current !== "string" || !keyIdPattern.test(value.current) || !value.keys || typeof value.keys !== "object" || Array.isArray(value.keys)) {
+        throw new Error("site_access_unavailable");
+    }
+    const keys = {};
+    for (const [keyId, encoded] of Object.entries(value.keys)) {
+        if (!keyIdPattern.test(keyId) || typeof encoded !== "string")
+            throw new Error("site_access_unavailable");
+        const bytes = base64urlToBytes(encoded);
+        if (bytes.byteLength !== 32)
+            throw new Error("site_access_unavailable");
+        keys[keyId] = bytes;
+    }
+    if (!keys[value.current])
+        throw new Error("site_access_unavailable");
+    return { current: value.current, keys };
+}
+async function hkdfKey(root, siteId, keyId, purpose, algorithm, usages) {
+    const material = await crypto.subtle.importKey("raw", asBuffer(root), "HKDF", false, ["deriveKey"]);
+    return crypto.subtle.deriveKey({
+        name: "HKDF", hash: "SHA-256",
+        salt: encoder.encode("adminkit.site-access.v1"),
+        info: encoder.encode(`${purpose}|${siteId}|${keyId}`),
+    }, material, algorithm, false, usages);
+}
+function aad(siteId, versionId) {
+    return encoder.encode(`adminkit.site-access.v1|${siteId}|${versionId}`);
+}
+async function descriptor(input) {
+    if (!uuid.test(input.versionId) || input.formatVersion !== 1)
+        throw new Error("invalid_site_access");
+    if (input.enabled !== Boolean(input.keyId && input.nonce && input.ciphertext))
+        throw new Error("invalid_site_access");
+    const descriptorChecksum = await canonicalChecksum(input);
+    return { ...input, descriptorChecksum };
+}
+export async function createSiteAccessVersion(input) {
+    if (!input.enabled)
+        return descriptor({ versionId: input.versionId, enabled: false, formatVersion: 1, keyId: null, nonce: null, ciphertext: null });
+    if (typeof input.password !== "string" || input.password.length < 8 || input.password.length > 200)
+        throw new Error("invalid_site_access_password");
+    const keyring = parseKeyring(input.keyring);
+    const salt = crypto.getRandomValues(new Uint8Array(16));
+    const passwordKey = await crypto.subtle.importKey("raw", encoder.encode(input.password), "PBKDF2", false, ["deriveBits"]);
+    const hash = new Uint8Array(await crypto.subtle.deriveBits({ name: "PBKDF2", hash: "SHA-256", salt: asBuffer(salt), iterations: siteAccessPbkdf2Iterations }, passwordKey, 256));
+    const plaintext = encoder.encode(canonicalJson({ version: 1, kdf: "PBKDF2-SHA256", iterations: siteAccessPbkdf2Iterations, salt: bytesToBase64url(salt), hash: bytesToBase64url(hash) }));
+    const nonce = crypto.getRandomValues(new Uint8Array(12));
+    const encryptionKey = await hkdfKey(keyring.keys[keyring.current], input.siteId, keyring.current, "verifier", { name: "AES-GCM", length: 256 }, ["encrypt"]);
+    const ciphertext = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv: asBuffer(nonce), additionalData: asBuffer(aad(input.siteId, input.versionId)), tagLength: 128 }, encryptionKey, plaintext));
+    return descriptor({ versionId: input.versionId, enabled: true, formatVersion: 1, keyId: keyring.current, nonce: bytesToBase64url(nonce), ciphertext: bytesToBase64url(ciphertext) });
+}
+async function decryptVerifier(input) {
+    const keyring = parseKeyring(input.keyring);
+    const keyId = input.access.keyId || "";
+    const root = keyring.keys[keyId];
+    if (!root || !input.access.nonce || !input.access.ciphertext)
+        throw new Error("site_access_unavailable");
+    try {
+        const key = await hkdfKey(root, input.siteId, keyId, "verifier", { name: "AES-GCM", length: 256 }, ["decrypt"]);
+        const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: asBuffer(base64urlToBytes(input.access.nonce)), additionalData: asBuffer(aad(input.siteId, input.access.versionId)), tagLength: 128 }, key, asBuffer(base64urlToBytes(input.access.ciphertext)));
+        const value = JSON.parse(decoder.decode(plaintext));
+        if (value?.version !== 1 || value?.kdf !== "PBKDF2-SHA256" || value?.iterations !== siteAccessPbkdf2Iterations)
+            throw new Error("site_access_unavailable");
+        return { salt: base64urlToBytes(value.salt), hash: base64urlToBytes(value.hash), keyring, keyId };
+    }
+    catch {
+        throw new Error("site_access_unavailable");
+    }
+}
+function constantTimeBytes(left, right) {
+    let difference = left.byteLength ^ right.byteLength;
+    for (let index = 0; index < Math.max(left.byteLength, right.byteLength); index += 1)
+        difference |= (left[index] || 0) ^ (right[index] || 0);
+    return difference === 0;
+}
+export async function verifySiteAccessPassword(input) {
+    if (!input.access.enabled)
+        return false;
+    const verifier = await decryptVerifier(input);
+    const passwordKey = await crypto.subtle.importKey("raw", encoder.encode(input.password), "PBKDF2", false, ["deriveBits"]);
+    const candidate = new Uint8Array(await crypto.subtle.deriveBits({ name: "PBKDF2", hash: "SHA-256", salt: asBuffer(verifier.salt), iterations: siteAccessPbkdf2Iterations }, passwordKey, 256));
+    return constantTimeBytes(candidate, verifier.hash);
+}
+export async function siteAccessSessionToken(input) {
+    if (!input.access.enabled || !input.access.keyId)
+        throw new Error("site_access_unavailable");
+    const keyring = parseKeyring(input.keyring);
+    const root = keyring.keys[input.access.keyId];
+    if (!root)
+        throw new Error("site_access_unavailable");
+    const key = await hkdfKey(root, input.siteId, input.access.keyId, "session", { name: "HMAC", hash: "SHA-256" }, ["sign"]);
+    const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(`session|${input.access.versionId}`)));
+    return `${input.access.versionId}.${bytesToBase64url(signature)}`;
+}
+async function rowDescriptor(row) {
+    return row ? descriptor({ versionId: row.versionId, enabled: Boolean(row.enabled), formatVersion: row.formatVersion, keyId: row.keyId, nonce: row.nonce, ciphertext: row.ciphertext }) : null;
+}
+export class D1SiteAccessRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async initialize(now) {
+        await this.db.prepare("INSERT INTO site_access_state (singleton, active_version_id, draft_version_id, updated_at) VALUES (1, NULL, NULL, ?) ON CONFLICT(singleton) DO NOTHING").bind(now).run();
+    }
+    async state() {
+        const rows = (await this.db.prepare(`SELECT version.version_id AS versionId, version.enabled, version.format_version AS formatVersion,
+      version.key_id AS keyId, version.nonce, version.ciphertext, version.state
+      FROM site_access_versions version JOIN site_access_state state ON state.singleton = 1
+      WHERE version.version_id IN (state.active_version_id, state.draft_version_id)`).all()).results ?? [];
+        return {
+            active: await rowDescriptor(rows.find((row) => row.state === "active") ?? null),
+            draft: await rowDescriptor(rows.find((row) => row.state === "draft") ?? null),
+        };
+    }
+    async saveDraft(input) {
+        const current = await this.db.prepare("SELECT draft_version_id AS draftVersionId FROM site_access_state WHERE singleton = 1").first();
+        if (!current || current.draftVersionId !== input.expectedDraftVersionId)
+            throw new Error("stale_site_access");
+        const statements = [];
+        if (input.expectedDraftVersionId)
+            statements.push(this.db.prepare(`UPDATE site_access_versions SET state = 'erased', erased_at = ?
+      WHERE version_id = ? AND state = 'draft'`).bind(input.now, input.expectedDraftVersionId));
+        statements.push(this.db.prepare(`INSERT INTO site_access_versions
+      (version_id, state, enabled, format_version, key_id, nonce, ciphertext, request_checksum, created_by_subject, created_by_label, created_at)
+      SELECT ?, 'draft', ?, ?, ?, ?, ?, ?, ?, ?, ? FROM site_access_state
+      WHERE singleton = 1 AND draft_version_id IS ?`)
+            .bind(input.access.versionId, Number(input.access.enabled), input.access.formatVersion, input.access.keyId, input.access.nonce, input.access.ciphertext, input.requestChecksum, input.authorSubject, input.authorLabel, input.now, input.expectedDraftVersionId));
+        statements.push(this.db.prepare("UPDATE site_access_state SET draft_version_id = ?, updated_at = ? WHERE singleton = 1 AND draft_version_id IS ?")
+            .bind(input.access.versionId, input.now, input.expectedDraftVersionId));
+        const results = await this.db.batch(statements);
+        if (results.at(-2)?.meta?.changes !== 1 || results.at(-1)?.meta?.changes !== 1)
+            throw new Error("stale_site_access");
+    }
+    async discard(expectedDraftVersionId, now) {
+        const results = await this.db.batch([
+            this.db.prepare("UPDATE site_access_versions SET state = 'erased', erased_at = ? WHERE version_id = ? AND state = 'draft'").bind(now, expectedDraftVersionId),
+            this.db.prepare("UPDATE site_access_state SET draft_version_id = NULL, updated_at = ? WHERE singleton = 1 AND draft_version_id = ?").bind(now, expectedDraftVersionId),
+        ]);
+        if (results[0]?.meta?.changes !== 1 || results[1]?.meta?.changes !== 1)
+            throw new Error("stale_site_access");
+    }
+}

package/dist/theme.css

@@ -291,6 +291,7 @@ a.ak-btn { text-decoration: none; display: inline-flex; align-items: center; }
 .mf-root-drop.is-over { border-color: var(--ak-accent); color: var(--ak-accent); background: var(--ak-panel); }
 /* Il cestino chiude la colonna, staccato: è un posto dove si va, non una cartella fra le altre. */
 .mf-tail { margin-top: 14px; padding-top: 12px; border-top: 1px solid var(--ak-line); }
+.mf-settings-tail { margin-top: 8px; }
 .mf-ico { flex: none; color: var(--ak-ink-quiet); }
 .mf-item.is-on .mf-ico { color: var(--ak-accent); }
 
@@ -370,6 +371,18 @@ a.ak-btn { text-decoration: none; display: inline-flex; align-items: center; }
   background: var(--ak-panel); border: 1px solid var(--ak-accent);
   font: 500 var(--ak-fs-small)/1.4 var(--ak-font); color: var(--ak-ink);
 }
+.mg-journal { display: flex; flex-direction: column; gap: 6px; }
+.mg-journal-row {
+  display: flex; align-items: center; gap: 9px; flex-wrap: wrap;
+  margin: 0; padding: 8px 11px; border: 1px solid var(--ak-line); border-radius: var(--ak-radius);
+  background: var(--ak-panel); font: 500 var(--ak-fs-small)/1.4 var(--ak-font); color: var(--ak-ink);
+}
+.mg-journal-row.is-blocked_in_use, .mg-journal-row.is-completed_with_warning { border-color: var(--ak-accent); }
+.mg-journal-row.is-failed { border-color: var(--ak-danger); }
+.mg-journal-badge {
+  padding: 3px 6px; border-radius: 999px; background: var(--ak-bg);
+  color: var(--ak-ink-quiet); font: 600 10px/1 var(--ak-font); text-transform: uppercase; letter-spacing: .05em;
+}
 
 /* Celle di ingombro uguale, immagine INTERA dentro. Prima erano quadrati con `object-fit: cover`:
    un verticale sembrava un quadrato e per riconoscere una foto bisognava aprirla. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardinali-studio/adminkit",
-  "version": "2.2.10",
+  "version": "2.2.12",
   "type": "module",
   "description": "Motore riusabile di un pannello di amministrazione per siti Hugo su Cloudflare Pages: codec del front matter guidato dallo schema, form React, libreria media su R2. NIENTE di specifico di un sito qui dentro.",
   "license": "UNLICENSED",
@@ -99,5 +99,8 @@
     "typescript": "^5.9.3",
     "wrangler": "4.114.0",
     "zod": "^4.4.3"
+  },
+  "dependencies": {
+    "heic-to": "^1.3.0"
   }
 }