@cardinali-studio/adminkit 2.2.21 → 2.2.23

package/dist/functions/api/assets/delete.js

@@ -126,10 +126,27 @@ export async function onRequestPost({ request, env, data }) {
       const operable = keyList.filter((key) => !pending.has(key));
       const result = operable.length ? await d1DeleteMedia({ env, data, body: { ...body, keys: operable } }) : null;
       for (const keepKey of keepKeys) await env.MEDIA.delete(keepKey);
-      return json({ ok: true, trashed: result?.trashed ?? keyList.length, operationId: result?.operationId, pagesUpdated: result?.documents.map((document) => document.kind) ?? [], deferred: Boolean(result), d1: true, warning: result ? "I file resteranno disponibili fino alla pubblicazione." : undefined });
+      return json({
+        ok: true,
+        trashed: result?.trashed ?? keyList.length,
+        operationId: result?.operationId,
+        pagesUpdated: result?.publishedDocuments?.map((document) => document.kind) ?? [],
+        requiresPublication: result?.requiresPublication === true,
+        deferred: result?.requiresPublication === true || Number(result?.failed ?? 0) > 0,
+        completed: result ? Number(result.completed ?? 0) : keyList.length,
+        failed: Number(result?.failed ?? 0),
+        d1: true,
+        warning: result?.requiresPublication ? "Le pagine verranno pubblicate senza questi Media prima di spostarli nel cestino." : undefined,
+      });
     } catch (error) {
-      const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_source_busy" ? "media_source_busy" : "media_operation_unavailable";
-      return json({ ok: false, code, error: code === "media_source_busy" ? "Questo Media è già in un'operazione in corso." : "Non riesco a registrare l'operazione Media D1." }, code === "unauthenticated" ? 401 : 409);
+      const code = error?.message === "unauthenticated" ? "unauthenticated"
+        : error?.message === "media_source_busy" ? "media_source_busy"
+          : error?.message === "invalid_document" ? "media_replacement_required"
+            : "media_operation_unavailable";
+      const message = code === "media_source_busy" ? "Questo Media è già in un'operazione in corso."
+        : code === "media_replacement_required" ? "Una pagina richiede questa immagine: sostituiscila prima di eliminarla."
+          : "Non riesco a registrare l'operazione Media D1.";
+      return json({ ok: false, code, error: message }, code === "unauthenticated" ? 401 : code === "media_replacement_required" ? 422 : 409);
     }
   }
 

package/dist/functions/api/assets/media.js

@@ -1,9 +1,13 @@
 /* D1 Media operation status and bounded recovery. These routes exist only
  * after D1 cutover; Git-mode Media keeps its established pending-marker flow. */
-import { json } from "../../_shared/assets.js";
+import { guessMime, isKey, json } from "../../_shared/assets.js";
 import { D1MediaOperationRepository } from "../../../media.js";
-import { contentPersistenceMode } from "../../site.js";
+import { contentPersistenceMode, languages } from "../../site.js";
 import { cancelD1MediaOperation, resumeD1MediaOperation } from "../../_shared/d1-media.js";
+import {
+  altLocales, mediaAltMetadataValue, normalizeMediaAlt,
+  MEDIA_ALT_METADATA_KEY, MEDIA_UPLOADED_METADATA_KEY,
+} from "../../_shared/media-alt.js";
 
 function unavailable() { return json({ ok: false, code: "feature_inactive", error: "Journal Media D1 non attivo." }, 404); }
 function failure(error) {
@@ -11,6 +15,57 @@ function failure(error) {
   return json({ ok: false, code, error: code === "unauthenticated" ? "Sessione non valida: ricarica la pagina per rientrare." : "L'operazione Media non può essere completata." }, code === "unauthenticated" ? 401 : 409);
 }
 
+/** Aggiorna solo i metadata editoriali del file. R2 richiede di riscrivere l'oggetto per
+ * cambiare customMetadata: conserviamo quindi esplicitamente la data originaria, oltre a tutti
+ * i metadata HTTP/EXIF già presenti. */
+export async function onRequestPatch({ request, env }) {
+  if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
+  let body;
+  try { body = await request.json(); } catch { return json({ ok: false, code: "media_alt_invalid", error: "JSON non valido." }, 400); }
+  const key = typeof body?.key === "string" ? body.key : "";
+  if (!isKey(key) || key.startsWith("_trash/") || key.startsWith("_adminkit/")) {
+    return json({ ok: false, code: "media_alt_invalid", error: "File Media non valido." }, 400);
+  }
+  const object = await env.MEDIA.get(key);
+  if (!object) return json({ ok: false, code: "media_not_found", error: "Il file non esiste più." }, 404);
+  const type = object.httpMetadata?.contentType || guessMime(key);
+  if (!type.startsWith("image/")) {
+    return json({ ok: false, code: "media_alt_not_applicable", error: "Il testo alternativo si applica alle immagini." }, 422);
+  }
+  let alt;
+  try { alt = normalizeMediaAlt(body.alt, altLocales(languages())); }
+  catch (error) {
+    const tooLarge = error?.message === "media_alt_too_large";
+    return json({
+      ok: false,
+      code: tooLarge ? "media_alt_too_large" : "media_alt_invalid",
+      error: tooLarge ? "I testi alternativi sono troppo estesi per i metadati del file." : "Testo alternativo non valido.",
+    }, 400);
+  }
+  const customMetadata = { ...(object.customMetadata || {}) };
+  const encoded = mediaAltMetadataValue(alt);
+  if (encoded) customMetadata[MEDIA_ALT_METADATA_KEY] = encoded;
+  else delete customMetadata[MEDIA_ALT_METADATA_KEY];
+  if (!customMetadata[MEDIA_UPLOADED_METADATA_KEY]) {
+    customMetadata[MEDIA_UPLOADED_METADATA_KEY] = object.uploaded instanceof Date
+      ? object.uploaded.toISOString()
+      : new Date().toISOString();
+  }
+  const saved = await env.MEDIA.put(key, object.body, {
+    httpMetadata: object.httpMetadata || {},
+    customMetadata,
+    ...(object.etag ? { onlyIf: { etagMatches: object.etag } } : {}),
+  });
+  if (object.etag && saved === null) {
+    return json({
+      ok: false,
+      code: "media_alt_conflict",
+      error: "Il file è cambiato durante il salvataggio. Riaprilo e riprova.",
+    }, 409);
+  }
+  return json({ ok: true, key, alt });
+}
+
 export async function onRequestGet({ env }) {
   if (contentPersistenceMode() !== "d1") return unavailable();
   if (!env.CONTENT_DB) return json({ ok: false, code: "content_unavailable", error: "Persistenza contenuti non disponibile." }, 503);

package/dist/functions/api/assets/move.js

@@ -145,7 +145,11 @@ export async function onRequestPost({ request, env, data }) {
     if (Object.hasOwn(body, "applyRefs")) return json({ ok: true, moved: 0, pagesUpdated: [], failed: [], d1: true });
     try {
       const result = await d1MoveMedia({ env, data, body });
-      return json({ ok: true, ...result, pagesUpdated: result.documents.map((document) => document.kind), failed: [], warning: "Le sorgenti restano disponibili fino alla pubblicazione." });
+      return json({
+        ok: true, ...result,
+        pagesUpdated: result.publishedDocuments.map((document) => document.kind), failed: [],
+        warning: result.requiresPublication ? "Le pagine verranno pubblicate con i nuovi indirizzi prima di rimuovere le sorgenti." : undefined,
+      });
     } catch (error) {
       const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_source_busy" ? "media_source_busy" : "media_operation_unavailable";
       return json({ ok: false, code, error: code === "media_source_busy" ? "Questo Media è già in un'operazione in corso." : "Non riesco a registrare l'operazione Media D1." }, code === "unauthenticated" ? 401 : 409);

package/dist/functions/api/assets/upload.js

@@ -5,6 +5,7 @@
 import { isPrefix, json, guessMime, uniqueKey } from "../../_shared/assets.js";
 import { extractCapturedAt } from "../../_shared/exif.js";
 import { sizeFromBuffer } from "../../_shared/imagesize.js";
+import { MEDIA_UPLOADED_METADATA_KEY } from "../../_shared/media-alt.js";
 
 export async function onRequestPost({ request, env }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
@@ -21,7 +22,7 @@ export async function onRequestPost({ request, env }) {
   if (!ctype || ctype === "application/octet-stream") ctype = guessMime(key);
 
   // data di scatto (EXIF) per l'ordinamento "Data scatto"
-  const custom = {};
+  const custom = { [MEDIA_UPLOADED_METADATA_KEY]: new Date().toISOString() };
   const suppliedCapturedAt = request.headers.get("X-Captured-At") || "";
   if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}$/.test(suppliedCapturedAt)) {
     custom.capturedAt = suppliedCapturedAt;
@@ -52,6 +53,7 @@ export async function onRequestPost({ request, env }) {
     capturedAt: custom.capturedAt || null,
     w: wh ? wh[0] : null,
     h: wh ? wh[1] : null,
+    alt: { decorative: false, texts: {} },
     url: "/media/" + key.split("/").map(encodeURIComponent).join("/"),
   });
 }

package/dist/functions/api/assets.js

@@ -4,8 +4,9 @@
 import { isPrefix, json, listKeysUnder } from "../_shared/assets.js";
 import { sizeFromBucket } from "../_shared/imagesize.js";
 import { pendingSourceKeys } from "../_shared/pending-media.js";
-import { contentPersistenceMode } from "../site.js";
+import { contentPersistenceMode, languages } from "../site.js";
 import { d1PendingSourceKeys } from "../_shared/d1-media.js";
+import { altLocales, mediaAltFromMetadata, MEDIA_UPLOADED_METADATA_KEY } from "../_shared/media-alt.js";
 
 const IMG = /\.(webp|jpe?g|png|avif|gif)$/i;
 
@@ -15,6 +16,7 @@ export async function onRequestGet({ request, env }) {
   let prefix = (url.searchParams.get("prefix") || "").trim();
   if (!isPrefix(prefix)) return json({ ok: false, error: `prefisso non valido: ${prefix}` }, 400);
   const pending = contentPersistenceMode() === "d1" ? await d1PendingSourceKeys(env.CONTENT_DB) : await pendingSourceKeys(env.MEDIA);
+  const locales = altLocales(languages());
 
   /* `recursive=1` guarda TUTTO quello che c'è sotto, a qualunque profondità: serve a chi deve
    * spostare o cancellare una cartella intera, che altrimenti si porterebbe dietro solo il primo
@@ -82,11 +84,12 @@ export async function onRequestGet({ request, env }) {
       name: o.key.slice(prefix.length),
       size: o.size,
       url: "/media/" + o.key.split("/").map(encodeURIComponent).join("/"),
-      uploaded: o.uploaded,
+      uploaded: cm[MEDIA_UPLOADED_METADATA_KEY] || o.uploaded,
       capturedAt: cm.capturedAt || null,
       type: (o.httpMetadata && o.httpMetadata.contentType) || "",
       w: w > 0 ? w : null,
       h: h > 0 ? h : null,
+      alt: mediaAltFromMetadata(cm, locales),
     };
   }));
 

package/dist/gallery.d.ts

@@ -3,6 +3,8 @@ export type GalleryImage = {
     w?: number | null;
     h?: number | null;
     hidden?: boolean;
+    /** Copia iniziale del default Media, modificabile nel contesto della singola gallery. */
+    alt?: string;
 };
 export type SectionType = "header" | "text" | "image" | "gallery";
 /** Una sezione della pagina gallery. Ha TUTTI i campi qualunque sia il tipo: Zod e React vogliono

package/dist/media.d.ts

@@ -1,4 +1,16 @@
 import type { D1DatabaseLike } from "./persistence.js";
+export declare function mediaPublicUrl(key: string): string;
+/** Rewrites exactly the Media references owned by one operation. Exact array
+ * values are removed as array items; scalar slots become an empty string and
+ * are then accepted or rejected by the site's complete schema validator. */
+export declare function rewriteMediaValue(value: unknown, input: {
+    replacements?: Readonly<Record<string, string>>;
+    removals?: readonly string[];
+}): {
+    changed: boolean;
+    value?: unknown;
+    removed?: boolean;
+};
 export declare const mediaOperationStates: readonly ["preparing", "ready", "blocked_in_use", "bound", "finalizing", "completed", "completed_with_warning", "cancelled", "failed"];
 export type MediaOperationState = typeof mediaOperationStates[number];
 export type MediaOperationType = "move" | "delete";
@@ -95,6 +107,11 @@ export declare class D1MediaOperationRepository {
         metadataJson: string | null;
     }): Promise<"pending" | "ready">;
     beginFinalization(operationId: string, releaseId: string, now: number): Promise<void>;
+    /** An operation whose sources occur in neither the public manifest nor any
+     * current draft needs no content release. The same guarded transition closes
+     * the last race before R2 cleanup; a concurrent reference makes it stay
+     * ready for the isolated-publication path instead. */
+    beginUnpublishedFinalization(operationId: string, now: number): Promise<boolean>;
     /** Individual cleanup writes are retryable. A single failed entry reaches
      * `completed_with_warning` only after every entry has a terminal result;
      * the already-live release is never rolled back. */
@@ -124,9 +141,11 @@ export declare class D1MediaOperationRepository {
     /** Work is named by its immutable release binding: there is intentionally no
      * "latest operation" cleanup path. */
     finalizationWork(releaseId: string): Promise<readonly BoundMediaEntry[]>;
+    unboundFinalizationWork(operationId: string): Promise<readonly BoundMediaEntry[]>;
     /** A warning is a live release with incomplete housekeeping. Retrying resets
      * only failed effects, never an already-completed entry. */
     resumeFinalization(operationId: string, releaseId: string, now: number): Promise<void>;
+    resumeUnboundFinalization(operationId: string, now: number): Promise<void>;
     readyDeleteEntry(input: {
         operationId: string;
         entryId: string;

package/dist/media.js

@@ -1,4 +1,81 @@
 import { canonicalJson } from "./persistence.js";
+const MEDIA_PREFIX = "/media/";
+export function mediaPublicUrl(key) {
+    return MEDIA_PREFIX + key.split("/").map(encodeURIComponent).join("/");
+}
+function replaceBoundedMediaUrl(value, from, to) {
+    let cursor = 0;
+    let next = "";
+    while (cursor < value.length) {
+        const found = value.indexOf(from, cursor);
+        if (found < 0)
+            return next + value.slice(cursor);
+        const after = value[found + from.length];
+        /* A media key is a complete path, not a string prefix. Query/fragment
+         * suffixes and further URL/path characters belong to another reference. */
+        if (after && /[A-Za-z0-9._~%/?#-]/.test(after)) {
+            next += value.slice(cursor, found + from.length);
+            cursor = found + from.length;
+            continue;
+        }
+        next += value.slice(cursor, found) + to;
+        cursor = found + from.length;
+    }
+    return next;
+}
+/** Rewrites exactly the Media references owned by one operation. Exact array
+ * values are removed as array items; scalar slots become an empty string and
+ * are then accepted or rejected by the site's complete schema validator. */
+export function rewriteMediaValue(value, input) {
+    const replacements = Object.fromEntries(Object.entries(input.replacements ?? {})
+        .map(([from, to]) => [mediaPublicUrl(from), mediaPublicUrl(to)]));
+    const removals = new Set((input.removals ?? []).map(mediaPublicUrl));
+    const visit = (item, inArray) => {
+        if (typeof item === "string") {
+            if (inArray && removals.has(item))
+                return { changed: true, removed: true };
+            let next = item;
+            for (const [from, to] of Object.entries(replacements))
+                next = replaceBoundedMediaUrl(next, from, to);
+            for (const from of removals)
+                next = replaceBoundedMediaUrl(next, from, "");
+            return { changed: next !== item, value: next };
+        }
+        if (Array.isArray(item)) {
+            let changed = false;
+            const next = [];
+            for (const child of item) {
+                const result = visit(child, true);
+                changed ||= result.changed;
+                if (!result.removed)
+                    next.push(result.value);
+            }
+            return { changed, value: next };
+        }
+        if (item && typeof item === "object") {
+            /* Gallery entries conventionally carry the asset identity in `src` and
+             * exist only to describe that asset (dimensions/visibility may surround
+             * it). Removing the whole array item preserves a valid collection;
+             * broader object shapes remain intact and let the site validator decide
+             * whether an empty optional slot is acceptable or needs replacement. */
+            if (inArray && typeof item.src === "string"
+                && removals.has(item.src)) {
+                return { changed: true, removed: true };
+            }
+            let changed = false;
+            const next = {};
+            for (const [key, child] of Object.entries(item)) {
+                const result = visit(child, false);
+                changed ||= result.changed;
+                if (!result.removed)
+                    next[key] = result.value;
+            }
+            return { changed, value: next };
+        }
+        return { changed: false, value: item };
+    };
+    return visit(value, false);
+}
 export const mediaOperationStates = [
     "preparing", "ready", "blocked_in_use", "bound", "finalizing", "completed", "completed_with_warning", "cancelled", "failed",
 ];
@@ -171,6 +248,37 @@ export class D1MediaOperationRepository {
         if (result.meta?.changes !== 1)
             throw new Error("media_operation_unavailable");
     }
+    /** An operation whose sources occur in neither the public manifest nor any
+     * current draft needs no content release. The same guarded transition closes
+     * the last race before R2 cleanup; a concurrent reference makes it stay
+     * ready for the isolated-publication path instead. */
+    async beginUnpublishedFinalization(operationId, now) {
+        const result = await this.db.prepare(`UPDATE media_operations SET state = 'finalizing', updated_at = ?
+      WHERE operation_id = ? AND state = 'ready'
+        AND NOT EXISTS (SELECT 1 FROM content_release_media_operations WHERE operation_id = ?)
+        AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+          JOIN content_site_state state ON state.singleton = 1
+          JOIN content_release_entries published_entry ON published_entry.release_id = state.current_release_id
+          JOIN content_revisions published ON published.document_id = published_entry.document_id
+            AND published.revision_id = published_entry.revision_id
+          WHERE source.operation_id = media_operations.operation_id AND published.payload_json IS NOT NULL
+            AND instr(published.payload_json, '/media/' || source.source_key) > 0)
+        AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+          JOIN content_releases release ON release.status = 'publishing'
+          JOIN content_release_entries candidate_entry ON candidate_entry.release_id = release.release_id
+          JOIN content_revisions candidate ON candidate.document_id = candidate_entry.document_id
+            AND candidate.revision_id = candidate_entry.revision_id
+          WHERE source.operation_id = media_operations.operation_id AND candidate.payload_json IS NOT NULL
+            AND instr(candidate.payload_json, '/media/' || source.source_key) > 0)
+        AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+          JOIN content_documents document
+          JOIN content_revisions draft ON draft.document_id = document.document_id
+            AND draft.revision_id = document.draft_revision_id
+          WHERE source.operation_id = media_operations.operation_id AND draft.payload_json IS NOT NULL
+            AND instr(draft.payload_json, '/media/' || source.source_key) > 0)`)
+            .bind(now, operationId, operationId).run();
+        return result.meta?.changes === 1;
+    }
     /** Individual cleanup writes are retryable. A single failed entry reaches
      * `completed_with_warning` only after every entry has a terminal result;
      * the already-live release is never rolled back. */
@@ -284,6 +392,17 @@ export class D1MediaOperationRepository {
       ORDER BY operation.operation_id, entry.entry_id`).bind(releaseId).all()).results ?? [];
         return rows;
     }
+    async unboundFinalizationWork(operationId) {
+        return (await this.db.prepare(`SELECT operation.operation_id AS operationId, operation.type,
+      operation.state AS operationState, entry.entry_id AS entryId, entry.source_key AS sourceKey,
+      entry.destination_key AS destinationKey, entry.finalization_state AS finalizationState
+      FROM media_operations operation
+      JOIN media_operation_entries entry ON entry.operation_id = operation.operation_id
+      WHERE operation.operation_id = ? AND operation.state IN ('finalizing', 'completed_with_warning')
+        AND NOT EXISTS (SELECT 1 FROM content_release_media_operations WHERE operation_id = operation.operation_id)
+        AND entry.finalization_state IN ('pending', 'failed')
+      ORDER BY entry.entry_id`).bind(operationId).all()).results ?? [];
+    }
     /** A warning is a live release with incomplete housekeeping. Retrying resets
      * only failed effects, never an already-completed entry. */
     async resumeFinalization(operationId, releaseId, now) {
@@ -300,6 +419,19 @@ export class D1MediaOperationRepository {
         if (results[0]?.meta?.changes !== 1)
             throw new Error("media_operation_unavailable");
     }
+    async resumeUnboundFinalization(operationId, now) {
+        const resume = this.db.prepare(`UPDATE media_operations SET state = 'finalizing', updated_at = ?, retry_count = retry_count + 1
+      WHERE operation_id = ? AND state = 'completed_with_warning'
+        AND NOT EXISTS (SELECT 1 FROM content_release_media_operations WHERE operation_id = ?)`)
+            .bind(now, operationId, operationId);
+        const reset = this.db.prepare(`UPDATE media_operation_entries SET finalization_state = 'pending', safe_error = NULL
+      WHERE operation_id = ? AND finalization_state = 'failed'
+        AND EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'finalizing')`)
+            .bind(operationId, operationId);
+        const results = await this.db.batch([resume, reset]);
+        if (results[0]?.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+    }
     async readyDeleteEntry(input) {
         const entry = this.db.prepare(`UPDATE media_operation_entries
       SET object_checksum = ?, etag = ?, metadata_json = ?, preparation_state = 'ready'

package/dist/normalize.d.ts

@@ -20,6 +20,7 @@ export type WorkCard = {
 export type Work = {
     title: string;
     cover: string;
+    coverAlt: string;
     description: string[];
     info: WorkInfo[];
     cards: WorkCard[];

package/dist/normalize.js

@@ -33,7 +33,7 @@ export const CARD_KINDS = [
     { type: "frosted", label: "Testo su immagine", hint: "Parole sopra una fotografia" },
 ];
 export function emptyWork() {
-    return { title: "", cover: "", description: [], info: [], cards: [] };
+    return { title: "", cover: "", coverAlt: "", description: [], info: [], cards: [] };
 }
 /* Il tipo di una card nuova è SEMPRE esplicito, mai stringa vuota: un `select` mostra comunque
  * la prima opzione quando il valore non combacia con nessuna, quindi una card salvata senza
@@ -48,6 +48,7 @@ export function normalizeWorks(value) {
         return {
             title: str(item.title),
             cover: str(item.cover),
+            coverAlt: str(item.coverAlt),
             description: list(item.description).map(str).filter(Boolean),
             info: list(item.info).map((entry) => {
                 const o = obj(entry);

package/dist/persistence.d.ts

@@ -103,6 +103,13 @@ export type SaveInput = Revision & {
     authorSubject: string;
     authorLabel: string;
 };
+/** A system-owned revision that may enter one release without becoming the
+ * document's editorial draft. Its ancestry is the exact revision in the
+ * current public manifest; an existing draft is deliberately neither selected
+ * nor cleared. */
+export type DetachedRevisionInput = Omit<SaveInput, "expectedDraftRevisionId"> & {
+    baseRevisionId: string;
+};
 export type ReleaseInput = {
     releaseId: string;
     requestChecksum: string;
@@ -122,6 +129,7 @@ export type ReleaseInput = {
     siteAccessVersionId?: string | null;
 };
 export type ReleaseDeploymentInput = ReleaseInput & {
+    detachedRevisions?: readonly DetachedRevisionInput[];
     attempt: {
         attemptId: string;
         intentKind: string;

package/dist/persistence.js

@@ -332,11 +332,19 @@ export class D1ContentRepository {
             : [];
         const manifest = new Map(inherited.map((entry) => [entry.document_id, entry.revision_id]));
         const selected = [...input.entries];
+        const detached = [...(input.detachedRevisions ?? [])];
         const mediaOperationIds = [...new Set(input.mediaOperationIds ?? [])];
         if (!selected.length && !mediaOperationIds.length && !input.siteAccessVersionId)
             throw new Error("invalid_document");
+        if (new Set(detached.map((entry) => entry.documentId)).size !== detached.length
+            || new Set(detached.map((entry) => entry.revisionId)).size !== detached.length
+            || detached.some((entry) => selected.some((draft) => draft.documentId === entry.documentId)
+                || (entry.payload === null) === !entry.tombstone))
+            throw new Error("invalid_document");
         for (const entry of selected)
             manifest.set(entry.documentId, entry.revisionId);
+        for (const entry of detached)
+            manifest.set(entry.documentId, entry.revisionId);
         const selectionGuard = selected.length ? selected.map(() => "EXISTS (SELECT 1 FROM content_documents WHERE document_id = ? AND draft_revision_id = ?)").join(" AND ") : "1 = 1";
         const accessGuard = input.siteAccessVersionId ? `AND EXISTS (SELECT 1 FROM site_access_versions version JOIN site_access_state access_state ON access_state.singleton = 1
       WHERE version.version_id = ? AND version.state IN ('draft','active') AND version.version_id IN (access_state.draft_version_id, access_state.active_version_id))` : "";
@@ -346,6 +354,22 @@ export class D1ContentRepository {
         AND NOT EXISTS (SELECT 1 FROM production_deployment_attempts WHERE active_slot = 1) AND ${selectionGuard} ${accessGuard}`)
             .bind(input.releaseId, input.requestChecksum, input.manifestChecksum, input.schemaPackageVersion, input.materializerVersion, input.authorSubject, input.now, state.current_release_id, ...selected.flatMap((entry) => [entry.documentId, entry.revisionId]), ...(input.siteAccessVersionId ? [input.siteAccessVersionId] : []));
         const statements = [];
+        if (detached.length) {
+            const eligible = detached.map(() => `(
+        EXISTS (SELECT 1 FROM content_documents document WHERE document.document_id = ? AND document.kind = ? AND document.locale = ?)
+        AND EXISTS (SELECT 1 FROM content_site_state state JOIN content_release_entries entry
+          ON entry.release_id = state.current_release_id WHERE state.singleton = 1
+            AND entry.document_id = ? AND entry.revision_id = ?)
+        AND NOT EXISTS (SELECT 1 FROM content_revisions WHERE revision_id = ?)
+      )`).join(" AND ");
+            statements.push(this.db.prepare(`INSERT INTO content_site_state
+        (singleton, current_release_id, schema_generation, updated_at)
+        SELECT 2, NULL, 0, ? WHERE NOT (${eligible})`)
+                .bind(input.now, ...detached.flatMap((entry) => [
+                entry.documentId, entry.kind, entry.locale, entry.documentId, entry.baseRevisionId, entry.revisionId,
+            ])));
+        }
+        let mediaEligibility = null;
         if (mediaOperationIds.length) {
             const revisionIds = [...manifest.values()];
             const eligible = mediaOperationIds.map(() => `(
@@ -353,17 +377,45 @@ export class D1ContentRepository {
         AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
           JOIN content_revisions revision ON revision.revision_id IN (${revisionIds.map(() => "?").join(",")})
           WHERE source.operation_id = ? AND revision.payload_json IS NOT NULL
-            AND instr(revision.payload_json, '/media/' || source.source_key) > 0))`).join(" AND ");
+            AND instr(revision.payload_json, '/media/' || source.source_key) > 0)
+        AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+          JOIN content_documents document
+          JOIN content_revisions draft ON draft.document_id = document.document_id
+            AND draft.revision_id = document.draft_revision_id
+          WHERE source.operation_id = ? AND draft.payload_json IS NOT NULL
+            AND instr(draft.payload_json, '/media/' || source.source_key) > 0))`).join(" AND ");
             /* As with multi-document Save, zero affected rows do not abort a D1
              * batch. Convert an ineligible Media binding into a CHECK violation
-             * before the candidate exists, so no release/attempt can commit alone. */
-            statements.push(this.db.prepare(`INSERT INTO content_site_state
+             * inside the same transaction, after detached revisions exist but before
+             * any dependent binding can become durable. */
+            mediaEligibility = this.db.prepare(`INSERT INTO content_site_state
         (singleton, current_release_id, schema_generation, updated_at)
         SELECT 2, NULL, 0, ? WHERE NOT (${eligible})`)
-                .bind(input.now, ...mediaOperationIds.flatMap((operationId) => [operationId, ...revisionIds, operationId])));
+                .bind(input.now, ...mediaOperationIds.flatMap((operationId) => [operationId, ...revisionIds, operationId, operationId]));
         }
         const candidateIndex = statements.length;
         statements.push(candidate);
+        /* Detached revisions are guarded by the candidate itself. If the lane is
+         * busy or the base release moved, they affect zero rows together with the
+         * rest of the release instead of becoming orphan system revisions. */
+        for (const entry of detached) {
+            statements.push(this.db.prepare(`INSERT INTO content_revisions
+        (revision_id, document_id, base_revision_id, payload_json, is_tombstone, schema_version,
+         payload_checksum, request_checksum, author_subject, author_label, created_at)
+        SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM content_documents document
+        JOIN content_site_state state ON state.singleton = 1
+        JOIN content_release_entries published ON published.release_id = state.current_release_id
+          AND published.document_id = document.document_id
+        WHERE document.document_id = ? AND document.kind = ? AND document.locale = ?
+          AND published.revision_id = ? AND NOT EXISTS
+            (SELECT 1 FROM content_revisions existing WHERE existing.revision_id = ?)
+          AND EXISTS (SELECT 1 FROM content_releases release
+            WHERE release.release_id = ? AND release.status = 'publishing')`)
+                .bind(entry.revisionId, entry.documentId, entry.baseRevisionId, entry.payload === null ? null : canonicalJson(entry.payload), Number(entry.tombstone), entry.schemaVersion, entry.payloadChecksum, entry.requestChecksum, entry.authorSubject, entry.authorLabel, entry.now, entry.documentId, entry.kind, entry.locale, entry.baseRevisionId, entry.revisionId, input.releaseId));
+        }
+        const mediaEligibilityIndex = mediaEligibility ? statements.length : -1;
+        if (mediaEligibility)
+            statements.push(mediaEligibility);
         /* Every dependent write is guarded by the exact candidate. D1 batches are
          * atomic on SQL errors, but a guarded INSERT that affects zero rows is not
          * an error: without this predicate, a busy lane made these FK inserts
@@ -391,7 +443,13 @@ export class D1ContentRepository {
             JOIN content_release_entries entry ON entry.release_id = ?
             JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
             WHERE source.operation_id = media_operations.operation_id
-              AND revision.payload_json IS NOT NULL AND instr(revision.payload_json, '/media/' || source.source_key) > 0)`)
+              AND revision.payload_json IS NOT NULL AND instr(revision.payload_json, '/media/' || source.source_key) > 0)
+          AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+            JOIN content_documents document
+            JOIN content_revisions draft ON draft.document_id = document.document_id
+              AND draft.revision_id = document.draft_revision_id
+            WHERE source.operation_id = media_operations.operation_id AND draft.payload_json IS NOT NULL
+              AND instr(draft.payload_json, '/media/' || source.source_key) > 0)`)
                 .bind(input.now, operationId, input.releaseId));
             statements.push(this.db.prepare(`INSERT INTO content_release_media_operations (release_id, operation_id)
         SELECT ?, ? WHERE EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'publishing')
@@ -405,7 +463,9 @@ export class D1ContentRepository {
         AND EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'publishing')`)
             .bind(input.attempt.attemptId, input.attempt.intentKind, input.attempt.requestedReleaseId, input.attempt.requestedCodeSha, input.attempt.codeSha, input.releaseId, input.attempt.expectedFingerprint, input.now, input.now, input.releaseId));
         const results = await this.db.batch(statements);
-        if (results[candidateIndex]?.meta?.changes !== 1 || results.slice(candidateIndex + 1, -1).some((result) => result.meta?.changes !== 1)
+        if (results[candidateIndex]?.meta?.changes !== 1
+            || results.slice(candidateIndex + 1, -1).some((result, offset) => candidateIndex + 1 + offset !== mediaEligibilityIndex
+                && result.meta?.changes !== 1)
             || results.at(-1)?.meta?.changes !== 1)
             throw new Error("deployment_lane_busy");
         return "created";
@@ -424,6 +484,18 @@ export class D1ContentRepository {
         SET phase = 'failed', active_slot = NULL, error_code = ?, error_stage = ?, safe_message = ?, updated_at = ?, finished_at = ?
         WHERE attempt_id = ? AND release_id = ? AND phase = 'waiting' AND ci_claim_token_checksum IS NULL AND ci_claim_expires_at IS NULL`)
                 .bind(input.code, input.stage, input.message, input.now, input.now, input.attemptId, input.releaseId),
+            /* Dispatch failed before CI could claim the immutable candidate. Its
+             * Media intents must become publishable again in this same recovery
+             * transaction; otherwise one transient GitHub error strands them bound
+             * forever to a failed release. */
+            this.db.prepare(`UPDATE media_operations SET state = 'ready', updated_at = ?
+        WHERE state = 'bound' AND operation_id IN
+          (SELECT operation_id FROM content_release_media_operations WHERE release_id = ?)
+          AND EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'failed')`)
+                .bind(input.now, input.releaseId, input.releaseId),
+            this.db.prepare(`DELETE FROM content_release_media_operations WHERE release_id = ?
+        AND EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'failed')`)
+                .bind(input.releaseId, input.releaseId),
         ]);
         if (results[0]?.meta?.changes !== 1 || results[1]?.meta?.changes !== 1)
             throw new Error("attempt_unavailable");

package/dist/theme.css

@@ -405,6 +405,13 @@ a.ak-btn { text-decoration: none; display: inline-flex; align-items: center; }
   max-width: 100%; max-height: 100%; width: auto; height: auto; display: block;
   background: var(--ak-line); box-shadow: 0 1px 4px rgba(0, 0, 0, .16);
 }
+.mg-alt-badge {
+  position: absolute; top: 5px; right: 5px; z-index: 2; pointer-events: none;
+  padding: 4px 6px; border-radius: 999px; background: rgba(20, 20, 20, .78); color: #fff;
+  font: 600 9px/1 var(--ak-font); text-transform: uppercase; letter-spacing: .04em;
+}
+.mg-alt-badge.is-missing { background: var(--ak-danger); }
+.mg-alt-badge.is-decorative { background: rgba(80, 80, 80, .82); }
 /* La cornice della selezione è DECORAZIONE: `pointer-events: none` o si prende lei il click.
    Essendo un ::after del frame viene disegnata dopo la casella, quindi le stava sopra: premere
    la spunta di un elemento già selezionato non lo deselezionava, lo apriva. */
@@ -494,6 +501,41 @@ a.ak-btn { text-decoration: none; display: inline-flex; align-items: center; }
 .lb-info dl { margin: 0; display: grid; grid-template-columns: auto 1fr; gap: 5px 14px; font: 400 12px/1.4 var(--ak-font); }
 .lb-info dt { color: #9b9b98; }
 .lb-info dd { margin: 0; word-break: break-word; }
+.lb-alt-button { font: 700 11px/1 var(--ak-font); letter-spacing: .04em; }
+.lb-alt {
+  position: absolute; right: 12px; top: 58px; z-index: 3; width: min(390px, calc(100vw - 24px));
+  max-height: calc(100vh - 76px); overflow: auto; display: flex; flex-direction: column; gap: 14px;
+  background: rgba(22, 22, 22, .97); border: 1px solid rgba(255, 255, 255, .16);
+  border-radius: 9px; padding: 16px; color: #eaeaea; box-shadow: 0 18px 48px rgba(0, 0, 0, .4);
+}
+.lb-alt > header { display: flex; align-items: flex-start; justify-content: space-between; gap: 12px; }
+.lb-alt > header div { display: flex; flex-direction: column; gap: 3px; }
+.lb-alt > header strong { font: 600 15px/1.2 var(--ak-font); }
+.lb-alt > header span { color: #a9a9a5; font: 400 11px/1.3 var(--ak-font); }
+.lb-alt > header button {
+  border: 0; background: transparent; color: #fff; cursor: pointer; padding: 0 2px;
+  font: 300 22px/1 var(--ak-font);
+}
+.lb-alt-decorative { display: flex; align-items: flex-start; gap: 9px; cursor: pointer; }
+.lb-alt-decorative input { margin: 2px 0 0; }
+.lb-alt-decorative span { display: flex; flex-direction: column; gap: 3px; }
+.lb-alt-decorative strong { font: 500 13px/1.3 var(--ak-font); }
+.lb-alt-decorative small, .lb-alt-guidance { color: #adada8; font: 400 11px/1.45 var(--ak-font); }
+.lb-alt-decorative code { color: #fff; }
+.lb-alt-fields { display: flex; flex-direction: column; gap: 11px; }
+.lb-alt-fields label { display: flex; flex-direction: column; gap: 6px; }
+.lb-alt-fields label > span { display: flex; justify-content: space-between; gap: 12px; font: 500 12px/1.2 var(--ak-font); }
+.lb-alt-fields label > span small { color: #8f8f8b; font-weight: 400; }
+.lb-alt-fields textarea {
+  width: 100%; resize: vertical; box-sizing: border-box; padding: 9px 10px;
+  border: 1px solid #555; border-radius: 6px; background: #111; color: #fff;
+  font: 400 13px/1.45 var(--ak-font);
+}
+.lb-alt-fields textarea:focus { outline: 2px solid var(--ak-accent); outline-offset: 1px; }
+.lb-alt-guidance, .lb-alt-error, .lb-alt-saved { margin: 0; }
+.lb-alt-error { color: #ff9b9b; font: 500 11px/1.4 var(--ak-font); }
+.lb-alt-saved { color: #b9e6bd; font: 500 11px/1.4 var(--ak-font); }
+.lb-alt footer { display: flex; justify-content: flex-end; }
 
 /* ---- Media: il dialogo di caricamento ------------------------------------------------- */
 .up { position: fixed; inset: 0; z-index: 70; background: rgba(0, 0, 0, .42); display: grid; place-items: center; padding: 5vh 5vw; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardinali-studio/adminkit",
-  "version": "2.2.21",
+  "version": "2.2.23",
   "type": "module",
   "description": "Motore riusabile di un pannello di amministrazione per siti Hugo su Cloudflare Pages: codec del front matter guidato dallo schema, form React, libreria media su R2. NIENTE di specifico di un sito qui dentro.",
   "license": "UNLICENSED",