@cardinali-studio/adminkit 2.2.9 → 2.2.11

package/dist/api.d.ts

@@ -1,4 +1,5 @@
 import { type JsonValue } from "./persistence.js";
+import type { MediaOperationStatus } from "./media.js";
 export declare class ApiError extends Error {
     code: string;
     status: number;
@@ -143,6 +144,7 @@ export declare const api: {
             kind: string;
             updatedAt: number;
         }[];
+        mediaOperations?: MediaOperationStatus[];
         activeReleaseId?: string | null;
     }>;
     contentPublish: () => Promise<{
@@ -219,6 +221,19 @@ export declare const api: {
         }[];
         warning?: string;
     }>;
+    mediaOperations: () => Promise<{
+        ok: true;
+        operations: MediaOperationStatus[];
+    }>;
+    resumeMediaOperation: (operationId: string, releaseId: string) => Promise<{
+        ok: true;
+        completed: number;
+        failed: number;
+    }>;
+    cancelMediaOperation: (operationId: string) => Promise<{
+        ok: true;
+        cancelled: true;
+    }>;
     usage: (target: {
         keys?: string[];
         prefixes?: string[];

package/dist/api.js

@@ -78,14 +78,38 @@ export const api = {
     /** `label` è il nome per esteso; lo slug della chiave lo calcola il server e lo restituisce. */
     createFolder: (parent, name, opts = {}) => post("/admin/api/assets/folder", { parent, name, ...opts }),
     /** Con `skipRefs` copia senza cancellare gli originali e restituisce la mappa degli URL. */
-    move: (keys, dest, opts = {}) => post("/admin/api/assets/move", { keys, dest, ...opts }),
+    move: async (keys, dest, opts = {}) => {
+        const operationId = crypto.randomUUID();
+        const destinationPrefix = dest.trim().endsWith("/") ? dest.trim() : `${dest.trim()}/`;
+        const sourceKeys = [...new Set(keys)].filter((key) => {
+            const slash = key.lastIndexOf("/");
+            const parent = slash < 0 ? "" : key.slice(0, slash + 1);
+            return parent !== destinationPrefix;
+        });
+        if (!sourceKeys.length)
+            return {
+                ok: true, moved: 0, finalized: 0, urlMap: {}, pagesUpdated: [], failed: [],
+            };
+        const requestChecksum = await canonicalChecksum({ action: "media.operation", operationId, type: "move", sourceKeys, sourcePrefix: null, destinationPrefix });
+        return post("/admin/api/assets/move", { keys: sourceKeys, dest: destinationPrefix, operationId, requestChecksum, ...opts });
+    },
     /** Riscrive i riferimenti, poi elimina gli originali le cui copie sono state verificate. */
     moveApplyRefs: (applyRefs) => post("/admin/api/assets/move", { applyRefs }),
+    mediaOperations: () => call("/admin/api/assets/media"),
+    resumeMediaOperation: (operationId, releaseId) => post("/admin/api/assets/media", { action: "resume", operationId, releaseId }),
+    cancelMediaOperation: (operationId) => post("/admin/api/assets/media", { action: "cancel", operationId }),
     usage: (target) => post("/admin/api/assets/usage", target),
     /* `refsOnly` pulisce solo i riferimenti nelle pagine (un commit, niente file spostati);
      * `skipRefs` sposta i file e non tocca il repo. Servono a spezzare una cancellazione grande
      * in più richieste senza fare un commit — cioè una build — per ogni gruppo. */
-    remove: (target, opts = {}) => post("/admin/api/assets/delete", { ...target, ...opts }),
+    remove: async (target, opts = {}) => {
+        const operationId = crypto.randomUUID();
+        const sourceKeys = target.prefixes?.length ? null : [...new Set(target.keys ?? [])];
+        const requestChecksum = sourceKeys?.length
+            ? await canonicalChecksum({ action: "media.operation", operationId, type: "delete", sourceKeys, sourcePrefix: null, destinationPrefix: null })
+            : undefined;
+        return post("/admin/api/assets/delete", { ...target, operationId, ...(requestChecksum ? { requestChecksum } : {}), ...opts });
+    },
     // ---- richieste dal form di contatto
     requests: () => call("/admin/api/requests"),
     markRequest: (id, handled) => call("/admin/api/requests", {

package/dist/app/lib/publish.js

@@ -22,7 +22,12 @@ export function usePublish() {
                 setAhead(d.ahead ?? 0);
                 setCommits((d.documents ?? []).map((document) => ({
                     message: `Modifica salvata (${document.kind})`, date: document.updatedAt ? new Date(document.updatedAt).toISOString() : null,
-                })));
+                })).concat((d.mediaOperations ?? [])
+                    .filter((operation) => operation.state === "ready")
+                    .map((operation) => ({
+                    message: operation.type === "move" ? "Spostamento Media pronto" : "Eliminazione Media pronta",
+                    date: operation.updatedAt ? new Date(operation.updatedAt).toISOString() : null,
+                }))));
                 setConfigured(true);
                 setError(null);
             }

package/dist/deployment.d.ts

@@ -89,6 +89,7 @@ export declare class D1DeploymentAttemptRepository {
     finalize(input: {
         attemptId: string;
         releaseId: string;
+        intentKind: DeploymentIntent;
         tokenChecksum: string;
         now: number;
     }): Promise<void>;

package/dist/deployment.js

@@ -163,6 +163,19 @@ export class D1DeploymentAttemptRepository {
      * batch. Every mutating statement repeats the capability guard, so a stale
      * claim cannot publish content even if a prior read was valid. */
     async finalize(input) {
+        if (input.intentKind === "code") {
+            const result = await this.db.prepare(`UPDATE production_deployment_attempts
+        SET phase = 'succeeded', active_slot = NULL, updated_at = ?, finished_at = ?
+        WHERE attempt_id = ? AND release_id = ? AND intent_kind = 'code' AND phase = 'verifying_canonical'
+          AND ci_claim_token_checksum = ? AND ci_claim_expires_at > ?
+          AND EXISTS (SELECT 1 FROM content_site_state state JOIN content_releases release
+            ON release.release_id = state.current_release_id
+            WHERE state.singleton = 1 AND state.current_release_id = ? AND release.status = 'published')`)
+                .bind(input.now, input.now, input.attemptId, input.releaseId, input.tokenChecksum, input.now, input.releaseId).run();
+            if (result.meta?.changes !== 1)
+                throw new Error("attempt_unavailable");
+            return;
+        }
         const guard = `EXISTS (SELECT 1 FROM production_deployment_attempts WHERE attempt_id = ? AND release_id = ?
       AND phase = 'verifying_canonical' AND ci_claim_token_checksum = ? AND ci_claim_expires_at > ?)`;
         const statements = [

package/dist/form/media/MediaGrid.js

@@ -23,6 +23,15 @@ import { SORT_LABELS } from "./useMediaLibrary.js";
 import { DRAG_TYPE, DRAG_FOLDERS, readDragged, FolderMenu } from "./MediaFolders.js";
 import { Lightbox } from "./Lightbox.js";
 import { UploadDialog } from "./UploadDialog.js";
+const JOURNAL_LABELS = {
+    preparing: "Preparo le copie Media.",
+    ready: "Media pronta: pubblica per applicare la modifica.",
+    blocked_in_use: "Operazione bloccata: una bozza o la versione online usa ancora la sorgente.",
+    bound: "Pubblicazione con Media in corso.",
+    finalizing: "Pubblicazione riuscita: completo la pulizia Media.",
+    completed_with_warning: "Pubblicato con Media da completare.",
+    failed: "Operazione Media interrotta prima della pubblicazione.",
+};
 /* Scaricare più file significa più download: il browser ne consente una raffica breve dallo
  * stesso gesto dell'utente, e non c'è modo di fare uno zip senza un endpoint che lo costruisca. */
 function download(urls) {
@@ -117,7 +126,7 @@ export function MediaGrid({ lib, onPick, onCancel }) {
                     void lib.upload(e.dataTransfer.files);
                 }, children: [dragDepth > 0 && (_jsx("div", { className: "mg-dropzone", children: _jsxs("span", { children: ["Rilascia per caricare in ", _jsx("strong", { children: lib.prefix ? lib.labelOf(lib.prefix) : "Senza cartella" })] }) })), _jsx("header", { className: "mg-bar", children: sel.size === 0 ? (_jsxs(_Fragment, { children: [(manage || lib.multiple) && (_jsxs("label", { className: "mg-all", children: [_jsx("input", { type: "checkbox", checked: false, ref: (el) => { if (el)
                                                 el.indeterminate = false; }, onChange: () => lib.setAll(true) }), _jsx("span", { children: "Seleziona tutto" })] })), _jsx("span", { className: "ak-spacer" }), _jsxs("label", { className: "ak-hint", children: ["ordina per", " ", _jsx("select", { className: "mg-sort", value: lib.sortKey, onChange: (e) => lib.setSort(e.target.value), children: Object.entries(SORT_LABELS).map(([k, l]) => _jsx("option", { value: k, children: l }, k)) }), _jsx("button", { className: "ak-icon", onClick: lib.flipDir, title: "Inverti l'ordine", children: lib.sortDir === "asc" ? "↑" : "↓" })] })] })) : (_jsxs(_Fragment, { children: [_jsxs("label", { className: "mg-all", children: [_jsx("input", { type: "checkbox", checked: allOn, ref: (el) => { if (el)
-                                                el.indeterminate = !allOn; }, onChange: () => lib.setAll(!allOn) }), _jsxs("span", { children: [sel.size, " selezionate"] })] }), !allOn && lib.shown.length > sel.size && (_jsxs("button", { className: "mg-act is-link", onClick: () => lib.setAll(true), children: ["Seleziona tutte le ", lib.shown.length] })), manage && (_jsxs(_Fragment, { children: [lib.shown.some((f) => sel.has(f.key)) && (_jsx("button", { className: "mg-act", onClick: () => download(lib.shown.filter((f) => sel.has(f.key)).map((f) => ({ url: f.url, name: f.name }))), children: "Scarica" })), _jsx(MoveMenu, { lib: lib, keys: [...sel] }), _jsx("button", { className: "mg-act is-danger", onClick: () => void lib.remove([...sel]), children: "Elimina" })] })), _jsx("span", { className: "ak-spacer" }), _jsx("button", { className: "mg-act", onClick: () => lib.setAll(false), children: "Deseleziona" })] })) }), lib.error && _jsx("p", { className: "ak-error", onClick: lib.clearError, children: lib.error }), lib.progress && (_jsxs("p", { className: "mg-progress", children: [lib.progress.verb, " ", lib.progress.done, "/", lib.progress.total, "\u2026 \u2014 non chiudere la pagina"] })), lib.prefix !== "" && (manage || lib.subfolders.length > 0) && (_jsxs("section", { className: "mg-section", children: [_jsxs("div", { className: "mg-section-head", children: [_jsx("h2", { className: "mg-section-title", children: "Cartelle" }), manage && (_jsx("button", { className: "mg-act", onClick: () => void lib.newFolder(lib.prefix), children: "+ Cartella" }))] }), lib.subfolders.length > 0 && (_jsx("div", { className: "mg", children: lib.subfolders.map((f) => (_jsx(FolderCell, { lib: lib, folder: f, manage: manage }, f.prefix))) }))] })), lib.prefix !== "" && (manage || lib.subfolders.length > 0) && lib.shown.length > 0 && (_jsx("h2", { className: "mg-section-title", children: "Foto" })), _jsx("div", { className: "mg", children: lib.shown.map((f, i) => {
+                                                el.indeterminate = !allOn; }, onChange: () => lib.setAll(!allOn) }), _jsxs("span", { children: [sel.size, " selezionate"] })] }), !allOn && lib.shown.length > sel.size && (_jsxs("button", { className: "mg-act is-link", onClick: () => lib.setAll(true), children: ["Seleziona tutte le ", lib.shown.length] })), manage && (_jsxs(_Fragment, { children: [lib.shown.some((f) => sel.has(f.key)) && (_jsx("button", { className: "mg-act", onClick: () => download(lib.shown.filter((f) => sel.has(f.key)).map((f) => ({ url: f.url, name: f.name }))), children: "Scarica" })), _jsx(MoveMenu, { lib: lib, keys: [...sel] }), _jsx("button", { className: "mg-act is-danger", onClick: () => void lib.remove([...sel]), children: "Elimina" })] })), _jsx("span", { className: "ak-spacer" }), _jsx("button", { className: "mg-act", onClick: () => lib.setAll(false), children: "Deseleziona" })] })) }), lib.error && _jsx("p", { className: "ak-error", onClick: lib.clearError, children: lib.error }), manage && lib.mediaOperations.length > 0 && (_jsx("section", { className: "mg-journal", "aria-live": "polite", "aria-label": "Stato operazioni Media", children: lib.mediaOperations.map((operation) => (_jsxs("div", { className: `mg-journal-row is-${operation.state}`, children: [_jsx("span", { className: "mg-journal-badge", children: operation.type === "move" ? "Spostamento" : "Eliminazione" }), _jsx("span", { children: JOURNAL_LABELS[operation.state] ?? "Operazione Media in attesa." }), operation.failedEntries > 0 && _jsxs("span", { className: "ak-hint", children: [operation.failedEntries, " file da riprovare"] }), _jsx("span", { className: "ak-spacer" }), operation.state === "completed_with_warning" && operation.releaseId && (_jsx("button", { className: "mg-act", disabled: lib.busy, onClick: () => void lib.resumeMedia(operation), children: "Riprendi" })), ["preparing", "ready", "blocked_in_use", "failed"].includes(operation.state) && !operation.releaseId && (_jsx("button", { className: "mg-act is-danger", disabled: lib.busy, onClick: () => void lib.cancelMedia(operation), children: "Annulla" }))] }, operation.operationId))) })), lib.progress && (_jsxs("p", { className: "mg-progress", children: [lib.progress.verb, " ", lib.progress.done, "/", lib.progress.total, "\u2026 \u2014 non chiudere la pagina"] })), lib.prefix !== "" && (manage || lib.subfolders.length > 0) && (_jsxs("section", { className: "mg-section", children: [_jsxs("div", { className: "mg-section-head", children: [_jsx("h2", { className: "mg-section-title", children: "Cartelle" }), manage && (_jsx("button", { className: "mg-act", onClick: () => void lib.newFolder(lib.prefix), children: "+ Cartella" }))] }), lib.subfolders.length > 0 && (_jsx("div", { className: "mg", children: lib.subfolders.map((f) => (_jsx(FolderCell, { lib: lib, folder: f, manage: manage }, f.prefix))) }))] })), lib.prefix !== "" && (manage || lib.subfolders.length > 0) && lib.shown.length > 0 && (_jsx("h2", { className: "mg-section-title", children: "Foto" })), _jsx("div", { className: "mg", children: lib.shown.map((f, i) => {
                             const on = sel.has(f.key);
                             return (_jsxs("figure", { className: "mg-item" + (on ? " is-on" : ""), draggable: manage, onDragStart: (e) => {
                                     // Si trascina la SELEZIONE se la foto ne fa parte, altrimenti solo quella.

package/dist/form/media/useMediaLibrary.d.ts

@@ -1,4 +1,5 @@
 import { type AssetFile, type AssetFolder } from "../../api.js";
+import type { MediaOperationStatus } from "../../media.js";
 export type SortKey = "uploaded" | "capturedAt" | "name" | "size";
 export declare const SORT_LABELS: Record<SortKey, string>;
 export interface MediaLibrary {
@@ -11,6 +12,7 @@ export interface MediaLibrary {
     selected: Set<string>;
     busy: boolean;
     error: string | null;
+    mediaOperations: MediaOperationStatus[];
     /** Avanzamento di un'operazione lunga. `verb` è quello che si sta facendo ("Carico",
      *  "Cestino", "Sposto"): senza, un'attesa di trenta secondi non dice cosa sta succedendo e
      *  chi guarda ricarica la pagina — interrompendo l'operazione a metà. */
@@ -43,6 +45,8 @@ export interface MediaLibrary {
     renameFolder(prefix: string, label: string): Promise<void>;
     /** Cestina la cartella e tutto ciò che contiene. */
     removeFolder(prefix: string): Promise<void>;
+    resumeMedia(operation: MediaOperationStatus): Promise<void>;
+    cancelMedia(operation: MediaOperationStatus): Promise<void>;
     /** Il nome da mostrare per un prefisso: l'etichetta se c'è, altrimenti lo slug. */
     labelOf(prefix: string): string;
     clearError(): void;

package/dist/form/media/useMediaLibrary.js

@@ -11,6 +11,7 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { api, uploadQueue, ApiError } from "../../api.js";
 import { storageKey } from "../../config.js";
+import { contentPersistenceMode } from "../../app/site.js";
 /* Quanti file per richiesta nelle operazioni lunghe (cestina, sposta). Ogni file costa al
  * server tre operazioni su R2 — legge, riscrive altrove, cancella — su oggetti da qualche MB.
  * Dieci tiene una richiesta sotto i pochi secondi, che è la soglia oltre la quale chi guarda
@@ -34,6 +35,7 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
     const [busy, setBusy] = useState(false);
     const [loaded, setLoaded] = useState(false);
     const [error, setError] = useState(null);
+    const [mediaOperations, setMediaOperations] = useState([]);
     const [progress, setProgress] = useState(null);
     const [uploadOpen, setUploadOpen] = useState(false);
     const [viewing, setViewing] = useState(null);
@@ -54,7 +56,13 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         setBusy(true);
         setError(null);
         try {
-            const [a, f] = await Promise.all([api.assets(p), api.folders()]);
+            const [a, f, journal] = await Promise.all([
+                api.assets(p),
+                api.folders(),
+                mode === "manage" && contentPersistenceMode() === "d1"
+                    ? api.mediaOperations()
+                    : Promise.resolve({ ok: true, operations: [] }),
+            ]);
             if (fallback && p && !(f.folders ?? []).some((x) => p === x.prefix || p.startsWith(x.prefix))) {
                 setBusy(false);
                 return load("");
@@ -68,6 +76,7 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
             setFiles(a.files ?? []);
             setSubfolders(a.folders ?? []);
             setFolders(f.folders ?? []);
+            setMediaOperations(journal.operations ?? []);
             setPrefix(p);
             setSelected(new Set());
             setViewing(null);
@@ -88,7 +97,7 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         finally {
             setBusy(false);
         }
-    }, [remember]);
+    }, [remember, mode]);
     /* Caricamento PIGRO come per la home: chi apre l'admin sulle pagine non paga l'elenco del
      * bucket. `loaded` e non `files.length`, altrimenti una cartella vuota ritenterebbe all'infinito.
      *
@@ -469,6 +478,44 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
     }, [prefix, load, moveFolder]);
     /** Cestina una cartella con tutto quello che contiene. È `remove` con una lista di uno. */
     const removeFolder = useCallback((target) => remove([target]), [remove]);
+    const resumeMedia = useCallback(async (operation) => {
+        if (!operation.releaseId)
+            return;
+        setBusy(true);
+        setError(null);
+        let failure = null;
+        try {
+            await api.resumeMediaOperation(operation.operationId, operation.releaseId);
+        }
+        catch (e) {
+            failure = e instanceof ApiError ? e.message : String(e);
+        }
+        finally {
+            setBusy(false);
+            await load(prefix);
+            if (failure)
+                setError(failure);
+        }
+    }, [load, prefix]);
+    const cancelMedia = useCallback(async (operation) => {
+        if (!confirm("Annullare questa operazione Media? Le copie già preparate resteranno disponibili nella libreria."))
+            return;
+        setBusy(true);
+        setError(null);
+        let failure = null;
+        try {
+            await api.cancelMediaOperation(operation.operationId);
+        }
+        catch (e) {
+            failure = e instanceof ApiError ? e.message : String(e);
+        }
+        finally {
+            setBusy(false);
+            await load(prefix);
+            if (failure)
+                setError(failure);
+        }
+    }, [load, prefix]);
     const step = useCallback((delta) => {
         setViewing((i) => {
             if (i === null)
@@ -478,7 +525,7 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         });
     }, [shown.length]);
     return {
-        mode, multiple, prefix, folders, subfolders, shown, selected, busy, error, progress,
+        mode, multiple, prefix, folders, subfolders, shown, selected, busy, error, mediaOperations, progress,
         sortKey, sortDir, uploadOpen, viewing,
         go: (p) => void load(p),
         reload: () => void load(prefix),
@@ -489,7 +536,7 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         setUploadOpen,
         view: setViewing,
         step,
-        move, remove, newFolder, renameFolder, removeFolder, labelOf,
+        move, remove, newFolder, renameFolder, removeFolder, resumeMedia, cancelMedia, labelOf,
         clearError: () => setError(null),
     };
 }

package/dist/functions/_shared/d1-media.js

@@ -0,0 +1,317 @@
+/* D1-mode Media bridge. It deliberately owns no site schema: the site
+ * validator remains the authority for every draft revision generated by an
+ * explicit Media operation. Git is never consulted from this module. */
+import {
+  canonicalChecksum, canonicalJson, contentSaveRequestChecksum, D1ContentRepository,
+} from "../../persistence.js";
+import {
+  D1MediaOperationRepository, prepareMediaCopy,
+} from "../../media.js";
+import { validateContentDocument } from "../site.js";
+import { isKey, moveToTrash, sanitizeName } from "./assets.js";
+
+const MEDIA_PREFIX = "/media/";
+
+function mediaUrl(key) { return MEDIA_PREFIX + key.split("/").map(encodeURIComponent).join("/"); }
+
+function editor(data) {
+  const payload = data?.cloudflareAccess?.JWT?.payload;
+  if (!payload?.sub) throw new Error("unauthenticated");
+  return { subject: String(payload.sub), label: String(payload.email || payload.name || "Admin").slice(0, 200) };
+}
+
+function operationId(value) {
+  if (value === undefined || value === null || value === "") return crypto.randomUUID();
+  if (typeof value !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) throw new Error("invalid_media_operation");
+  return value;
+}
+
+function replaceBoundedUrl(value, from, to) {
+  let cursor = 0;
+  let next = "";
+  while (cursor < value.length) {
+    const found = value.indexOf(from, cursor);
+    if (found < 0) return next + value.slice(cursor);
+    const after = value[found + from.length];
+    /* A media key is a path, not a string prefix. Query/fragment suffixes and
+     * further URL/path characters belong to a different reference and must
+     * not be rewritten accidentally. */
+    if (after && /[A-Za-z0-9._~%!$&'()*+,;=:@/?#-]/.test(after)) {
+      next += value.slice(cursor, found + from.length);
+      cursor = found + from.length;
+      continue;
+    }
+    next += value.slice(cursor, found) + to;
+    cursor = found + from.length;
+  }
+  return next;
+}
+
+function replaceText(value, replacements, removals) {
+  let next = value;
+  for (const [from, to] of Object.entries(replacements)) next = replaceBoundedUrl(next, from, to);
+  for (const from of removals) next = replaceBoundedUrl(next, from, "");
+  return next;
+}
+
+/** JSON Media values are intentionally rewritten only as complete public URLs
+ * (or a URL embedded in Markdown). Arrays lose an exact removed URL; scalar
+ * slots become empty strings and are then validated by the site's schema. */
+function rewriteValue(value, replacements, removals, inArray = false) {
+  if (typeof value === "string") {
+    if (removals.has(value) && inArray) return { changed: true, removed: true };
+    const next = replaceText(value, replacements, removals);
+    return { changed: next !== value, value: next };
+  }
+  if (Array.isArray(value)) {
+    let changed = false;
+    const next = [];
+    for (const item of value) {
+      const result = rewriteValue(item, replacements, removals, true);
+      changed ||= result.changed;
+      if (!result.removed) next.push(result.value);
+    }
+    return { changed, value: next };
+  }
+  if (value && typeof value === "object") {
+    let changed = false;
+    const next = {};
+    for (const [key, item] of Object.entries(value)) {
+      const result = rewriteValue(item, replacements, removals, false);
+      changed ||= result.changed;
+      if (!result.removed) next[key] = result.value;
+    }
+    return { changed, value: next };
+  }
+  return { changed: false, value };
+}
+
+async function effectiveDocuments(db) {
+  return ((await db.prepare(`SELECT document.document_id AS documentId, document.kind, document.locale,
+    document.draft_revision_id AS draftRevisionId, published.revision_id AS publishedRevisionId,
+    draft.payload_json AS draftPayload, draft.is_tombstone AS draftTombstone,
+    published.payload_json AS publishedPayload, published.is_tombstone AS publishedTombstone,
+    COALESCE(draft.schema_version, published.schema_version) AS schemaVersion
+    FROM content_documents document
+    LEFT JOIN content_revisions draft ON draft.document_id = document.document_id AND draft.revision_id = document.draft_revision_id
+    LEFT JOIN content_site_state state ON state.singleton = 1
+    LEFT JOIN content_release_entries entry ON entry.release_id = state.current_release_id AND entry.document_id = document.document_id
+    LEFT JOIN content_revisions published ON published.document_id = entry.document_id AND published.revision_id = entry.revision_id
+    WHERE document.abandoned_at IS NULL ORDER BY document.document_id`).all()).results ?? []);
+}
+
+async function rewriteDocuments({ db, data, replacements = {}, removals = [] }) {
+  const replacementUrls = Object.fromEntries(Object.entries(replacements).map(([from, to]) => [mediaUrl(from), mediaUrl(to)]));
+  const removalUrls = new Set(removals.map(mediaUrl));
+  const commands = [];
+  for (const row of await effectiveDocuments(db)) {
+    const useDraft = row.draftRevisionId !== null;
+    const raw = useDraft ? row.draftPayload : row.publishedPayload;
+    if (!raw || (useDraft ? row.draftTombstone : row.publishedTombstone)) continue;
+    let payload;
+    try { payload = JSON.parse(raw); } catch { throw new Error("invalid_document"); }
+    const rewritten = rewriteValue(payload, replacementUrls, removalUrls);
+    if (!rewritten.changed) continue;
+    const normalized = validateContentDocument({
+      documentId: row.documentId, kind: row.kind, locale: row.locale, schemaVersion: row.schemaVersion,
+      tombstone: false, payload: rewritten.value,
+    });
+    commands.push({
+      revisionId: crypto.randomUUID(), documentId: row.documentId,
+      baseRevisionId: useDraft ? row.draftRevisionId : row.publishedRevisionId,
+      expectedDraftRevisionId: row.draftRevisionId, kind: row.kind, locale: row.locale,
+      schemaVersion: row.schemaVersion, tombstone: false, payload: normalized.payload,
+    });
+  }
+  const who = editor(data);
+  const repository = new D1ContentRepository(db);
+  /* Every command was fully parsed and site-validated before the first write.
+   * A stale CAS leaves sources untouched; an already-created R2 destination is
+   * deliberately a reusable visible asset, never an orphan cleanup target. */
+  const now = Date.now();
+  await repository.saveMany(await Promise.all(commands.map(async (command) => ({
+    ...command, payloadChecksum: await canonicalChecksum(command.payload), requestChecksum: await contentSaveRequestChecksum(command),
+    now, authorSubject: who.subject, authorLabel: who.label,
+  }))));
+  return { documents: commands.map((command) => ({ documentId: command.documentId, kind: command.kind })) };
+}
+
+function keys(input) {
+  const unique = [...new Set((Array.isArray(input) ? input : []).filter(isKey).filter((key) => !key.startsWith("_trash/")))];
+  if (!unique.length) throw new Error("invalid_media_operation");
+  return unique;
+}
+
+async function uniqueOperationKey(bucket, prefix, filename, reserved) {
+  const name = sanitizeName(filename);
+  const dot = name.lastIndexOf(".");
+  const base = dot > 0 ? name.slice(0, dot) : name;
+  const extension = dot > 0 ? name.slice(dot) : "";
+  for (let suffix = 1; suffix <= 999; suffix += 1) {
+    const candidate = suffix === 1 ? `${prefix}${name}` : `${prefix}${base}-${suffix}${extension}`;
+    if (reserved.has(candidate) || await bucket.head(candidate)) continue;
+    reserved.add(candidate);
+    return candidate;
+  }
+  throw new Error("media_destination_collision");
+}
+
+async function createOperation({ db, data, type, id, entries, sourcePrefix = null, destinationPrefix = null, clientChecksum = null }) {
+  const who = editor(data);
+  const requestChecksum = await canonicalChecksum({
+    action: "media.operation", operationId: id, type,
+    sourceKeys: entries.map((entry) => entry.sourceKey), sourcePrefix, destinationPrefix,
+  });
+  if (clientChecksum && clientChecksum !== requestChecksum) throw new Error("invalid_media_operation");
+  const journal = new D1MediaOperationRepository(db);
+  const created = await journal.create({ operationId: id, requestChecksum, type, entries, sourcePrefix, destinationPrefix, authorSubject: who.subject, now: Date.now() });
+  return { journal, created };
+}
+
+async function inspectSource(bucket, entry) {
+  const object = await bucket.get(entry.sourceKey);
+  if (!object) throw new Error("media_source_missing");
+  const bytes = await object.arrayBuffer();
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  const objectChecksum = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return {
+    ...entry,
+    objectChecksum,
+    etag: object.etag ?? null,
+    metadataJson: canonicalJson({ httpMetadata: object.httpMetadata ?? {}, customMetadata: object.customMetadata ?? {} }),
+  };
+}
+
+export async function d1MoveMedia({ env, data, body }) {
+  if (!env.CONTENT_DB || !env.MEDIA) throw new Error("content_unavailable");
+  let destination = String(body.dest || "").trim();
+  if (destination && !destination.endsWith("/")) destination += "/";
+  if (!destination || !/^(?:[A-Za-z0-9._-]+\/)+$/.test(destination) || destination.startsWith("_trash/")) throw new Error("invalid_media_operation");
+  const sourceKeys = keys(body.keys).filter((key) => key.slice(0, key.lastIndexOf("/") + 1) !== destination);
+  const id = operationId(body.operationId);
+  if (!sourceKeys.length) return { operationId: id, repeated: false, moved: 0, urlMap: {}, documents: [] };
+  const entries = [];
+  const reserved = new Set();
+  for (const sourceKey of sourceKeys) {
+    const base = sourceKey.split("/").pop();
+    const destinationKey = await uniqueOperationKey(env.MEDIA, destination, base, reserved);
+    entries.push({ entryId: crypto.randomUUID(), sourceKey, destinationKey });
+  }
+  const { journal, created } = await createOperation({ db: env.CONTENT_DB, data, type: "move", id, entries, sourcePrefix: null, destinationPrefix: destination, clientChecksum: body.requestChecksum });
+  if (created === "repeated") {
+    const stored = await journal.entries(id);
+    return {
+      operationId: id, repeated: true, moved: stored.length,
+      urlMap: Object.fromEntries(stored.filter((entry) => entry.destinationKey).map((entry) => [mediaUrl(entry.sourceKey), mediaUrl(entry.destinationKey)])),
+      documents: [],
+    };
+  }
+  try {
+    for (const entry of entries) await prepareMediaCopy({ bucket: env.MEDIA, journal, operationId: id, entryId: entry.entryId, sourceKey: entry.sourceKey, destinationKey: entry.destinationKey, now: Date.now() });
+    const rewritten = await rewriteDocuments({ db: env.CONTENT_DB, data, replacements: Object.fromEntries(entries.map((entry) => [entry.sourceKey, entry.destinationKey])) });
+    return { operationId: id, repeated: false, moved: entries.length, urlMap: Object.fromEntries(entries.map((entry) => [mediaUrl(entry.sourceKey), mediaUrl(entry.destinationKey)])), documents: rewritten.documents };
+  } catch (error) {
+    await journal.cancel(id, Date.now()).catch(() => null);
+    throw error;
+  }
+}
+
+export async function d1DeleteMedia({ env, data, body }) {
+  if (!env.CONTENT_DB || !env.MEDIA) throw new Error("content_unavailable");
+  const sourceKeys = keys(body.keys);
+  const id = operationId(body.operationId);
+  const entries = sourceKeys.map((sourceKey) => ({ entryId: crypto.randomUUID(), sourceKey }));
+  const { journal, created } = await createOperation({ db: env.CONTENT_DB, data, type: "delete", id, entries, clientChecksum: body.requestChecksum });
+  if (created === "repeated") return { operationId: id, repeated: true, trashed: (await journal.entries(id)).length, documents: [] };
+  try {
+    const inspected = await Promise.all(entries.map((entry) => inspectSource(env.MEDIA, entry)));
+    const rewritten = await rewriteDocuments({ db: env.CONTENT_DB, data, removals: sourceKeys });
+    for (const entry of inspected) await journal.readyDeleteEntry({ ...entry, operationId: id, now: Date.now() });
+    return { operationId: id, repeated: false, trashed: entries.length, documents: rewritten.documents };
+  } catch (error) {
+    await journal.cancel(id, Date.now()).catch(() => null);
+    throw error;
+  }
+}
+
+export async function d1PendingSourceKeys(db) {
+  return new Set(await new D1MediaOperationRepository(db).activeSourceKeys());
+}
+
+/** Usage is read from the public release, every current draft, and an
+ * in-flight immutable candidate. It never reads Git in D1 mode. */
+export async function d1MediaUsage(db, sourceKeys) {
+  const keys = [...new Set(sourceKeys.filter(isKey))];
+  if (!keys.length) return { usage: {}, pages: [], count: 0, selectedCount: 0, blockers: [] };
+  const rows = (await db.prepare(`SELECT document.kind, document.document_id AS documentId, revision.payload_json AS payload
+    FROM content_documents document
+    JOIN content_revisions revision ON revision.document_id = document.document_id AND revision.revision_id = document.draft_revision_id
+    UNION
+    SELECT document.kind, document.document_id AS documentId, revision.payload_json AS payload
+    FROM content_site_state state
+    JOIN content_release_entries entry ON entry.release_id = state.current_release_id
+    JOIN content_documents document ON document.document_id = entry.document_id
+    JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
+    UNION
+    SELECT document.kind, document.document_id AS documentId, revision.payload_json AS payload
+    FROM content_releases release
+    JOIN content_release_entries entry ON entry.release_id = release.release_id
+    JOIN content_documents document ON document.document_id = entry.document_id
+    JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
+    WHERE release.status = 'publishing'`).all()).results ?? [];
+  const usage = {};
+  const pages = new Set();
+  for (const key of keys) {
+    const url = mediaUrl(key);
+    const locations = [...new Set(rows.filter((row) => typeof row.payload === "string" && row.payload.includes(url))
+      .map((row) => `${row.kind} · ${row.documentId}`))];
+    if (locations.length) { usage[key] = locations; locations.forEach((location) => pages.add(location)); }
+  }
+  return { usage, pages: [...pages], count: Object.keys(usage).length, selectedCount: keys.length, blockers: [] };
+}
+
+export async function finalizeD1MediaRelease({ env, releaseId, now = Date.now() }) {
+  if (!env.CONTENT_DB || !env.MEDIA) return { completed: 0, failed: 0, skipped: "binding non configurati" };
+  const journal = new D1MediaOperationRepository(env.CONTENT_DB);
+  const work = await journal.finalizationWork(releaseId);
+  const byOperation = new Map();
+  for (const entry of work) {
+    const group = byOperation.get(entry.operationId) || [];
+    group.push(entry); byOperation.set(entry.operationId, group);
+  }
+  let completed = 0, failed = 0;
+  for (const [id, entries] of byOperation) {
+    const first = entries[0];
+    if (first.operationState === "completed_with_warning") await journal.resumeFinalization(id, releaseId, now);
+    else await journal.beginFinalization(id, releaseId, now);
+    for (const entry of entries) {
+      try {
+        if (entry.type === "delete") await moveToTrash(env.MEDIA, entry.sourceKey);
+        else await env.MEDIA.delete(entry.sourceKey);
+        await journal.recordFinalizedEntry({ operationId: id, entryId: entry.entryId, now, outcome: "completed" });
+        completed += 1;
+      } catch {
+        await journal.recordFinalizedEntry({ operationId: id, entryId: entry.entryId, now, outcome: "failed", safeError: "La pulizia del Media verrà ritentata." });
+        failed += 1;
+      }
+    }
+  }
+  return { completed, failed };
+}
+
+export async function resumeD1MediaOperation({ env, data, operationId: id, releaseId }) {
+  if (!env.CONTENT_DB || !env.MEDIA) throw new Error("content_unavailable");
+  editor(data);
+  if (typeof id !== "string" || typeof releaseId !== "string") throw new Error("invalid_media_operation");
+  const journal = new D1MediaOperationRepository(env.CONTENT_DB);
+  await journal.resumeFinalization(id, releaseId, Date.now());
+  return finalizeD1MediaRelease({ env, releaseId, now: Date.now() });
+}
+
+export async function cancelD1MediaOperation({ env, data, operationId: id }) {
+  if (!env.CONTENT_DB) throw new Error("content_unavailable");
+  editor(data);
+  if (typeof id !== "string") throw new Error("invalid_media_operation");
+  await new D1MediaOperationRepository(env.CONTENT_DB).cancel(id, Date.now());
+  return { cancelled: true };
+}

package/dist/functions/api/assets/delete.js

@@ -23,6 +23,8 @@ import { mediaUrl } from "../../_shared/refs.js";
 import { rewriteMediaReferences } from "../../_shared/media-content.js";
 import { getBase, DRAFT } from "../../_shared/github.js";
 import { finalizePendingMedia, recordPendingMedia } from "../../_shared/pending-media.js";
+import { contentPersistenceMode } from "../../site.js";
+import { d1DeleteMedia, d1PendingSourceKeys } from "../../_shared/d1-media.js";
 
 const enc = new TextEncoder();
 
@@ -90,7 +92,7 @@ export async function verifyRefsPreflight(env, token, keys, currentCommit) {
   return keys.every((key) => allowed.has(key));
 }
 
-export async function onRequestPost({ request, env }) {
+export async function onRequestPost({ request, env, data }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
   let body;
   try { body = await request.json(); } catch { return json({ ok: false, error: "JSON non valido" }, 400); }
@@ -115,6 +117,22 @@ export async function onRequestPost({ request, env }) {
   const keyList = [...keys].filter((k) => !k.startsWith("_trash/"));
   if (!keyList.length && !keepKeys.length) return json({ ok: true, trashed: 0, pagesUpdated: [] });
 
+  if (contentPersistenceMode() === "d1") {
+    try {
+      /* A legacy client may repeat its old refsOnly/skipRefs sequence. Once a
+       * D1 operation owns a source, later chunks can only remove .keep files;
+       * they cannot manufacture a second destructive operation. */
+      const pending = await d1PendingSourceKeys(env.CONTENT_DB);
+      const operable = keyList.filter((key) => !pending.has(key));
+      const result = operable.length ? await d1DeleteMedia({ env, data, body: { ...body, keys: operable } }) : null;
+      for (const keepKey of keepKeys) await env.MEDIA.delete(keepKey);
+      return json({ ok: true, trashed: result?.trashed ?? keyList.length, operationId: result?.operationId, pagesUpdated: result?.documents.map((document) => document.kind) ?? [], deferred: Boolean(result), d1: true, warning: result ? "I file resteranno disponibili fino alla pubblicazione." : undefined });
+    } catch (error) {
+      const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_source_busy" ? "media_source_busy" : "media_operation_unavailable";
+      return json({ ok: false, code, error: code === "media_source_busy" ? "Questo Media è già in un'operazione in corso." : "Non riesco a registrare l'operazione Media D1." }, code === "unauthenticated" ? 401 : 409);
+    }
+  }
+
   const refsOnly = body.refsOnly === true;
   const skipRefs = body.skipRefs === true;
   if (keyList.length && (!env.GITHUB_TOKEN || !env.GITHUB_REPO)) {

package/dist/functions/api/assets/folders.js

@@ -4,11 +4,13 @@
  */
 import { json, TRASH, listKeysUnder } from "../../_shared/assets.js";
 import { pendingSourceKeys } from "../../_shared/pending-media.js";
+import { contentPersistenceMode } from "../../site.js";
+import { d1PendingSourceKeys } from "../../_shared/d1-media.js";
 
 export async function onRequestGet({ env }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
   const keys = await listKeysUnder(env.MEDIA, "");
-  const pending = await pendingSourceKeys(env.MEDIA);
+  const pending = contentPersistenceMode() === "d1" ? await d1PendingSourceKeys(env.CONTENT_DB) : await pendingSourceKeys(env.MEDIA);
   const counts = {};
   for (const k of keys) {
     if (k.startsWith(TRASH) || k.startsWith("_pending-media/") || pending.has(k)) continue;

package/dist/functions/api/assets/media.js

@@ -0,0 +1,30 @@
+/* D1 Media operation status and bounded recovery. These routes exist only
+ * after D1 cutover; Git-mode Media keeps its established pending-marker flow. */
+import { json } from "../../_shared/assets.js";
+import { D1MediaOperationRepository } from "../../../media.js";
+import { contentPersistenceMode } from "../../site.js";
+import { cancelD1MediaOperation, resumeD1MediaOperation } from "../../_shared/d1-media.js";
+
+function unavailable() { return json({ ok: false, code: "feature_inactive", error: "Journal Media D1 non attivo." }, 404); }
+function failure(error) {
+  const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_operation_unavailable" ? "media_operation_unavailable" : "media_operation_invalid";
+  return json({ ok: false, code, error: code === "unauthenticated" ? "Sessione non valida: ricarica la pagina per rientrare." : "L'operazione Media non può essere completata." }, code === "unauthenticated" ? 401 : 409);
+}
+
+export async function onRequestGet({ env }) {
+  if (contentPersistenceMode() !== "d1") return unavailable();
+  if (!env.CONTENT_DB) return json({ ok: false, code: "content_unavailable", error: "Persistenza contenuti non disponibile." }, 503);
+  try { return json({ ok: true, operations: await new D1MediaOperationRepository(env.CONTENT_DB).statuses() }); }
+  catch (error) { return failure(error); }
+}
+
+export async function onRequestPost({ request, env, data }) {
+  if (contentPersistenceMode() !== "d1") return unavailable();
+  let body;
+  try { body = await request.json(); } catch { return json({ ok: false, code: "media_operation_invalid", error: "JSON non valido." }, 400); }
+  try {
+    if (body?.action === "cancel") return json({ ok: true, ...(await cancelD1MediaOperation({ env, data, operationId: body.operationId })) });
+    if (body?.action === "resume") return json({ ok: true, ...(await resumeD1MediaOperation({ env, data, operationId: body.operationId, releaseId: body.releaseId })) });
+    throw new Error("invalid_media_operation");
+  } catch (error) { return failure(error); }
+}

package/dist/functions/api/assets/move.js

@@ -14,6 +14,8 @@ import { mediaUrl } from "../../_shared/refs.js";
 import { rewriteMediaReferences } from "../../_shared/media-content.js";
 import { getBase } from "../../_shared/github.js";
 import { finalizePendingMedia, recordPendingMedia } from "../../_shared/pending-media.js";
+import { contentPersistenceMode } from "../../site.js";
+import { d1MoveMedia } from "../../_shared/d1-media.js";
 
 function mediaKey(url) {
   if (typeof url !== "string" || !url.startsWith("/media/")) return null;
@@ -128,8 +130,27 @@ async function confirmRewrittenCommit(env, commitSha) {
   }
 }
 
-export async function onRequestPost({ request, env }) {
+export async function onRequestPost({ request, env, data }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
+  let body;
+  try { body = await request.json(); } catch { return json({ ok: false, error: "JSON non valido" }, 400); }
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return json({ ok: false, error: "Corpo richiesta non valido" }, 400);
+  }
+
+  if (contentPersistenceMode() === "d1") {
+    /* The former two-step Git protocol must never become a second editorial
+     * writer after cutover. A stale browser's applyRefs call is harmless: the
+     * first D1 command already created the revisions and journal intent. */
+    if (Object.hasOwn(body, "applyRefs")) return json({ ok: true, moved: 0, pagesUpdated: [], failed: [], d1: true });
+    try {
+      const result = await d1MoveMedia({ env, data, body });
+      return json({ ok: true, ...result, pagesUpdated: result.documents.map((document) => document.kind), failed: [], warning: "Le sorgenti restano disponibili fino alla pubblicazione." });
+    } catch (error) {
+      const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_source_busy" ? "media_source_busy" : "media_operation_unavailable";
+      return json({ ok: false, code, error: code === "media_source_busy" ? "Questo Media è già in un'operazione in corso." : "Non riesco a registrare l'operazione Media D1." }, code === "unauthenticated" ? 401 : 409);
+    }
+  }
   if (!env.GITHUB_TOKEN || !env.GITHUB_REPO) {
     return json({
       ok: false,
@@ -137,11 +158,6 @@ export async function onRequestPost({ request, env }) {
       error: "Non posso spostare media senza aggiornare i riferimenti nel sito.",
     }, 503);
   }
-  let body;
-  try { body = await request.json(); } catch { return json({ ok: false, error: "JSON non valido" }, 400); }
-  if (!body || typeof body !== "object" || Array.isArray(body)) {
-    return json({ ok: false, error: "Corpo richiesta non valido" }, 400);
-  }
 
   /* Seconda fase: le copie esistono già. Prima le verifichiamo TUTTE, poi aggiorniamo il repo,
    * infine cancelliamo gli originali. */

package/dist/functions/api/assets/usage.js

@@ -7,10 +7,11 @@ import { mediaUrl } from "../../_shared/refs.js";
 import {
   readMediaSources, summarizeMediaUsage, planMediaRewrite,
 } from "../../_shared/media-content.js";
+import { contentPersistenceMode } from "../../site.js";
+import { d1MediaUsage } from "../../_shared/d1-media.js";
 
 export async function onRequestPost({ request, env }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
-  if (!env.GITHUB_TOKEN || !env.GITHUB_REPO) return json({ ok: false, error: "backend GitHub non configurato" }, 500);
   let body;
   try { body = await request.json(); } catch { return json({ ok: false, error: "JSON non valido" }, 400); }
   if (!body || typeof body !== "object" || Array.isArray(body)) {
@@ -27,6 +28,9 @@ export async function onRequestPost({ request, env }) {
       return json({ ok: true, usage: {}, pages: [], count: 0, selectedCount: 0, blockers: [] });
     }
 
+    if (contentPersistenceMode() === "d1") return json({ ok: true, ...(await d1MediaUsage(env.CONTENT_DB, keyList)) });
+    if (!env.GITHUB_TOKEN || !env.GITHUB_REPO) return json({ ok: false, error: "backend GitHub non configurato" }, 500);
+
     const { sources } = await readMediaSources(env);
     const summary = summarizeMediaUsage(sources, keyList, mediaUrl);
     const plan = planMediaRewrite(sources, { removeUrls: keyList.map(mediaUrl) });

package/dist/functions/api/assets.js

@@ -4,6 +4,8 @@
 import { isPrefix, json, listKeysUnder } from "../_shared/assets.js";
 import { sizeFromBucket } from "../_shared/imagesize.js";
 import { pendingSourceKeys } from "../_shared/pending-media.js";
+import { contentPersistenceMode } from "../site.js";
+import { d1PendingSourceKeys } from "../_shared/d1-media.js";
 
 const IMG = /\.(webp|jpe?g|png|avif|gif)$/i;
 
@@ -12,7 +14,7 @@ export async function onRequestGet({ request, env }) {
   const url = new URL(request.url);
   let prefix = (url.searchParams.get("prefix") || "").trim();
   if (!isPrefix(prefix)) return json({ ok: false, error: `prefisso non valido: ${prefix}` }, 400);
-  const pending = await pendingSourceKeys(env.MEDIA);
+  const pending = contentPersistenceMode() === "d1" ? await d1PendingSourceKeys(env.CONTENT_DB) : await pendingSourceKeys(env.MEDIA);
 
   /* `recursive=1` guarda TUTTO quello che c'è sotto, a qualunque profondità: serve a chi deve
    * spostare o cancellare una cartella intera, che altrimenti si porterebbe dietro solo il primo

package/dist/functions/api/content-ci.js

@@ -4,11 +4,13 @@ import {
   D1DeploymentAttemptRepository, claimTokenChecksum, constantTimeSecretEqual,
   isTerminalDeploymentPhase,
 } from "../../deployment.js";
-import { releaseExportFromStored } from "../../release.js";
+import { deploymentFingerprint, releaseExportFromStored } from "../../release.js";
+import { finalizeD1MediaRelease } from "../_shared/d1-media.js";
 
 const MAX_BODY_BYTES = 8_000;
 const claimLifetimeMs = 20 * 60 * 1_000;
 const id = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const sha = /^[0-9a-f]{40}$/i;
 const phases = new Set(["validating", "materializing", "building", "deploying", "verifying_deployment_url", "verifying_canonical"]);
 const failure = {
   materialization_failed: { stage: "materializing", message: "La generazione del sito non è riuscita." },
@@ -94,6 +96,27 @@ export async function handleInternalContentCi({ request, env }) {
     const now = Date.now();
     const { attempts, content } = repositories(env);
 
+    if (path === "/internal/deployment/register-code" && request.method === "POST") {
+      const input = await body(request);
+      if (!sha.test(input.codeSha || "")) throw new Error("invalid_request");
+      const state = await env.CONTENT_DB.prepare("SELECT current_release_id AS currentReleaseId FROM content_site_state WHERE singleton = 1")
+        .first();
+      if (!state?.currentReleaseId) throw new Error("content_unavailable");
+      const snapshot = await content.getReleaseExport(state.currentReleaseId);
+      if (!snapshot || snapshot.status !== "published") throw new Error("content_unavailable");
+      const fingerprint = await deploymentFingerprint({
+        codeSha: input.codeSha, manifestChecksum: snapshot.manifestChecksum,
+        schemaPackageVersion: snapshot.schemaPackageVersion, materializerVersion: snapshot.materializerVersion,
+      });
+      const attemptId = crypto.randomUUID();
+      await attempts.register({
+        attemptId, intentKind: "code", requestedReleaseId: snapshot.releaseId, requestedCodeSha: input.codeSha,
+        releaseId: snapshot.releaseId, codeSha: input.codeSha, expectedFingerprint: fingerprint.fingerprint, now,
+      });
+      return response({ ok: true, attemptId, releaseId: snapshot.releaseId, codeSha: input.codeSha,
+        expectedFingerprint: fingerprint.fingerprint });
+    }
+
     if (path === "/internal/deployment/claim" && request.method === "POST") {
       const identity = requiredIdentity(await body(request));
       const attempt = await attempts.get(identity.attemptId);
@@ -124,8 +147,14 @@ export async function handleInternalContentCi({ request, env }) {
       return response({ ok: true, attempt: { ...identity, phase: input.phase } });
     }
     if (path === "/internal/deployment/finalize" && request.method === "POST") {
-      await attempts.finalize({ ...identity, tokenChecksum: checksum, now });
-      return response({ ok: true, attempt: { ...identity, phase: "succeeded" } });
+      await attempts.finalize({ ...identity, intentKind: attempt.intentKind, tokenChecksum: checksum, now });
+      /* The release is already authoritative once this returns. Media cleanup
+       * is deliberately best-effort and journaled: a warning must not pretend
+       * to roll back a verified public deployment. */
+      const media = attempt.intentKind === "content"
+        ? await finalizeD1MediaRelease({ env, releaseId: identity.releaseId, now }).catch(() => ({ completed: 0, failed: 0, warning: true }))
+        : undefined;
+      return response({ ok: true, attempt: { ...identity, phase: "succeeded" }, ...(media ? { media } : {}) });
     }
     if (path === "/internal/deployment/fail" && request.method === "POST") {
       const detail = failure[input.code];

package/dist/functions/index.js

@@ -30,6 +30,7 @@ import * as assetsDelete from "./api/assets/delete.js";
 import * as assetsFolder from "./api/assets/folder.js";
 import * as assetsFolders from "./api/assets/folders.js";
 import * as assetsMove from "./api/assets/move.js";
+import * as assetsMedia from "./api/assets/media.js";
 import * as assetsPreview from "./api/assets/preview.js";
 import * as assetsTrash from "./api/assets/trash.js";
 import * as assetsTrashDelete from "./api/assets/trash/delete.js";
@@ -66,6 +67,7 @@ const ROUTES = {
   "assets/folder": { mod: null, h: assetsFolder },
   "assets/folders": { mod: null, h: assetsFolders },
   "assets/move": { mod: null, h: assetsMove },
+  "assets/media": { mod: null, h: assetsMedia },
   "assets/preview": { mod: null, h: assetsPreview },
   "assets/trash": { mod: null, h: assetsTrash },
   "assets/trash/delete": { mod: null, h: assetsTrashDelete },

package/dist/media.d.ts

@@ -52,6 +52,30 @@ export type CreateMediaOperation = Readonly<{
     now: number;
     entries: readonly MediaOperationEntryInput[];
 }>;
+export type BoundMediaEntry = Readonly<{
+    operationId: string;
+    type: MediaOperationType;
+    operationState: MediaOperationState;
+    entryId: string;
+    sourceKey: string;
+    destinationKey: string | null;
+    finalizationState: "pending" | "completed" | "failed" | "cancelled";
+}>;
+export type MediaOperationStatus = Readonly<{
+    operationId: string;
+    type: MediaOperationType;
+    state: MediaOperationState;
+    releaseId: string | null;
+    updatedAt: number;
+    failedEntries: number;
+}>;
+export type StoredMediaOperationEntry = Readonly<{
+    entryId: string;
+    sourceKey: string;
+    destinationKey: string | null;
+    preparationState: string;
+    finalizationState: string;
+}>;
 /** SQL journal adapter. R2 copy/delete happens around this adapter; it never
  * infers an object as removable simply because a caller stopped mentioning it. */
 export declare class D1MediaOperationRepository {
@@ -83,6 +107,34 @@ export declare class D1MediaOperationRepository {
     }): Promise<"pending" | "settled">;
     blockReintroducedSources(sourceKeys: readonly string[], now: number): Promise<number>;
     cancel(operationId: string, now: number): Promise<void>;
+    /** Sources are hidden from the normal library only while an unresolved
+     * operation owns them. The query deliberately never derives removability
+     * from this list. */
+    activeSourceKeys(): Promise<readonly string[]>;
+    /** Candidates bind every ready operation whose source has been rewritten;
+     * the release repository repeats the frozen-manifest no-source guard in the
+     * same transaction as the binding. */
+    readyOperationIds(): Promise<readonly string[]>;
+    /** A Discard block is reversible only when the current effective documents
+     * no longer contain any owned source. Re-evaluation changes journal state;
+     * it never synthesizes or rewrites content. */
+    refreshBlockedOperations(now: number): Promise<number>;
+    statuses(): Promise<readonly MediaOperationStatus[]>;
+    entries(operationId: string): Promise<readonly StoredMediaOperationEntry[]>;
+    /** Work is named by its immutable release binding: there is intentionally no
+     * "latest operation" cleanup path. */
+    finalizationWork(releaseId: string): Promise<readonly BoundMediaEntry[]>;
+    /** A warning is a live release with incomplete housekeeping. Retrying resets
+     * only failed effects, never an already-completed entry. */
+    resumeFinalization(operationId: string, releaseId: string, now: number): Promise<void>;
+    readyDeleteEntry(input: {
+        operationId: string;
+        entryId: string;
+        now: number;
+        objectChecksum: string;
+        etag: string | null;
+        metadataJson: string | null;
+    }): Promise<"pending" | "ready">;
 }
 type R2Metadata = Record<string, string>;
 export type MediaR2Object = {

package/dist/media.js

@@ -164,7 +164,7 @@ export class D1MediaOperationRepository {
     }
     async beginFinalization(operationId, releaseId, now) {
         const result = await this.db.prepare(`UPDATE media_operations SET state = 'finalizing', updated_at = ?
-      WHERE operation_id = ? AND state = 'bound' AND EXISTS (SELECT 1 FROM content_release_media_operations
+      WHERE operation_id = ? AND state IN ('bound', 'finalizing') AND EXISTS (SELECT 1 FROM content_release_media_operations
         WHERE operation_id = ? AND release_id = ?) AND EXISTS (SELECT 1 FROM content_releases
         WHERE release_id = ? AND status = 'published')`)
             .bind(now, operationId, operationId, releaseId, releaseId).run();
@@ -213,6 +213,108 @@ export class D1MediaOperationRepository {
         if (results[0]?.meta?.changes !== 1)
             throw new Error("media_operation_unavailable");
     }
+    /** Sources are hidden from the normal library only while an unresolved
+     * operation owns them. The query deliberately never derives removability
+     * from this list. */
+    async activeSourceKeys() {
+        const rows = (await this.db.prepare(`SELECT DISTINCT entry.source_key AS sourceKey
+      FROM media_operation_entries entry
+      JOIN media_operations operation ON operation.operation_id = entry.operation_id
+      WHERE operation.state IN ('ready', 'bound', 'finalizing', 'completed_with_warning')
+        AND entry.finalization_state NOT IN ('completed', 'cancelled')
+      ORDER BY entry.source_key`).all()).results ?? [];
+        return rows.map((row) => row.sourceKey);
+    }
+    /** Candidates bind every ready operation whose source has been rewritten;
+     * the release repository repeats the frozen-manifest no-source guard in the
+     * same transaction as the binding. */
+    async readyOperationIds() {
+        await this.refreshBlockedOperations(Date.now());
+        const rows = (await this.db.prepare("SELECT operation_id AS operationId FROM media_operations WHERE state = 'ready' ORDER BY operation_id")
+            .all()).results ?? [];
+        return rows.map((row) => row.operationId);
+    }
+    /** A Discard block is reversible only when the current effective documents
+     * no longer contain any owned source. Re-evaluation changes journal state;
+     * it never synthesizes or rewrites content. */
+    async refreshBlockedOperations(now) {
+        const result = await this.db.prepare(`UPDATE media_operations SET state = 'ready', updated_at = ?
+      WHERE state = 'blocked_in_use' AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+        JOIN content_documents document
+        LEFT JOIN content_revisions draft ON draft.document_id = document.document_id AND draft.revision_id = document.draft_revision_id
+        LEFT JOIN content_site_state site_state ON site_state.singleton = 1
+        LEFT JOIN content_release_entries published_entry ON published_entry.release_id = site_state.current_release_id
+          AND published_entry.document_id = document.document_id
+        LEFT JOIN content_revisions published ON published.document_id = published_entry.document_id
+          AND published.revision_id = published_entry.revision_id
+        WHERE source.operation_id = media_operations.operation_id
+          AND instr(COALESCE(draft.payload_json, published.payload_json, ''), '/media/' || source.source_key) > 0)`)
+            .bind(now).run();
+        return Number(result.meta?.changes ?? 0);
+    }
+    async statuses() {
+        return (await this.db.prepare(`SELECT operation.operation_id AS operationId, operation.type, operation.state,
+      binding.release_id AS releaseId, operation.updated_at AS updatedAt,
+      SUM(CASE WHEN entry.finalization_state = 'failed' THEN 1 ELSE 0 END) AS failedEntries
+      FROM media_operations operation
+      LEFT JOIN content_release_media_operations binding ON binding.operation_id = operation.operation_id
+      JOIN media_operation_entries entry ON entry.operation_id = operation.operation_id
+      WHERE operation.state NOT IN ('completed', 'cancelled')
+      GROUP BY operation.operation_id, operation.type, operation.state, binding.release_id, operation.updated_at
+      ORDER BY operation.updated_at DESC, operation.operation_id`).all()).results ?? [];
+    }
+    async entries(operationId) {
+        return (await this.db.prepare(`SELECT entry_id AS entryId, source_key AS sourceKey,
+      destination_key AS destinationKey, preparation_state AS preparationState,
+      finalization_state AS finalizationState
+      FROM media_operation_entries WHERE operation_id = ? ORDER BY entry_id`)
+            .bind(operationId).all()).results ?? [];
+    }
+    /** Work is named by its immutable release binding: there is intentionally no
+     * "latest operation" cleanup path. */
+    async finalizationWork(releaseId) {
+        const rows = (await this.db.prepare(`SELECT operation.operation_id AS operationId, operation.type, operation.state AS operationState,
+      entry.entry_id AS entryId, entry.source_key AS sourceKey, entry.destination_key AS destinationKey,
+      entry.finalization_state AS finalizationState
+      FROM content_release_media_operations binding
+      JOIN media_operations operation ON operation.operation_id = binding.operation_id
+      JOIN media_operation_entries entry ON entry.operation_id = operation.operation_id
+      WHERE binding.release_id = ? AND operation.state IN ('bound', 'finalizing', 'completed_with_warning')
+        AND entry.finalization_state IN ('pending', 'failed')
+      ORDER BY operation.operation_id, entry.entry_id`).bind(releaseId).all()).results ?? [];
+        return rows;
+    }
+    /** A warning is a live release with incomplete housekeeping. Retrying resets
+     * only failed effects, never an already-completed entry. */
+    async resumeFinalization(operationId, releaseId, now) {
+        const resume = this.db.prepare(`UPDATE media_operations SET state = 'finalizing', updated_at = ?, retry_count = retry_count + 1
+      WHERE operation_id = ? AND state = 'completed_with_warning'
+        AND EXISTS (SELECT 1 FROM content_release_media_operations WHERE operation_id = ? AND release_id = ?)
+        AND EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'published')`)
+            .bind(now, operationId, operationId, releaseId, releaseId);
+        const reset = this.db.prepare(`UPDATE media_operation_entries SET finalization_state = 'pending', safe_error = NULL
+      WHERE operation_id = ? AND finalization_state = 'failed'
+        AND EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'finalizing')`)
+            .bind(operationId, operationId);
+        const results = await this.db.batch([resume, reset]);
+        if (results[0]?.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+    }
+    async readyDeleteEntry(input) {
+        const entry = this.db.prepare(`UPDATE media_operation_entries
+      SET object_checksum = ?, etag = ?, metadata_json = ?, preparation_state = 'ready'
+      WHERE operation_id = ? AND entry_id = ? AND preparation_state = 'pending'
+        AND EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND type = 'delete' AND state = 'preparing')`)
+            .bind(input.objectChecksum, input.etag, input.metadataJson, input.operationId, input.entryId, input.operationId);
+        const ready = this.db.prepare(`UPDATE media_operations SET state = 'ready', updated_at = ?
+      WHERE operation_id = ? AND type = 'delete' AND state = 'preparing' AND NOT EXISTS (SELECT 1 FROM media_operation_entries
+        WHERE operation_id = ? AND preparation_state != 'ready')`)
+            .bind(input.now, input.operationId, input.operationId);
+        const results = await this.db.batch([entry, ready]);
+        if (results[0]?.meta?.changes !== 1)
+            throw new Error("media_operation_unavailable");
+        return results[1]?.meta?.changes === 1 ? "ready" : "pending";
+    }
 }
 const MEDIA_CHECKSUM_METADATA = "adminkit-sha256";
 async function bytesChecksum(bytes) {

package/dist/persistence.d.ts

@@ -115,6 +115,10 @@ export type ReleaseInput = {
         documentId: string;
         revisionId: string;
     }[];
+    /** Operations are bound in the same D1 transaction as the immutable
+     * manifest. The SQL guard rejects any candidate still containing a source
+     * URL, so a caller cannot make cleanup race a public reference. */
+    mediaOperationIds?: readonly string[];
 };
 export type ReleaseDeploymentInput = ReleaseInput & {
     attempt: {
@@ -157,6 +161,11 @@ export declare class D1ContentRepository {
      * no "latest" variant: a deployment attempt must name what it exports. */
     getReleaseExport(releaseId: string): Promise<StoredReleaseExport | null>;
     save(input: SaveInput): Promise<"created" | "repeated">;
+    /** Multi-document editorial gestures (such as a Media rewrite) must not
+     * leave half their draft revisions behind when a later CAS discovers an
+     * editor's concurrent save. D1 batches are transactional, so we validate
+     * every identity and build every guarded statement before issuing one batch. */
+    saveMany(inputs: readonly SaveInput[]): Promise<void>;
     discard(documentId: string, expectedDraftRevisionId: string | null, baselineRevisionId: string | null, now: number): Promise<void>;
     publish(input: ReleaseInput): Promise<"created" | "repeated">;
     /** Candidate release and deployment-lane reservation are inseparable: a

package/dist/persistence.js

@@ -183,12 +183,79 @@ export class D1ContentRepository {
             throw new Error("stale_revision");
         return "created";
     }
+    /** Multi-document editorial gestures (such as a Media rewrite) must not
+     * leave half their draft revisions behind when a later CAS discovers an
+     * editor's concurrent save. D1 batches are transactional, so we validate
+     * every identity and build every guarded statement before issuing one batch. */
+    async saveMany(inputs) {
+        if (!inputs.length || new Set(inputs.map((input) => input.documentId)).size !== inputs.length
+            || new Set(inputs.map((input) => input.revisionId)).size !== inputs.length)
+            throw new Error("invalid_document");
+        const statements = [];
+        const guards = [];
+        for (const input of inputs) {
+            const existing = await this.db.prepare("SELECT revision_id, request_checksum FROM content_revisions WHERE revision_id = ?").bind(input.revisionId).first();
+            if (existing) {
+                assertIdempotent({ requestChecksum: existing.request_checksum }, input.requestChecksum);
+                continue;
+            }
+            if ((input.payload === null) === !input.tombstone)
+                throw new Error("invalid_document");
+            const document = await this.db.prepare("SELECT document_id, kind, locale, draft_revision_id, abandoned_at FROM content_documents WHERE document_id = ?").bind(input.documentId).first();
+            if (document && (document.kind !== input.kind || document.locale !== input.locale))
+                throw new Error("invalid_document");
+            const expectedDraftRevisionId = input.expectedDraftRevisionId === undefined ? input.baseRevisionId : input.expectedDraftRevisionId;
+            if (document && document.draft_revision_id !== expectedDraftRevisionId)
+                throw new Error("stale_revision");
+            const payload = input.payload === null ? null : canonicalJson(input.payload);
+            guards.push({ documentId: input.documentId, kind: input.kind, locale: input.locale, expectedDraftRevisionId, revisionId: input.revisionId });
+            const hasBase = expectedDraftRevisionId !== null;
+            const guard = hasBase ? "draft_revision_id = ?" : "draft_revision_id IS NULL";
+            statements.push(this.db.prepare(`INSERT INTO content_documents (document_id, kind, locale, translation_group_id, draft_revision_id, created_at, updated_at)
+        SELECT ?, ?, ?, ?, NULL, ?, ? WHERE NOT EXISTS (SELECT 1 FROM content_documents WHERE document_id = ?)`)
+                .bind(input.documentId, input.kind, input.locale, input.translationGroupId ?? null, input.now, input.now, input.documentId));
+            statements.push(this.db.prepare(`INSERT INTO content_revisions (revision_id, document_id, base_revision_id, payload_json, is_tombstone, schema_version, payload_checksum, request_checksum, author_subject, author_label, created_at)
+        SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? FROM content_documents WHERE document_id = ? AND ${guard}`)
+                .bind(input.revisionId, input.documentId, input.baseRevisionId, payload, Number(input.tombstone), input.schemaVersion, input.payloadChecksum, input.requestChecksum, input.authorSubject, input.authorLabel, input.now, input.documentId, ...(hasBase ? [expectedDraftRevisionId] : [])));
+            statements.push(this.db.prepare(`UPDATE content_documents SET draft_revision_id = ?, updated_at = ?, abandoned_at = NULL WHERE document_id = ? AND ${guard}`)
+                .bind(input.revisionId, input.now, input.documentId, ...(hasBase ? [expectedDraftRevisionId] : [])));
+        }
+        if (!statements.length)
+            return;
+        const guardSql = guards.map(() => `(NOT EXISTS (SELECT 1 FROM content_documents WHERE document_id = ?) AND ? IS NULL
+      OR EXISTS (SELECT 1 FROM content_documents WHERE document_id = ? AND kind = ? AND locale = ? AND draft_revision_id IS ?))
+      AND NOT EXISTS (SELECT 1 FROM content_revisions WHERE revision_id = ?)`).join(" AND ");
+        /* A zero-row CAS is not a SQL error and therefore would not roll a D1
+         * batch back. This statement turns any stale precondition into a CHECK
+         * violation before the first revision write; singleton=2 can never be a
+         * valid site-state row. */
+        const abortOnStale = this.db.prepare(`INSERT INTO content_site_state
+      (singleton, current_release_id, schema_generation, updated_at)
+      SELECT 2, NULL, 0, ? WHERE NOT (${guardSql})`)
+            .bind(inputs[0].now, ...guards.flatMap((guard) => [guard.documentId, guard.expectedDraftRevisionId,
+            guard.documentId, guard.kind, guard.locale, guard.expectedDraftRevisionId, guard.revisionId]));
+        const results = await this.db.batch([abortOnStale, ...statements]);
+        for (let index = 1; index < results.length; index += 3) {
+            if (results[index + 1]?.meta?.changes !== 1 || results[index + 2]?.meta?.changes !== 1)
+                throw new Error("stale_revision");
+        }
+    }
     async discard(documentId, expectedDraftRevisionId, baselineRevisionId, now) {
         const expected = expectedDraftRevisionId === null ? "draft_revision_id IS NULL" : "draft_revision_id = ?";
         const set = baselineRevisionId === null ? null : baselineRevisionId;
         const update = this.db.prepare(`UPDATE content_documents SET draft_revision_id = ?, abandoned_at = CASE WHEN ? IS NULL THEN ? ELSE NULL END, updated_at = ? WHERE document_id = ? AND ${expected}`)
             .bind(set, set, now, now, documentId, ...(expectedDraftRevisionId === null ? [] : [expectedDraftRevisionId]));
-        const [result] = await this.db.batch([update]);
+        /* Restoring a baseline can reintroduce a source that a ready destructive
+         * operation was about to remove. This lives in the same transaction as the
+         * pointer CAS: Discard still succeeds, but the operation becomes visibly
+         * blocked rather than deleting a newly referenced public asset. */
+        const blockReintroduced = this.db.prepare(`UPDATE media_operations SET state = 'blocked_in_use', updated_at = ?
+      WHERE state = 'ready' AND ? IS NOT NULL AND EXISTS (SELECT 1 FROM media_operation_entries entry
+        JOIN content_revisions baseline ON baseline.revision_id = ? AND baseline.document_id = ?
+        WHERE entry.operation_id = media_operations.operation_id AND baseline.payload_json IS NOT NULL
+          AND instr(baseline.payload_json, '/media/' || entry.source_key) > 0)`)
+            .bind(now, baselineRevisionId, baselineRevisionId, documentId);
+        const [result] = await this.db.batch([update, blockReintroduced]);
         if (result?.meta?.changes === 1)
             return;
         const current = await this.db.prepare("SELECT document_id, draft_revision_id, abandoned_at FROM content_documents WHERE document_id = ?").bind(documentId).first();
@@ -252,20 +319,56 @@ export class D1ContentRepository {
             : [];
         const manifest = new Map(inherited.map((entry) => [entry.document_id, entry.revision_id]));
         const selected = [...input.entries];
-        if (!selected.length)
+        const mediaOperationIds = [...new Set(input.mediaOperationIds ?? [])];
+        if (!selected.length && !mediaOperationIds.length)
             throw new Error("invalid_document");
         for (const entry of selected)
             manifest.set(entry.documentId, entry.revisionId);
-        const selectionGuard = selected.map(() => "EXISTS (SELECT 1 FROM content_documents WHERE document_id = ? AND draft_revision_id = ?)").join(" AND ");
+        const selectionGuard = selected.length ? selected.map(() => "EXISTS (SELECT 1 FROM content_documents WHERE document_id = ? AND draft_revision_id = ?)").join(" AND ") : "1 = 1";
         const candidate = this.db.prepare(`INSERT INTO content_releases (release_id, base_release_id, request_checksum, status, active_slot, manifest_checksum, schema_package_version, materializer_version, created_by_subject, created_at)
       SELECT ?, current_release_id, ?, 'publishing', 1, ?, ?, ?, ?, ? FROM content_site_state
       WHERE singleton = 1 AND current_release_id IS ? AND NOT EXISTS (SELECT 1 FROM content_releases WHERE active_slot = 1)
         AND NOT EXISTS (SELECT 1 FROM production_deployment_attempts WHERE active_slot = 1) AND ${selectionGuard}`)
             .bind(input.releaseId, input.requestChecksum, input.manifestChecksum, input.schemaPackageVersion, input.materializerVersion, input.authorSubject, input.now, state.current_release_id, ...selected.flatMap((entry) => [entry.documentId, entry.revisionId]));
-        const statements = [candidate];
+        const statements = [];
+        if (mediaOperationIds.length) {
+            const revisionIds = [...manifest.values()];
+            const eligible = mediaOperationIds.map(() => `(
+        EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'ready')
+        AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+          JOIN content_revisions revision ON revision.revision_id IN (${revisionIds.map(() => "?").join(",")})
+          WHERE source.operation_id = ? AND revision.payload_json IS NOT NULL
+            AND instr(revision.payload_json, '/media/' || source.source_key) > 0))`).join(" AND ");
+            /* As with multi-document Save, zero affected rows do not abort a D1
+             * batch. Convert an ineligible Media binding into a CHECK violation
+             * before the candidate exists, so no release/attempt can commit alone. */
+            statements.push(this.db.prepare(`INSERT INTO content_site_state
+        (singleton, current_release_id, schema_generation, updated_at)
+        SELECT 2, NULL, 0, ? WHERE NOT (${eligible})`)
+                .bind(input.now, ...mediaOperationIds.flatMap((operationId) => [operationId, ...revisionIds, operationId])));
+        }
+        const candidateIndex = statements.length;
+        statements.push(candidate);
         for (const [documentId, revisionId] of manifest)
             statements.push(this.db.prepare("INSERT INTO content_release_entries (release_id, document_id, revision_id) SELECT ?, ?, ? WHERE EXISTS (SELECT 1 FROM content_revisions WHERE document_id = ? AND revision_id = ?)")
                 .bind(input.releaseId, documentId, revisionId, documentId, revisionId));
+        for (const operationId of mediaOperationIds) {
+            /* `instr` is intentionally evaluated against the frozen release entries,
+             * not drafts or a mutable current pointer. A URL is JSON-escaped neither
+             * by `/` nor by the canonical serializer, so the exact R2 public prefix
+             * remains a reliable conservative guard. */
+            statements.push(this.db.prepare(`UPDATE media_operations SET state = 'bound', updated_at = ?
+        WHERE operation_id = ? AND state = 'ready'
+          AND NOT EXISTS (SELECT 1 FROM media_operation_entries source
+            JOIN content_release_entries entry ON entry.release_id = ?
+            JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
+            WHERE source.operation_id = media_operations.operation_id
+              AND revision.payload_json IS NOT NULL AND instr(revision.payload_json, '/media/' || source.source_key) > 0)`)
+                .bind(input.now, operationId, input.releaseId));
+            statements.push(this.db.prepare(`INSERT INTO content_release_media_operations (release_id, operation_id)
+        SELECT ?, ? WHERE EXISTS (SELECT 1 FROM media_operations WHERE operation_id = ? AND state = 'bound')`)
+                .bind(input.releaseId, operationId, operationId));
+        }
         statements.push(this.db.prepare(`INSERT INTO production_deployment_attempts
       (attempt_id, intent_kind, requested_release_id, requested_code_sha, code_sha, release_id, expected_fingerprint, phase, active_slot, created_at, updated_at)
       SELECT ?, ?, ?, ?, ?, ?, ?, 'waiting', 1, ?, ?
@@ -273,7 +376,7 @@ export class D1ContentRepository {
         AND EXISTS (SELECT 1 FROM content_releases WHERE release_id = ? AND status = 'publishing')`)
             .bind(input.attempt.attemptId, input.attempt.intentKind, input.attempt.requestedReleaseId, input.attempt.requestedCodeSha, input.attempt.codeSha, input.releaseId, input.attempt.expectedFingerprint, input.now, input.now, input.releaseId));
         const results = await this.db.batch(statements);
-        if (results[0]?.meta?.changes !== 1 || results.slice(1, -1).some((result) => result.meta?.changes !== 1)
+        if (results[candidateIndex]?.meta?.changes !== 1 || results.slice(candidateIndex + 1, -1).some((result) => result.meta?.changes !== 1)
             || results.at(-1)?.meta?.changes !== 1)
             throw new Error("deployment_lane_busy");
         return "created";

package/dist/theme.css

@@ -370,6 +370,18 @@ a.ak-btn { text-decoration: none; display: inline-flex; align-items: center; }
   background: var(--ak-panel); border: 1px solid var(--ak-accent);
   font: 500 var(--ak-fs-small)/1.4 var(--ak-font); color: var(--ak-ink);
 }
+.mg-journal { display: flex; flex-direction: column; gap: 6px; }
+.mg-journal-row {
+  display: flex; align-items: center; gap: 9px; flex-wrap: wrap;
+  margin: 0; padding: 8px 11px; border: 1px solid var(--ak-line); border-radius: var(--ak-radius);
+  background: var(--ak-panel); font: 500 var(--ak-fs-small)/1.4 var(--ak-font); color: var(--ak-ink);
+}
+.mg-journal-row.is-blocked_in_use, .mg-journal-row.is-completed_with_warning { border-color: var(--ak-accent); }
+.mg-journal-row.is-failed { border-color: var(--ak-danger); }
+.mg-journal-badge {
+  padding: 3px 6px; border-radius: 999px; background: var(--ak-bg);
+  color: var(--ak-ink-quiet); font: 600 10px/1 var(--ak-font); text-transform: uppercase; letter-spacing: .05em;
+}
 
 /* Celle di ingombro uguale, immagine INTERA dentro. Prima erano quadrati con `object-fit: cover`:
    un verticale sembrava un quadrato e per riconoscere una foto bisognava aprirla. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardinali-studio/adminkit",
-  "version": "2.2.9",
+  "version": "2.2.11",
   "type": "module",
   "description": "Motore riusabile di un pannello di amministrazione per siti Hugo su Cloudflare Pages: codec del front matter guidato dallo schema, form React, libreria media su R2. NIENTE di specifico di un sito qui dentro.",
   "license": "UNLICENSED",