dineway 0.2.0 → 0.2.1

package/dist/publication-authorization-RKiHXKtq.mjs

@@ -0,0 +1,985 @@
+import { i as encodeCursor, r as decodeCursor } from "./types-ChxYDRvx.mjs";
+import { t as SiteActivityRepository } from "./site-activity-h8smOlYI.mjs";
+import { t as ReviewRequestRepository } from "./review-requests-CTWGnWUt.mjs";
+import { a as getSiteSettingsWithDb } from "./settings-BECcAIRH.mjs";
+import { n as buildStableActionHash, t as ReviewPayloadBuilder } from "./review-payload-BysRWpxS.mjs";
+import { t as SYSTEM_ACTOR_ID } from "./actor-0QJ1Gbtf.mjs";
+import { n as redactActivityRecord } from "./activity-DUaz_w7p.mjs";
+import { ulid } from "ulidx";
+
+//#region src/database/repositories/content-release-grants.ts
+var ContentReleaseGrantRepository = class {
+	constructor(db) {
+		this.db = db;
+	}
+	async createOrReplaceActive(input) {
+		return this.db.transaction().execute(async (transaction) => {
+			const existing = await findActiveForTarget(transaction, input.collection, input.entryId, input.operation);
+			if (existing?.actionHash === input.actionHash) return existing;
+			const now = input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+			if (existing) {
+				const revoked = await transaction.updateTable("_dineway_content_release_grants").set({
+					status: "revoked",
+					updated_at: now,
+					revoked_at: now,
+					revocation_reason: "replaced"
+				}).where("id", "=", existing.id).where("status", "=", "active").executeTakeFirst();
+				if (Number(revoked.numUpdatedRows ?? 0) !== 1) throw new Error("Active content release grant changed during replacement");
+			}
+			const id = ulid();
+			await transaction.insertInto("_dineway_content_release_grants").values(toInsertableGrant(id, input, now)).execute();
+			const created = await findById(transaction, id);
+			if (!created) throw new Error("Failed to create content release grant");
+			return created;
+		});
+	}
+	async findById(id) {
+		return findById(this.db, id);
+	}
+	async findActiveForTarget(collection, entryId, operation) {
+		return findActiveForTarget(this.db, collection, entryId, operation);
+	}
+	async list(query = {}) {
+		const limit = clampLimit$1(query.limit);
+		let statement = this.db.selectFrom("_dineway_content_release_grants").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
+		if (query.status) statement = statement.where("status", "=", query.status);
+		if (query.collection) statement = statement.where("collection", "=", query.collection);
+		if (query.entryId) statement = statement.where("entry_id", "=", query.entryId);
+		if (query.operation) statement = statement.where("operation", "=", query.operation);
+		if (query.cursor) {
+			const cursor = decodeCursor(query.cursor);
+			if (cursor) statement = statement.where((eb) => eb.or([eb("created_at", "<", cursor.orderValue), eb.and([eb("created_at", "=", cursor.orderValue), eb("id", "<", cursor.id)])]));
+		}
+		const rows = await statement.execute();
+		const items = rows.slice(0, limit).map(rowToGrant);
+		const result = { items };
+		if (rows.length > limit && items.length > 0) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.createdAt, last.id);
+		}
+		return result;
+	}
+	async findDueScheduled(now, limit = 50) {
+		return (await this.db.selectFrom("_dineway_content_release_grants").selectAll().where("status", "=", "active").where("operation", "=", "schedule").where("scheduled_at", "<=", now).where((eb) => eb.or([eb("expires_at", "is", null), eb("expires_at", ">", now)])).orderBy("scheduled_at", "asc").orderBy("id", "asc").limit(clampLimit$1(limit)).execute()).map(rowToGrant);
+	}
+	async consume(id, transitionedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+		return this.transition(id, "consumed", transitionedAt);
+	}
+	async revoke(id, reason, transitionedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+		return this.transition(id, "revoked", transitionedAt, reason);
+	}
+	async expire(id, transitionedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+		return this.transition(id, "expired", transitionedAt);
+	}
+	async transition(id, status, transitionedAt, revocationReason) {
+		const result = await this.db.updateTable("_dineway_content_release_grants").set({
+			status,
+			updated_at: transitionedAt,
+			consumed_at: status === "consumed" ? transitionedAt : null,
+			revoked_at: status === "revoked" ? transitionedAt : null,
+			revocation_reason: status === "revoked" ? revocationReason ?? "revoked" : null
+		}).where("id", "=", id).where("status", "=", "active").executeTakeFirst();
+		if (Number(result.numUpdatedRows ?? 0) === 1) return this.findById(id);
+		const existing = await this.findById(id);
+		return existing?.status === status ? existing : null;
+	}
+};
+async function findById(db, id) {
+	const row = await db.selectFrom("_dineway_content_release_grants").selectAll().where("id", "=", id).executeTakeFirst();
+	return row ? rowToGrant(row) : null;
+}
+async function findActiveForTarget(db, collection, entryId, operation) {
+	const row = await db.selectFrom("_dineway_content_release_grants").selectAll().where("collection", "=", collection).where("entry_id", "=", entryId).where("operation", "=", operation).where("status", "=", "active").executeTakeFirst();
+	return row ? rowToGrant(row) : null;
+}
+function toInsertableGrant(id, input, now) {
+	return {
+		id,
+		status: "active",
+		collection: input.collection,
+		entry_id: input.entryId,
+		scope: input.scope ?? `content:${input.collection}:${input.entryId}`,
+		live_revision_id: input.liveRevisionId,
+		draft_revision_id: input.draftRevisionId,
+		reviewed_rev: input.reviewedRev,
+		editorial_review_request_id: input.editorialReviewRequestId,
+		release_hitl_request_id: input.releaseHitlRequestId,
+		operation: input.operation,
+		scheduled_at: input.scheduledAt,
+		published_at: input.publishedAt,
+		site_timezone: input.siteTimezone,
+		action_hash: input.actionHash,
+		policy_contributions: JSON.stringify(input.policyContributions),
+		authorization_method: input.authorizationMethod,
+		authorized_by_actor_type: input.authorizedByActorType,
+		authorized_by_actor_id: input.authorizedByActorId,
+		authorized_auth_metadata: jsonOrNull(input.authorizedAuthMetadata),
+		expires_at: input.expiresAt ?? null,
+		created_at: now,
+		updated_at: now,
+		consumed_at: null,
+		revoked_at: null,
+		revocation_reason: null
+	};
+}
+function rowToGrant(row) {
+	return {
+		id: row.id,
+		status: row.status,
+		collection: row.collection,
+		entryId: row.entry_id,
+		scope: row.scope,
+		liveRevisionId: row.live_revision_id,
+		draftRevisionId: row.draft_revision_id,
+		reviewedRev: row.reviewed_rev,
+		editorialReviewRequestId: row.editorial_review_request_id,
+		releaseHitlRequestId: row.release_hitl_request_id,
+		operation: row.operation,
+		scheduledAt: row.scheduled_at,
+		publishedAt: row.published_at,
+		siteTimezone: row.site_timezone,
+		actionHash: row.action_hash,
+		policyContributions: parsePolicyContributions(row.policy_contributions),
+		authorizationMethod: row.authorization_method,
+		authorizedByActorType: row.authorized_by_actor_type,
+		authorizedByActorId: row.authorized_by_actor_id,
+		authorizedAuthMetadata: parseNullableRecord$1(row.authorized_auth_metadata),
+		expiresAt: row.expires_at,
+		createdAt: row.created_at,
+		updatedAt: row.updated_at,
+		consumedAt: row.consumed_at,
+		revokedAt: row.revoked_at,
+		revocationReason: row.revocation_reason
+	};
+}
+function parsePolicyContributions(value) {
+	try {
+		const parsed = JSON.parse(value);
+		if (!Array.isArray(parsed)) return [];
+		return parsed.filter(isPolicyContribution);
+	} catch {
+		return [];
+	}
+}
+function isPolicyContribution(value) {
+	if (!isRecord$2(value)) return false;
+	return typeof value.providerId === "string" && typeof value.policyVersion === "string" && typeof value.fingerprint === "string" && (value.reservationId === null || typeof value.reservationId === "string");
+}
+function parseNullableRecord$1(value) {
+	if (!value) return null;
+	try {
+		const parsed = JSON.parse(value);
+		return isRecord$2(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function jsonOrNull(value) {
+	return value ? JSON.stringify(value) : null;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function clampLimit$1(limit) {
+	if (!Number.isFinite(limit)) return 50;
+	return Math.max(1, Math.min(100, Math.floor(limit ?? 50)));
+}
+
+//#endregion
+//#region src/database/repositories/hitl-requests.ts
+const HITL_REQUEST_STATUSES = [
+	"pending",
+	"approved",
+	"rejected"
+];
+const HITL_REQUEST_PRIORITIES = [
+	"low",
+	"normal",
+	"high",
+	"urgent"
+];
+var HitlRequestRepository = class {
+	constructor(db) {
+		this.db = db;
+	}
+	async create(input) {
+		const id = ulid();
+		const now = input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+		await this.db.insertInto("_dineway_hitl_requests").values(toInsertableHitlRequest(id, input, now)).execute();
+		const request = await this.findById(id);
+		if (!request) throw new Error("Failed to create HITL request");
+		return request;
+	}
+	async findById(id) {
+		const row = await this.db.selectFrom("_dineway_hitl_requests").selectAll().where("id", "=", id).executeTakeFirst();
+		return row ? rowToHitlRequest(row) : null;
+	}
+	async list(query = {}) {
+		const limit = clampLimit(query.limit);
+		const rows = await this.queryRows(query).execute();
+		const items = rows.slice(0, limit).map(rowToHitlRequest);
+		const result = { items };
+		if (rows.length > limit && items.length > 0) {
+			const last = items.at(-1);
+			result.nextCursor = encodeCursor(last.createdAt, last.id);
+		}
+		return result;
+	}
+	async resolve(id, input) {
+		const resolvedAt = input.resolvedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+		const result = await this.db.updateTable("_dineway_hitl_requests").set({
+			status: input.decision,
+			resolved_by_actor_type: input.resolvedByActorType,
+			resolved_by_actor_id: input.resolvedByActorId,
+			resolved_auth_metadata: jsonStringOrNull(input.resolvedAuthMetadata),
+			review_note: input.reviewNote ?? null,
+			resolved_at: resolvedAt,
+			updated_at: resolvedAt
+		}).where("id", "=", id).where("status", "=", "pending").executeTakeFirst();
+		if (Number(result.numUpdatedRows ?? 0) === 0) return null;
+		return this.findById(id);
+	}
+	queryRows(query) {
+		const limit = clampLimit(query.limit);
+		let q = this.db.selectFrom("_dineway_hitl_requests").selectAll().orderBy("created_at", "desc").orderBy("id", "desc").limit(limit + 1);
+		if (query.scope) q = q.where("scope", "=", query.scope);
+		if (query.scopes && query.scopes.length > 0) q = q.where("scope", "in", query.scopes);
+		if (query.statuses && query.statuses.length > 0) q = q.where("status", "in", query.statuses);
+		if (query.priority) q = q.where("priority", "=", query.priority);
+		if (query.actionType) q = q.where("action_type", "=", query.actionType);
+		if (query.targetRefType) q = q.where("target_ref_type", "=", query.targetRefType);
+		if (query.targetRefId) q = q.where("target_ref_id", "=", query.targetRefId);
+		if (query.relatedAssignmentId) q = q.where("related_assignment_id", "=", query.relatedAssignmentId);
+		if (query.requestedByActorType && query.requestedByActorId) q = q.where("requested_by_actor_type", "=", query.requestedByActorType).where("requested_by_actor_id", "=", query.requestedByActorId);
+		if (query.participantActor) q = q.where("requested_by_actor_type", "=", query.participantActor.actorType).where("requested_by_actor_id", "=", query.participantActor.actorId);
+		if (query.since) q = q.where("updated_at", ">=", query.since);
+		if (query.cursor) {
+			const decoded = decodeCursor(query.cursor);
+			if (decoded) q = q.where((eb) => eb.or([eb("created_at", "<", decoded.orderValue), eb.and([eb("created_at", "=", decoded.orderValue), eb("id", "<", decoded.id)])]));
+		}
+		return q;
+	}
+};
+function toInsertableHitlRequest(id, input, now) {
+	return {
+		id,
+		scope: input.scope,
+		action_type: input.actionType,
+		status: "pending",
+		priority: input.priority ?? "normal",
+		title: input.title,
+		summary: input.summary ?? null,
+		risk_reason: input.riskReason,
+		review_payload: JSON.stringify(input.reviewPayload),
+		target_ref_type: input.targetRefType,
+		target_ref_id: input.targetRefId,
+		requested_by_actor_type: input.requestedByActorType,
+		requested_by_actor_id: input.requestedByActorId,
+		requested_auth_metadata: jsonStringOrNull(input.requestedAuthMetadata),
+		resolved_by_actor_type: null,
+		resolved_by_actor_id: null,
+		resolved_auth_metadata: null,
+		review_note: null,
+		metadata: jsonString(input.metadata),
+		related_assignment_id: input.relatedAssignmentId ?? null,
+		related_handoff_snapshot_id: input.relatedHandoffSnapshotId ?? null,
+		sla_due_at: input.slaDueAt ?? null,
+		created_at: now,
+		updated_at: now,
+		resolved_at: null
+	};
+}
+function rowToHitlRequest(row) {
+	return {
+		id: row.id,
+		scope: row.scope,
+		actionType: row.action_type,
+		status: row.status,
+		priority: row.priority,
+		title: row.title,
+		summary: row.summary,
+		riskReason: row.risk_reason,
+		reviewPayload: parseRecord(row.review_payload),
+		targetRefType: row.target_ref_type,
+		targetRefId: row.target_ref_id,
+		requestedByActorType: row.requested_by_actor_type,
+		requestedByActorId: row.requested_by_actor_id,
+		requestedAuthMetadata: parseNullableRecord(row.requested_auth_metadata),
+		resolvedByActorType: row.resolved_by_actor_type,
+		resolvedByActorId: row.resolved_by_actor_id,
+		resolvedAuthMetadata: parseNullableRecord(row.resolved_auth_metadata),
+		reviewNote: row.review_note,
+		metadata: parseRecord(row.metadata),
+		relatedAssignmentId: row.related_assignment_id,
+		relatedHandoffSnapshotId: row.related_handoff_snapshot_id,
+		slaDueAt: row.sla_due_at,
+		createdAt: row.created_at,
+		updatedAt: row.updated_at,
+		resolvedAt: row.resolved_at
+	};
+}
+function jsonString(value) {
+	return JSON.stringify(value ?? {});
+}
+function jsonStringOrNull(value) {
+	return value ? JSON.stringify(value) : null;
+}
+function parseRecord(value) {
+	if (!value) return {};
+	try {
+		const parsed = JSON.parse(value);
+		return isRecord$1(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+function parseNullableRecord(value) {
+	if (!value) return null;
+	return parseRecord(value);
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function clampLimit(limit) {
+	if (!limit || limit < 1) return 50;
+	return Math.min(limit, 100);
+}
+
+//#endregion
+//#region src/site-context/release-payload.ts
+async function buildContentReleaseActionHash(input) {
+	return buildStableActionHash({
+		actionType: input.actionType,
+		collection: input.collection,
+		entryId: input.entryId,
+		liveRevisionId: input.liveRevisionId,
+		draftRevisionId: input.draftRevisionId,
+		reviewedRev: input.reviewedRev,
+		editorialReviewRequestId: input.editorialReviewRequestId,
+		editorialActionHash: input.editorialActionHash,
+		operation: input.operation,
+		publishedAt: normalizeOptionalTimestamp(input.publishedAt),
+		scheduledAt: normalizeOptionalTimestamp(input.scheduledAt),
+		siteTimezone: input.siteTimezone,
+		policyContributions: normalizePolicyContributions(input.policyContributions)
+	});
+}
+var ReleasePayloadBuilder = class {
+	reviewPayloadBuilder;
+	constructor(options) {
+		this.options = options;
+		this.reviewPayloadBuilder = new ReviewPayloadBuilder(options.handlers);
+	}
+	async buildContentReleasePayload(input) {
+		assertReleaseInput(input);
+		const editorial = await this.reviewPayloadBuilder.buildContentReviewPayload({
+			collection: input.collection,
+			id: input.id
+		});
+		const review = await this.loadApprovedReview(input.editorialReviewRequestId);
+		if (!reviewMatchesEditorialTarget(review, editorial)) throw new Error("Editorial review does not match the current draft");
+		const actionType = input.operation === "publish" ? "content.release.publish" : "content.release.schedule";
+		const publishedAt = normalizeOptionalTimestamp(input.publishedAt);
+		const scheduledAt = normalizeOptionalTimestamp(input.scheduledAt);
+		const policyContributions = normalizePolicyContributions(input.policyContributions ?? []);
+		const actionFingerprint = {
+			actionType,
+			collection: editorial.collection,
+			entryId: editorial.entryId,
+			liveRevisionId: editorial.liveRevisionId,
+			draftRevisionId: editorial.draftRevisionId,
+			reviewedRev: editorial.reviewedRev,
+			editorialReviewRequestId: review.id,
+			editorialActionHash: editorial.actionHash,
+			operation: input.operation,
+			publishedAt,
+			scheduledAt,
+			siteTimezone: input.siteTimezone,
+			policyContributions
+		};
+		const actionHash = await buildContentReleaseActionHash(actionFingerprint);
+		return {
+			collection: editorial.collection,
+			entryId: editorial.entryId,
+			scope: editorial.scope,
+			liveRevisionId: editorial.liveRevisionId,
+			draftRevisionId: editorial.draftRevisionId,
+			reviewedRev: editorial.reviewedRev,
+			actionType,
+			operation: input.operation,
+			editorialReviewRequestId: review.id,
+			editorialActionHash: editorial.actionHash,
+			publishedAt,
+			scheduledAt,
+			siteTimezone: input.siteTimezone,
+			policyContributions,
+			actionHash,
+			releasePayload: {
+				kind: "content_release",
+				actionType,
+				target: {
+					...actionFingerprint,
+					scope: editorial.scope,
+					actionHash
+				},
+				editorialReview: {
+					requestId: review.id,
+					resolvedByActorType: review.resolvedByActorType,
+					resolvedByActorId: review.resolvedByActorId,
+					resolvedAt: review.resolvedAt
+				}
+			}
+		};
+	}
+	async loadApprovedReview(id) {
+		const review = await this.options.reviewRequests.findById(id);
+		if (!review) throw new Error("Editorial review request not found");
+		if (review.status !== "approved") throw new Error("Editorial review is not approved");
+		return review;
+	}
+};
+function assertReleaseInput(input) {
+	if (input.siteTimezone.trim().length === 0) throw new Error("Site timezone is required");
+	if (input.operation === "schedule" && !normalizeOptionalTimestamp(input.scheduledAt)) throw new Error("Scheduled time is required for a schedule release");
+	if (input.operation === "publish" && normalizeOptionalTimestamp(input.scheduledAt)) throw new Error("Scheduled time is only valid for a schedule release");
+	if (input.operation === "schedule" && normalizeOptionalTimestamp(input.publishedAt)) throw new Error("Published time is only valid for an immediate publish release");
+}
+function reviewMatchesEditorialTarget(review, editorial) {
+	return review.collection === editorial.collection && review.entryId === editorial.entryId && review.scope === editorial.scope && review.liveRevisionId === editorial.liveRevisionId && review.draftRevisionId === editorial.draftRevisionId && review.reviewedRev === editorial.reviewedRev && review.actionType === editorial.actionType && review.actionHash === editorial.actionHash;
+}
+function normalizePolicyContributions(contributions) {
+	const normalized = contributions.map((contribution) => {
+		assertNonEmpty("Policy provider ID", contribution.providerId);
+		assertNonEmpty("Policy version", contribution.policyVersion);
+		assertNonEmpty("Policy fingerprint", contribution.fingerprint);
+		return {
+			providerId: contribution.providerId,
+			policyVersion: contribution.policyVersion,
+			fingerprint: contribution.fingerprint,
+			reservationId: normalizeOptionalString(contribution.reservationId)
+		};
+	});
+	const providerIds = /* @__PURE__ */ new Set();
+	for (const contribution of normalized) {
+		if (providerIds.has(contribution.providerId)) throw new Error(`Duplicate publication release policy provider: ${contribution.providerId}`);
+		providerIds.add(contribution.providerId);
+	}
+	return normalized.toSorted((left, right) => left.providerId.localeCompare(right.providerId));
+}
+function normalizeOptionalTimestamp(value) {
+	return normalizeOptionalString(value);
+}
+function normalizeOptionalString(value) {
+	return value && value.length > 0 ? value : null;
+}
+function assertNonEmpty(label, value) {
+	if (value.length === 0) throw new Error(`${label} is required`);
+}
+
+//#endregion
+//#region src/site-context/publication-authorization.ts
+var PublicationAuthorizationError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "PublicationAuthorizationError";
+	}
+};
+var PublicationAuthorizationService = class {
+	reviewRequests;
+	releaseGrants;
+	hitlRequests;
+	activity;
+	releasePayloadBuilder;
+	policies;
+	getSiteTimezone;
+	now;
+	constructor(options) {
+		this.options = options;
+		this.reviewRequests = new ReviewRequestRepository(options.db);
+		this.releaseGrants = new ContentReleaseGrantRepository(options.db);
+		this.hitlRequests = new HitlRequestRepository(options.db);
+		this.activity = new SiteActivityRepository(options.db);
+		this.releasePayloadBuilder = new ReleasePayloadBuilder({
+			handlers: options.handlers,
+			reviewRequests: this.reviewRequests
+		});
+		this.policies = [...options.policies ?? []].toSorted((left, right) => left.id.localeCompare(right.id));
+		this.assertUniquePolicyIds();
+		this.getSiteTimezone = options.getSiteTimezone ?? (async () => {
+			return (await getSiteSettingsWithDb(options.db)).timezone?.trim() || "UTC";
+		});
+		this.now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+	}
+	async publishAuthorizedContent(input) {
+		const siteTimezone = await this.getSiteTimezone();
+		const authorized = await this.authorize({
+			...input,
+			operation: "publish",
+			siteTimezone
+		});
+		const result = await this.options.handlers.handleContentPublish(input.collection, input.id, { publishedAt: input.publishedAt });
+		if (!result.success) await this.failAuthorizedRelease(authorized, "content_publish_failed", result.error?.code);
+		const consumed = await this.releaseGrants.consume(authorized.grant.id, this.now());
+		if (!consumed) {
+			await this.releasePolicies(authorized.preparedPolicies, "release_grant_transition_failed");
+			throw new PublicationAuthorizationError("RELEASE_GRANT_TRANSITION_FAILED", "Content published but its release grant could not be consumed");
+		}
+		await this.consumePolicies(authorized.preparedPolicies);
+		await this.logSuccess(input, authorized.release, consumed);
+		return {
+			grant: consumed,
+			result
+		};
+	}
+	async scheduleAuthorizedContent(input) {
+		const siteTimezone = await this.getSiteTimezone();
+		const authorized = await this.authorize({
+			...input,
+			operation: "schedule",
+			siteTimezone
+		});
+		const result = await this.options.handlers.handleContentSchedule(input.collection, input.id, input.scheduledAt);
+		if (!result.success) await this.failAuthorizedRelease(authorized, "content_schedule_failed", result.error?.code);
+		await this.logSuccess(input, authorized.release, authorized.grant);
+		return {
+			grant: authorized.grant,
+			result
+		};
+	}
+	async publishAuthorizedDueContent(input) {
+		const grant = await this.releaseGrants.findActiveForTarget(input.collection, input.id, "schedule");
+		if (!grant) {
+			await this.blockScheduledRelease(input, null, "schedule_grant_required");
+			throw new PublicationAuthorizationError("SCHEDULE_GRANT_REQUIRED", "Due content has no active Schedule grant");
+		}
+		const preparedPolicies = this.restorePreparedPolicies(grant.policyContributions);
+		let release;
+		try {
+			release = await this.revalidateScheduledGrant(input, grant, preparedPolicies);
+		} catch (error) {
+			const reason = errorReason(error);
+			await this.releasePolicies(preparedPolicies, reason);
+			if (error instanceof PublicationAuthorizationError && error.code === "SCHEDULE_GRANT_EXPIRED") await this.releaseGrants.expire(grant.id, this.now());
+			else await this.releaseGrants.revoke(grant.id, reason, this.now());
+			await this.blockScheduledRelease(input, grant, reason);
+			throw error;
+		}
+		const result = await this.options.handlers.handleContentPublish(input.collection, input.id, {
+			publishedAt: input.publishedAt,
+			requireScheduledDue: true
+		});
+		if (!result.success) throw new PublicationAuthorizationError(result.error?.code ?? "RELEASE_GRANT_FAILED", "Authorized scheduled publication failed and remains eligible for retry");
+		const consumed = await this.releaseGrants.consume(grant.id, this.now());
+		if (!consumed) throw new PublicationAuthorizationError("RELEASE_GRANT_TRANSITION_FAILED", "Scheduled content published but its release grant could not be consumed");
+		await this.consumePolicies(preparedPolicies);
+		await this.logScheduledPublish(release, consumed);
+		return {
+			grant: consumed,
+			result
+		};
+	}
+	async unscheduleAuthorizedContent(input) {
+		const activeGrant = await this.releaseGrants.findActiveForTarget(input.collection, input.id, "schedule");
+		let revokedGrant = null;
+		if (activeGrant) {
+			await this.releasePolicies(this.restorePreparedPolicies(activeGrant.policyContributions), "content_unscheduled");
+			revokedGrant = await this.releaseGrants.revoke(activeGrant.id, "content_unscheduled", this.now());
+			if (!revokedGrant) throw new PublicationAuthorizationError("RELEASE_GRANT_TRANSITION_FAILED", "Content schedule grant could not be revoked");
+		}
+		const result = await this.options.handlers.handleContentUnschedule(input.collection, input.id);
+		if (!result.success) throw new PublicationAuthorizationError(result.error?.code ?? "CONTENT_UNSCHEDULE_ERROR", "Authorized content unschedule failed");
+		await this.logUnschedule(input, revokedGrant);
+		return {
+			grant: revokedGrant,
+			result
+		};
+	}
+	async authorize(input) {
+		if (input.actor.actorType === "system") throw new PublicationAuthorizationError("ACTOR_NOT_ALLOWED", "System actors must use the scheduled publication boundary");
+		let preparedPolicies = [];
+		try {
+			const activeGrant = await this.releaseGrants.findActiveForTarget(input.collection, input.id, input.operation);
+			const baseRelease = await this.buildRelease(input, []);
+			preparedPolicies = await this.preparePolicies(toPreparationTarget(baseRelease, activeGrant?.policyContributions ?? []));
+			const release = await this.buildRelease(input, preparedPolicies.map((prepared) => prepared.contribution));
+			await this.validatePolicies(release, preparedPolicies);
+			const tokenActor = isTokenAuthenticatedActor(input.actor);
+			const hitl = tokenActor ? await this.requireApprovedReleaseHitl(input, release) : null;
+			const grant = await this.releaseGrants.createOrReplaceActive({
+				collection: release.collection,
+				entryId: release.entryId,
+				scope: release.scope,
+				liveRevisionId: release.liveRevisionId,
+				draftRevisionId: release.draftRevisionId,
+				reviewedRev: release.reviewedRev,
+				editorialReviewRequestId: release.editorialReviewRequestId,
+				releaseHitlRequestId: hitl?.id ?? null,
+				operation: release.operation,
+				scheduledAt: release.scheduledAt,
+				publishedAt: release.publishedAt,
+				siteTimezone: release.siteTimezone,
+				actionHash: release.actionHash,
+				policyContributions: toStoredPolicyContributions(release.policyContributions),
+				authorizationMethod: tokenActor ? "approved_hitl" : "human_action",
+				authorizedByActorType: input.actor.actorType,
+				authorizedByActorId: input.actor.actorId,
+				authorizedAuthMetadata: redactActivityRecord(input.actor.authMetadata),
+				createdAt: this.now()
+			});
+			if (activeGrant && activeGrant.id !== grant.id) await this.releaseReplacedPolicies(activeGrant.policyContributions, preparedPolicies);
+			return {
+				release,
+				grant,
+				preparedPolicies
+			};
+		} catch (error) {
+			await this.releasePolicies(preparedPolicies, errorReason(error));
+			if (error instanceof PublicationAuthorizationError) throw error;
+			throw new PublicationAuthorizationError("RELEASE_GRANT_FAILED", error instanceof Error ? error.message : "Failed to authorize content release");
+		}
+	}
+	async revalidateScheduledGrant(input, grant, preparedPolicies) {
+		const now = this.now();
+		if (grant.expiresAt && grant.expiresAt <= now) throw new PublicationAuthorizationError("SCHEDULE_GRANT_EXPIRED", "Schedule grant expired before execution");
+		if (grant.scheduledAt !== input.scheduledAt) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "Schedule grant time does not match the due content");
+		const review = await this.reviewRequests.findById(grant.editorialReviewRequestId);
+		if (!review || !reviewMatchesGrant(review, grant)) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "Schedule grant editorial approval is no longer valid");
+		const content = extractContentState(await this.options.handlers.handleContentGet(input.collection, input.id));
+		if (!content || content.id !== grant.entryId || content.liveRevisionId !== grant.liveRevisionId || content.draftRevisionId !== grant.draftRevisionId || content.scheduledAt !== grant.scheduledAt) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "Scheduled content no longer matches its authorized release");
+		if (((await this.getSiteTimezone()).trim() || "UTC") !== grant.siteTimezone) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "Site timezone changed after the release was authorized");
+		if (preparedPolicies.length !== grant.policyContributions.length) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "A release policy required by the Schedule grant is unavailable");
+		const actionType = "content.release.schedule";
+		const actionHash = await buildContentReleaseActionHash({
+			actionType,
+			collection: grant.collection,
+			entryId: grant.entryId,
+			liveRevisionId: grant.liveRevisionId,
+			draftRevisionId: grant.draftRevisionId,
+			reviewedRev: grant.reviewedRev,
+			editorialReviewRequestId: grant.editorialReviewRequestId,
+			editorialActionHash: review.actionHash,
+			operation: "schedule",
+			publishedAt: grant.publishedAt,
+			scheduledAt: grant.scheduledAt,
+			siteTimezone: grant.siteTimezone,
+			policyContributions: grant.policyContributions
+		});
+		const release = {
+			collection: grant.collection,
+			entryId: grant.entryId,
+			scope: grant.scope,
+			liveRevisionId: grant.liveRevisionId,
+			draftRevisionId: grant.draftRevisionId,
+			reviewedRev: grant.reviewedRev,
+			actionType,
+			operation: "schedule",
+			editorialReviewRequestId: grant.editorialReviewRequestId,
+			editorialActionHash: review.actionHash,
+			publishedAt: grant.publishedAt,
+			scheduledAt: grant.scheduledAt,
+			siteTimezone: grant.siteTimezone,
+			policyContributions: grant.policyContributions,
+			actionHash,
+			releasePayload: {
+				kind: "content_release",
+				actionType,
+				target: {
+					actionType,
+					collection: grant.collection,
+					entryId: grant.entryId,
+					liveRevisionId: grant.liveRevisionId,
+					draftRevisionId: grant.draftRevisionId,
+					reviewedRev: grant.reviewedRev,
+					editorialReviewRequestId: grant.editorialReviewRequestId,
+					editorialActionHash: review.actionHash,
+					operation: "schedule",
+					publishedAt: grant.publishedAt,
+					scheduledAt: grant.scheduledAt,
+					siteTimezone: grant.siteTimezone,
+					policyContributions: grant.policyContributions,
+					scope: grant.scope,
+					actionHash
+				},
+				editorialReview: {
+					requestId: review.id,
+					resolvedByActorType: review.resolvedByActorType,
+					resolvedByActorId: review.resolvedByActorId,
+					resolvedAt: review.resolvedAt
+				}
+			}
+		};
+		if (actionHash !== grant.actionHash) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "Schedule grant fingerprint no longer matches");
+		if (grant.authorizationMethod === "approved_hitl") {
+			const request = grant.releaseHitlRequestId ? await this.hitlRequests.findById(grant.releaseHitlRequestId) : null;
+			if (!request || !matchesReleaseHitl(request, release, grantActor(grant))) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "Schedule grant release approval is no longer valid");
+		}
+		await this.validatePolicies(release, preparedPolicies);
+		return release;
+	}
+	async buildRelease(input, policyContributions) {
+		try {
+			return await this.releasePayloadBuilder.buildContentReleasePayload({
+				collection: input.collection,
+				id: input.id,
+				operation: input.operation,
+				editorialReviewRequestId: input.editorialReviewRequestId,
+				publishedAt: input.publishedAt,
+				scheduledAt: input.scheduledAt,
+				siteTimezone: input.siteTimezone,
+				policyContributions
+			});
+		} catch (error) {
+			throw new PublicationAuthorizationError("EDITORIAL_REVIEW_INVALID", error instanceof Error ? error.message : "Editorial review is invalid");
+		}
+	}
+	async requireApprovedReleaseHitl(input, release) {
+		if (!input.releaseHitlRequestId) throw new PublicationAuthorizationError("RELEASE_HITL_REQUIRED", "Token-authenticated publication requires an approved release HITL request");
+		const request = await this.hitlRequests.findById(input.releaseHitlRequestId);
+		if (!request || !matchesReleaseHitl(request, release, input.actor)) throw new PublicationAuthorizationError("RELEASE_HITL_INVALID", "Release HITL request is not approved for the current operation");
+		return request;
+	}
+	async preparePolicies(target) {
+		const prepared = [];
+		try {
+			for (const policy of this.policies) {
+				const contribution = await policy.prepare(target);
+				if (contribution.providerId !== policy.id) throw new Error(`Publication policy ${policy.id} returned another provider ID`);
+				prepared.push({
+					policy,
+					contribution
+				});
+			}
+			return prepared;
+		} catch (error) {
+			await this.releasePolicies(prepared, "release_policy_prepare_failed");
+			throw new PublicationAuthorizationError("RELEASE_POLICY_FAILED", error instanceof Error ? error.message : "Publication release policy failed");
+		}
+	}
+	async validatePolicies(release, preparedPolicies) {
+		try {
+			for (const prepared of preparedPolicies) await prepared.policy.validate(release, prepared.contribution);
+		} catch (error) {
+			throw new PublicationAuthorizationError("RELEASE_POLICY_FAILED", error instanceof Error ? error.message : "Publication release policy rejected release");
+		}
+	}
+	async failAuthorizedRelease(authorized, reason, handlerErrorCode) {
+		await this.releaseGrants.revoke(authorized.grant.id, reason, this.now());
+		await this.releasePolicies(authorized.preparedPolicies, reason);
+		throw new PublicationAuthorizationError(handlerErrorCode ?? "RELEASE_GRANT_FAILED", `Authorized content ${authorized.release.operation} failed`);
+	}
+	async consumePolicies(preparedPolicies) {
+		for (const prepared of preparedPolicies) await prepared.policy.consume?.(prepared.contribution);
+	}
+	async releasePolicies(preparedPolicies, reason) {
+		for (const prepared of preparedPolicies.toReversed()) await prepared.policy.release?.(prepared.contribution, reason);
+	}
+	async releaseReplacedPolicies(contributions, currentPolicies) {
+		const currentByProvider = new Map(currentPolicies.map((prepared) => [prepared.contribution.providerId, prepared.contribution]));
+		const replaced = this.restorePreparedPolicies(contributions).filter((prepared) => {
+			const current = currentByProvider.get(prepared.contribution.providerId);
+			return !current || current.reservationId !== prepared.contribution.reservationId || current.fingerprint !== prepared.contribution.fingerprint;
+		});
+		try {
+			await this.releasePolicies(replaced, "release_grant_replaced");
+		} catch (error) {
+			console.error("[publication-authorization] Failed to release replaced policy state:", error);
+		}
+	}
+	restorePreparedPolicies(contributions) {
+		const policiesById = new Map(this.policies.map((policy) => [policy.id, policy]));
+		return contributions.flatMap((contribution) => {
+			const policy = policiesById.get(contribution.providerId);
+			return policy ? [{
+				policy,
+				contribution: {
+					providerId: contribution.providerId,
+					policyVersion: contribution.policyVersion,
+					fingerprint: contribution.fingerprint,
+					...contribution.reservationId ? { reservationId: contribution.reservationId } : {}
+				}
+			}] : [];
+		});
+	}
+	async logSuccess(input, release, grant) {
+		await this.activity.create({
+			actorType: input.actor.actorType,
+			actorId: input.actor.actorId,
+			authMetadata: redactActivityRecord(input.actor.authMetadata),
+			actionType: release.actionType,
+			subjectType: "content",
+			subjectId: release.entryId,
+			relatedSubjectType: "review_request",
+			relatedSubjectId: release.editorialReviewRequestId,
+			sourceType: input.sourceType ?? "unknown",
+			sourceName: input.sourceName ?? null,
+			resultStatus: "succeeded",
+			scope: release.scope,
+			summary: `${release.operation === "publish" ? "Published" : "Scheduled"} ${release.collection}/${release.entryId}`,
+			detail: {
+				editorialReviewRequestId: release.editorialReviewRequestId,
+				releaseHitlRequestId: grant.releaseHitlRequestId,
+				releaseGrantId: grant.id,
+				actionHash: release.actionHash,
+				scheduledAt: release.scheduledAt,
+				publishedAt: release.publishedAt
+			},
+			createdAt: this.now()
+		});
+	}
+	async logUnschedule(input, grant) {
+		await this.activity.create({
+			actorType: input.actor.actorType,
+			actorId: input.actor.actorId,
+			authMetadata: redactActivityRecord(input.actor.authMetadata),
+			actionType: "content.unscheduled",
+			subjectType: "content",
+			subjectId: input.id,
+			sourceType: input.sourceType ?? "unknown",
+			sourceName: input.sourceName ?? null,
+			resultStatus: "succeeded",
+			scope: `content:${input.collection}:${input.id}`,
+			summary: `Unscheduled ${input.collection}/${input.id}`,
+			detail: {
+				releaseGrantId: grant?.id ?? null,
+				revocationReason: grant?.revocationReason ?? null
+			},
+			createdAt: this.now()
+		});
+	}
+	async blockScheduledRelease(input, grant, reason) {
+		const result = await this.options.handlers.handleContentUnschedule(input.collection, input.id);
+		await this.activity.create({
+			actorType: "system",
+			actorId: SYSTEM_ACTOR_ID,
+			authMetadata: { auth_method: "system" },
+			actionType: "content.schedule_blocked",
+			subjectType: "content",
+			subjectId: input.id,
+			relatedSubjectType: grant ? "review_request" : null,
+			relatedSubjectId: grant?.editorialReviewRequestId ?? null,
+			sourceType: "system",
+			sourceName: "scheduled_publish",
+			resultStatus: "blocked",
+			scope: `content:${input.collection}:${input.id}`,
+			summary: `Blocked scheduled publication for ${input.collection}/${input.id}`,
+			detail: {
+				reason,
+				releaseGrantId: grant?.id ?? null,
+				unscheduled: result.success
+			},
+			createdAt: this.now()
+		});
+		if (!result.success) throw new PublicationAuthorizationError(result.error?.code ?? "CONTENT_UNSCHEDULE_ERROR", "Blocked scheduled content could not be unscheduled");
+	}
+	async logScheduledPublish(release, grant) {
+		await this.activity.create({
+			actorType: "system",
+			actorId: SYSTEM_ACTOR_ID,
+			authMetadata: { auth_method: "system" },
+			actionType: "content.release.publish",
+			subjectType: "content",
+			subjectId: release.entryId,
+			relatedSubjectType: "review_request",
+			relatedSubjectId: release.editorialReviewRequestId,
+			sourceType: "system",
+			sourceName: "scheduled_publish",
+			resultStatus: "succeeded",
+			scope: release.scope,
+			summary: `Published scheduled content ${release.collection}/${release.entryId}`,
+			detail: {
+				editorialReviewRequestId: release.editorialReviewRequestId,
+				releaseHitlRequestId: grant.releaseHitlRequestId,
+				releaseGrantId: grant.id,
+				actionHash: release.actionHash,
+				scheduledAt: release.scheduledAt,
+				authorizedByActorType: grant.authorizedByActorType,
+				authorizedByActorId: grant.authorizedByActorId,
+				authorizedAuthMetadata: grant.authorizedAuthMetadata
+			},
+			createdAt: this.now()
+		});
+	}
+	assertUniquePolicyIds() {
+		const ids = /* @__PURE__ */ new Set();
+		for (const policy of this.policies) {
+			if (ids.has(policy.id)) throw new Error(`Duplicate publication release policy: ${policy.id}`);
+			ids.add(policy.id);
+		}
+	}
+};
+function toPreparationTarget(release, replacedPolicyContributions) {
+	return {
+		collection: release.collection,
+		entryId: release.entryId,
+		scope: release.scope,
+		operation: release.operation,
+		liveRevisionId: release.liveRevisionId,
+		draftRevisionId: release.draftRevisionId,
+		reviewedRev: release.reviewedRev,
+		editorialReviewRequestId: release.editorialReviewRequestId,
+		editorialActionHash: release.editorialActionHash,
+		publishedAt: release.publishedAt,
+		scheduledAt: release.scheduledAt,
+		siteTimezone: release.siteTimezone,
+		replacedPolicyContributions: replacedPolicyContributions.map((contribution) => ({
+			providerId: contribution.providerId,
+			policyVersion: contribution.policyVersion,
+			fingerprint: contribution.fingerprint,
+			...contribution.reservationId ? { reservationId: contribution.reservationId } : {}
+		}))
+	};
+}
+function toStoredPolicyContributions(contributions) {
+	return contributions.map((contribution) => ({ ...contribution }));
+}
+function matchesReleaseHitl(request, release, actor) {
+	return request.status === "approved" && request.scope === release.scope && request.actionType === release.actionType && request.targetRefType === "content" && request.targetRefId === release.entryId && request.requestedByActorType === actor.actorType && request.requestedByActorId === actor.actorId && extractActionHash(request.metadata) === release.actionHash;
+}
+function reviewMatchesGrant(review, grant) {
+	return review.status === "approved" && review.collection === grant.collection && review.entryId === grant.entryId && review.scope === grant.scope && review.liveRevisionId === grant.liveRevisionId && review.draftRevisionId === grant.draftRevisionId && review.reviewedRev === grant.reviewedRev && review.actionType === "content.publish";
+}
+function grantActor(grant) {
+	return {
+		actorType: grant.authorizedByActorType,
+		actorId: grant.authorizedByActorId,
+		authMetadata: grant.authorizedAuthMetadata ?? {}
+	};
+}
+function extractContentState(result) {
+	if (!result.success) return null;
+	const item = asRecord(asRecord(result.data)?.item ?? result.data);
+	const id = stringOrNull(item?.id);
+	if (!item || !id) return null;
+	return {
+		id,
+		liveRevisionId: stringOrNull(item.liveRevisionId),
+		draftRevisionId: stringOrNull(item.draftRevisionId),
+		scheduledAt: stringOrNull(item.scheduledAt)
+	};
+}
+function asRecord(value) {
+	return isRecord(value) ? value : null;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringOrNull(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function extractActionHash(metadata) {
+	const value = metadata.actionHash;
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function isTokenAuthenticatedActor(actor) {
+	if (actor.actorType === "api_token") return true;
+	const authMethod = actor.authMetadata.auth_method;
+	return authMethod === "api_token" || authMethod === "oauth_token";
+}
+function errorReason(error) {
+	if (error instanceof PublicationAuthorizationError) return error.code.toLowerCase();
+	return "release_authorization_failed";
+}
+
+//#endregion
+export { HITL_REQUEST_STATUSES as a, HITL_REQUEST_PRIORITIES as i, PublicationAuthorizationService as n, HitlRequestRepository as o, ReleasePayloadBuilder as r, PublicationAuthorizationError as t };