dineway 0.2.4 → 0.2.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (169) hide show
  1. package/dist/api/route-utils.d.mts +3 -3
  2. package/dist/api/route-utils.mjs +1 -1
  3. package/dist/api/schemas/index.d.mts +2 -2
  4. package/dist/api/schemas/index.mjs +3 -3
  5. package/dist/{api-BZ_oWfPM.mjs → api-B660nbLj.mjs} +1 -1
  6. package/dist/astro/index.d.mts +2 -2
  7. package/dist/astro/index.mjs +2 -2
  8. package/dist/astro/middleware/auth.d.mts +2 -2
  9. package/dist/astro/middleware/auth.mjs +2 -2
  10. package/dist/astro/middleware/setup.mjs +1 -1
  11. package/dist/astro/middleware.mjs +10 -10
  12. package/dist/astro/routes/api/admin/allowed-domains/_domain_.mjs +2 -2
  13. package/dist/astro/routes/api/admin/allowed-domains/index.mjs +2 -2
  14. package/dist/astro/routes/api/admin/briefing.mjs +2 -2
  15. package/dist/astro/routes/api/admin/byline-fields/_slug_.mjs +2 -2
  16. package/dist/astro/routes/api/admin/byline-fields/index.mjs +2 -2
  17. package/dist/astro/routes/api/admin/byline-fields/reorder.mjs +2 -2
  18. package/dist/astro/routes/api/admin/bylines/_id_/index.mjs +2 -2
  19. package/dist/astro/routes/api/admin/bylines/_id_/translations.mjs +2 -2
  20. package/dist/astro/routes/api/admin/bylines/index.mjs +2 -2
  21. package/dist/astro/routes/api/admin/comments/_id_/status.mjs +2 -2
  22. package/dist/astro/routes/api/admin/comments/bulk.mjs +2 -2
  23. package/dist/astro/routes/api/admin/comments/index.mjs +2 -2
  24. package/dist/astro/routes/api/admin/context/_id_/history.mjs +3 -3
  25. package/dist/astro/routes/api/admin/context/_id_/index.mjs +3 -3
  26. package/dist/astro/routes/api/admin/context/_id_/review.mjs +5 -5
  27. package/dist/astro/routes/api/admin/context/_id_/supersede.mjs +5 -5
  28. package/dist/astro/routes/api/admin/context/diff.mjs +5 -5
  29. package/dist/astro/routes/api/admin/context/index.mjs +5 -5
  30. package/dist/astro/routes/api/admin/context/stale.mjs +5 -5
  31. package/dist/astro/routes/api/admin/hitl-requests/_id_/index.mjs +4 -4
  32. package/dist/astro/routes/api/admin/hitl-requests/_id_/resolve.mjs +6 -6
  33. package/dist/astro/routes/api/admin/hitl-requests/index.mjs +6 -6
  34. package/dist/astro/routes/api/admin/hooks/exclusive/_hookName_.mjs +3 -3
  35. package/dist/astro/routes/api/admin/plugins/_id_/disable.mjs +6 -6
  36. package/dist/astro/routes/api/admin/plugins/_id_/enable.mjs +6 -6
  37. package/dist/astro/routes/api/admin/plugins/_id_/index.mjs +3 -3
  38. package/dist/astro/routes/api/admin/plugins/_id_/uninstall.mjs +6 -6
  39. package/dist/astro/routes/api/admin/plugins/_id_/update.mjs +6 -6
  40. package/dist/astro/routes/api/admin/plugins/index.mjs +3 -3
  41. package/dist/astro/routes/api/admin/plugins/marketplace/_id_/index.mjs +3 -3
  42. package/dist/astro/routes/api/admin/plugins/marketplace/_id_/install.mjs +6 -6
  43. package/dist/astro/routes/api/admin/plugins/marketplace/index.mjs +3 -3
  44. package/dist/astro/routes/api/admin/plugins/updates.mjs +3 -3
  45. package/dist/astro/routes/api/admin/review-requests/_id_/resolve.mjs +4 -4
  46. package/dist/astro/routes/api/admin/review-requests/index.mjs +4 -4
  47. package/dist/astro/routes/api/admin/themes/marketplace/_id_/index.mjs +3 -3
  48. package/dist/astro/routes/api/admin/themes/marketplace/index.mjs +3 -3
  49. package/dist/astro/routes/api/admin/users/_id_/index.mjs +2 -2
  50. package/dist/astro/routes/api/admin/users/index.mjs +2 -2
  51. package/dist/astro/routes/api/auth/invite/complete.mjs +4 -4
  52. package/dist/astro/routes/api/auth/invite/index.mjs +2 -2
  53. package/dist/astro/routes/api/auth/invite/register-options.mjs +3 -3
  54. package/dist/astro/routes/api/auth/magic-link/send.mjs +2 -2
  55. package/dist/astro/routes/api/auth/me.mjs +2 -2
  56. package/dist/astro/routes/api/auth/mode.mjs +1 -1
  57. package/dist/astro/routes/api/auth/passkey/_id_.mjs +2 -2
  58. package/dist/astro/routes/api/auth/passkey/options.mjs +3 -3
  59. package/dist/astro/routes/api/auth/passkey/register/options.mjs +3 -3
  60. package/dist/astro/routes/api/auth/passkey/register/verify.mjs +4 -4
  61. package/dist/astro/routes/api/auth/passkey/verify.mjs +4 -4
  62. package/dist/astro/routes/api/auth/signup/complete.mjs +4 -4
  63. package/dist/astro/routes/api/auth/signup/request.mjs +2 -2
  64. package/dist/astro/routes/api/comments/_collection_/_contentId_/index.mjs +2 -2
  65. package/dist/astro/routes/api/comments/_collection_/_contentId_/reactions.mjs +2 -2
  66. package/dist/astro/routes/api/content/_collection_/_id_/preview-url.mjs +2 -2
  67. package/dist/astro/routes/api/content/_collection_/_id_/publish.mjs +17 -8
  68. package/dist/astro/routes/api/content/_collection_/_id_/release-readiness.d.mts +7 -0
  69. package/dist/astro/routes/api/content/_collection_/_id_/release-readiness.mjs +43 -0
  70. package/dist/astro/routes/api/content/_collection_/_id_/schedule.mjs +6 -4
  71. package/dist/astro/routes/api/content/_collection_/_id_/terms/_taxonomy_.mjs +2 -2
  72. package/dist/astro/routes/api/content/_collection_/_id_.mjs +2 -2
  73. package/dist/astro/routes/api/content/_collection_/index.mjs +2 -2
  74. package/dist/astro/routes/api/content/_collection_/trash.mjs +2 -2
  75. package/dist/astro/routes/api/health.mjs +1 -1
  76. package/dist/astro/routes/api/import/probe.mjs +2 -2
  77. package/dist/astro/routes/api/import/wordpress/execute.d.mts +2 -2
  78. package/dist/astro/routes/api/import/wordpress/execute.mjs +3 -3
  79. package/dist/astro/routes/api/import/wordpress/media.d.mts +2 -2
  80. package/dist/astro/routes/api/import/wordpress/media.mjs +2 -2
  81. package/dist/astro/routes/api/import/wordpress/prepare.mjs +5 -5
  82. package/dist/astro/routes/api/import/wordpress/rewrite-urls.d.mts +2 -2
  83. package/dist/astro/routes/api/import/wordpress/rewrite-urls.mjs +5 -5
  84. package/dist/astro/routes/api/import/wordpress-plugin/analyze.mjs +2 -2
  85. package/dist/astro/routes/api/import/wordpress-plugin/execute.d.mts +2 -2
  86. package/dist/astro/routes/api/import/wordpress-plugin/execute.mjs +5 -5
  87. package/dist/astro/routes/api/manifest.mjs +2 -2
  88. package/dist/astro/routes/api/mcp.mjs +46 -8
  89. package/dist/astro/routes/api/media/_id_/confirm.mjs +2 -2
  90. package/dist/astro/routes/api/media/_id_.mjs +2 -2
  91. package/dist/astro/routes/api/media/upload-url.mjs +2 -2
  92. package/dist/astro/routes/api/media.mjs +2 -2
  93. package/dist/astro/routes/api/menus/_name_/items/_id_.mjs +5 -5
  94. package/dist/astro/routes/api/menus/_name_/items.mjs +5 -5
  95. package/dist/astro/routes/api/menus/_name_/reorder.mjs +5 -5
  96. package/dist/astro/routes/api/menus/_name_/translations.mjs +5 -5
  97. package/dist/astro/routes/api/menus/_name_.mjs +5 -5
  98. package/dist/astro/routes/api/menus/index.mjs +5 -5
  99. package/dist/astro/routes/api/openapi.json.mjs +24 -3
  100. package/dist/astro/routes/api/redirects/404s/index.mjs +2 -2
  101. package/dist/astro/routes/api/redirects/404s/summary.mjs +2 -2
  102. package/dist/astro/routes/api/redirects/_id_.mjs +5 -5
  103. package/dist/astro/routes/api/redirects/index.mjs +5 -5
  104. package/dist/astro/routes/api/schema/collections/_slug_/fields/_fieldSlug_.mjs +3 -3
  105. package/dist/astro/routes/api/schema/collections/_slug_/fields/index.mjs +3 -3
  106. package/dist/astro/routes/api/schema/collections/_slug_/fields/reorder.mjs +3 -3
  107. package/dist/astro/routes/api/schema/collections/_slug_/index.mjs +3 -3
  108. package/dist/astro/routes/api/schema/collections/index.mjs +3 -3
  109. package/dist/astro/routes/api/schema/orphans/_slug_.mjs +3 -3
  110. package/dist/astro/routes/api/schema/orphans/index.mjs +3 -3
  111. package/dist/astro/routes/api/search/enable.mjs +2 -2
  112. package/dist/astro/routes/api/search/index.mjs +2 -2
  113. package/dist/astro/routes/api/search/rebuild.mjs +2 -2
  114. package/dist/astro/routes/api/search/suggest.mjs +2 -2
  115. package/dist/astro/routes/api/sections/_slug_.mjs +5 -5
  116. package/dist/astro/routes/api/sections/index.mjs +5 -5
  117. package/dist/astro/routes/api/settings.mjs +5 -5
  118. package/dist/astro/routes/api/setup/admin-verify.mjs +5 -5
  119. package/dist/astro/routes/api/setup/admin.mjs +3 -3
  120. package/dist/astro/routes/api/setup/index.mjs +3 -3
  121. package/dist/astro/routes/api/setup/status.mjs +1 -1
  122. package/dist/astro/routes/api/snapshot.mjs +1 -1
  123. package/dist/astro/routes/api/taxonomies/_name_/terms/_slug_/translations.mjs +5 -5
  124. package/dist/astro/routes/api/taxonomies/_name_/terms/_slug_.mjs +5 -5
  125. package/dist/astro/routes/api/taxonomies/_name_/terms/index.mjs +5 -5
  126. package/dist/astro/routes/api/taxonomies/index.mjs +5 -5
  127. package/dist/astro/routes/api/well-known/auth.mjs +2 -2
  128. package/dist/astro/routes/api/widget-areas/_name_/reorder.mjs +5 -5
  129. package/dist/astro/routes/api/widget-areas/_name_/widgets/_id_.mjs +5 -5
  130. package/dist/astro/routes/api/widget-areas/_name_/widgets.mjs +5 -5
  131. package/dist/astro/routes/api/widget-areas/_name_.mjs +3 -3
  132. package/dist/astro/routes/api/widget-areas/index.mjs +5 -5
  133. package/dist/astro/types.d.mts +3 -3
  134. package/dist/{byline-fields-yT4herdN.mjs → byline-fields-BRUB-Vla.mjs} +1 -1
  135. package/dist/{byline-fields-CXBvHvRM.d.mts → byline-fields-DS-K2aXR.d.mts} +262 -44
  136. package/dist/cli/index.mjs +54 -6
  137. package/dist/cli/plugin-kit.d.mts +8 -0
  138. package/dist/client/external-auth-headers.d.mts +1 -1
  139. package/dist/client/index.d.mts +24 -4
  140. package/dist/client/index.mjs +18 -4
  141. package/dist/{context-AJNd0tcG.mjs → context-BQ8O8pqD.mjs} +1 -1
  142. package/dist/{hitl-requests-Bee8Cjj8.mjs → hitl-requests-01Xe2FfD.mjs} +1 -1
  143. package/dist/{hitl-route-helpers-DtHaKGgm.mjs → hitl-route-helpers-vdROIary.mjs} +1 -1
  144. package/dist/index.d.mts +3 -3
  145. package/dist/index.mjs +6 -6
  146. package/dist/{jsonld-BFdufCos.d.mts → jsonld-Bn0uJ5Yz.d.mts} +1 -1
  147. package/dist/{mcp-reviewed-executor-DnlF7mIL.mjs → mcp-reviewed-executor-BCR-Pgtg.mjs} +2 -2
  148. package/dist/media/local-runtime.d.mts +2 -2
  149. package/dist/page/index.d.mts +3 -3
  150. package/dist/plugin-utils.d.mts +2 -2
  151. package/dist/plugins/adapt-sandbox-entry.d.mts +2 -2
  152. package/dist/{public-url-BVBNJJkd.d.mts → public-url-D_iHIBiH.d.mts} +1 -1
  153. package/dist/{publication-authorization-BVQ5rCAF.mjs → publication-authorization-DP_I_Emr.mjs} +178 -7
  154. package/dist/{redirects-E_B6hvuz.mjs → redirects-CWGZMRsj.mjs} +101 -3
  155. package/dist/runtime.d.mts +3 -3
  156. package/dist/{site-context-CzaEGizi.mjs → site-context-qU_bKUMe.mjs} +1 -1
  157. package/dist/{types-CQnfHvPQ.d.mts → types-y0lpkCXC.d.mts} +191 -108
  158. package/dist/ui/server-runtime.d.mts +5 -5
  159. package/dist/version-u-P3k0nP.mjs +6 -0
  160. package/package.json +1 -1
  161. package/dist/version-EHBE9US2.mjs +0 -6
  162. /package/dist/{allowed-origins-oVgzR3X5.mjs → allowed-origins-VLgv2PL1.mjs} +0 -0
  163. /package/dist/{challenge-store-DtdQHXf5.mjs → challenge-store-BMkL2kmt.mjs} +0 -0
  164. /package/dist/{mode-DqpBaEOy.mjs → mode-DPC7segX.mjs} +0 -0
  165. /package/dist/{portable-text-Ehqj3I_y.d.mts → portable-text-BYUu-wtj.d.mts} +0 -0
  166. /package/dist/{provider-loader-BIbIiz0P.d.mts → provider-loader-Db-pJFu3.d.mts} +0 -0
  167. /package/dist/{session-user-CYjNeJoD.mjs → session-user-BwliEFp0.mjs} +0 -0
  168. /package/dist/{setup-complete-DcAQzVsB.mjs → setup-complete-PvF8I7Oh.mjs} +0 -0
  169. /package/dist/{transport-BZ3aqdu7.d.mts → transport-CXkC1F2Z.d.mts} +0 -0
@@ -163,7 +163,10 @@ function parsePolicyContributions(value) {
163
163
  }
164
164
  function isPolicyContribution(value) {
165
165
  if (!isRecord$2(value)) return false;
166
- return typeof value.providerId === "string" && typeof value.policyVersion === "string" && typeof value.fingerprint === "string" && (value.reservationId === null || typeof value.reservationId === "string");
166
+ return typeof value.providerId === "string" && typeof value.policyVersion === "string" && isPolicyDisposition(value.disposition) && typeof value.fingerprint === "string" && (value.reservationId === null || typeof value.reservationId === "string");
167
+ }
168
+ function isPolicyDisposition(value) {
169
+ return value === "enforced" || value === "not_applicable" || value === "overridden";
167
170
  }
168
171
  function parseNullableRecord$1(value) {
169
172
  if (!value) return null;
@@ -452,9 +455,11 @@ function normalizePolicyContributions(contributions) {
452
455
  assertNonEmpty("Policy provider ID", contribution.providerId);
453
456
  assertNonEmpty("Policy version", contribution.policyVersion);
454
457
  assertNonEmpty("Policy fingerprint", contribution.fingerprint);
458
+ assertPolicyDisposition(contribution.disposition);
455
459
  return {
456
460
  providerId: contribution.providerId,
457
461
  policyVersion: contribution.policyVersion,
462
+ disposition: contribution.disposition,
458
463
  fingerprint: contribution.fingerprint,
459
464
  reservationId: normalizeOptionalString(contribution.reservationId)
460
465
  };
@@ -475,6 +480,9 @@ function normalizeOptionalString(value) {
475
480
  function assertNonEmpty(label, value) {
476
481
  if (value.length === 0) throw new Error(`${label} is required`);
477
482
  }
483
+ function assertPolicyDisposition(value) {
484
+ if (value !== "enforced" && value !== "not_applicable" && value !== "overridden") throw new Error("Publication release policy disposition is invalid");
485
+ }
478
486
 
479
487
  //#endregion
480
488
  //#region src/site-context/publication-authorization.ts
@@ -491,6 +499,7 @@ var PublicationAuthorizationService = class {
491
499
  hitlRequests;
492
500
  activity;
493
501
  releasePayloadBuilder;
502
+ reviewPayloadBuilder;
494
503
  policies;
495
504
  getSiteTimezone;
496
505
  now;
@@ -504,6 +513,7 @@ var PublicationAuthorizationService = class {
504
513
  handlers: options.handlers,
505
514
  reviewRequests: this.reviewRequests
506
515
  });
516
+ this.reviewPayloadBuilder = new ReviewPayloadBuilder(options.handlers);
507
517
  this.policies = [...options.policies ?? []].toSorted((left, right) => left.id.localeCompare(right.id));
508
518
  this.assertUniquePolicyIds();
509
519
  this.getSiteTimezone = options.getSiteTimezone ?? (async () => {
@@ -511,6 +521,133 @@ var PublicationAuthorizationService = class {
511
521
  });
512
522
  this.now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
513
523
  }
524
+ async checkPublicationReadiness(input) {
525
+ const generatedAt = this.now();
526
+ const operation = input.operation ?? "publish";
527
+ const siteTimezone = await this.getSiteTimezone();
528
+ const blockers = [];
529
+ const warnings = [];
530
+ if (input.actor.actorType === "system") blockers.push({
531
+ code: "ACTOR_NOT_ALLOWED",
532
+ source: "authorization",
533
+ message: "System actors must use the scheduled publication boundary"
534
+ });
535
+ if (operation === "schedule" && !input.scheduledAt) blockers.push({
536
+ code: "SCHEDULED_AT_REQUIRED",
537
+ source: "content",
538
+ message: "Scheduled publication requires a timestamp"
539
+ });
540
+ let target = null;
541
+ try {
542
+ const editorial = await this.reviewPayloadBuilder.buildContentReviewPayload({
543
+ collection: input.collection,
544
+ id: input.id
545
+ });
546
+ target = {
547
+ collection: editorial.collection,
548
+ entryId: editorial.entryId,
549
+ scope: editorial.scope,
550
+ operation,
551
+ liveRevisionId: editorial.liveRevisionId,
552
+ draftRevisionId: editorial.draftRevisionId,
553
+ reviewedRev: editorial.reviewedRev,
554
+ publishedAt: input.publishedAt ?? null,
555
+ scheduledAt: input.scheduledAt ?? null,
556
+ siteTimezone
557
+ };
558
+ if (!editorial.draftRevisionId) blockers.push({
559
+ code: "EXACT_DRAFT_REQUIRED",
560
+ source: "content",
561
+ message: "Publication requires an exact current Draft Revision"
562
+ });
563
+ } catch (error) {
564
+ blockers.push({
565
+ code: "CONTENT_RELEASE_TARGET_INVALID",
566
+ source: "content",
567
+ message: error instanceof Error ? error.message : "Publication target is invalid"
568
+ });
569
+ }
570
+ if (!input.editorialReviewRequestId) blockers.push({
571
+ code: "EDITORIAL_REVIEW_REQUIRED",
572
+ source: "editorial_review",
573
+ message: "Publication requires an approved Review for the exact current Draft"
574
+ });
575
+ else if (target && (operation !== "schedule" || input.scheduledAt)) try {
576
+ await this.releasePayloadBuilder.buildContentReleasePayload({
577
+ collection: input.collection,
578
+ id: input.id,
579
+ operation,
580
+ editorialReviewRequestId: input.editorialReviewRequestId,
581
+ publishedAt: input.publishedAt,
582
+ scheduledAt: input.scheduledAt,
583
+ siteTimezone
584
+ });
585
+ } catch (error) {
586
+ blockers.push({
587
+ code: "EDITORIAL_REVIEW_INVALID",
588
+ source: "editorial_review",
589
+ message: error instanceof Error ? error.message : "Editorial review is invalid"
590
+ });
591
+ }
592
+ if (isTokenAuthenticatedActor(input.actor)) if (!input.releaseHitlRequestId) blockers.push({
593
+ code: "RELEASE_HITL_REQUIRED",
594
+ source: "release_hitl",
595
+ message: "Token-authenticated publication requires approved release authorization"
596
+ });
597
+ else {
598
+ const request = await this.hitlRequests.findById(input.releaseHitlRequestId);
599
+ if (!request || !target || !basicReleaseHitlMatches(request, target, input.actor)) blockers.push({
600
+ code: "RELEASE_HITL_INVALID",
601
+ source: "release_hitl",
602
+ message: "Release authorization is not approved for the current target and actor"
603
+ });
604
+ }
605
+ if (target) {
606
+ const policyFindingGroups = await Promise.all(this.policies.map(async (policy) => {
607
+ if (!policy.checkReadiness) return [{
608
+ severity: "blocker",
609
+ code: "POLICY_READINESS_UNAVAILABLE",
610
+ source: "policy",
611
+ policyId: policy.id,
612
+ message: `Publication policy ${policy.id} has no read-only readiness check`
613
+ }];
614
+ try {
615
+ return (await policy.checkReadiness(target)).map((blocker) => ({
616
+ ...blocker,
617
+ source: "policy",
618
+ policyId: blocker.policyId ?? policy.id
619
+ }));
620
+ } catch (error) {
621
+ return [{
622
+ severity: "blocker",
623
+ code: "POLICY_READINESS_FAILED",
624
+ source: "policy",
625
+ policyId: policy.id,
626
+ message: error instanceof Error ? error.message : "Publication policy readiness failed"
627
+ }];
628
+ }
629
+ }));
630
+ for (const finding of policyFindingGroups.flat()) {
631
+ if (finding.severity === "warning") continue;
632
+ const { severity: _severity, ...blocker } = finding;
633
+ blockers.push(blocker);
634
+ }
635
+ warnings.push(...policyFindingGroups.flat().filter((finding) => finding.severity === "warning"));
636
+ }
637
+ const orderedBlockers = blockers.toSorted((left, right) => `${left.source}:${left.policyId ?? ""}:${left.code}:${left.message}`.localeCompare(`${right.source}:${right.policyId ?? ""}:${right.code}:${right.message}`));
638
+ const orderedWarnings = warnings.toSorted((left, right) => `${left.source}:${left.policyId ?? ""}:${left.code}:${left.message}`.localeCompare(`${right.source}:${right.policyId ?? ""}:${right.code}:${right.message}`));
639
+ const canForce = orderedBlockers.length === 0 && orderedWarnings.length > 0 && orderedWarnings.every((warning) => warning.overridable) && isHumanSessionActor(input.actor);
640
+ const ready = orderedBlockers.length === 0 && orderedWarnings.length === 0;
641
+ return {
642
+ ready,
643
+ canForce,
644
+ generatedAt,
645
+ nextAction: ready ? operation : canForce ? "confirm_policy_warnings" : "fix_release_blockers",
646
+ target,
647
+ blockers: orderedBlockers,
648
+ warnings: orderedWarnings
649
+ };
650
+ }
514
651
  async publishAuthorizedContent(input) {
515
652
  const siteTimezone = await this.getSiteTimezone();
516
653
  const authorized = await this.authorize({
@@ -529,7 +666,8 @@ var PublicationAuthorizationService = class {
529
666
  await this.logSuccess(input, authorized.release, consumed);
530
667
  return {
531
668
  grant: consumed,
532
- result
669
+ result,
670
+ receipt: publicationReceipt(consumed, "published")
533
671
  };
534
672
  }
535
673
  async scheduleAuthorizedContent(input) {
@@ -544,7 +682,8 @@ var PublicationAuthorizationService = class {
544
682
  await this.logSuccess(input, authorized.release, authorized.grant);
545
683
  return {
546
684
  grant: authorized.grant,
547
- result
685
+ result,
686
+ receipt: publicationReceipt(authorized.grant, "scheduled")
548
687
  };
549
688
  }
550
689
  async publishAuthorizedDueContent(input) {
@@ -576,7 +715,8 @@ var PublicationAuthorizationService = class {
576
715
  await this.logScheduledPublish(release, consumed);
577
716
  return {
578
717
  grant: consumed,
579
- result
718
+ result,
719
+ receipt: publicationReceipt(consumed, "published")
580
720
  };
581
721
  }
582
722
  async unscheduleAuthorizedContent(input) {
@@ -597,11 +737,12 @@ var PublicationAuthorizationService = class {
597
737
  }
598
738
  async authorize(input) {
599
739
  if (input.actor.actorType === "system") throw new PublicationAuthorizationError("ACTOR_NOT_ALLOWED", "System actors must use the scheduled publication boundary");
740
+ if ((input.policyOverrides?.length ?? 0) > 0 && !isHumanSessionActor(input.actor)) throw new PublicationAuthorizationError("POLICY_OVERRIDE_NOT_ALLOWED", "Only an authenticated human session may confirm publication policy warnings");
600
741
  let preparedPolicies = [];
601
742
  try {
602
743
  const activeGrant = await this.releaseGrants.findActiveForTarget(input.collection, input.id, input.operation);
603
744
  const baseRelease = await this.buildRelease(input, []);
604
- preparedPolicies = await this.preparePolicies(toPreparationTarget(baseRelease, activeGrant?.policyContributions ?? []));
745
+ preparedPolicies = await this.preparePolicies(toPreparationTarget(baseRelease, activeGrant?.policyContributions ?? [], input.actor, input.policyOverrides ?? []));
605
746
  const release = await this.buildRelease(input, preparedPolicies.map((prepared) => prepared.contribution));
606
747
  await this.validatePolicies(release, preparedPolicies);
607
748
  const tokenActor = isTokenAuthenticatedActor(input.actor);
@@ -778,7 +919,7 @@ var PublicationAuthorizationService = class {
778
919
  const currentByProvider = new Map(currentPolicies.map((prepared) => [prepared.contribution.providerId, prepared.contribution]));
779
920
  const replaced = this.restorePreparedPolicies(contributions).filter((prepared) => {
780
921
  const current = currentByProvider.get(prepared.contribution.providerId);
781
- return !current || current.reservationId !== prepared.contribution.reservationId || current.fingerprint !== prepared.contribution.fingerprint;
922
+ return !current || current.disposition !== prepared.contribution.disposition || current.reservationId !== prepared.contribution.reservationId || current.fingerprint !== prepared.contribution.fingerprint;
782
923
  });
783
924
  try {
784
925
  await this.releasePolicies(replaced, "release_grant_replaced");
@@ -795,6 +936,7 @@ var PublicationAuthorizationService = class {
795
936
  contribution: {
796
937
  providerId: contribution.providerId,
797
938
  policyVersion: contribution.policyVersion,
939
+ disposition: contribution.disposition,
798
940
  fingerprint: contribution.fingerprint,
799
941
  ...contribution.reservationId ? { reservationId: contribution.reservationId } : {}
800
942
  }
@@ -908,7 +1050,7 @@ var PublicationAuthorizationService = class {
908
1050
  }
909
1051
  }
910
1052
  };
911
- function toPreparationTarget(release, replacedPolicyContributions) {
1053
+ function toPreparationTarget(release, replacedPolicyContributions, actor, policyOverrides) {
912
1054
  return {
913
1055
  collection: release.collection,
914
1056
  entryId: release.entryId,
@@ -922,9 +1064,12 @@ function toPreparationTarget(release, replacedPolicyContributions) {
922
1064
  publishedAt: release.publishedAt,
923
1065
  scheduledAt: release.scheduledAt,
924
1066
  siteTimezone: release.siteTimezone,
1067
+ actor,
1068
+ policyOverrides,
925
1069
  replacedPolicyContributions: replacedPolicyContributions.map((contribution) => ({
926
1070
  providerId: contribution.providerId,
927
1071
  policyVersion: contribution.policyVersion,
1072
+ disposition: contribution.disposition,
928
1073
  fingerprint: contribution.fingerprint,
929
1074
  ...contribution.reservationId ? { reservationId: contribution.reservationId } : {}
930
1075
  }))
@@ -936,6 +1081,29 @@ function toStoredPolicyContributions(contributions) {
936
1081
  function matchesReleaseHitl(request, release, actor) {
937
1082
  return request.status === "approved" && request.scope === release.scope && request.actionType === release.actionType && request.targetRefType === "content" && request.targetRefId === release.entryId && request.requestedByActorType === actor.actorType && request.requestedByActorId === actor.actorId && extractActionHash(request.metadata) === release.actionHash;
938
1083
  }
1084
+ function basicReleaseHitlMatches(request, target, actor) {
1085
+ return request.status === "approved" && request.scope === target.scope && request.actionType === (target.operation === "publish" ? "content.release.publish" : "content.release.schedule") && request.targetRefType === "content" && request.targetRefId === target.entryId && request.requestedByActorType === actor.actorType && request.requestedByActorId === actor.actorId;
1086
+ }
1087
+ function publicationReceipt(grant, status) {
1088
+ return {
1089
+ id: grant.id,
1090
+ status,
1091
+ collection: grant.collection,
1092
+ contentId: grant.entryId,
1093
+ liveRevisionId: status === "published" ? grant.draftRevisionId : grant.liveRevisionId,
1094
+ draftRevisionId: grant.draftRevisionId,
1095
+ editorialReviewRequestId: grant.editorialReviewRequestId,
1096
+ releaseHitlRequestId: grant.releaseHitlRequestId,
1097
+ actionHash: grant.actionHash,
1098
+ policyContributions: grant.policyContributions,
1099
+ authorizedByActorType: grant.authorizedByActorType,
1100
+ authorizedByActorId: grant.authorizedByActorId,
1101
+ createdAt: grant.createdAt,
1102
+ consumedAt: grant.consumedAt,
1103
+ publishedAt: grant.publishedAt ?? (status === "published" ? grant.consumedAt : null),
1104
+ scheduledAt: grant.scheduledAt
1105
+ };
1106
+ }
939
1107
  function reviewMatchesGrant(review, grant) {
940
1108
  return review.status === "approved" && review.collection === grant.collection && review.entryId === grant.entryId && review.scope === grant.scope && review.liveRevisionId === grant.liveRevisionId && review.draftRevisionId === grant.draftRevisionId && review.reviewedRev === grant.reviewedRev && review.actionType === "content.publish";
941
1109
  }
@@ -976,6 +1144,9 @@ function isTokenAuthenticatedActor(actor) {
976
1144
  const authMethod = actor.authMetadata.auth_method;
977
1145
  return authMethod === "api_token" || authMethod === "oauth_token";
978
1146
  }
1147
+ function isHumanSessionActor(actor) {
1148
+ return actor.actorType === "user" && actor.authMetadata.auth_method === "session";
1149
+ }
979
1150
  function errorReason(error) {
980
1151
  if (error instanceof PublicationAuthorizationError) return error.code.toLowerCase();
981
1152
  return "release_authorization_failed";
@@ -155,6 +155,11 @@ const contentDateOverride = z.iso.datetime({
155
155
  offset: true,
156
156
  message: "must be an ISO 8601 datetime"
157
157
  }).nullish();
158
+ const publicationPolicyOverrideSchema = z.object({
159
+ policyId: z.string().min(1),
160
+ warningCode: z.string().min(1),
161
+ fingerprint: z.string().min(1)
162
+ });
158
163
  const contentCreateBody = z.object({
159
164
  data: z.record(z.string(), z.unknown()),
160
165
  slug: z.string().nullish(),
@@ -183,7 +188,8 @@ const contentScheduleBody = z.object({
183
188
  example: "2025-06-15T09:00:00Z"
184
189
  }),
185
190
  reviewRequestId: z.string().min(1, "reviewRequestId is required").meta({ description: "Approved editorial Review Request bound to the exact Draft Revision" }),
186
- releaseAuthorizationId: z.string().min(1).optional().meta({ description: "Approved exact release HITL Request required for token actors" })
191
+ releaseAuthorizationId: z.string().min(1).optional().meta({ description: "Approved exact release HITL Request required for token actors" }),
192
+ policyOverrides: z.array(publicationPolicyOverrideSchema).max(20).optional()
187
193
  }).meta({ id: "ContentScheduleBody" });
188
194
  const contentPublishBody = z.object({
189
195
  publishedAt: z.iso.datetime({
@@ -191,8 +197,99 @@ const contentPublishBody = z.object({
191
197
  message: "must be an ISO 8601 datetime"
192
198
  }).optional().meta({ description: "Optional ISO 8601 datetime to backdate the publish. Requires content:publish_any permission. Without this, existing published_at is preserved on re-publish." }),
193
199
  reviewRequestId: z.string().min(1, "reviewRequestId is required").meta({ description: "Approved editorial Review Request bound to the exact Draft Revision" }),
194
- releaseAuthorizationId: z.string().min(1).optional().meta({ description: "Approved exact release HITL Request required for token actors" })
200
+ releaseAuthorizationId: z.string().min(1).optional().meta({ description: "Approved exact release HITL Request required for token actors" }),
201
+ policyOverrides: z.array(publicationPolicyOverrideSchema).max(20).optional()
195
202
  }).meta({ id: "ContentPublishBody" });
203
+ const contentPublicationReceiptSchema = z.object({
204
+ id: z.string(),
205
+ status: z.enum(["published", "scheduled"]),
206
+ collection: z.string(),
207
+ contentId: z.string(),
208
+ liveRevisionId: z.string().nullable(),
209
+ draftRevisionId: z.string().nullable(),
210
+ editorialReviewRequestId: z.string(),
211
+ releaseHitlRequestId: z.string().nullable(),
212
+ actionHash: z.string(),
213
+ policyContributions: z.array(z.object({
214
+ providerId: z.string(),
215
+ policyVersion: z.string(),
216
+ disposition: z.enum([
217
+ "enforced",
218
+ "not_applicable",
219
+ "overridden"
220
+ ]),
221
+ fingerprint: z.string(),
222
+ reservationId: z.string().nullable()
223
+ })),
224
+ authorizedByActorType: z.enum([
225
+ "user",
226
+ "api_token",
227
+ "system"
228
+ ]),
229
+ authorizedByActorId: z.string(),
230
+ createdAt: z.string(),
231
+ consumedAt: z.string().nullable(),
232
+ publishedAt: z.string().nullable(),
233
+ scheduledAt: z.string().nullable()
234
+ }).meta({ id: "ContentPublicationReceipt" });
235
+ const contentReleaseReadinessQuery = z.object({
236
+ operation: z.enum(["publish", "schedule"]).optional(),
237
+ reviewRequestId: z.string().optional(),
238
+ releaseAuthorizationId: z.string().optional(),
239
+ publishedAt: z.iso.datetime({ offset: true }).optional(),
240
+ scheduledAt: z.iso.datetime({ offset: true }).optional(),
241
+ locale: localeCode.optional()
242
+ }).meta({ id: "ContentReleaseReadinessQuery" });
243
+ const contentReleaseReadinessResponseSchema = z.object({
244
+ ready: z.boolean(),
245
+ canForce: z.boolean(),
246
+ generatedAt: z.string(),
247
+ nextAction: z.enum([
248
+ "publish",
249
+ "schedule",
250
+ "confirm_policy_warnings",
251
+ "fix_release_blockers"
252
+ ]),
253
+ target: z.object({
254
+ collection: z.string(),
255
+ entryId: z.string(),
256
+ scope: z.string(),
257
+ operation: z.enum(["publish", "schedule"]),
258
+ liveRevisionId: z.string().nullable(),
259
+ draftRevisionId: z.string().nullable(),
260
+ reviewedRev: z.string(),
261
+ publishedAt: z.string().nullable(),
262
+ scheduledAt: z.string().nullable(),
263
+ siteTimezone: z.string()
264
+ }).nullable(),
265
+ blockers: z.array(z.object({
266
+ code: z.string(),
267
+ source: z.enum([
268
+ "content",
269
+ "editorial_review",
270
+ "release_hitl",
271
+ "authorization",
272
+ "policy"
273
+ ]),
274
+ message: z.string(),
275
+ policyId: z.string().optional()
276
+ })),
277
+ warnings: z.array(z.object({
278
+ severity: z.literal("warning"),
279
+ code: z.string(),
280
+ source: z.enum([
281
+ "content",
282
+ "editorial_review",
283
+ "release_hitl",
284
+ "authorization",
285
+ "policy"
286
+ ]),
287
+ message: z.string(),
288
+ policyId: z.string().optional(),
289
+ fingerprint: z.string(),
290
+ overridable: z.boolean()
291
+ }))
292
+ }).meta({ id: "ContentReleaseReadinessResponse" });
196
293
  const contentPreviewUrlBody = z.object({
197
294
  expiresIn: z.union([z.string(), z.number()]).optional(),
198
295
  pathPattern: z.string().optional()
@@ -234,6 +331,7 @@ const contentResponseSchema = z.object({
234
331
  item: contentItemSchema,
235
332
  _rev: z.string().optional().meta({ description: "Opaque revision token for optimistic concurrency" })
236
333
  }).meta({ id: "ContentResponse" });
334
+ const contentPublishResponseSchema = contentResponseSchema.extend({ publicationReceipt: contentPublicationReceiptSchema }).meta({ id: "ContentPublishResponse" });
237
335
  /** Response for content list endpoints */
238
336
  const contentListResponseSchema = z.object({
239
337
  items: z.array(contentItemSchema),
@@ -1134,4 +1232,4 @@ const notFoundSummarySchema = z.object({
1134
1232
  const notFoundSummaryResponseSchema = z.object({ items: z.array(notFoundSummarySchema) }).meta({ id: "NotFoundSummaryResponse" });
1135
1233
 
1136
1234
  //#endregion
1137
- export { createMenuBody as $, contentCompareResponseSchema as $t, searchRebuildBody as A, localeCode as An, fieldResponseSchema as At, updateSectionBody as B, mediaConfirmBody as Bt, userDetailSchema as C, contentBylineInputSchema as Cn, collectionResponseSchema as Ct, usersListQuery as D, cursorPaginationQuery as Dn, createFieldBody as Dt, userUpdateBody as E, countResponseSchema as En, createCollectionBody as Et, siteSettingsSchema as F, successEnvelope as Fn, schemaExportQuery as Ft, taxonomyListResponseSchema as G, mediaListResponseSchema as Gt, createTermBody as H, mediaExistingResponseSchema as Ht, createSectionBody as I, updateCollectionBody as It, termResponseSchema as J, mediaUpdateBody as Jt, termGetResponseSchema as K, mediaProviderListQuery as Kt, sectionListResponseSchema as L, updateFieldBody as Lt, searchResultSchema as M, offsetPaginationQuery as Mn, orphanRegisterBody as Mt, searchSuggestQuery as N, roleLevel as Nn, orphanedTableListResponseSchema as Nt, searchEnableBody as O, deleteResponseSchema as On, fieldListResponseSchema as Ot, settingsUpdateBody as P, slugPattern as Pn, orphanedTableSchema as Pt, updateTermBody as Q, contentAuthorsResponseSchema as Qt, sectionSchema as R, DEFAULT_MAX_UPLOAD_SIZE as Rt, allowedDomainUpdateBody as S, bylinesListQuery as Sn, collectionListResponseSchema as St, userSchema as T, apiErrorSchema as Tn, collectionWithFieldsResponseSchema as Tt, taxonomyDefSchema as U, mediaItemSchema as Ut, createTaxonomyDefBody as V, mediaConfirmResponseSchema as Vt, taxonomyDefTranslationsSchema as W, mediaListQuery as Wt, termTranslationsSchema as X, mediaUploadUrlResponseSchema as Xt, termSchema as Y, mediaUploadUrlBody as Yt, termWithCountSchema as Z, contentAuthorSchema as Zt, widgetAreaSchema as _, bylineCreateBody as _n, createCommentBody as _t, notFoundPruneBody as a, contentPublishBody as an, menuTranslationsSchema as at, widgetSchema as b, bylineSummarySchema as bn, publicCommentSchema as bt, notFoundSummarySchema as c, contentSeoInput as cn, updateMenuBody as ct, redirectsListQuery as d, contentTranslationSchema as dn, commentBulkBody as dt, contentCreateBody as en, createMenuItemBody as et, updateRedirectBody as f, contentTranslationsResponseSchema as fn, commentBulkResponseSchema as ft, updateWidgetBody as g, trashedContentListResponseSchema as gn, commentStatusBody as gt, reorderWidgetsBody as h, trashedContentItemSchema as hn, commentSchema as ht, notFoundListResponseSchema as i, contentPreviewUrlBody as in, menuSchema as it, searchResponseSchema as j, localeFilterQuery as jn, fieldSchema as jt, searchQuery as k, httpUrl as kn, fieldReorderBody as kt, redirectListResponseSchema as l, contentSeoSchema as ln, updateMenuItemBody as lt, createWidgetBody as m, contentUpdateBody as mn, commentListQuery as mt, notFoundEntrySchema as n, contentListQuery as nn, menuItemTypeEnum as nt, notFoundSummaryQuery as o, contentResponseSchema as on, menuWithItemsSchema as ot, createWidgetAreaBody as p, contentTrashQuery as pn, commentCountsResponseSchema as pt, termListResponseSchema as q, mediaResponseSchema as qt, notFoundListQuery as r, contentListResponseSchema as rn, menuListItemSchema as rt, notFoundSummaryResponseSchema as s, contentScheduleBody as sn, reorderMenuItemsBody as st, createRedirectBody as t, contentItemSchema as tn, menuItemSchema as tt, redirectSchema as u, contentTermsBody as un, adminCommentListResponseSchema as ut, widgetAreaWithWidgetsAndCountSchema as v, bylineCreditSchema as vn, createReactionBody as vt, userListResponseSchema as w, VALID_ROLE_LEVELS as wn, collectionSchema as wt, allowedDomainCreateBody as x, bylineUpdateBody as xn, collectionGetQuery as xt, widgetAreaWithWidgetsSchema as y, bylineListResponseSchema as yn, publicCommentListResponseSchema as yt, sectionsListQuery as z, formatFileSize as zt };
1235
+ export { createMenuBody as $, contentCompareResponseSchema as $t, searchRebuildBody as A, countResponseSchema as An, fieldResponseSchema as At, updateSectionBody as B, mediaConfirmBody as Bt, userDetailSchema as C, bylineListResponseSchema as Cn, collectionResponseSchema as Ct, usersListQuery as D, contentBylineInputSchema as Dn, createFieldBody as Dt, userUpdateBody as E, bylinesListQuery as En, createCollectionBody as Et, siteSettingsSchema as F, localeFilterQuery as Fn, schemaExportQuery as Ft, taxonomyListResponseSchema as G, mediaListResponseSchema as Gt, createTermBody as H, mediaExistingResponseSchema as Ht, createSectionBody as I, offsetPaginationQuery as In, updateCollectionBody as It, termResponseSchema as J, mediaUpdateBody as Jt, termGetResponseSchema as K, mediaProviderListQuery as Kt, sectionListResponseSchema as L, roleLevel as Ln, updateFieldBody as Lt, searchResultSchema as M, deleteResponseSchema as Mn, orphanRegisterBody as Mt, searchSuggestQuery as N, httpUrl as Nn, orphanedTableListResponseSchema as Nt, searchEnableBody as O, VALID_ROLE_LEVELS as On, fieldListResponseSchema as Ot, settingsUpdateBody as P, localeCode as Pn, orphanedTableSchema as Pt, updateTermBody as Q, contentAuthorsResponseSchema as Qt, sectionSchema as R, slugPattern as Rn, DEFAULT_MAX_UPLOAD_SIZE as Rt, allowedDomainUpdateBody as S, bylineCreditSchema as Sn, collectionListResponseSchema as St, userSchema as T, bylineUpdateBody as Tn, collectionWithFieldsResponseSchema as Tt, taxonomyDefSchema as U, mediaItemSchema as Ut, createTaxonomyDefBody as V, mediaConfirmResponseSchema as Vt, taxonomyDefTranslationsSchema as W, mediaListQuery as Wt, termTranslationsSchema as X, mediaUploadUrlResponseSchema as Xt, termSchema as Y, mediaUploadUrlBody as Yt, termWithCountSchema as Z, contentAuthorSchema as Zt, widgetAreaSchema as _, contentTrashQuery as _n, createCommentBody as _t, notFoundPruneBody as a, contentPublicationReceiptSchema as an, menuTranslationsSchema as at, widgetSchema as b, trashedContentListResponseSchema as bn, publicCommentSchema as bt, notFoundSummarySchema as c, contentReleaseReadinessQuery as cn, updateMenuBody as ct, redirectsListQuery as d, contentScheduleBody as dn, commentBulkBody as dt, contentCreateBody as en, createMenuItemBody as et, updateRedirectBody as f, contentSeoInput as fn, commentBulkResponseSchema as ft, updateWidgetBody as g, contentTranslationsResponseSchema as gn, commentStatusBody as gt, reorderWidgetsBody as h, contentTranslationSchema as hn, commentSchema as ht, notFoundListResponseSchema as i, contentPreviewUrlBody as in, menuSchema as it, searchResponseSchema as j, cursorPaginationQuery as jn, fieldSchema as jt, searchQuery as k, apiErrorSchema as kn, fieldReorderBody as kt, redirectListResponseSchema as l, contentReleaseReadinessResponseSchema as ln, updateMenuItemBody as lt, createWidgetBody as m, contentTermsBody as mn, commentListQuery as mt, notFoundEntrySchema as n, contentListQuery as nn, menuItemTypeEnum as nt, notFoundSummaryQuery as o, contentPublishBody as on, menuWithItemsSchema as ot, createWidgetAreaBody as p, contentSeoSchema as pn, commentCountsResponseSchema as pt, termListResponseSchema as q, mediaResponseSchema as qt, notFoundListQuery as r, contentListResponseSchema as rn, menuListItemSchema as rt, notFoundSummaryResponseSchema as s, contentPublishResponseSchema as sn, reorderMenuItemsBody as st, createRedirectBody as t, contentItemSchema as tn, menuItemSchema as tt, redirectSchema as u, contentResponseSchema as un, adminCommentListResponseSchema as ut, widgetAreaWithWidgetsAndCountSchema as v, contentUpdateBody as vn, createReactionBody as vt, userListResponseSchema as w, bylineSummarySchema as wn, collectionSchema as wt, allowedDomainCreateBody as x, bylineCreateBody as xn, collectionGetQuery as xt, widgetAreaWithWidgetsSchema as y, trashedContentItemSchema as yn, publicCommentListResponseSchema as yt, sectionsListQuery as z, successEnvelope as zn, formatFileSize as zt };
@@ -1,10 +1,10 @@
1
- import { as as EntryFilter, cs as dinewayLoader, is as EntryData, ls as getDb, rs as CollectionFilter } from "./types-CQnfHvPQ.mjs";
1
+ import { Ts as getDb, bs as EntryData, ws as dinewayLoader, xs as EntryFilter, ys as CollectionFilter } from "./types-y0lpkCXC.mjs";
2
2
  import "./types-BFeoAIHl.mjs";
3
3
  import "./runner-Bcy5w0vj.mjs";
4
4
  import "./index-DybFmYtZ.mjs";
5
5
  import "./types-S9VIopdY.mjs";
6
6
  import "./validate-YiX3rly5.mjs";
7
- import "./byline-fields-CXBvHvRM.mjs";
7
+ import "./byline-fields-DS-K2aXR.mjs";
8
8
  import "./types-BsTXSvKG.mjs";
9
- import { t as getMediaProvider } from "./provider-loader-BIbIiz0P.mjs";
9
+ import { t as getMediaProvider } from "./provider-loader-Db-pJFu3.mjs";
10
10
  export { type CollectionFilter, type EntryData, type EntryFilter, dinewayLoader, getDb, getMediaProvider };
@@ -3,7 +3,7 @@ import { i as encodeCursor, r as decodeCursor } from "./types-Bshd_6wQ.mjs";
3
3
  import { t as ContentRepository } from "./content-Cbl8HbIR.mjs";
4
4
  import { t as SiteActivityRepository } from "./site-activity-BVK40wCy.mjs";
5
5
  import { t as ReviewRequestRepository } from "./review-requests-CObSuTYU.mjs";
6
- import { o as HitlRequestRepository } from "./publication-authorization-BVQ5rCAF.mjs";
6
+ import { o as HitlRequestRepository } from "./publication-authorization-DP_I_Emr.mjs";
7
7
  import { r as isPattern } from "./patterns-CoqlXUvk.mjs";
8
8
  import { a as ContextRepository, i as parseSiteBriefingScope, l as handlePluginList } from "./briefing-GFhLTLJo.mjs";
9
9
  import { t as FTSManager } from "./fts-manager-Zo9uhGel.mjs";