dineway 0.2.33 → 0.2.35

package/dist/{publication-authorization-C-vYPGD8.mjs → publication-authorization-Dq_20SZR.mjs}

@@ -1,39 +1,60 @@
-import { i as encodeCursor, r as decodeCursor } from "./types-BpSTdH1H.mjs";
-import { t as SiteActivityRepository } from "./site-activity-7oezuHXK.mjs";
-import { n as stableStringify } from "./stable-hash-DF7R5eN8.mjs";
-import { n as ReviewRequestRepository } from "./review-requests-DICrYH2-.mjs";
-import { a as getSiteSettingsWithDb } from "./settings-CAsQLi0N.mjs";
-import { n as buildStableActionHash, t as ReviewPayloadBuilder } from "./review-payload-f1L4lzQg.mjs";
-import { t as SYSTEM_ACTOR_ID } from "./actor-DrJJsvy6.mjs";
-import { n as redactActivityRecord } from "./activity-CfryM8jO.mjs";
+import { AtomicWriteConflict, atomicBatch, isD1Database, rowUnchanged } from "./database/batch.mjs";
+import { r as currentIsoTimestampValue } from "./dialect-helpers-C6xtO-Ui.mjs";
+import { i as encodeCursor, r as decodeCursor } from "./types-BqxIv8Il.mjs";
+import { r as getOAuthTokenHash, t as SYSTEM_ACTOR_ID } from "./actor-DxUAJgQX.mjs";
+import { o as invalidateCollectionCache } from "./object-cache-BGjIlY9s.mjs";
+import { t as ContentRepository } from "./content-D9xKUSno.mjs";
+import { t as SiteActivityRepository } from "./site-activity-BrN2NviL.mjs";
+import { n as stableStringify } from "./stable-hash-DEtJgcp7.mjs";
+import { r as ReviewRequestRepository } from "./review-requests-BF2eEKr8.mjs";
+import { i as invalidateRedirectCache } from "./cache-DZDOBJv3.mjs";
+import { n as buildStableActionHash, t as ReviewPayloadBuilder, w as prepareContentPublication } from "./review-payload-LLIi1sxO.mjs";
+import { a as getSiteSettingsWithDb } from "./settings-DRFy8JQx.mjs";
+import { n as redactActivityRecord } from "./activity-BbtYp_4V.mjs";
+import { sql } from "kysely";
 import { ulid } from "ulidx";
+import { canActOnOwn, hasPermission, hasScope, toRoleLevel } from "@dineway-ai/auth";
+import { z } from "zod";
 
 //#region src/database/repositories/content-release-grants.ts
 var ContentReleaseGrantRepository = class {
 	constructor(db) {
 		this.db = db;
 	}
-	async createOrReplaceActive(input) {
-		const operation = async (transaction) => {
-			const existing = await findActiveForTarget(transaction, input.collection, input.entryId, input.operation);
-			if (existing?.actionHash === input.actionHash) return existing;
-			const now = input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
-			if (existing) {
-				const revoked = await transaction.updateTable("_dineway_content_release_grants").set({
-					status: "revoked",
-					updated_at: now,
-					revoked_at: now,
-					revocation_reason: "replaced"
-				}).where("id", "=", existing.id).where("status", "=", "active").executeTakeFirst();
-				if (Number(revoked.numUpdatedRows ?? 0) !== 1) throw new Error("Active content release grant changed during replacement");
+	async prepareCreateOrReplaceActive(input) {
+		const current = await this.db.selectFrom("_dineway_content_release_grants").selectAll().where("collection", "=", input.collection).where("entry_id", "=", input.entryId).where("operation", "=", input.operation).where("status", "=", "active").executeTakeFirst();
+		const checks = [current ? rowUnchanged("_dineway_content_release_grants", current) : sql`NOT EXISTS (SELECT 1 FROM _dineway_content_release_grants WHERE collection = ${input.collection} AND entry_id = ${input.entryId} AND operation = ${input.operation} AND status = 'active')`];
+		if (current?.action_hash === input.actionHash) return {
+			grant: rowToGrant(current),
+			batch: {
+				checks,
+				statements: []
+			}
+		};
+		const now = input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+		const statements = [];
+		if (current) statements.push(this.db.updateTable("_dineway_content_release_grants").set({
+			status: "revoked",
+			updated_at: now,
+			revoked_at: now,
+			revocation_reason: "replaced"
+		}).where("id", "=", current.id).where("status", "=", "active").compile());
+		const row = toInsertableGrant(ulid(), input, now);
+		statements.push(this.db.insertInto("_dineway_content_release_grants").values(row).compile());
+		return {
+			grant: rowToGrant(row),
+			batch: {
+				checks,
+				statements
 			}
-			const id = ulid();
-			await transaction.insertInto("_dineway_content_release_grants").values(toInsertableGrant(id, input, now)).execute();
-			const created = await findById(transaction, id);
-			if (!created) throw new Error("Failed to create content release grant");
-			return created;
 		};
-		return this.db.isTransaction ? operation(this.db) : this.db.transaction().execute(operation);
+	}
+	async createOrReplaceActive(input) {
+		const prepared = await this.prepareCreateOrReplaceActive(input);
+		await atomicBatch(this.db, prepared.batch);
+		const grant = await this.findById(prepared.grant.id);
+		if (!grant) throw new Error("Failed to create content release grant");
+		return grant;
 	}
 	async findById(id) {
 		return findById(this.db, id);
@@ -511,7 +532,8 @@ var PublicationAuthorizationService = class {
 	now;
 	constructor(options) {
 		this.options = options;
-		this.reviewRequests = new ReviewRequestRepository(options.db);
+		const reviewRepository = new ReviewRequestRepository(options.db);
+		this.reviewRequests = { findById: async (id) => options.preparedReview?.review.id === id ? options.preparedReview.review : reviewRepository.findById(id) };
 		this.releaseGrants = new ContentReleaseGrantRepository(options.db);
 		this.hitlRequests = new HitlRequestRepository(options.db);
 		this.activity = new SiteActivityRepository(options.db);
@@ -655,7 +677,7 @@ var PublicationAuthorizationService = class {
 		};
 	}
 	async releaseApprovedReview(reviewId) {
-		if (!this.options.db.isTransaction) throw new PublicationAuthorizationError("RELEASE_GRANT_FAILED", "Automated release requires a transaction.");
+		if (!this.options.db.isTransaction && !isD1Database(this.options.db)) throw new PublicationAuthorizationError("RELEASE_GRANT_FAILED", "Automated release requires a transaction.");
 		const job = await this.options.db.selectFrom("_dineway_review_jobs").selectAll().where("review_id", "=", reviewId).where("release_state", "=", "releasing").executeTakeFirst();
 		const review = await this.reviewRequests.findById(reviewId);
 		if (!job || !review || review.status !== "approved" || review.revokedAt) throw new PublicationAuthorizationError("EDITORIAL_REVIEW_INVALID", "An active exact review approval is required.");
@@ -673,6 +695,27 @@ var PublicationAuthorizationService = class {
 			sourceType: "system",
 			sourceName: "review-automation"
 		};
+		if (isD1Database(this.options.db)) {
+			const future = job.scheduled_at && job.scheduled_at > this.now();
+			const outcome = future ? "scheduled" : "published";
+			await this.publishAtomic(future ? {
+				...input,
+				scheduledAt: job.scheduled_at
+			} : input, future ? "schedule" : "publish", {
+				checks: [rowUnchanged("_dineway_review_jobs", {
+					review_id: job.review_id,
+					release_state: job.release_state,
+					updated_at: job.updated_at,
+					scheduled_at: job.scheduled_at
+				})],
+				statements: [this.options.db.updateTable("_dineway_review_jobs").set({
+					release_state: outcome,
+					release_reason: null,
+					updated_at: this.now()
+				}).where("review_id", "=", job.review_id).where("release_state", "=", "releasing").compile()]
+			});
+			return outcome;
+		}
 		if (job.scheduled_at && job.scheduled_at > this.now()) {
 			await this.scheduleAuthorizedContent({
 				...input,
@@ -683,7 +726,13 @@ var PublicationAuthorizationService = class {
 		await this.publishAuthorizedContent(input);
 		return "published";
 	}
+	/** Commit a host-prepared review and publication as one explicit batch. */
+	async publishPreparedContent(input) {
+		if (!this.options.preparedReview) throw new PublicationAuthorizationError("CONFIRMATION_REQUIRED", "A prepared host confirmation is required");
+		return this.publishAtomic(input, "publish");
+	}
 	async publishAuthorizedContent(input) {
+		if (isD1Database(this.options.db)) return this.publishAtomic(input, "publish");
 		const siteTimezone = await this.getSiteTimezone();
 		const authorized = await this.authorize({
 			...input,
@@ -706,6 +755,7 @@ var PublicationAuthorizationService = class {
 		};
 	}
 	async scheduleAuthorizedContent(input) {
+		if (isD1Database(this.options.db)) return this.publishAtomic(input, "schedule");
 		const siteTimezone = await this.getSiteTimezone();
 		const authorized = await this.authorize({
 			...input,
@@ -722,6 +772,7 @@ var PublicationAuthorizationService = class {
 		};
 	}
 	async publishAuthorizedDueContent(input) {
+		if (isD1Database(this.options.db)) return this.publishDueAtomic(input);
 		const grant = await this.releaseGrants.findActiveForTarget(input.collection, input.id, "schedule");
 		if (!grant) {
 			await this.blockScheduledRelease(input, null, "schedule_grant_required");
@@ -760,6 +811,7 @@ var PublicationAuthorizationService = class {
 		};
 	}
 	async unscheduleAuthorizedContent(input) {
+		if (isD1Database(this.options.db)) return this.unscheduleAtomic(input);
 		const activeGrant = await this.releaseGrants.findActiveForTarget(input.collection, input.id, "schedule");
 		let revokedGrant = null;
 		if (activeGrant) {
@@ -791,6 +843,366 @@ var PublicationAuthorizationService = class {
 			await this.releasePolicies(prepared, "release_request_prepared");
 		}
 	}
+	async unscheduleAtomic(input) {
+		const db = this.options.db;
+		const snapshot = await new ContentRepository(db).snapshot(input.collection, input.id);
+		if (!snapshot) throw new PublicationAuthorizationError("NOT_FOUND", "Content not found");
+		const checks = [snapshot.check, ...await this.atomicActorChecks(input, snapshot.item)];
+		const rawGrant = await db.selectFrom("_dineway_content_release_grants").selectAll().where("collection", "=", input.collection).where("entry_id", "=", input.id).where("operation", "=", "schedule").where("status", "=", "active").executeTakeFirst();
+		checks.push(rawGrant ? rowUnchanged("_dineway_content_release_grants", rawGrant) : sql`NOT EXISTS (SELECT 1 FROM _dineway_content_release_grants WHERE collection = ${input.collection} AND entry_id = ${input.id} AND operation = 'schedule' AND status = 'active')`);
+		const grant = rawGrant ? await this.releaseGrants.findById(rawGrant.id) : null;
+		if (grant?.policyContributions.some((contribution) => contribution.reservationId)) throw new PublicationAuthorizationError("RELEASE_POLICY_FAILED", "Reservation policies require a transactional database adapter");
+		const statements = [sql`UPDATE ${sql.table(`ec_${input.collection}`)} SET scheduled_at = NULL, status = CASE WHEN status = 'published' THEN 'published' ELSE 'draft' END, updated_at = ${this.now()} WHERE id = ${input.id}`.compile(db)];
+		if (grant) statements.push(db.updateTable("_dineway_content_release_grants").set({
+			status: "revoked",
+			revoked_at: this.now(),
+			revocation_reason: "content_unscheduled",
+			updated_at: this.now()
+		}).where("id", "=", grant.id).compile(), db.updateTable("_dineway_review_jobs").set({
+			release_state: "blocked",
+			release_reason: "content_unscheduled",
+			updated_at: this.now()
+		}).where("review_id", "=", grant.editorialReviewRequestId).where("release_state", "in", [
+			"queued",
+			"scheduled",
+			"releasing"
+		]).compile());
+		statements.push(this.activity.prepareCreate({
+			...input.actor,
+			actionType: "content.unschedule",
+			subjectType: "content",
+			subjectId: input.id,
+			scope: `content:${input.collection}:${input.id}`,
+			summary: `Unscheduled ${input.collection}/${input.id}`,
+			sourceType: input.sourceType ?? "unknown",
+			sourceName: input.sourceName ?? null,
+			detail: {
+				releaseGrantId: grant?.id ?? null,
+				revocationReason: "content_unscheduled"
+			}
+		}).statement);
+		await atomicBatch(db, {
+			checks,
+			statements
+		});
+		invalidateCollectionCache(input.collection);
+		const result = await this.options.handlers.handleContentGet(input.collection, input.id);
+		await this.options.onUnscheduleCommitted?.(input.collection, input.id, snapshot.item);
+		return {
+			grant: grant ? await this.releaseGrants.findById(grant.id) : null,
+			result
+		};
+	}
+	async publishDueAtomic(input) {
+		const db = this.options.db;
+		const snapshot = await new ContentRepository(db).snapshot(input.collection, input.id);
+		if (!snapshot || !snapshot.item.scheduledAt || snapshot.item.scheduledAt > this.now()) throw new PublicationAuthorizationError("NOT_DUE", "Content is no longer due for publication");
+		const checks = [snapshot.check];
+		const rawGrant = await db.selectFrom("_dineway_content_release_grants").selectAll().where("collection", "=", input.collection).where("entry_id", "=", input.id).where("operation", "=", "schedule").where("status", "=", "active").executeTakeFirst();
+		const grant = rawGrant ? await this.releaseGrants.findById(rawGrant.id) : null;
+		checks.push(rawGrant ? rowUnchanged("_dineway_content_release_grants", rawGrant) : sql`NOT EXISTS (SELECT 1 FROM _dineway_content_release_grants WHERE collection = ${input.collection} AND entry_id = ${input.id} AND operation = 'schedule' AND status = 'active')`);
+		let release;
+		try {
+			if (!grant) throw new PublicationAuthorizationError("SCHEDULE_GRANT_REQUIRED", "Due content has no active schedule grant");
+			const review = await db.selectFrom("_dineway_review_requests").selectAll().where("id", "=", grant.editorialReviewRequestId).executeTakeFirst();
+			if (!review) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "Editorial review is missing");
+			checks.push(rowUnchanged("_dineway_review_requests", review));
+			const ids = [snapshot.item.liveRevisionId, snapshot.item.draftRevisionId].filter((id) => id !== null);
+			const revisions = ids.length ? await db.selectFrom("revisions").selectAll().where("id", "in", ids).execute() : [];
+			checks.push(...revisions.map((row) => rowUnchanged("revisions", row)));
+			const timezone = await db.selectFrom("options").selectAll().where("name", "=", "site:timezone").executeTakeFirst();
+			checks.push(timezone ? rowUnchanged("options", timezone) : sql`NOT EXISTS (SELECT 1 FROM options WHERE name = 'site:timezone')`);
+			const pluginStates = await db.selectFrom("_plugin_state").selectAll().execute();
+			checks.push(sql`(SELECT COUNT(*) FROM _plugin_state) = ${pluginStates.length}`, ...pluginStates.map((row) => rowUnchanged("_plugin_state", row)));
+			const preparedPolicies = this.restorePreparedPolicies(grant.policyContributions);
+			release = await this.revalidateScheduledGrant(input, grant, preparedPolicies, checks);
+			checks.push(...await this.atomicActorChecks({
+				actor: grantActor(grant),
+				editorialReviewRequestId: grant.editorialReviewRequestId
+			}, snapshot.item, true));
+		} catch (error) {
+			const reason = errorReason(error);
+			const statements = [sql`UPDATE ${sql.table(`ec_${input.collection}`)} SET scheduled_at = NULL, status = CASE WHEN status = 'published' THEN 'published' ELSE 'draft' END, updated_at = ${this.now()} WHERE id = ${input.id}`.compile(db)];
+			if (grant) statements.push(db.updateTable("_dineway_content_release_grants").set({
+				status: "revoked",
+				revoked_at: this.now(),
+				updated_at: this.now(),
+				revocation_reason: reason
+			}).where("id", "=", grant.id).compile(), db.updateTable("_dineway_review_jobs").set({
+				release_state: "blocked",
+				release_reason: reason,
+				updated_at: this.now()
+			}).where("review_id", "=", grant.editorialReviewRequestId).where("release_state", "=", "scheduled").compile());
+			statements.push(this.activity.prepareCreate({
+				actorType: "system",
+				actorId: SYSTEM_ACTOR_ID,
+				actionType: "content.schedule_blocked",
+				subjectType: "content",
+				subjectId: input.id,
+				scope: `content:${input.collection}:${input.id}`,
+				summary: "Blocked scheduled publication",
+				detail: {
+					reason,
+					releaseGrantId: grant?.id ?? null
+				},
+				sourceType: "system",
+				sourceName: "scheduled_publish",
+				resultStatus: "blocked"
+			}).statement);
+			await atomicBatch(db, {
+				checks,
+				statements
+			});
+			invalidateCollectionCache(input.collection);
+			throw error;
+		}
+		if (!grant) throw new Error("Validated schedule grant is missing");
+		const content = await prepareContentPublication(db, input.collection, input.id, {
+			publishedAt: input.publishedAt,
+			requireScheduledDue: true
+		});
+		checks.push(...content.batch.checks);
+		if (grant.expiresAt) checks.push(sql`${grant.expiresAt} > ${currentIsoTimestampValue(db)}`);
+		await atomicBatch(db, {
+			checks,
+			statements: [
+				...content.batch.statements,
+				db.updateTable("_dineway_content_release_grants").set({
+					status: "consumed",
+					consumed_at: this.now(),
+					updated_at: this.now()
+				}).where("id", "=", grant.id).where("status", "=", "active").compile(),
+				db.updateTable("_dineway_review_jobs").set({
+					release_state: "published",
+					release_reason: null,
+					updated_at: this.now()
+				}).where("review_id", "=", grant.editorialReviewRequestId).where("release_state", "in", ["scheduled", "releasing"]).compile(),
+				this.activity.prepareCreate({
+					actorType: "system",
+					actorId: SYSTEM_ACTOR_ID,
+					actionType: "content.schedule_published",
+					subjectType: "content",
+					subjectId: input.id,
+					relatedSubjectType: "review_request",
+					relatedSubjectId: grant.editorialReviewRequestId,
+					scope: release.scope,
+					summary: `Published scheduled ${input.collection}/${input.id}`,
+					detail: {
+						releaseGrantId: grant.id,
+						actionHash: release.actionHash
+					},
+					sourceType: "system",
+					sourceName: "scheduled_publish",
+					resultStatus: "succeeded"
+				}).statement
+			]
+		});
+		invalidateCollectionCache(input.collection);
+		invalidateRedirectCache();
+		const consumed = await this.releaseGrants.findById(grant.id);
+		if (!consumed) throw new Error("Committed schedule grant is missing");
+		const result = await this.options.handlers.handleContentGet(input.collection, input.id);
+		await this.options.onPublicationCommitted?.("publish", input.collection, input.id, snapshot.item);
+		return {
+			grant: consumed,
+			result,
+			receipt: publicationReceipt(consumed, "published")
+		};
+	}
+	async atomicActorChecks(input, content, scheduledAutomation = false) {
+		const db = this.options.db;
+		const checks = [];
+		const automated = input.actor.actorType === "system" && input.actor.actorId === "review-automation" && input.actor.authMetadata.auth_method === "review_automation";
+		if (input.actor.actorType === "system" && scheduledAutomation && automated) return checks;
+		if (input.actor.actorType === "system") {
+			const claim = automated ? await db.selectFrom("_dineway_review_jobs").selectAll().where("review_id", "=", input.editorialReviewRequestId ?? "").where("release_state", "=", "releasing").executeTakeFirst() : null;
+			if (!claim) throw new PublicationAuthorizationError("ACTOR_NOT_ALLOWED", "System publication requires a claimed approved review");
+			checks.push(rowUnchanged("_dineway_review_jobs", {
+				review_id: claim.review_id,
+				release_state: claim.release_state,
+				updated_at: claim.updated_at,
+				scheduled_at: claim.scheduled_at
+			}));
+		} else {
+			let userId = input.actor.actorId;
+			if (input.actor.actorType === "api_token") {
+				const token = await db.selectFrom("_dineway_api_tokens").select([
+					"id",
+					"user_id",
+					"scopes",
+					"expires_at"
+				]).where("id", "=", input.actor.actorId).executeTakeFirst();
+				if (!token || !hasScope(z.array(z.string()).parse(JSON.parse(token.scopes)), "content:write")) throw new PublicationAuthorizationError("ACTOR_NOT_ALLOWED", "Publication token is unavailable");
+				userId = token.user_id;
+				checks.push(rowUnchanged("_dineway_api_tokens", token), sql`EXISTS (SELECT 1 FROM _dineway_api_tokens WHERE id = ${token.id} AND (expires_at IS NULL OR expires_at > ${currentIsoTimestampValue(db)}))`);
+			} else if (input.actor.authMetadata.auth_method === "oauth_token") {
+				if (!scheduledAutomation) {
+					const hash = getOAuthTokenHash(input.actor);
+					const token = hash ? await db.selectFrom("_dineway_oauth_tokens").select([
+						"token_hash",
+						"token_type",
+						"user_id",
+						"scopes",
+						"expires_at",
+						"client_id"
+					]).where("token_hash", "=", hash).executeTakeFirst() : void 0;
+					if (!token || token.token_type !== "access" || token.user_id !== userId || !hasScope(z.array(z.string()).parse(JSON.parse(token.scopes)), "content:write")) throw new PublicationAuthorizationError("ACTOR_NOT_ALLOWED", "The authenticated OAuth publication token is unavailable");
+					checks.push(rowUnchanged("_dineway_oauth_tokens", token), sql`${token.expires_at} > ${currentIsoTimestampValue(db)}`);
+				}
+			} else if (input.actor.authMetadata.auth_method !== "session") throw new PublicationAuthorizationError("ACTOR_NOT_ALLOWED", "This authentication method requires an atomic authorization provider");
+			const user = await db.selectFrom("users").select([
+				"id",
+				"role",
+				"disabled"
+			]).where("id", "=", userId).executeTakeFirst();
+			const principal = user ? {
+				id: user.id,
+				role: toRoleLevel(user.role)
+			} : null;
+			if (!user || user.disabled || !principal || !canActOnOwn(principal, content.authorId ?? "", "content:publish_own", "content:publish_any") || "publishedAt" in input && input.publishedAt !== void 0 && !hasPermission(principal, "content:publish_any")) throw new PublicationAuthorizationError("ACTOR_NOT_ALLOWED", "Publication permission is no longer available");
+			checks.push(rowUnchanged("users", user));
+		}
+		return checks;
+	}
+	async publishAtomic(input, operation, extra = { statements: [] }) {
+		const db = this.options.db;
+		const snapshot = await new ContentRepository(db).snapshot(input.collection, input.id);
+		if (!snapshot) throw new PublicationAuthorizationError("NOT_FOUND", "Content not found");
+		const checks = [snapshot.check, ...extra.checks ?? []];
+		const ids = [snapshot.item.liveRevisionId, snapshot.item.draftRevisionId].filter((id) => id !== null);
+		const revisions = ids.length ? await db.selectFrom("revisions").selectAll().where("id", "in", ids).execute() : [];
+		checks.push(...revisions.map((row) => rowUnchanged("revisions", row)));
+		const storedReview = await db.selectFrom("_dineway_review_requests").selectAll().where("id", "=", input.editorialReviewRequestId).executeTakeFirst();
+		const confirmation = this.options.preparedReview;
+		const review = confirmation ? {
+			id: confirmation.review.id,
+			status: confirmation.review.status,
+			revoked_at: confirmation.review.revokedAt
+		} : storedReview;
+		if (!review || review.status !== "approved" || review.revoked_at) throw new PublicationAuthorizationError("EDITORIAL_REVIEW_INVALID", "An active editorial approval is required");
+		if (confirmation) {
+			if (operation !== "publish" || confirmation.review.id !== input.editorialReviewRequestId || !isHumanSessionActor(input.actor) || confirmation.review.requestedByActorId !== input.actor.actorId || confirmation.review.resolvedByActorId !== input.actor.actorId || confirmation.authorizationChecks.length === 0) throw new PublicationAuthorizationError("ACTOR_NOT_ALLOWED", "Confirmed publication requires explicit host authority for this review");
+			checks.push(...confirmation.batch.checks ?? [], ...confirmation.authorizationChecks);
+		} else if (storedReview) checks.push(rowUnchanged("_dineway_review_requests", storedReview));
+		const automated = input.actor.actorType === "system" && input.actor.actorId === "review-automation" && input.actor.authMetadata.auth_method === "review_automation";
+		if (!confirmation) checks.push(...await this.atomicActorChecks(input, snapshot.item));
+		if ((input.policyOverrides?.length ?? 0) > 0 && !isHumanSessionActor(input.actor)) throw new PublicationAuthorizationError("POLICY_OVERRIDE_NOT_ALLOWED", "Only a human session can confirm policy warnings");
+		const timezone = await db.selectFrom("options").selectAll().where("name", "=", "site:timezone").executeTakeFirst();
+		checks.push(timezone ? rowUnchanged("options", timezone) : sql`NOT EXISTS (SELECT 1 FROM options WHERE name = 'site:timezone')`);
+		const pluginStates = await db.selectFrom("_plugin_state").selectAll().execute();
+		checks.push(sql`(SELECT COUNT(*) FROM _plugin_state) = ${pluginStates.length}`, ...pluginStates.map((row) => rowUnchanged("_plugin_state", row)));
+		const releaseInput = {
+			...input,
+			operation,
+			siteTimezone: await this.getSiteTimezone()
+		};
+		const baseRelease = await this.buildRelease(releaseInput, []);
+		const reviewJob = await db.selectFrom("_dineway_review_jobs").selectAll().where("review_id", "=", review.id).executeTakeFirst();
+		if (reviewJob) checks.push(rowUnchanged("_dineway_review_jobs", reviewJob));
+		const active = await this.releaseGrants.findActiveForTarget(input.collection, input.id, operation);
+		if (active?.policyContributions.some((contribution) => contribution.reservationId)) throw new PublicationAuthorizationError("RELEASE_POLICY_FAILED", "Reservation policies require a transactional database adapter");
+		const preparedPolicies = [];
+		for (const policy of this.policies) {
+			if (!policy.prepareAtomic || !policy.validateAtomic) throw new PublicationAuthorizationError("RELEASE_POLICY_FAILED", `Policy ${policy.id} does not provide atomic D1 checks`);
+			const prepared = await policy.prepareAtomic(toPreparationTarget(baseRelease, active?.policyContributions ?? [], input.actor, input.policyOverrides ?? []));
+			if (prepared.contribution.providerId !== policy.id || prepared.contribution.reservationId) throw new PublicationAuthorizationError("RELEASE_POLICY_FAILED", "Invalid atomic policy contribution");
+			checks.push(...prepared.checks);
+			preparedPolicies.push({
+				policy,
+				contribution: prepared.contribution
+			});
+		}
+		const release = await this.buildRelease(releaseInput, preparedPolicies.map((prepared) => prepared.contribution));
+		for (const prepared of preparedPolicies) checks.push(...await prepared.policy.validateAtomic(release, prepared.contribution));
+		const hitl = isTokenAuthenticatedActor(input.actor) ? await this.requireApprovedReleaseHitl(releaseInput, release) : null;
+		if (hitl) {
+			const raw = await db.selectFrom("_dineway_hitl_requests").selectAll().where("id", "=", hitl.id).executeTakeFirstOrThrow();
+			checks.push(rowUnchanged("_dineway_hitl_requests", raw));
+		}
+		const preparedGrant = await this.releaseGrants.prepareCreateOrReplaceActive({
+			collection: release.collection,
+			entryId: release.entryId,
+			scope: release.scope,
+			liveRevisionId: release.liveRevisionId,
+			draftRevisionId: release.draftRevisionId,
+			reviewedRev: release.reviewedRev,
+			editorialReviewRequestId: release.editorialReviewRequestId,
+			releaseHitlRequestId: hitl?.id ?? null,
+			operation,
+			scheduledAt: release.scheduledAt,
+			publishedAt: release.publishedAt,
+			siteTimezone: release.siteTimezone,
+			actionHash: release.actionHash,
+			policyContributions: toStoredPolicyContributions(release.policyContributions),
+			authorizationMethod: automated ? "review_automation" : hitl ? "approved_hitl" : "human_action",
+			authorizedByActorType: input.actor.actorType,
+			authorizedByActorId: input.actor.actorId,
+			authorizedAuthMetadata: redactActivityRecord(input.actor.authMetadata),
+			createdAt: this.now()
+		});
+		checks.push(...preparedGrant.batch.checks ?? []);
+		const statements = [...confirmation?.batch.statements ?? [], ...preparedGrant.batch.statements];
+		if (operation === "publish") {
+			const preparedContent = await prepareContentPublication(db, input.collection, input.id, "publishedAt" in input ? { publishedAt: input.publishedAt } : {});
+			checks.push(...preparedContent.batch.checks);
+			statements.push(...preparedContent.batch.statements, db.updateTable("_dineway_content_release_grants").set({
+				status: "consumed",
+				consumed_at: this.now(),
+				updated_at: this.now()
+			}).where("id", "=", preparedGrant.grant.id).where("status", "=", "active").compile());
+		} else {
+			if (!release.scheduledAt || release.scheduledAt <= this.now()) throw new PublicationAuthorizationError("VALIDATION_ERROR", "Scheduled date must be in the future");
+			statements.push(sql`UPDATE ${sql.table(`ec_${input.collection}`)} SET status = CASE WHEN status = 'published' THEN 'published' ELSE 'scheduled' END, scheduled_at = ${release.scheduledAt}, updated_at = ${this.now()} WHERE id = ${input.id}`.compile(db));
+		}
+		statements.push(db.updateTable("_dineway_review_jobs").set({
+			release_state: operation === "publish" ? "published" : "scheduled",
+			release_reason: null,
+			updated_at: this.now()
+		}).where("review_id", "=", review.id).compile());
+		statements.push(this.activity.prepareCreate({
+			...input.actor,
+			authMetadata: redactActivityRecord(input.actor.authMetadata),
+			actionType: release.actionType,
+			subjectType: "content",
+			subjectId: input.id,
+			relatedSubjectType: "review_request",
+			relatedSubjectId: review.id,
+			sourceType: input.sourceType ?? "unknown",
+			sourceName: input.sourceName ?? null,
+			resultStatus: "succeeded",
+			scope: release.scope,
+			summary: `${operation === "publish" ? "Published" : "Scheduled"} ${input.collection}/${input.id}`,
+			detail: {
+				editorialReviewRequestId: review.id,
+				releaseHitlRequestId: hitl?.id ?? null,
+				releaseGrantId: preparedGrant.grant.id,
+				actionHash: release.actionHash,
+				scheduledAt: release.scheduledAt,
+				publishedAt: release.publishedAt
+			},
+			createdAt: this.now()
+		}).statement, ...extra.statements);
+		try {
+			await atomicBatch(db, {
+				checks,
+				statements
+			});
+		} catch (error) {
+			if (error instanceof AtomicWriteConflict) throw new PublicationAuthorizationError("EDITORIAL_REVIEW_INVALID", "Content, approval or publication permissions changed before commit");
+			throw error;
+		}
+		invalidateCollectionCache(input.collection);
+		invalidateRedirectCache();
+		const grant = await this.releaseGrants.findById(preparedGrant.grant.id);
+		if (!grant) throw new Error("Committed release grant is missing");
+		const result = await this.options.handlers.handleContentGet(input.collection, input.id);
+		await this.options.onPublicationCommitted?.(operation, input.collection, input.id, snapshot.item);
+		return {
+			grant,
+			result,
+			receipt: publicationReceipt(grant, operation === "publish" ? "published" : "scheduled")
+		};
+	}
 	async authorize(input) {
 		const automated = input.actor.actorType === "system" && input.actor.actorId === "review-automation" && input.actor.authMetadata.auth_method === "review_automation";
 		if (input.actor.actorType === "system") {
@@ -839,7 +1251,7 @@ var PublicationAuthorizationService = class {
 			throw new PublicationAuthorizationError("RELEASE_GRANT_FAILED", error instanceof Error ? error.message : "Failed to authorize content release");
 		}
 	}
-	async revalidateScheduledGrant(input, grant, preparedPolicies) {
+	async revalidateScheduledGrant(input, grant, preparedPolicies, atomicChecks) {
 		const now = this.now();
 		if (grant.expiresAt && grant.expiresAt <= now) throw new PublicationAuthorizationError("SCHEDULE_GRANT_EXPIRED", "Schedule grant expired before execution");
 		if (grant.scheduledAt !== input.scheduledAt) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "Schedule grant time does not match the due content");
@@ -930,7 +1342,11 @@ var PublicationAuthorizationService = class {
 			const request = grant.releaseHitlRequestId ? await this.hitlRequests.findById(grant.releaseHitlRequestId) : null;
 			if (!request || !matchesReleaseHitl(request, release, grantActor(grant))) throw new PublicationAuthorizationError("SCHEDULE_GRANT_INVALID", "Schedule grant release approval is no longer valid");
 		}
-		await this.validatePolicies(release, preparedPolicies);
+		if (atomicChecks) for (const prepared of preparedPolicies) {
+			if (!prepared.policy.validateAtomic || prepared.contribution.reservationId) throw new PublicationAuthorizationError("RELEASE_POLICY_FAILED", "Scheduled policy lacks atomic D1 checks");
+			atomicChecks.push(...await prepared.policy.validateAtomic(release, prepared.contribution));
+		}
+		else await this.validatePolicies(release, preparedPolicies);
 		return release;
 	}
 	async buildRelease(input, policyContributions) {
@@ -962,7 +1378,12 @@ var PublicationAuthorizationService = class {
 		const prepared = [];
 		try {
 			for (const policy of this.policies) {
-				const contribution = await policy.prepare(target);
+				let contribution;
+				if (isD1Database(this.options.db)) {
+					if (!policy.prepareAtomic) throw new Error(`Policy ${policy.id} does not provide atomic D1 checks`);
+					contribution = (await policy.prepareAtomic(target)).contribution;
+				} else contribution = await policy.prepare(target);
+				if (isD1Database(this.options.db) && contribution.reservationId) throw new Error("D1 policies cannot reserve external state");
 				if (contribution.providerId !== policy.id) throw new Error(`Publication policy ${policy.id} returned another provider ID`);
 				prepared.push({
 					policy,
@@ -977,7 +1398,10 @@ var PublicationAuthorizationService = class {
 	}
 	async validatePolicies(release, preparedPolicies) {
 		try {
-			for (const prepared of preparedPolicies) await prepared.policy.validate(release, prepared.contribution);
+			for (const prepared of preparedPolicies) if (isD1Database(this.options.db)) {
+				if (!prepared.policy.validateAtomic) throw new Error(`Policy ${prepared.policy.id} does not provide atomic D1 checks`);
+				await prepared.policy.validateAtomic(release, prepared.contribution);
+			} else await prepared.policy.validate(release, prepared.contribution);
 		} catch (error) {
 			throw new PublicationAuthorizationError("RELEASE_POLICY_FAILED", error instanceof Error ? error.message : "Publication release policy rejected release");
 		}
@@ -991,6 +1415,7 @@ var PublicationAuthorizationService = class {
 		for (const prepared of preparedPolicies) await prepared.policy.consume?.(prepared.contribution);
 	}
 	async releasePolicies(preparedPolicies, reason) {
+		if (isD1Database(this.options.db)) return;
 		for (const prepared of preparedPolicies.toReversed()) await prepared.policy.release?.(prepared.contribution, reason);
 	}
 	async releaseReplacedPolicies(contributions, currentPolicies) {

package/dist/{query-DcB9uGTW.mjs → query-BkWWdxyb.mjs}

@@ -1,7 +1,7 @@
-import { r as getDb } from "./loader-BDje8ME2.mjs";
-import { n as cachedQuery, t as CacheNamespace } from "./object-cache-D51qOseS.mjs";
-import { r as requestCached } from "./request-cache-BruBnFAR.mjs";
-import { n as SchemaRegistry } from "./registry-D-IV_h50.mjs";
+import { r as getDb } from "./loader-Cgsx23wU.mjs";
+import { n as cachedQuery, t as CacheNamespace } from "./object-cache-BGjIlY9s.mjs";
+import { r as requestCached } from "./request-cache-DPmV5nk4.mjs";
+import { n as SchemaRegistry } from "./registry-DcV93OL_.mjs";
 
 //#region src/schema/query.ts
 /**