@styleflow.app/flowpress-deploy 1.0.0-beta.0 → 1.0.0-beta.10

package/dist/ops/static-config.js

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+// Turns the static Astro build's Cloudflare-style `_redirects` and `_headers`
+// into Caddy directives, plus the /media and /app/uploads proxies that the
+// Pages Functions used to provide. Output: <dist>/.container/routes.caddy.
+//
+//   APP_ENV=production node FlowPress Deploy apps/web/dist-production
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+function quote(value) {
+    if (/["\s{}]/.test(value) && !/^"[^"]*"$/.test(value)) {
+        return `"${value.replaceAll('"', '\\"')}"`;
+    }
+    return value;
+}
+// FlowPress routing only emits exact paths (see validateRedirects), so every
+// line is "source target status". Both slash variants of a source redirect.
+export function redirectsToCaddy(text) {
+    const lines = [];
+    let index = 0;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const [source, target, status = "301", ...rest] = line.split(/\s+/);
+        if (rest.length || !source?.startsWith("/") || !target) {
+            throw new Error(`Unsupported _redirects line: ${line}`);
+        }
+        if (/[*:]/.test(source)) {
+            throw new Error(`Splats and placeholders are not supported: ${line}`);
+        }
+        if (!["301", "302", "307", "308"].includes(status)) {
+            throw new Error(`Unsupported redirect status: ${line}`);
+        }
+        const variants = source === "/"
+            ? ["/"]
+            : [source.replace(/\/+$/, ""), `${source.replace(/\/+$/, "")}/`];
+        index += 1;
+        lines.push(`@redirect${index} path ${variants.map(quote).join(" ")}`);
+        lines.push(`redir @redirect${index} ${quote(target)} ${status}`);
+    }
+    return lines;
+}
+export function headersToCaddy(text) {
+    const lines = [];
+    let pattern = null;
+    for (const raw of text.split(/\r?\n/)) {
+        if (!raw.trim() || raw.trim().startsWith("#"))
+            continue;
+        if (!/^\s/.test(raw)) {
+            pattern = raw.trim();
+            if (!pattern.startsWith("/"))
+                throw new Error(`Unsupported _headers pattern: ${pattern}`);
+            continue;
+        }
+        if (!pattern)
+            throw new Error(`Header without a path pattern: ${raw.trim()}`);
+        const separator = raw.indexOf(":");
+        if (separator < 0)
+            throw new Error(`Unsupported _headers line: ${raw.trim()}`);
+        const name = raw.slice(0, separator).trim();
+        const value = raw.slice(separator + 1).trim();
+        const matcher = pattern === "/*" ? "*" : pattern;
+        lines.push(`header ${matcher} ${name} ${quote(value)}`);
+    }
+    return lines;
+}
+export function proxiesToCaddy({ media, backend }) {
+    const lines = [];
+    const mediaUrl = new URL(media);
+    const mediaBase = mediaUrl.pathname.replace(/\/+$/, "");
+    lines.push("@flowpress_media path_regexp flowpress_media ^/media(/.+\\.[a-zA-Z0-9]{1,8})$");
+    lines.push("handle @flowpress_media {");
+    lines.push(`\trewrite * ${mediaBase}{http.regexp.flowpress_media.1}`);
+    lines.push(`\treverse_proxy ${mediaUrl.origin} {`);
+    lines.push("\t\theader_up Host {upstream_hostport}");
+    lines.push("\t}");
+    lines.push("}");
+    const backendUrl = new URL(backend);
+    lines.push("handle /app/uploads/* {");
+    lines.push(`\treverse_proxy ${backendUrl.origin} {`);
+    lines.push("\t\theader_up Host {upstream_hostport}");
+    lines.push("\t}");
+    lines.push("}");
+    return lines;
+}
+export function buildRoutesCaddy({ redirects = "", headers = "", media, backend }) {
+    return [
+        "# Generated by FlowPress Deploy. Do not edit.",
+        ...redirectsToCaddy(redirects),
+        ...headersToCaddy(headers),
+        ...proxiesToCaddy({ media, backend }),
+        "",
+    ].join("\n");
+}
+//# sourceMappingURL=static-config.js.map

package/dist/ops/static-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-config.js","sourceRoot":"","sources":["../../src/ops/static-config.js"],"names":[],"mappings":";AACA,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,EAAE;AACF,sEAAsE;AAEtE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,SAAS,KAAK,CAAC,KAAK;IAClB,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,IAAI;IACnC,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,GAAG;YAC7B,CAAC,CAAC,CAAC,GAAG,CAAC;YACP,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QACnE,KAAK,IAAI,CAAC,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAI;IACjC,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE;IAC/C,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC5F,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,eAAe,SAAS,iCAAiC,CAAC,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,mBAAmB,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAE,SAAS,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;IAC/E,OAAO;QACL,+CAA+C;QAC/C,GAAG,gBAAgB,CAAC,SAAS,CAAC;QAC9B,GAAG,cAAc,CAAC,OAAO,CAAC;QAC1B,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QACrC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/worker-assets.d.ts

@@ -0,0 +1,5 @@
+/** Match Wrangler's selective Worker-first patterns, including exclusions. */
+export function invokesWorkerFirst(patterns: any, pathname: any): boolean;
+export function validateWorkerAssets(config: any, staticPaths: any, reservedAreaEnabled?: boolean): void;
+export function assertFreeRuntimeRelease(target: any, env: any): void;
+//# sourceMappingURL=worker-assets.d.ts.map

package/dist/worker-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-assets.d.ts","sourceRoot":"","sources":["../src/worker-assets.js"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,0EAMC;AAED,yGAYC;AAED,sEAIC"}

package/dist/worker-assets.js

@@ -0,0 +1,35 @@
+/** Match Wrangler's selective Worker-first patterns, including exclusions. */
+export function invokesWorkerFirst(patterns, pathname) {
+    const match = pattern => new RegExp(`^${pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*")}$`).test(pathname);
+    if (patterns === true)
+        return true;
+    if (!Array.isArray(patterns))
+        return false;
+    return patterns.some(pattern => !pattern.startsWith("!") && match(pattern))
+        && !patterns.some(pattern => pattern.startsWith("!") && match(pattern.slice(1)));
+}
+export function validateWorkerAssets(config, staticPaths, reservedAreaEnabled = false) {
+    const patterns = config.assets?.run_worker_first;
+    if (config.assets?.binding !== "ASSETS" || !config.main)
+        throw new Error("Worker must have an ASSETS binding and compiled entrypoint");
+    if (reservedAreaEnabled && (patterns === true || patterns?.includes("/*")))
+        throw new Error("Public assets must bypass the Worker");
+    for (const path of (reservedAreaEnabled ? ["/area-riservata/", "/area-riservata/example/", "/api/flowpress/reserved-area/login", "/api/flowpress/reserved-area/logout"] : [])) {
+        if (!invokesWorkerFirst(patterns, path))
+            throw new Error(`Protected runtime route missing: ${path}`);
+    }
+    for (const path of staticPaths) {
+        if (path.startsWith("/area-riservata/") || path.startsWith("/api/flowpress/reserved-area/"))
+            throw new Error(`Private static asset forbidden: ${path}`);
+        if (reservedAreaEnabled && invokesWorkerFirst(patterns, path))
+            throw new Error(`Static asset invokes Worker: ${path}`);
+    }
+    if (reservedAreaEnabled && (config.kv_namespaces?.length || config.images))
+        throw new Error("Free runtime must not provision session KV or Images bindings");
+}
+export function assertFreeRuntimeRelease(target, env) {
+    if (target.environmentName === "production" && target.projectType === "workers" && env.FLOWPRESS_RESERVED_AREA_ENABLED === "true" && env.CF_FREE_RUNTIME_VERIFIED !== "true") {
+        throw new Error("Production Workers release is gated: validate staging CPU (p95 < 8 ms, p99 < 10 ms, no exceededCpu), then set CF_FREE_RUNTIME_VERIFIED=true in the production environment.");
+    }
+}
+//# sourceMappingURL=worker-assets.js.map

package/dist/worker-assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-assets.js","sourceRoot":"","sources":["../src/worker-assets.js"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,QAAQ,EAAE,QAAQ;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/H,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;WACtE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,GAAG,KAAK;IACnF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACvI,IAAI,mBAAmB,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpI,KAAK,MAAM,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,0BAA0B,EAAE,oCAAoC,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9K,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,+BAA+B,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QACxJ,IAAI,mBAAmB,IAAI,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,mBAAmB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AAC/J,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAM,EAAE,GAAG;IAClD,IAAI,MAAM,CAAC,eAAe,KAAK,YAAY,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,+BAA+B,KAAK,MAAM,IAAI,GAAG,CAAC,wBAAwB,KAAK,MAAM,EAAE,CAAC;QAC7K,MAAM,IAAI,KAAK,CAAC,4KAA4K,CAAC,CAAC;IAChM,CAAC;AACH,CAAC"}

package/docs/README.md

@@ -0,0 +1,16 @@
+# FlowPress Deploy: documentazione
+
+FlowPress Deploy collega le modifiche editoriali di WordPress ai workflow di
+build senza salvare token o contenuti nella propria coda.
+
+## Pagine
+
+| Argomento | Documento |
+| --- | --- |
+| Modello e responsabilità | [Architettura](architecture.md) |
+| Variabili richieste | [Configurazione](configuration.md) |
+| Deduplica, URI e revisioni | [Queue WordPress](wordpress-queue.md) |
+| Payload e callback | [Frontend e workflow](frontend-workflow.md) |
+| Uso quotidiano | [Operazioni](operations.md) |
+| Callback mancanti e retry | [Recovery](recovery.md) |
+| Diagnostica | [Troubleshooting](troubleshooting.md) |

package/docs/activities/2026-07-30-2339-initial-pack.md

@@ -0,0 +1,9 @@
+# Release iniziale deploy pack
+
+- Obiettivo: estrarre build full/partial, baseline e guardie Cloudflare.
+- Modifiche: package npm, MU-plugin Composer, test e workflow OIDC.
+- Verifiche: typecheck, 7 test, npm pack, Composer validate e PHP lint positivi.
+- Hardening pre-release: merge sicuro full/partial, sitemap, target
+  Pages/Workers, guardia `ASTRO_KEY` e lifecycle ack/release della queue.
+- Workflow tag idempotente per il bootstrap della prima pubblicazione npm.
+- Release prevista: `0.1.0-beta.0`; resta da configurare il Trusted Publisher npm.

package/docs/activities/2026-08-24-1745-wordpress-core-v1.md

@@ -0,0 +1,40 @@
+# Deploy su WordPress Core v1
+
+## Esito
+
+Preparata la major prerelease `1.0.0-beta.0` npm/Composer con dipendenza
+limitata a `flowpress/wordpress-core ^1.0.0@beta` e senza adapter v0.x. Il
+consumer canary mantiene il pin Core esatto.
+
+## Scope
+
+La logica Deploy non cambia. Versione package, Composer contract, lockfile,
+changelog e documentazione vengono pubblicati dallo stesso tag.
+
+## Verifiche
+
+| Gate | Esito |
+|---|---|
+| `npm ci && npm run release:check` | OK; 7/7 test e pack 9 file |
+| `npm audit` | OK; 0 vulnerabilita' dopo aggiornamento lockfile `nanoid` |
+| `composer validate --strict --no-check-publish` | OK |
+| PHP lint | OK |
+| `git diff --check` | OK |
+
+## Pubblicazione verificata
+
+- PR v1 unita su `main`; merge e `gitHead` npm:
+  `24e0033d78566890263249e56da3c15449e80897`.
+- Workflow Publish `32747502576`: verde con trusted publishing e provenance.
+- npm: `@styleflow.app/flowpress-deploy@1.0.0-beta.0`, dist-tag `next`;
+  integrity, shasum, tarball e firma presenti. `latest` resta sulla linea
+  precedente.
+- Repman: `flowpress/deploy@v1.0.0-beta.0`, sincronizzato dallo stesso tag e
+  con requisito `flowpress/wordpress-core ^1.0.0@beta`.
+- Canary DMO: installazione npm/Composer da registry, manifest coerente e gate
+  completo verde.
+
+## Rollback
+
+La linea `0.1.0-beta.0` resta immutabile. I consumer v1 usano pin esatti e non
+spostano `latest`.

package/docs/activities/2026-08-26-0926-revision-safe-queue.md

@@ -0,0 +1,41 @@
+# FlowPress Deploy: revision-safe editorial queue
+
+- Data: 2026-08-26 09:26 Europe/Rome
+- Repository: `StyleFlow-App/flowpress-deploy`
+- Versione prevista: `1.0.0-beta.1`
+
+## Obiettivo
+
+Rendere Deploy proprietario della queue editoriale tramite il provider Core,
+senza cambiare Core e senza assumere configurazioni Bagful/Cloudflare.
+
+## Modifiche
+
+- Provider automatico, schema queue/state/batch e migrazione Core non
+  distruttiva.
+- Fingerprint, URI history, WPML grouping, snapshot e ack revision-safe.
+- Enqueue a fine richiesta, azioni manuali, UI operativa e GitHub test.
+- Documentazione completa in `docs/` e inclusione nel pacchetto npm.
+
+## Verifiche
+
+- `php tests/php/queue-provider-test.php`: superato.
+- `find . -name '*.php' ... php -l`: superato.
+- `git diff --check`: superato.
+- `composer validate --strict`: superato.
+- `npm run release:check`: superato (typecheck, 7 test Vitest, test PHP,
+  pack dry-run con `docs/` e `includes/`).
+
+## Verifica manuale
+
+La verifica integrata in WordPress DMO sarà registrata nel report DMO; nessun
+dispatch o deploy remoto è autorizzato in questo task.
+
+## Commit suggerito
+
+`feat: add revision-safe editorial build queue`
+
+## Rischi e follow-up
+
+Il rollout richiede configurazione remota dei token e un test editoriale
+controllato prima di abilitare la pubblicazione production.

package/docs/activities/README.md

@@ -0,0 +1,5 @@
+# Indice attività
+
+- [2026-08-26-0926-revision-safe-queue.md](2026-08-26-0926-revision-safe-queue.md)
+- [2026-08-24-1745-wordpress-core-v1.md](2026-08-24-1745-wordpress-core-v1.md)
+- [2026-07-30-2339-initial-pack.md](2026-07-30-2339-initial-pack.md)

package/docs/architecture.md

@@ -0,0 +1,19 @@
+# Architettura
+
+## Perché
+
+Core espone il contratto di dispatch e callback; Deploy possiede lo stato
+editoriale necessario a non perdere aggiornamenti concorrenti.
+
+## Come funziona
+
+1. Il plugin registra il provider `flowpress-deploy` e lo seleziona.
+2. Gli hook Core inoltrano post, termini e modifiche globali al provider.
+3. Gli update vengono materializzati a `shutdown`, dopo meta e tassonomie.
+4. Le tabelle `flowpress_deploy_queue`, `flowpress_deploy_state` e
+   `flowpress_deploy_batches` conservano rispettivamente lavoro, ultimo stato
+   distribuito e snapshot immutabile del batch.
+5. Core effettua repository dispatch e callback usando il wire contract
+   pubblico. Deploy applica l’ack alla sola revisione fotografata.
+
+La coda conserva hash SHA-256 e URI, non il contenuto completo o credenziali.

package/docs/configuration.md

@@ -0,0 +1,19 @@
+# Configurazione
+
+## Perché
+
+Target e credenziali sono configurazione di ambiente e non devono finire nel
+database WordPress.
+
+## Come fare
+
+1. Definire `SF_STATIC_TARGETS_JSON`, per esempio `['production']` in JSON
+   valido.
+2. Definire `GITHUB_REPOSITORY_SLUG=organizzazione/repository`.
+3. Definire `CMS_GITHUB_DISPATCH_TOKEN` con il minimo accesso necessario al
+   repository.
+4. Definire `CMS_BUILD_CALLBACK_TOKEN` sia nel backend sia nel workflow.
+5. Aprire **Strumenti → FlowPress Deploy**: lo stato indica soltanto presenza
+   o assenza dei token, mai il loro valore.
+
+⚠️ Un target deve corrispondere esattamente a quello gestito dal workflow.

package/docs/frontend-workflow.md

@@ -0,0 +1,23 @@
+# Frontend e workflow
+
+## Wire contract
+
+Il repository dispatch riceve:
+
+```json
+{
+  "batchId": "uuid",
+  "target": "production",
+  "mode": "partial",
+  "paths": ["/pagina/"],
+  "deletedPaths": ["/vecchio-slug/"],
+  "queueIds": [12]
+}
+```
+
+Il workflow deve chiamare `POST /flowpress/v1/build-complete` con bearer token
+e body `{"batchId":"uuid","status":"success"}` soltanto dopo build, deploy
+e smoke test. In ogni altro caso invia `failure`.
+
+⚠️ L’assenza del callback non equivale a successo: il batch resta in-flight e
+sarà rilasciato dal recovery.

package/docs/operations.md

@@ -0,0 +1,15 @@
+# Operazioni
+
+## Come fare
+
+1. Aprire **Strumenti → FlowPress Deploy**.
+2. Verificare repository, token, righe pending, URI e batch in-flight.
+3. Espandere **Payload preview** prima dell’invio.
+4. Usare **Pubblica queue** per la modalità prevista.
+5. Usare **Force full** soltanto quando baseline o codice richiedono una build
+   completa; il browser chiede conferma.
+6. Per forzare un singolo contenuto usare **Aggiungi alla build queue** nella
+   schermata o nella lista di post/termini.
+
+Il pulsante **Test GitHub** verifica autenticazione e accesso al repository,
+senza inviare un deployment.

package/docs/recovery.md

@@ -0,0 +1,16 @@
+# Recovery
+
+## Callback failure
+
+1. Il callback `failure` libera il batch.
+2. Le righe tornano pending mantenendo l’ultima revisione editoriale.
+3. Correggere la causa nel workflow e ripubblicare la queue.
+
+## Callback mancante
+
+1. Il cron orario cerca batch in-flight più vecchi di sei ore.
+2. Il batch viene rilasciato come failure.
+3. Il limite è modificabile con `flowpress_deploy_stale_batch_hours`.
+
+⚠️ Non cancellare manualmente righe delle tre tabelle: si perderebbe la
+corrispondenza fra stato distribuito e snapshot. Usare callback/retry.

package/docs/troubleshooting.md

@@ -0,0 +1,22 @@
+# Troubleshooting
+
+## Queue vuota
+
+Controllare `SF_STATIC_TARGETS_JSON`, tipo di contenuto instradabile e che il
+salvataggio non sia autosave/revisione. Un salvataggio identico è correttamente
+deduplicato.
+
+## URI vecchio non eliminato
+
+Controllare `previous_uris` nella pagina Deploy e che il workflow consumi
+`deletedPaths`.
+
+## Batch sempre in-flight
+
+Verificare token callback e log del workflow. Attendere il recovery oppure
+inviare esplicitamente `failure` per il `batchId` corretto.
+
+## GitHub rifiuta il test
+
+Verificare slug repository, scadenza e permessi del token. La pagina non mostra
+né registra il segreto.

package/docs/wordpress-queue.md

@@ -0,0 +1,22 @@
+# Queue WordPress
+
+## Perché
+
+Salvataggi ripetuti, traduzioni e cambi slug non devono produrre build inutili
+o lasciare file vecchi online.
+
+## Come funziona
+
+1. Autosave e revisioni sono esclusi da Core.
+2. Deploy raggruppa per post/term ID; con WPML usa il translation group.
+3. Il fingerprint include contenuto, meta non volatili e tassonomie. Il filtro
+   `flowpress_deploy_volatile_meta_keys` aggiunge esclusioni.
+4. `flowpress_deploy_fingerprint_fields`, `flowpress_deploy_group_key` e
+   `flowpress_deploy_canonical_uris` permettono estensioni senza patch.
+5. `previous_uris` resta ancorato allo stato distribuito: uno slug change
+   produce il nuovo path e inserisce quello vecchio in `deletedPaths`.
+6. Una modifica durante un batch incrementa la revisione. Il callback completa
+   lo snapshot, ma rimette la revisione nuova in pending.
+
+La prima installazione importa le righe Core senza cancellarle; ogni vecchio
+batch in-flight viene importato come pending per un retry sicuro.

package/flowpress-deploy.php

@@ -1,21 +1,50 @@
 <?php
 /**
  * Plugin Name: FlowPress Deploy
- * Description: Installable deployment capability for FlowPress.
- * Version: 0.1.0-beta.0
+ * Description: Revision-safe editorial build queue and deployment capability for FlowPress.
+ * Version: 1.0.0-beta.5
  */
 
 if (! defined('ABSPATH')) {
     exit;
 }
 
+define('FLOWPRESS_DEPLOY_VERSION', '1.0.0-beta.5');
+define('FLOWPRESS_DEPLOY_FILE', __FILE__);
+
+require_once __DIR__ . '/includes/queue-provider.php';
+require_once __DIR__ . '/includes/manual-queue.php';
+require_once __DIR__ . '/includes/admin.php';
+require_once __DIR__ . '/includes/automatic-build.php';
+
+add_action('muplugins_loaded', static function (): void {
+    if (! function_exists('flowpress_register_build_queue_provider')) {
+        return;
+    }
+    flowpress_register_build_queue_provider('flowpress-deploy', [
+        'enqueue' => 'flowpress_deploy_collect_change',
+        'payload' => 'flowpress_deploy_build_payload',
+        'markDispatched' => 'flowpress_deploy_mark_dispatched',
+        'complete' => 'flowpress_deploy_complete_batch',
+        'pendingCount' => 'flowpress_deploy_pending_count',
+    ]);
+}, 110);
+
+add_filter('flowpress_build_queue_provider', static fn (): string => 'flowpress-deploy', 100);
+
 add_action('muplugins_loaded', static function (): void {
     if (! function_exists('flowpress_register_feature')) {
         return;
     }
     flowpress_register_feature('deploy', [
-        'version' => '0.1.0-beta.0',
-        'capabilities' => ['full-build', 'partial-build', 'build-callback'],
+        'version' => FLOWPRESS_DEPLOY_VERSION,
+        'capabilities' => [
+            'full-build',
+            'partial-build',
+            'build-callback',
+            'revision-safe-queue',
+            'manual-enqueue',
+        ],
         'config' => [
             'targets' => function_exists('flowpress_static_targets')
                 ? flowpress_static_targets()

package/includes/admin.php

@@ -0,0 +1,110 @@
+<?php
+
+if (! defined('ABSPATH')) {
+    exit;
+}
+
+add_action('admin_menu', static function (): void {
+    remove_submenu_page('tools.php', 'flowpress-builds');
+    add_management_page(
+        'FlowPress Deploy',
+        'FlowPress Deploy',
+        'manage_options',
+        'flowpress-builds',
+        'flowpress_deploy_render_admin_page'
+    );
+}, 100);
+
+add_action('admin_post_flowpress_deploy_test_github', static function (): void {
+    if (! current_user_can('manage_options')) {
+        wp_die('Forbidden', 403);
+    }
+    check_admin_referer('flowpress_deploy_test_github');
+    $repository = flowpress_env('GITHUB_REPOSITORY_SLUG');
+    $token = flowpress_env('CMS_GITHUB_DISPATCH_TOKEN');
+    $response = ($repository !== '' && $token !== '')
+        ? wp_remote_get('https://api.github.com/repos/' . $repository, [
+            'timeout' => 15,
+            'headers' => [
+                'Accept' => 'application/vnd.github+json',
+                'Authorization' => 'Bearer ' . $token,
+                'User-Agent' => 'FlowPress-Deploy/' . FLOWPRESS_DEPLOY_VERSION,
+            ],
+        ])
+        : new WP_Error('missing_config', 'Configurazione GitHub incompleta.');
+    $ok = ! is_wp_error($response) && wp_remote_retrieve_response_code($response) === 200;
+    set_transient('flowpress_build_notice_' . get_current_user_id(), [
+        'type' => $ok ? 'success' : 'error',
+        'message' => $ok ? 'Connessione GitHub verificata.' : (is_wp_error($response) ? $response->get_error_message() : 'GitHub ha rifiutato la richiesta.'),
+    ], 60);
+    wp_safe_redirect(admin_url('tools.php?page=flowpress-builds'));
+    exit;
+});
+
+function flowpress_deploy_render_admin_page(): void
+{
+    if (! current_user_can('manage_options')) {
+        return;
+    }
+    global $wpdb;
+    $notice = get_transient('flowpress_build_notice_' . get_current_user_id());
+    delete_transient('flowpress_build_notice_' . get_current_user_id());
+    $repository = flowpress_env('GITHUB_REPOSITORY_SLUG');
+    $has_dispatch_token = flowpress_env('CMS_GITHUB_DISPATCH_TOKEN') !== '';
+    $has_callback_token = flowpress_env('CMS_BUILD_CALLBACK_TOKEN') !== '';
+    echo '<div class="wrap"><h1>FlowPress Deploy</h1>';
+    if (is_array($notice)) {
+        printf('<div class="notice notice-%s"><p>%s</p></div>', esc_attr((string) $notice['type']), esc_html((string) $notice['message']));
+    }
+    echo '<p>La coda è deduplicata per contenuto logico e target. I token non vengono salvati né mostrati.</p>';
+    echo '<table class="widefat striped" style="max-width:900px"><tbody>';
+    printf('<tr><th>Repository GitHub</th><td>%s</td></tr>', esc_html($repository !== '' ? $repository : 'non configurato'));
+    printf('<tr><th>Token dispatch</th><td>%s</td></tr>', $has_dispatch_token ? 'configurato' : 'mancante');
+    printf('<tr><th>Token callback</th><td>%s</td></tr>', $has_callback_token ? 'configurato' : 'mancante');
+    echo '</tbody></table>';
+    echo '<form method="post" action="' . esc_url(admin_url('admin-post.php')) . '" style="margin:16px 0">';
+    wp_nonce_field('flowpress_deploy_test_github');
+    echo '<input type="hidden" name="action" value="flowpress_deploy_test_github">';
+    submit_button('Test GitHub', 'secondary', 'submit', false);
+    echo '</form>';
+    foreach (flowpress_static_targets() as $target) {
+        $payload = flowpress_deploy_build_payload($target, false);
+        $rows = (array) $wpdb->get_results($wpdb->prepare(
+            'SELECT * FROM ' . flowpress_deploy_queue_table() . ' WHERE target = %s ORDER BY updated_at DESC LIMIT 100',
+            $target
+        ), ARRAY_A);
+        $in_flight = (int) $wpdb->get_var($wpdb->prepare(
+            "SELECT COUNT(*) FROM " . flowpress_deploy_batch_table() . " WHERE target = %s AND status = 'in_flight'",
+            $target
+        ));
+        echo '<section style="margin:20px 0;padding:16px;background:#fff;border:1px solid #ccd0d4">';
+        printf('<h2>%s <small>(%d pending, %d in-flight)</small></h2>', esc_html($target), flowpress_deploy_pending_count($target), $in_flight);
+        echo '<p>Modalità prevista: <strong>' . esc_html($payload['mode']) . '</strong></p>';
+        echo '<details><summary>Payload preview</summary><pre style="white-space:pre-wrap">' . esc_html((string) wp_json_encode($payload, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES)) . '</pre></details>';
+        echo '<form method="post" action="' . esc_url(admin_url('admin-post.php')) . '" style="display:inline-block;margin:12px 8px 12px 0">';
+        wp_nonce_field('flowpress_publish_build');
+        echo '<input type="hidden" name="action" value="flowpress_publish_build"><input type="hidden" name="target" value="' . esc_attr($target) . '">';
+        submit_button('Pubblica queue', 'primary', 'submit', false);
+        echo '</form>';
+        echo '<form method="post" action="' . esc_url(admin_url('admin-post.php')) . '" style="display:inline-block" onsubmit="return confirm(\'Confermi la build completa?\')">';
+        wp_nonce_field('flowpress_publish_build');
+        echo '<input type="hidden" name="action" value="flowpress_publish_build"><input type="hidden" name="target" value="' . esc_attr($target) . '"><input type="hidden" name="force_full" value="1">';
+        submit_button('Force full', 'secondary', 'submit', false);
+        echo '</form>';
+        if ($rows !== []) {
+            echo '<table class="widefat striped"><thead><tr><th>Gruppo</th><th>URI correnti</th><th>URI precedenti</th><th>Rev.</th><th>Stato</th></tr></thead><tbody>';
+            foreach ($rows as $row) {
+                printf('<tr><td>%s</td><td>%s</td><td>%s</td><td>%d</td><td>%s</td></tr>',
+                    esc_html((string) $row['group_key']),
+                    esc_html(implode(', ', flowpress_deploy_decode_uris($row['current_uris'])) ?: '—'),
+                    esc_html(implode(', ', flowpress_deploy_decode_uris($row['previous_uris'])) ?: '—'),
+                    (int) $row['revision'],
+                    $row['batch_id'] ? 'in-flight' : 'pending'
+                );
+            }
+            echo '</tbody></table>';
+        }
+        echo '</section>';
+    }
+    echo '</div>';
+}