dineway 0.1.49 → 0.2.1

package/dist/{site-context-C8Az_P_I.mjs → site-context-B8T1kpUP.mjs}

@@ -1,18 +1,19 @@
 import { t as validateIdentifier } from "./validate-VPnKoIzW.mjs";
-import { i as encodeCursor, r as decodeCursor } from "./types-CSgR9nQB.mjs";
-import { t as ContentRepository } from "./content-CBxYGWfL.mjs";
-import { t as SiteActivityRepository } from "./site-activity-DONFrMBJ.mjs";
-import { t as ReviewRequestRepository } from "./review-requests-BW2NxY-l.mjs";
-import { n as normalizeEntityAlias, t as EntityAliasRepository } from "./entity-aliases-4y93Yjuc.mjs";
-import { r as isPattern } from "./patterns-DKAX6oqN.mjs";
-import { a as ContextRepository, i as parseSiteBriefingScope, l as handlePluginList } from "./briefing-CkTee1ex.mjs";
-import { t as FTSManager } from "./fts-manager-B5l_qwrA.mjs";
-import { n as SchemaRegistry } from "./registry-D7HACema.mjs";
-import { a as getSiteSettingsWithDb } from "./settings-CUXOxzsT.mjs";
-import { p as normalizeUrl } from "./utils-B8hBJ9Oz.mjs";
-import { t as sanitizeWordPressImportSlug } from "./wordpress-slugs-DHNR9LpG.mjs";
-import { s as searchCollection } from "./search-Gdrqj582.mjs";
-import { n as assertExperimentalSiteContextWorkflowsEnabled } from "./experimental-workflows-CSMffP6q.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-ChxYDRvx.mjs";
+import { t as ContentRepository } from "./content-DJcAYFhz.mjs";
+import { t as SiteActivityRepository } from "./site-activity-h8smOlYI.mjs";
+import { t as ReviewRequestRepository } from "./review-requests-CTWGnWUt.mjs";
+import { o as HitlRequestRepository } from "./publication-authorization-RKiHXKtq.mjs";
+import { r as isPattern } from "./patterns-CoqlXUvk.mjs";
+import { a as ContextRepository, i as parseSiteBriefingScope, l as handlePluginList } from "./briefing-0rf-su3-.mjs";
+import { t as FTSManager } from "./fts-manager-ewTGohf4.mjs";
+import { n as SchemaRegistry } from "./registry-BYYyb2tF.mjs";
+import { a as getSiteSettingsWithDb } from "./settings-BECcAIRH.mjs";
+import { n as buildStableActionHash, t as ReviewPayloadBuilder } from "./review-payload-BysRWpxS.mjs";
+import { n as assertExperimentalSiteContextWorkflowsEnabled } from "./experimental-workflows-GVhUgzEs.mjs";
+import { m as normalizeUrl } from "./utils-D1SrKGtP.mjs";
+import { t as sanitizeWordPressImportSlug } from "./wordpress-slugs-C3PWcowq.mjs";
+import { s as searchCollection } from "./search-DUKgZUlm.mjs";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 import { Role } from "@dineway-ai/auth";
@@ -30,7 +31,8 @@ const ASSIGNMENT_STATUSES = [
 	"blocked",
 	"completed",
 	"declined",
-	"cancelled"
+	"cancelled",
+	"overdue"
 ];
 const ASSIGNMENT_PRIORITIES = [
 	"low",
@@ -55,7 +57,7 @@ var AssignmentRepository = class {
 		return row ? rowToAssignment(row) : null;
 	}
 	async list(query = {}) {
-		const limit = clampLimit$3(query.limit);
+		const limit = clampLimit$2(query.limit);
 		const rows = await this.queryRows(query).execute();
 		const items = rows.slice(0, limit).map(rowToAssignment);
 		const result = { items };
@@ -73,7 +75,7 @@ var AssignmentRepository = class {
 			assigned_to_actor_id: input.assignedToActorId ?? null,
 			accepted_at: value,
 			updated_at: value,
-			metadata: jsonString$1(input.metadata)
+			metadata: jsonString(input.metadata)
 		});
 	}
 	async start(id, input = {}) {
@@ -82,7 +84,7 @@ var AssignmentRepository = class {
 			status: "in_progress",
 			started_at: value,
 			updated_at: value,
-			metadata: jsonString$1(input.metadata)
+			metadata: jsonString(input.metadata)
 		});
 	}
 	async block(id, input = {}) {
@@ -91,7 +93,7 @@ var AssignmentRepository = class {
 			status: "blocked",
 			blocked_at: value,
 			updated_at: value,
-			metadata: jsonString$1(input.metadata)
+			metadata: jsonString(input.metadata)
 		});
 	}
 	async complete(id, input = {}) {
@@ -104,7 +106,7 @@ var AssignmentRepository = class {
 			status: "completed",
 			completed_at: value,
 			updated_at: value,
-			metadata: jsonString$1(input.metadata)
+			metadata: jsonString(input.metadata)
 		});
 	}
 	async decline(id, input = {}) {
@@ -113,7 +115,7 @@ var AssignmentRepository = class {
 			status: "declined",
 			declined_at: value,
 			updated_at: value,
-			metadata: jsonString$1(input.metadata)
+			metadata: jsonString(input.metadata)
 		});
 	}
 	async cancel(id, input = {}) {
@@ -127,9 +129,36 @@ var AssignmentRepository = class {
 			status: "cancelled",
 			cancelled_at: value,
 			updated_at: value,
-			metadata: jsonString$1(input.metadata)
+			metadata: jsonString(input.metadata)
 		});
 	}
+	async markOverdueBefore(input) {
+		const limit = clampLimit$2(input.limit);
+		let query = this.db.selectFrom("_dineway_assignments").select("id").where("status", "in", [
+			"pending",
+			"accepted",
+			"in_progress",
+			"blocked"
+		]).where("due_at", "is not", null).where("due_at", "<=", input.before).orderBy("due_at", "asc").orderBy("id", "asc").limit(limit);
+		if (input.assignmentType) query = query.where("assignment_type", "=", input.assignmentType);
+		const candidates = await query.execute();
+		const at = input.at ?? (/* @__PURE__ */ new Date()).toISOString();
+		const overdue = [];
+		for (const candidate of candidates) {
+			const updated = await this.transition(candidate.id, [
+				"pending",
+				"accepted",
+				"in_progress",
+				"blocked"
+			], {
+				status: "overdue",
+				overdue_at: at,
+				updated_at: at
+			});
+			if (updated) overdue.push(updated);
+		}
+		return overdue;
+	}
 	async linkHitlRequest(id, relatedHitlRequestId, at = (/* @__PURE__ */ new Date()).toISOString()) {
 		const result = await this.db.updateTable("_dineway_assignments").set({
 			related_hitl_request_id: relatedHitlRequestId,
@@ -138,8 +167,16 @@ var AssignmentRepository = class {
 		if (Number(result.numUpdatedRows ?? 0) === 0) return null;
 		return this.findById(id);
 	}
+	async linkHandoffSnapshot(id, relatedHandoffSnapshotId, at = (/* @__PURE__ */ new Date()).toISOString()) {
+		const result = await this.db.updateTable("_dineway_assignments").set({
+			related_handoff_snapshot_id: relatedHandoffSnapshotId,
+			updated_at: at
+		}).where("id", "=", id).executeTakeFirst();
+		if (Number(result.numUpdatedRows ?? 0) === 0) return null;
+		return this.findById(id);
+	}
 	queryRows(query) {
-		const limit = clampLimit$3(query.limit);
+		const limit = clampLimit$2(query.limit);
 		let q = this.db.selectFrom("_dineway_assignments").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
 		if (query.scope) q = q.where("scope", "=", query.scope);
 		if (query.scopes && query.scopes.length > 0) q = q.where("scope", "in", query.scopes);
@@ -176,7 +213,7 @@ function toInsertableAssignment(id, input, now) {
 		assigned_by_actor_id: input.assignedByActorId,
 		assigned_to_actor_type: input.assignedToActorType ?? null,
 		assigned_to_actor_id: input.assignedToActorId ?? null,
-		metadata: jsonString$1(input.metadata),
+		metadata: jsonString(input.metadata),
 		related_handoff_snapshot_id: input.relatedHandoffSnapshotId ?? null,
 		related_hitl_request_id: input.relatedHitlRequestId ?? null,
 		due_at: input.dueAt ?? null,
@@ -187,7 +224,8 @@ function toInsertableAssignment(id, input, now) {
 		blocked_at: null,
 		completed_at: null,
 		declined_at: null,
-		cancelled_at: null
+		cancelled_at: null,
+		overdue_at: null
 	};
 }
 function rowToAssignment(row) {
@@ -204,7 +242,7 @@ function rowToAssignment(row) {
 		assignedByActorId: row.assigned_by_actor_id,
 		assignedToActorType: row.assigned_to_actor_type,
 		assignedToActorId: row.assigned_to_actor_id,
-		metadata: parseRecord$2(row.metadata),
+		metadata: parseRecord$1(row.metadata),
 		relatedHandoffSnapshotId: row.related_handoff_snapshot_id,
 		relatedHitlRequestId: row.related_hitl_request_id,
 		dueAt: row.due_at,
@@ -215,187 +253,299 @@ function rowToAssignment(row) {
 		blockedAt: row.blocked_at,
 		completedAt: row.completed_at,
 		declinedAt: row.declined_at,
-		cancelledAt: row.cancelled_at
+		cancelledAt: row.cancelled_at,
+		overdueAt: row.overdue_at
 	};
 }
-function jsonString$1(value) {
+function jsonString(value) {
 	return JSON.stringify(value ?? {});
 }
-function parseRecord$2(value) {
+function parseRecord$1(value) {
 	if (!value) return {};
 	try {
 		const parsed = JSON.parse(value);
-		return isRecord$5(parsed) ? parsed : {};
+		return isRecord$2(parsed) ? parsed : {};
 	} catch {
 		return {};
 	}
 }
-function isRecord$5(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function clampLimit$3(limit) {
+function clampLimit$2(limit) {
 	if (!limit || limit < 1) return 50;
 	return Math.min(limit, 100);
 }
 
 //#endregion
-//#region src/database/repositories/hitl-requests.ts
-const HITL_REQUEST_STATUSES = [
-	"pending",
-	"approved",
-	"rejected"
-];
-const HITL_REQUEST_PRIORITIES = [
-	"low",
-	"normal",
-	"high",
-	"urgent"
-];
-var HitlRequestRepository = class {
+//#region src/database/repositories/entity-aliases.ts
+const WHITESPACE_PATTERN = /\s+/g;
+function isResolvableEntityType(value) {
+	return value === "content" || value === "collection" || value === "plugin" || value === "taxonomy" || value === "menu";
+}
+function mapEntityAlias(row) {
+	if (!isResolvableEntityType(row.entity_type)) throw new Error(`Invalid entity alias type: ${row.entity_type}`);
+	return {
+		id: row.id,
+		entityType: row.entity_type,
+		collectionSlug: row.collection_slug,
+		entityId: row.entity_id,
+		alias: row.alias,
+		normalizedAlias: row.normalized_alias,
+		createdAt: row.created_at
+	};
+}
+function normalizeEntityAlias(value) {
+	return value.trim().toLowerCase().replace(WHITESPACE_PATTERN, " ");
+}
+var EntityAliasRepository = class {
 	constructor(db) {
 		this.db = db;
 	}
 	async create(input) {
 		const id = ulid();
-		const now = input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
-		await this.db.insertInto("_dineway_hitl_requests").values(toInsertableHitlRequest(id, input, now)).execute();
-		const request = await this.findById(id);
-		if (!request) throw new Error("Failed to create HITL request");
-		return request;
+		const normalizedAlias = normalizeEntityAlias(input.alias);
+		await this.db.insertInto("_dineway_entity_aliases").values({
+			id,
+			entity_type: input.entityType,
+			collection_slug: input.collectionSlug ?? null,
+			entity_id: input.entityId,
+			alias: input.alias,
+			normalized_alias: normalizedAlias
+		}).execute();
+		return mapEntityAlias(await this.db.selectFrom("_dineway_entity_aliases").selectAll().where("id", "=", id).executeTakeFirstOrThrow());
+	}
+	async findByNormalizedAlias(input) {
+		const limit = Math.min(Math.max(input.limit ?? 10, 1), 50);
+		const collectionSlug = input.collectionSlug;
+		let query = this.db.selectFrom("_dineway_entity_aliases").selectAll().where("normalized_alias", "=", input.normalizedAlias);
+		if (input.entityTypes && input.entityTypes.length > 0) query = query.where("entity_type", "in", input.entityTypes);
+		if (collectionSlug) query = query.where((eb) => eb.or([eb("collection_slug", "is", null), eb("collection_slug", "=", collectionSlug)]));
+		return (await query.orderBy("created_at", "desc").limit(limit).execute()).map(mapEntityAlias);
 	}
-	async findById(id) {
-		const row = await this.db.selectFrom("_dineway_hitl_requests").selectAll().where("id", "=", id).executeTakeFirst();
-		return row ? rowToHitlRequest(row) : null;
+};
+
+//#endregion
+//#region src/database/repositories/handoff-snapshots.ts
+var HandoffSnapshotRepository = class {
+	constructor(db) {
+		this.db = db;
 	}
-	async list(query = {}) {
-		const limit = clampLimit$2(query.limit);
-		const rows = await this.queryRows(query).execute();
-		const items = rows.slice(0, limit).map(rowToHitlRequest);
-		const result = { items };
-		if (rows.length > limit && items.length > 0) {
-			const last = items.at(-1);
-			result.nextCursor = encodeCursor(last.createdAt, last.id);
-		}
-		return result;
+	async create(input) {
+		const id = ulid();
+		await this.db.insertInto("_dineway_handoff_snapshots").values(toInsertableHandoffSnapshot(id, input)).execute();
+		return this.findById(id).then((snapshot) => {
+			if (!snapshot) throw new Error("Failed to create handoff snapshot");
+			return snapshot;
+		});
 	}
-	async resolve(id, input) {
-		const resolvedAt = input.resolvedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-		const result = await this.db.updateTable("_dineway_hitl_requests").set({
-			status: input.decision,
-			resolved_by_actor_type: input.resolvedByActorType,
-			resolved_by_actor_id: input.resolvedByActorId,
-			resolved_auth_metadata: jsonStringOrNull(input.resolvedAuthMetadata),
-			review_note: input.reviewNote ?? null,
-			resolved_at: resolvedAt,
-			updated_at: resolvedAt
-		}).where("id", "=", id).where("status", "=", "pending").executeTakeFirst();
-		if (Number(result.numUpdatedRows ?? 0) === 0) return null;
-		return this.findById(id);
+	async findById(id) {
+		const row = await this.db.selectFrom("_dineway_handoff_snapshots").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? rowToHandoffSnapshot(row) : null;
 	}
-	queryRows(query) {
-		const limit = clampLimit$2(query.limit);
-		let q = this.db.selectFrom("_dineway_hitl_requests").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
-		if (query.scope) q = q.where("scope", "=", query.scope);
-		if (query.scopes && query.scopes.length > 0) q = q.where("scope", "in", query.scopes);
-		if (query.statuses && query.statuses.length > 0) q = q.where("status", "in", query.statuses);
-		if (query.priority) q = q.where("priority", "=", query.priority);
-		if (query.actionType) q = q.where("action_type", "=", query.actionType);
-		if (query.targetRefType) q = q.where("target_ref_type", "=", query.targetRefType);
-		if (query.targetRefId) q = q.where("target_ref_id", "=", query.targetRefId);
-		if (query.relatedAssignmentId) q = q.where("related_assignment_id", "=", query.relatedAssignmentId);
-		if (query.requestedByActorType && query.requestedByActorId) q = q.where("requested_by_actor_type", "=", query.requestedByActorType).where("requested_by_actor_id", "=", query.requestedByActorId);
-		if (query.participantActor) q = q.where("requested_by_actor_type", "=", query.participantActor.actorType).where("requested_by_actor_id", "=", query.participantActor.actorId);
-		if (query.since) q = q.where("updated_at", ">=", query.since);
-		if (query.cursor) {
-			const decoded = decodeCursor(query.cursor);
-			if (decoded) q = q.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
-		}
-		return q;
+	async markResumed(id, resumedAt) {
+		const value = resumedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+		await this.db.updateTable("_dineway_handoff_snapshots").set({ resumed_at: value }).where("id", "=", id).execute();
+		return this.findById(id);
 	}
 };
-function toInsertableHitlRequest(id, input, now) {
+function toInsertableHandoffSnapshot(id, input) {
 	return {
 		id,
 		scope: input.scope,
-		action_type: input.actionType,
-		status: "pending",
-		priority: input.priority ?? "normal",
-		title: input.title,
-		summary: input.summary ?? null,
-		risk_reason: input.riskReason,
-		review_payload: JSON.stringify(input.reviewPayload),
-		target_ref_type: input.targetRefType,
-		target_ref_id: input.targetRefId,
-		requested_by_actor_type: input.requestedByActorType,
-		requested_by_actor_id: input.requestedByActorId,
-		requested_auth_metadata: jsonStringOrNull(input.requestedAuthMetadata),
-		resolved_by_actor_type: null,
-		resolved_by_actor_id: null,
-		resolved_auth_metadata: null,
-		review_note: null,
-		metadata: jsonString(input.metadata),
-		related_assignment_id: input.relatedAssignmentId ?? null,
-		related_handoff_snapshot_id: input.relatedHandoffSnapshotId ?? null,
-		sla_due_at: input.slaDueAt ?? null,
-		created_at: now,
-		updated_at: now,
-		resolved_at: null
+		actor_type: input.actorType,
+		actor_id: input.actorId,
+		auth_metadata: jsonOrNull(input.authMetadata),
+		objective: input.objective,
+		reasoning: input.reasoning,
+		key_findings: JSON.stringify(input.keyFindings ?? []),
+		touched_objects: JSON.stringify(input.touchedObjects ?? []),
+		pending_actions: JSON.stringify(input.pendingActions ?? []),
+		tool_evidence: JSON.stringify(input.toolEvidence ?? []),
+		confidence: input.confidence ?? null,
+		handoff_kind: input.handoffKind ?? "pause",
+		reference_type: input.referenceType ?? null,
+		reference_id: input.referenceId ?? null,
+		created_at: input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+		resumed_at: null
 	};
 }
-function rowToHitlRequest(row) {
+function rowToHandoffSnapshot(row) {
 	return {
 		id: row.id,
 		scope: row.scope,
-		actionType: row.action_type,
-		status: row.status,
-		priority: row.priority,
-		title: row.title,
-		summary: row.summary,
-		riskReason: row.risk_reason,
-		reviewPayload: parseRecord$1(row.review_payload),
-		targetRefType: row.target_ref_type,
-		targetRefId: row.target_ref_id,
-		requestedByActorType: row.requested_by_actor_type,
-		requestedByActorId: row.requested_by_actor_id,
-		requestedAuthMetadata: parseNullableRecord(row.requested_auth_metadata),
-		resolvedByActorType: row.resolved_by_actor_type,
-		resolvedByActorId: row.resolved_by_actor_id,
-		resolvedAuthMetadata: parseNullableRecord(row.resolved_auth_metadata),
-		reviewNote: row.review_note,
-		metadata: parseRecord$1(row.metadata),
-		relatedAssignmentId: row.related_assignment_id,
-		relatedHandoffSnapshotId: row.related_handoff_snapshot_id,
-		slaDueAt: row.sla_due_at,
+		actorType: row.actor_type,
+		actorId: row.actor_id,
+		authMetadata: parseRecord(row.auth_metadata),
+		objective: row.objective,
+		reasoning: row.reasoning,
+		keyFindings: parseArray(row.key_findings),
+		touchedObjects: parseArray(row.touched_objects),
+		pendingActions: parseArray(row.pending_actions),
+		toolEvidence: parseArray(row.tool_evidence),
+		confidence: row.confidence,
+		handoffKind: row.handoff_kind,
+		referenceType: row.reference_type,
+		referenceId: row.reference_id,
 		createdAt: row.created_at,
-		updatedAt: row.updated_at,
-		resolvedAt: row.resolved_at
+		resumedAt: row.resumed_at
 	};
 }
-function jsonString(value) {
-	return JSON.stringify(value ?? {});
-}
-function jsonStringOrNull(value) {
+function jsonOrNull(value) {
 	return value ? JSON.stringify(value) : null;
 }
-function parseRecord$1(value) {
-	if (!value) return {};
+function parseRecord(value) {
+	if (!value) return null;
 	try {
 		const parsed = JSON.parse(value);
-		return isRecord$4(parsed) ? parsed : {};
+		return isRecord$1(parsed) ? parsed : null;
 	} catch {
-		return {};
+		return null;
 	}
 }
-function parseNullableRecord(value) {
-	if (!value) return null;
-	return parseRecord$1(value);
+function parseArray(value) {
+	if (!value) return [];
+	try {
+		const parsed = JSON.parse(value);
+		return Array.isArray(parsed) ? parsed.filter((_item) => true) : [];
+	} catch {
+		return [];
+	}
 }
-function isRecord$4(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function clampLimit$2(limit) {
-	if (!limit || limit < 1) return 50;
-	return Math.min(limit, 100);
+
+//#endregion
+//#region src/site-context/hitl.ts
+const HITL_REQUEST_VALID_FROM = { resolve: ["pending"] };
+var HitlRequestService = class {
+	repository;
+	assignments;
+	constructor(db) {
+		this.db = db;
+		this.repository = new HitlRequestRepository(db);
+		this.assignments = new AssignmentRepository(db);
+	}
+	async create(actor, input) {
+		parseSiteBriefingScope(input.scope);
+		const assignment = input.relatedAssignmentId ? await this.assignments.findById(input.relatedAssignmentId) : null;
+		if (input.relatedAssignmentId && !assignment) throw new Error(`Assignment not found: ${input.relatedAssignmentId}`);
+		if (assignment) {
+			this.assertRelatedAssignmentReadable(assignment, actor);
+			if (assignment.scope !== input.scope) throw new Error("Related assignment scope must match the HITL request scope.");
+			if (assignment.relatedHitlRequestId) throw new Error(`Assignment ${assignment.id} is already linked to HITL request ${assignment.relatedHitlRequestId}.`);
+		}
+		if (input.relatedHandoffSnapshotId) {
+			const snapshot = await new HandoffSnapshotRepository(this.db).findById(input.relatedHandoffSnapshotId);
+			if (!snapshot) throw new Error(`Handoff snapshot not found: ${input.relatedHandoffSnapshotId}`);
+			this.assertRelatedHandoffSnapshotReadable(snapshot, actor);
+			if (snapshot.scope !== input.scope) throw new Error("Related handoff snapshot scope must match the HITL request scope.");
+		}
+		const request = await this.repository.create({
+			scope: input.scope,
+			actionType: input.actionType,
+			title: input.title,
+			summary: input.summary,
+			riskReason: input.riskReason,
+			reviewPayload: input.reviewPayload,
+			targetRefType: input.targetRefType,
+			targetRefId: input.targetRefId,
+			requestedByActorType: actor.actorType,
+			requestedByActorId: actor.actorId,
+			requestedAuthMetadata: actor.authMetadata,
+			priority: input.priority,
+			metadata: input.metadata,
+			relatedAssignmentId: input.relatedAssignmentId,
+			relatedHandoffSnapshotId: input.relatedHandoffSnapshotId,
+			slaDueAt: input.slaDueAt,
+			createdAt: input.createdAt
+		});
+		if (assignment) {
+			if (!await this.assignments.linkHitlRequest(assignment.id, request.id, request.createdAt)) throw new Error(`Failed to link assignment ${assignment.id} to HITL request ${request.id}.`);
+		}
+		return request;
+	}
+	async get(id, actor) {
+		const request = await this.repository.findById(id);
+		if (!request) return null;
+		this.assertReadable(request, actor);
+		return request;
+	}
+	async list(actor, input = {}) {
+		return this.repository.list(this.buildListQuery(actor, input));
+	}
+	async resolve(input) {
+		const request = await this.loadExisting(input.id);
+		this.assertResolver(input.actor);
+		this.assertReadable(request, input.actor);
+		this.assertValidAction("resolve", request.status);
+		const resolved = await this.repository.resolve(request.id, {
+			decision: input.decision,
+			resolvedByActorType: input.actor.actorType,
+			resolvedByActorId: input.actor.actorId,
+			resolvedAuthMetadata: input.actor.authMetadata,
+			reviewNote: input.reviewNote,
+			resolvedAt: input.at
+		});
+		if (!resolved) throw new Error(`Failed to resolve HITL request ${request.id}.`);
+		return resolved;
+	}
+	buildListQuery(actor, input) {
+		const query = {
+			scope: input.scope,
+			scopes: input.scopes,
+			statuses: input.statuses,
+			priority: input.priority,
+			actionType: input.actionType,
+			targetRefType: input.targetRefType,
+			targetRefId: input.targetRefId,
+			relatedAssignmentId: input.relatedAssignmentId,
+			since: input.since,
+			limit: input.limit,
+			cursor: input.cursor
+		};
+		if (isHitlSupervisor(actor.userRole)) return query;
+		return {
+			...query,
+			requestedByActorType: actor.actorType,
+			requestedByActorId: actor.actorId
+		};
+	}
+	async loadExisting(id) {
+		const request = await this.repository.findById(id);
+		if (!request) throw new Error(`HITL request not found: ${id}`);
+		return request;
+	}
+	assertReadable(request, actor) {
+		if (isHitlSupervisor(actor.userRole)) return;
+		if (request.requestedByActorType === actor.actorType && request.requestedByActorId === actor.actorId) return;
+		throw new Error("Insufficient permissions to read this HITL request.");
+	}
+	assertResolver(actor) {
+		if (isHitlSupervisor(actor.userRole)) return;
+		throw new Error("HITL requests may only be resolved by an editor or admin.");
+	}
+	assertRelatedAssignmentReadable(assignment, actor) {
+		if (isHitlSupervisor(actor.userRole)) return;
+		if (matchesActor$1(assignment.assignedByActorType, assignment.assignedByActorId, actor) || matchesActor$1(assignment.assignedToActorType, assignment.assignedToActorId, actor)) return;
+		throw new Error("Insufficient permissions to link this assignment to a HITL request.");
+	}
+	assertRelatedHandoffSnapshotReadable(snapshot, actor) {
+		if (isHitlSupervisor(actor.userRole)) return;
+		if (matchesActor$1(snapshot.actorType, snapshot.actorId, actor)) return;
+		throw new Error("Insufficient permissions to link this handoff snapshot to a HITL request.");
+	}
+	assertValidAction(action, status) {
+		const validFrom = HITL_REQUEST_VALID_FROM[action];
+		if (!validFrom.includes(status)) throw new Error(`Cannot ${action} a HITL request in status "${status}". Valid statuses: ${validFrom.join(", ")}.`);
+	}
+};
+function isHitlSupervisor(role) {
+	return role >= Role.EDITOR;
+}
+function matchesActor$1(actorType, actorId, actor) {
+	return actorType === actor.actorType && actorId === actor.actorId;
 }
 
 //#endregion
@@ -436,131 +586,11 @@ function toPublicContextEntryPage(page) {
 }
 function toPublicContextDiff(diff) {
 	return {
-		newEntries: toPublicContextEntries(diff.newEntries),
-		supersededEntries: toPublicContextEntries(diff.supersededEntries),
-		staleEntries: toPublicContextEntries(diff.staleEntries),
-		reviewedEntries: toPublicContextEntries(diff.reviewedEntries)
-	};
-}
-
-//#endregion
-//#region src/site-context/action-hash.ts
-async function buildStableActionHash(value) {
-	return sha256Hex(stableStringify(value));
-}
-function stableStringify(value) {
-	if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
-	if (isRecord$3(value)) return `{${Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).toSorted(([left], [right]) => left.localeCompare(right)).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableStringify(entryValue)}`).join(",")}}`;
-	return JSON.stringify(value ?? null);
-}
-function isRecord$3(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-async function sha256Hex(value) {
-	const buffer = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-	return Array.from(new Uint8Array(buffer), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-
-//#endregion
-//#region src/site-context/review-payload.ts
-var ReviewPayloadBuilder = class {
-	constructor(handlers) {
-		this.handlers = handlers;
-	}
-	async buildContentReviewPayload(input) {
-		const actionType = input.actionType ?? "content.publish";
-		const content = await this.loadContent(input.collection, input.id);
-		const compare = await this.loadCompare(input.collection, content.entryId);
-		const live = asRecord(compare.live);
-		const draft = asRecord(compare.draft) ?? content.data;
-		const hasChanges = typeof compare.hasChanges === "boolean" ? compare.hasChanges : stableStringify(live) !== stableStringify(draft);
-		const actionHash = await buildStableActionHash({
-			actionType,
-			collection: input.collection,
-			entryId: content.entryId,
-			liveRevisionId: content.liveRevisionId,
-			draftRevisionId: content.draftRevisionId,
-			reviewedRev: content.reviewedRev,
-			live,
-			draft
-		});
-		const scope = `content:${input.collection}:${content.entryId}`;
-		const summary = input.summary ?? `Review ${actionType} for ${input.collection}/${content.displayTitle ?? content.entryId}`;
-		return {
-			collection: input.collection,
-			entryId: content.entryId,
-			scope,
-			liveRevisionId: content.liveRevisionId,
-			draftRevisionId: content.draftRevisionId,
-			reviewedRev: content.reviewedRev,
-			actionType,
-			actionHash,
-			reviewPayload: {
-				kind: "content_review",
-				actionType,
-				summary,
-				target: {
-					collection: input.collection,
-					entryId: content.entryId,
-					scope,
-					liveRevisionId: content.liveRevisionId,
-					draftRevisionId: content.draftRevisionId,
-					reviewedRev: content.reviewedRev,
-					actionHash
-				},
-				content: {
-					id: content.entryId,
-					slug: content.slug,
-					status: content.status,
-					title: content.displayTitle,
-					updatedAt: content.updatedAt
-				},
-				diff: {
-					hasChanges,
-					live,
-					draft
-				}
-			}
-		};
-	}
-	async loadContent(collection, id) {
-		const result = await this.handlers.handleContentGet(collection, id);
-		if (!result.success) throw new Error(result.error?.message ?? `Content item not found: ${collection}/${id}`);
-		const payload = asRecord(result.data);
-		const item = asRecord(payload?.item);
-		if (!payload || !item) throw new Error("Content get response did not include an item");
-		const entryId = stringOrNull(item.id);
-		const reviewedRev = stringOrNull(payload._rev);
-		if (!entryId) throw new Error("Content item is missing id");
-		if (!reviewedRev) throw new Error("Content item is missing _rev for review binding");
-		const data = asRecord(item.data) ?? {};
-		const title = stringOrNull(data.title) ?? stringOrNull(item.title) ?? stringOrNull(item.slug);
-		return {
-			entryId,
-			reviewedRev,
-			liveRevisionId: stringOrNull(item.liveRevisionId),
-			draftRevisionId: stringOrNull(item.draftRevisionId),
-			slug: stringOrNull(item.slug),
-			status: stringOrNull(item.status),
-			updatedAt: stringOrNull(item.updatedAt),
-			displayTitle: title,
-			data
-		};
-	}
-	async loadCompare(collection, id) {
-		const result = await this.handlers.handleContentCompare(collection, id);
-		if (!result.success) throw new Error(result.error?.message ?? `Failed to compare content: ${collection}/${id}`);
-		return asRecord(result.data) ?? {};
-	}
-};
-function asRecord(value) {
-	return isRecord$2(value) ? value : null;
-}
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function stringOrNull(value) {
-	return typeof value === "string" && value.length > 0 ? value : null;
+		newEntries: toPublicContextEntries(diff.newEntries),
+		supersededEntries: toPublicContextEntries(diff.supersededEntries),
+		staleEntries: toPublicContextEntries(diff.staleEntries),
+		reviewedEntries: toPublicContextEntries(diff.reviewedEntries)
+	};
 }
 
 //#endregion
@@ -2742,12 +2772,12 @@ function parseUnknownRecord(value) {
 	if (!value) return null;
 	try {
 		const parsed = JSON.parse(value);
-		return isRecord$1(parsed) ? parsed : null;
+		return isRecord(parsed) ? parsed : null;
 	} catch {
 		return null;
 	}
 }
-function isRecord$1(value) {
+function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -3135,7 +3165,7 @@ var EntityResolver = class {
 		return this.options.db.selectFrom("_dineway_taxonomy_defs").selectAll().execute();
 	}
 	async listPlugins() {
-		const result = await handlePluginList(this.options.db, this.options.handlers.configuredPlugins, this.options.handlers.config.marketplace);
+		const result = await handlePluginList(this.options.db, this.options.handlers.configuredPlugins, this.options.handlers.sandboxedPluginEntries ?? [], this.options.handlers.config.marketplace);
 		return result.success ? result.data?.items ?? [] : [];
 	}
 	contentCandidate(item, context, matchTier, matchReason) {
@@ -3534,97 +3564,6 @@ function clampLimit$1(value) {
 	return Math.min(Math.max(1, value ?? 10), 100);
 }
 
-//#endregion
-//#region src/database/repositories/handoff-snapshots.ts
-var HandoffSnapshotRepository = class {
-	constructor(db) {
-		this.db = db;
-	}
-	async create(input) {
-		const id = ulid();
-		await this.db.insertInto("_dineway_handoff_snapshots").values(toInsertableHandoffSnapshot(id, input)).execute();
-		return this.findById(id).then((snapshot) => {
-			if (!snapshot) throw new Error("Failed to create handoff snapshot");
-			return snapshot;
-		});
-	}
-	async findById(id) {
-		const row = await this.db.selectFrom("_dineway_handoff_snapshots").selectAll().where("id", "=", id).executeTakeFirst();
-		return row ? rowToHandoffSnapshot(row) : null;
-	}
-	async markResumed(id, resumedAt) {
-		const value = resumedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-		await this.db.updateTable("_dineway_handoff_snapshots").set({ resumed_at: value }).where("id", "=", id).execute();
-		return this.findById(id);
-	}
-};
-function toInsertableHandoffSnapshot(id, input) {
-	return {
-		id,
-		scope: input.scope,
-		actor_type: input.actorType,
-		actor_id: input.actorId,
-		auth_metadata: jsonOrNull(input.authMetadata),
-		objective: input.objective,
-		reasoning: input.reasoning,
-		key_findings: JSON.stringify(input.keyFindings ?? []),
-		touched_objects: JSON.stringify(input.touchedObjects ?? []),
-		pending_actions: JSON.stringify(input.pendingActions ?? []),
-		tool_evidence: JSON.stringify(input.toolEvidence ?? []),
-		confidence: input.confidence ?? null,
-		handoff_kind: input.handoffKind ?? "pause",
-		reference_type: input.referenceType ?? null,
-		reference_id: input.referenceId ?? null,
-		created_at: input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-		resumed_at: null
-	};
-}
-function rowToHandoffSnapshot(row) {
-	return {
-		id: row.id,
-		scope: row.scope,
-		actorType: row.actor_type,
-		actorId: row.actor_id,
-		authMetadata: parseRecord(row.auth_metadata),
-		objective: row.objective,
-		reasoning: row.reasoning,
-		keyFindings: parseArray(row.key_findings),
-		touchedObjects: parseArray(row.touched_objects),
-		pendingActions: parseArray(row.pending_actions),
-		toolEvidence: parseArray(row.tool_evidence),
-		confidence: row.confidence,
-		handoffKind: row.handoff_kind,
-		referenceType: row.reference_type,
-		referenceId: row.reference_id,
-		createdAt: row.created_at,
-		resumedAt: row.resumed_at
-	};
-}
-function jsonOrNull(value) {
-	return value ? JSON.stringify(value) : null;
-}
-function parseRecord(value) {
-	if (!value) return null;
-	try {
-		const parsed = JSON.parse(value);
-		return isRecord(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-function parseArray(value) {
-	if (!value) return [];
-	try {
-		const parsed = JSON.parse(value);
-		return Array.isArray(parsed) ? parsed.filter((_item) => true) : [];
-	} catch {
-		return [];
-	}
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
 //#endregion
 //#region src/site-context/handoff.ts
 const DEFAULT_ACTIVITY_LIMIT = 25;
@@ -3638,16 +3577,25 @@ var HandoffSnapshotStore = class {
 		this.now = options.now ?? /* @__PURE__ */ new Date();
 	}
 	async capture(input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		parseSiteBriefingScope(input.scope);
-		return new HandoffSnapshotRepository(this.db).create(input);
+		if (Boolean(input.referenceType) !== Boolean(input.referenceId)) throw new Error("Handoff reference type and id must be provided together.");
+		return this.withTransaction(async (transaction) => {
+			if (input.referenceType === "assignment") {
+				const assignment = await new AssignmentRepository(transaction).findById(input.referenceId);
+				if (!assignment) throw new Error(`Assignment not found: ${input.referenceId}`);
+				if (assignment.scope !== input.scope) throw new Error("Referenced Assignment scope must match the Handoff scope.");
+			}
+			const snapshot = await new HandoffSnapshotRepository(transaction).create(input);
+			if (input.referenceType === "assignment") {
+				if (!await new AssignmentRepository(transaction).linkHandoffSnapshot(input.referenceId, snapshot.id, snapshot.createdAt)) throw new Error(`Assignment not found: ${input.referenceId}`);
+			}
+			return snapshot;
+		});
 	}
 	async get(id) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		return new HandoffSnapshotRepository(this.db).findById(id);
 	}
 	async resume(input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		const repository = new HandoffSnapshotRepository(this.db);
 		const snapshot = await repository.findById(input.id);
 		if (!snapshot) return null;
@@ -3717,6 +3665,10 @@ var HandoffSnapshotStore = class {
 			}
 		};
 	}
+	async withTransaction(operation) {
+		if (this.db.isTransaction) return operation(this.db);
+		return this.db.transaction().execute(operation);
+	}
 };
 function summarizeScope(scope) {
 	return {
@@ -3772,7 +3724,6 @@ var AssignmentService = class {
 		this.repository = new AssignmentRepository(db);
 	}
 	async create(actor, input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		if (input.relatedHandoffSnapshotId) {
 			const snapshot = await new HandoffSnapshotRepository(this.db).findById(input.relatedHandoffSnapshotId);
 			if (!snapshot) throw new Error(`Handoff snapshot not found: ${input.relatedHandoffSnapshotId}`);
@@ -3796,18 +3747,15 @@ var AssignmentService = class {
 		});
 	}
 	async get(id, actor) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		const assignment = await this.repository.findById(id);
 		if (!assignment) return null;
 		this.assertReadable(assignment, actor);
 		return assignment;
 	}
 	async list(actor, input = {}) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		return this.repository.list(this.buildListQuery(actor, input));
 	}
 	async accept(input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		const assignment = await this.loadExisting(input.id);
 		this.assertAssigneeAction("accept", assignment, input.actor);
 		this.assertValidAction("accept", assignment.status);
@@ -3821,7 +3769,6 @@ var AssignmentService = class {
 		return accepted;
 	}
 	async start(input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		const assignment = await this.loadExisting(input.id);
 		this.assertAssigneeAction("start", assignment, input.actor);
 		this.assertValidAction("start", assignment.status);
@@ -3833,7 +3780,6 @@ var AssignmentService = class {
 		return started;
 	}
 	async block(input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		const assignment = await this.loadExisting(input.id);
 		this.assertAssigneeAction("block", assignment, input.actor);
 		this.assertValidAction("block", assignment.status);
@@ -3845,7 +3791,6 @@ var AssignmentService = class {
 		return blocked;
 	}
 	async complete(input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		const assignment = await this.loadExisting(input.id);
 		this.assertAssigneeAction("complete", assignment, input.actor);
 		this.assertValidAction("complete", assignment.status);
@@ -3857,7 +3802,6 @@ var AssignmentService = class {
 		return completed;
 	}
 	async decline(input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		const assignment = await this.loadExisting(input.id);
 		this.assertAssigneeAction("decline", assignment, input.actor);
 		this.assertValidAction("decline", assignment.status);
@@ -3869,7 +3813,6 @@ var AssignmentService = class {
 		return declined;
 	}
 	async cancel(input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
 		const assignment = await this.loadExisting(input.id);
 		this.assertCanceller(assignment, input.actor);
 		this.assertValidAction("cancel", assignment.status);
@@ -3924,7 +3867,7 @@ var AssignmentService = class {
 	}
 	assertReadable(assignment, actor) {
 		if (isWorkflowSupervisor(actor.userRole)) return;
-		if (matchesActor$1(assignment.assignedByActorType, assignment.assignedByActorId, actor) || matchesActor$1(assignment.assignedToActorType, assignment.assignedToActorId, actor)) return;
+		if (matchesActor(assignment.assignedByActorType, assignment.assignedByActorId, actor) || matchesActor(assignment.assignedToActorType, assignment.assignedToActorId, actor)) return;
 		throw new Error("Insufficient permissions to access this assignment.");
 	}
 	assertAssigneeAction(action, assignment, actor) {
@@ -3933,12 +3876,12 @@ var AssignmentService = class {
 			if (action === "accept") return;
 			throw new Error(`Only an assigned actor can ${action} this assignment.`);
 		}
-		if (matchesActor$1(assignment.assignedToActorType, assignment.assignedToActorId, actor)) return;
+		if (matchesActor(assignment.assignedToActorType, assignment.assignedToActorId, actor)) return;
 		throw new Error(`Only the assignee can ${action} this assignment.`);
 	}
 	assertCanceller(assignment, actor) {
 		if (isWorkflowSupervisor(actor.userRole)) return;
-		if (matchesActor$1(assignment.assignedByActorType, assignment.assignedByActorId, actor)) return;
+		if (matchesActor(assignment.assignedByActorType, assignment.assignedByActorId, actor)) return;
 		throw new Error("Only the assigner or an editor can cancel this assignment.");
 	}
 	assertValidAction(action, currentStatus) {
@@ -3951,7 +3894,7 @@ function validateAssignmentAction(action, currentStatus) {
 	if (validFrom.includes(currentStatus)) return null;
 	return `Cannot ${action} an assignment that is currently '${currentStatus}'. Must be: ${validFrom.join(" or ")}`;
 }
-function matchesActor$1(actorType, actorId, actor) {
+function matchesActor(actorType, actorId, actor) {
 	return actorType === actor.actorType && actorId === actor.actorId;
 }
 function isWorkflowSupervisor(userRole) {
@@ -3965,142 +3908,6 @@ function mergeReasonMetadata(metadata, key, reason) {
 	};
 }
 
-//#endregion
-//#region src/site-context/hitl.ts
-const HITL_REQUEST_VALID_FROM = { resolve: ["pending"] };
-var HitlRequestService = class {
-	repository;
-	assignments;
-	constructor(db) {
-		this.db = db;
-		this.repository = new HitlRequestRepository(db);
-		this.assignments = new AssignmentRepository(db);
-	}
-	async create(actor, input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
-		parseSiteBriefingScope(input.scope);
-		const assignment = input.relatedAssignmentId ? await this.assignments.findById(input.relatedAssignmentId) : null;
-		if (input.relatedAssignmentId && !assignment) throw new Error(`Assignment not found: ${input.relatedAssignmentId}`);
-		if (assignment) {
-			this.assertRelatedAssignmentReadable(assignment, actor);
-			if (assignment.scope !== input.scope) throw new Error("Related assignment scope must match the HITL request scope.");
-			if (assignment.relatedHitlRequestId) throw new Error(`Assignment ${assignment.id} is already linked to HITL request ${assignment.relatedHitlRequestId}.`);
-		}
-		if (input.relatedHandoffSnapshotId) {
-			const snapshot = await new HandoffSnapshotRepository(this.db).findById(input.relatedHandoffSnapshotId);
-			if (!snapshot) throw new Error(`Handoff snapshot not found: ${input.relatedHandoffSnapshotId}`);
-			this.assertRelatedHandoffSnapshotReadable(snapshot, actor);
-			if (snapshot.scope !== input.scope) throw new Error("Related handoff snapshot scope must match the HITL request scope.");
-		}
-		const request = await this.repository.create({
-			scope: input.scope,
-			actionType: input.actionType,
-			title: input.title,
-			summary: input.summary,
-			riskReason: input.riskReason,
-			reviewPayload: input.reviewPayload,
-			targetRefType: input.targetRefType,
-			targetRefId: input.targetRefId,
-			requestedByActorType: actor.actorType,
-			requestedByActorId: actor.actorId,
-			requestedAuthMetadata: actor.authMetadata,
-			priority: input.priority,
-			metadata: input.metadata,
-			relatedAssignmentId: input.relatedAssignmentId,
-			relatedHandoffSnapshotId: input.relatedHandoffSnapshotId,
-			slaDueAt: input.slaDueAt,
-			createdAt: input.createdAt
-		});
-		if (assignment) {
-			if (!await this.assignments.linkHitlRequest(assignment.id, request.id, request.createdAt)) throw new Error(`Failed to link assignment ${assignment.id} to HITL request ${request.id}.`);
-		}
-		return request;
-	}
-	async get(id, actor) {
-		assertExperimentalSiteContextWorkflowsEnabled();
-		const request = await this.repository.findById(id);
-		if (!request) return null;
-		this.assertReadable(request, actor);
-		return request;
-	}
-	async list(actor, input = {}) {
-		assertExperimentalSiteContextWorkflowsEnabled();
-		return this.repository.list(this.buildListQuery(actor, input));
-	}
-	async resolve(input) {
-		assertExperimentalSiteContextWorkflowsEnabled();
-		const request = await this.loadExisting(input.id);
-		this.assertResolver(input.actor);
-		this.assertReadable(request, input.actor);
-		this.assertValidAction("resolve", request.status);
-		const resolved = await this.repository.resolve(request.id, {
-			decision: input.decision,
-			resolvedByActorType: input.actor.actorType,
-			resolvedByActorId: input.actor.actorId,
-			resolvedAuthMetadata: input.actor.authMetadata,
-			reviewNote: input.reviewNote,
-			resolvedAt: input.at
-		});
-		if (!resolved) throw new Error(`Failed to resolve HITL request ${request.id}.`);
-		return resolved;
-	}
-	buildListQuery(actor, input) {
-		const query = {
-			scope: input.scope,
-			scopes: input.scopes,
-			statuses: input.statuses,
-			priority: input.priority,
-			actionType: input.actionType,
-			targetRefType: input.targetRefType,
-			targetRefId: input.targetRefId,
-			relatedAssignmentId: input.relatedAssignmentId,
-			since: input.since,
-			limit: input.limit,
-			cursor: input.cursor
-		};
-		if (isHitlSupervisor(actor.userRole)) return query;
-		return {
-			...query,
-			requestedByActorType: actor.actorType,
-			requestedByActorId: actor.actorId
-		};
-	}
-	async loadExisting(id) {
-		const request = await this.repository.findById(id);
-		if (!request) throw new Error(`HITL request not found: ${id}`);
-		return request;
-	}
-	assertReadable(request, actor) {
-		if (isHitlSupervisor(actor.userRole)) return;
-		if (request.requestedByActorType === actor.actorType && request.requestedByActorId === actor.actorId) return;
-		throw new Error("Insufficient permissions to read this HITL request.");
-	}
-	assertResolver(actor) {
-		if (isHitlSupervisor(actor.userRole)) return;
-		throw new Error("HITL requests may only be resolved by an editor or admin.");
-	}
-	assertRelatedAssignmentReadable(assignment, actor) {
-		if (isHitlSupervisor(actor.userRole)) return;
-		if (matchesActor(assignment.assignedByActorType, assignment.assignedByActorId, actor) || matchesActor(assignment.assignedToActorType, assignment.assignedToActorId, actor)) return;
-		throw new Error("Insufficient permissions to link this assignment to a HITL request.");
-	}
-	assertRelatedHandoffSnapshotReadable(snapshot, actor) {
-		if (isHitlSupervisor(actor.userRole)) return;
-		if (matchesActor(snapshot.actorType, snapshot.actorId, actor)) return;
-		throw new Error("Insufficient permissions to link this handoff snapshot to a HITL request.");
-	}
-	assertValidAction(action, status) {
-		const validFrom = HITL_REQUEST_VALID_FROM[action];
-		if (!validFrom.includes(status)) throw new Error(`Cannot ${action} a HITL request in status "${status}". Valid statuses: ${validFrom.join(", ")}.`);
-	}
-};
-function isHitlSupervisor(role) {
-	return role >= Role.EDITOR;
-}
-function matchesActor(actorType, actorId, actor) {
-	return actorType === actor.actorType && actorId === actor.actorId;
-}
-
 //#endregion
 //#region src/site-context/workflow-hitl.ts
 var WorkflowHitlCoordinator = class {
@@ -4143,4 +3950,4 @@ var WorkflowHitlCoordinator = class {
 };
 
 //#endregion
-export { HITL_REQUEST_STATUSES as C, ASSIGNMENT_STATUSES as E, HITL_REQUEST_PRIORITIES as S, ASSIGNMENT_PRIORITIES as T, RiskPolicyEvaluator as _, ActorExpertiseService as a, toPublicContextEntry as b, SectionHitlPayloadBuilder as c, RedirectHitlPayloadBuilder as d, SettingsHitlPayloadBuilder as f, SchemaHitlPayloadBuilder as g, PluginHitlPayloadBuilder as h, HandoffSnapshotStore as i, TaxonomyHitlPayloadBuilder as l, ExclusiveHookHitlPayloadBuilder as m, HitlRequestService as n, EntityResolver as o, WordPressImportHitlPayloadBuilder as p, AssignmentService as r, WidgetHitlPayloadBuilder as s, WorkflowHitlCoordinator as t, MenuHitlPayloadBuilder as u, ReviewPayloadBuilder as v, ASSIGNMENT_ACTOR_TYPES as w, toPublicContextEntryPage as x, toPublicContextDiff as y };
+export { ASSIGNMENT_STATUSES as C, ASSIGNMENT_PRIORITIES as S, toPublicContextDiff as _, EntityResolver as a, HitlRequestService as b, TaxonomyHitlPayloadBuilder as c, SettingsHitlPayloadBuilder as d, WordPressImportHitlPayloadBuilder as f, RiskPolicyEvaluator as g, SchemaHitlPayloadBuilder as h, ActorExpertiseService as i, MenuHitlPayloadBuilder as l, PluginHitlPayloadBuilder as m, AssignmentService as n, WidgetHitlPayloadBuilder as o, ExclusiveHookHitlPayloadBuilder as p, HandoffSnapshotStore as r, SectionHitlPayloadBuilder as s, WorkflowHitlCoordinator as t, RedirectHitlPayloadBuilder as u, toPublicContextEntry as v, AssignmentRepository as w, ASSIGNMENT_ACTOR_TYPES as x, toPublicContextEntryPage as y };