@cardinali-studio/adminkit 2.2.9 → 2.2.10

package/dist/deployment.d.ts

@@ -89,6 +89,7 @@ export declare class D1DeploymentAttemptRepository {
     finalize(input: {
         attemptId: string;
         releaseId: string;
+        intentKind: DeploymentIntent;
         tokenChecksum: string;
         now: number;
     }): Promise<void>;

package/dist/deployment.js

@@ -163,6 +163,19 @@ export class D1DeploymentAttemptRepository {
      * batch. Every mutating statement repeats the capability guard, so a stale
      * claim cannot publish content even if a prior read was valid. */
     async finalize(input) {
+        if (input.intentKind === "code") {
+            const result = await this.db.prepare(`UPDATE production_deployment_attempts
+        SET phase = 'succeeded', active_slot = NULL, updated_at = ?, finished_at = ?
+        WHERE attempt_id = ? AND release_id = ? AND intent_kind = 'code' AND phase = 'verifying_canonical'
+          AND ci_claim_token_checksum = ? AND ci_claim_expires_at > ?
+          AND EXISTS (SELECT 1 FROM content_site_state state JOIN content_releases release
+            ON release.release_id = state.current_release_id
+            WHERE state.singleton = 1 AND state.current_release_id = ? AND release.status = 'published')`)
+                .bind(input.now, input.now, input.attemptId, input.releaseId, input.tokenChecksum, input.now, input.releaseId).run();
+            if (result.meta?.changes !== 1)
+                throw new Error("attempt_unavailable");
+            return;
+        }
         const guard = `EXISTS (SELECT 1 FROM production_deployment_attempts WHERE attempt_id = ? AND release_id = ?
       AND phase = 'verifying_canonical' AND ci_claim_token_checksum = ? AND ci_claim_expires_at > ?)`;
         const statements = [

package/dist/functions/api/content-ci.js

@@ -4,11 +4,12 @@ import {
   D1DeploymentAttemptRepository, claimTokenChecksum, constantTimeSecretEqual,
   isTerminalDeploymentPhase,
 } from "../../deployment.js";
-import { releaseExportFromStored } from "../../release.js";
+import { deploymentFingerprint, releaseExportFromStored } from "../../release.js";
 
 const MAX_BODY_BYTES = 8_000;
 const claimLifetimeMs = 20 * 60 * 1_000;
 const id = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const sha = /^[0-9a-f]{40}$/i;
 const phases = new Set(["validating", "materializing", "building", "deploying", "verifying_deployment_url", "verifying_canonical"]);
 const failure = {
   materialization_failed: { stage: "materializing", message: "La generazione del sito non è riuscita." },
@@ -94,6 +95,27 @@ export async function handleInternalContentCi({ request, env }) {
     const now = Date.now();
     const { attempts, content } = repositories(env);
 
+    if (path === "/internal/deployment/register-code" && request.method === "POST") {
+      const input = await body(request);
+      if (!sha.test(input.codeSha || "")) throw new Error("invalid_request");
+      const state = await env.CONTENT_DB.prepare("SELECT current_release_id AS currentReleaseId FROM content_site_state WHERE singleton = 1")
+        .first();
+      if (!state?.currentReleaseId) throw new Error("content_unavailable");
+      const snapshot = await content.getReleaseExport(state.currentReleaseId);
+      if (!snapshot || snapshot.status !== "published") throw new Error("content_unavailable");
+      const fingerprint = await deploymentFingerprint({
+        codeSha: input.codeSha, manifestChecksum: snapshot.manifestChecksum,
+        schemaPackageVersion: snapshot.schemaPackageVersion, materializerVersion: snapshot.materializerVersion,
+      });
+      const attemptId = crypto.randomUUID();
+      await attempts.register({
+        attemptId, intentKind: "code", requestedReleaseId: snapshot.releaseId, requestedCodeSha: input.codeSha,
+        releaseId: snapshot.releaseId, codeSha: input.codeSha, expectedFingerprint: fingerprint.fingerprint, now,
+      });
+      return response({ ok: true, attemptId, releaseId: snapshot.releaseId, codeSha: input.codeSha,
+        expectedFingerprint: fingerprint.fingerprint });
+    }
+
     if (path === "/internal/deployment/claim" && request.method === "POST") {
       const identity = requiredIdentity(await body(request));
       const attempt = await attempts.get(identity.attemptId);
@@ -124,7 +146,7 @@ export async function handleInternalContentCi({ request, env }) {
       return response({ ok: true, attempt: { ...identity, phase: input.phase } });
     }
     if (path === "/internal/deployment/finalize" && request.method === "POST") {
-      await attempts.finalize({ ...identity, tokenChecksum: checksum, now });
+      await attempts.finalize({ ...identity, intentKind: attempt.intentKind, tokenChecksum: checksum, now });
       return response({ ok: true, attempt: { ...identity, phase: "succeeded" } });
     }
     if (path === "/internal/deployment/fail" && request.method === "POST") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardinali-studio/adminkit",
-  "version": "2.2.9",
+  "version": "2.2.10",
   "type": "module",
   "description": "Motore riusabile di un pannello di amministrazione per siti Hugo su Cloudflare Pages: codec del front matter guidato dallo schema, form React, libreria media su R2. NIENTE di specifico di un sito qui dentro.",
   "license": "UNLICENSED",