@cardinali-studio/adminkit 2.2.10 → 2.2.12

package/dist/form/media/useMediaLibrary.js

@@ -9,8 +9,10 @@
  * una sola implementazione, due impaginazioni.
  */
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { api, uploadQueue, ApiError } from "../../api.js";
+import { api, ApiError } from "../../api.js";
 import { storageKey } from "../../config.js";
+import { contentPersistenceMode } from "../../app/site.js";
+import { startMediaUpload, useMediaUploadCompletions } from "./media-upload-queue.js";
 /* Quanti file per richiesta nelle operazioni lunghe (cestina, sposta). Ogni file costa al
  * server tre operazioni su R2 — legge, riscrive altrove, cancella — su oggetti da qualche MB.
  * Dieci tiene una richiesta sotto i pochi secondi, che è la soglia oltre la quale chi guarda
@@ -34,9 +36,15 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
     const [busy, setBusy] = useState(false);
     const [loaded, setLoaded] = useState(false);
     const [error, setError] = useState(null);
+    const [mediaOperations, setMediaOperations] = useState([]);
     const [progress, setProgress] = useState(null);
     const [uploadOpen, setUploadOpen] = useState(false);
     const [viewing, setViewing] = useState(null);
+    const [autoWebp, setAutoWebpState] = useState(true);
+    const [settingsBusy, setSettingsBusy] = useState(false);
+    const [settingsLoaded, setSettingsLoaded] = useState(false);
+    const mediaUploadCompletions = useMediaUploadCompletions();
+    const seenMediaUploadCompletions = useRef(mediaUploadCompletions);
     // Le preferenze di ordinamento restano dov'erano — il prefisso che il sito dichiara al
     // bootstrap ricostruisce le chiavi di prima: la memoria muscolare di chi usa il pannello
     // tutti i giorni non ha motivo di azzerarsi per una riorganizzazione dei sorgenti.
@@ -54,7 +62,13 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         setBusy(true);
         setError(null);
         try {
-            const [a, f] = await Promise.all([api.assets(p), api.folders()]);
+            const [a, f, journal] = await Promise.all([
+                api.assets(p),
+                api.folders(),
+                mode === "manage" && contentPersistenceMode() === "d1"
+                    ? api.mediaOperations()
+                    : Promise.resolve({ ok: true, operations: [] }),
+            ]);
             if (fallback && p && !(f.folders ?? []).some((x) => p === x.prefix || p.startsWith(x.prefix))) {
                 setBusy(false);
                 return load("");
@@ -68,6 +82,7 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
             setFiles(a.files ?? []);
             setSubfolders(a.folders ?? []);
             setFolders(f.folders ?? []);
+            setMediaOperations(journal.operations ?? []);
             setPrefix(p);
             setSelected(new Set());
             setViewing(null);
@@ -88,7 +103,7 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         finally {
             setBusy(false);
         }
-    }, [remember]);
+    }, [remember, mode]);
     /* Caricamento PIGRO come per la home: chi apre l'admin sulle pagine non paga l'elenco del
      * bucket. `loaded` e non `files.length`, altrimenti una cartella vuota ritenterebbe all'infinito.
      *
@@ -116,6 +131,29 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         void load(start, true);
     }, [active, loaded, busy, error, load, remember]);
     useEffect(() => { localStorage.setItem(storageKey("sortKey"), sortKey); localStorage.setItem(storageKey("sortDir"), sortDir); }, [sortKey, sortDir]);
+    /* Questa preferenza è del SITO, non del browser: il backend la conserva nel bucket Media.
+     * Finché non arriva la risposta vale il default ON, così anche i siti già esistenti hanno il
+     * nuovo comportamento senza migrazioni. Si carica solo nella vista di gestione: il picker non
+     * offre upload e non deve fare una richiesta che non userà. */
+    useEffect(() => {
+        if (mode !== "manage" || !active || settingsLoaded)
+            return;
+        setSettingsBusy(true);
+        void api.mediaSettings()
+            .then((result) => { setAutoWebpState(result.settings.autoWebp); setSettingsLoaded(true); })
+            .catch((e) => setError(e instanceof ApiError ? e.message : String(e)))
+            .finally(() => setSettingsBusy(false));
+    }, [mode, active, settingsLoaded]);
+    /* Un upload può finire mentre si guarda un'altra sezione. Al ritorno ricarichiamo la
+     * cartella corrente una volta sola, senza riportare l'utente nella cartella in cui il job era
+     * partito. Lo stato della coda è esterno a React, quindi sopravvive alla navigazione. */
+    useEffect(() => {
+        if (!active || seenMediaUploadCompletions.current === mediaUploadCompletions)
+            return;
+        seenMediaUploadCompletions.current = mediaUploadCompletions;
+        if (loaded)
+            void load(prefix);
+    }, [active, mediaUploadCompletions, loaded, load, prefix]);
     /* Chiudere o ricaricare mentre un'operazione è in corso la interrompe: il gruppo in volo non
      * arriva mai. Ora ogni gruppo è definitivo, quindi si perde poco — ma vale comunque la pena
      * chiedere, perché è esattamente il gesto che uno fa quando "non sta succedendo niente". */
@@ -164,26 +202,50 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         const arr = Array.from(list);
         if (!arr.length)
             return true;
-        setProgress({ done: 0, total: arr.length, verb: "Carico" });
-        const errs = [];
+        let convert = autoWebp;
+        /* Evita la piccola finestra fra apertura dei Media e arrivo dell'impostazione: se sul sito
+           la conversione è OFF, un upload immediato non deve partire col default ON. */
+        if (!settingsLoaded) {
+            try {
+                const result = await api.mediaSettings();
+                convert = result.settings.autoWebp;
+                setAutoWebpState(convert);
+                setSettingsLoaded(true);
+            }
+            catch (e) {
+                setError(e instanceof ApiError ? e.message : String(e));
+                return false;
+            }
+        }
+        const destination = prefix
+            ? seenLabels.current[prefix] || prefix.replace(/\/$/, "").split("/").pop() || prefix
+            : "Senza cartella";
+        startMediaUpload({
+            prefix,
+            title: `${arr.length} file · ${destination}`,
+            files: arr,
+            autoWebp: convert,
+        });
+        return true;
+    }, [prefix, autoWebp, settingsLoaded]);
+    const setAutoWebp = useCallback(async (on) => {
+        const previous = autoWebp;
+        setAutoWebpState(on);
+        setSettingsBusy(true);
+        setError(null);
         try {
-            await uploadQueue(prefix, arr, (done, total, _r, err) => {
-                setProgress({ done, total, verb: "Carico" });
-                if (err)
-                    errs.push(err);
-            });
+            const result = await api.saveMediaSettings(on);
+            setAutoWebpState(result.settings.autoWebp);
+            setSettingsLoaded(true);
+        }
+        catch (e) {
+            setAutoWebpState(previous);
+            setError(e instanceof ApiError ? e.message : String(e));
         }
         finally {
-            setProgress(null);
-            // SEMPRE, anche se qualcosa è fallito: dopo un'operazione a metà l'elenco che si vede è
-            // una bugia, ed è peggio dell'errore.
-            await load(prefix);
+            setSettingsBusy(false);
         }
-        // Dopo `load`, che azzera il messaggio: prima veniva scritto e subito cancellato.
-        if (errs.length)
-            setError(`Non caricati: ${errs.join("; ")}`);
-        return errs.length === 0;
-    }, [prefix, load]);
+    }, [autoWebp]);
     const labelOf = useCallback((p) => {
         const f = folders.find((x) => x.prefix === p) ?? subfolders.find((x) => x.prefix === p);
         return f?.label || seenLabels.current[p] || p.replace(/\/$/, "").split("/").pop() || "";
@@ -469,6 +531,44 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
     }, [prefix, load, moveFolder]);
     /** Cestina una cartella con tutto quello che contiene. È `remove` con una lista di uno. */
     const removeFolder = useCallback((target) => remove([target]), [remove]);
+    const resumeMedia = useCallback(async (operation) => {
+        if (!operation.releaseId)
+            return;
+        setBusy(true);
+        setError(null);
+        let failure = null;
+        try {
+            await api.resumeMediaOperation(operation.operationId, operation.releaseId);
+        }
+        catch (e) {
+            failure = e instanceof ApiError ? e.message : String(e);
+        }
+        finally {
+            setBusy(false);
+            await load(prefix);
+            if (failure)
+                setError(failure);
+        }
+    }, [load, prefix]);
+    const cancelMedia = useCallback(async (operation) => {
+        if (!confirm("Annullare questa operazione Media? Le copie già preparate resteranno disponibili nella libreria."))
+            return;
+        setBusy(true);
+        setError(null);
+        let failure = null;
+        try {
+            await api.cancelMediaOperation(operation.operationId);
+        }
+        catch (e) {
+            failure = e instanceof ApiError ? e.message : String(e);
+        }
+        finally {
+            setBusy(false);
+            await load(prefix);
+            if (failure)
+                setError(failure);
+        }
+    }, [load, prefix]);
     const step = useCallback((delta) => {
         setViewing((i) => {
             if (i === null)
@@ -478,8 +578,8 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         });
     }, [shown.length]);
     return {
-        mode, multiple, prefix, folders, subfolders, shown, selected, busy, error, progress,
-        sortKey, sortDir, uploadOpen, viewing,
+        mode, multiple, prefix, folders, subfolders, shown, selected, busy, error, mediaOperations, progress,
+        sortKey, sortDir, uploadOpen, viewing, autoWebp, settingsBusy,
         go: (p) => void load(p),
         reload: () => void load(prefix),
         toggle, setAll,
@@ -487,9 +587,10 @@ export function useMediaLibrary({ mode, multiple = true, active = true, remember
         flipDir: () => setSortDir((d) => (d === "asc" ? "desc" : "asc")),
         upload,
         setUploadOpen,
+        setAutoWebp,
         view: setViewing,
         step,
-        move, remove, newFolder, renameFolder, removeFolder, labelOf,
+        move, remove, newFolder, renameFolder, removeFolder, resumeMedia, cancelMedia, labelOf,
         clearError: () => setError(null),
     };
 }

package/dist/functions/_shared/assets.js

@@ -32,8 +32,9 @@ export function sanitizeName(name) {
 export function guessMime(key) {
   const e = (key.split(".").pop() || "").toLowerCase();
   return {
-    jpg: "image/jpeg", jpeg: "image/jpeg", png: "image/png", webp: "image/webp",
-    gif: "image/gif", avif: "image/avif", svg: "image/svg+xml",
+    jpg: "image/jpeg", jpeg: "image/jpeg", jfif: "image/jpeg", png: "image/png", webp: "image/webp",
+    gif: "image/gif", avif: "image/avif", heic: "image/heic", heif: "image/heif",
+    tif: "image/tiff", tiff: "image/tiff", bmp: "image/bmp", svg: "image/svg+xml",
     mp4: "video/mp4", webm: "video/webm", mov: "video/quicktime", pdf: "application/pdf",
   }[e] || "application/octet-stream";
 }

package/dist/functions/_shared/d1-media.js

@@ -0,0 +1,317 @@
+/* D1-mode Media bridge. It deliberately owns no site schema: the site
+ * validator remains the authority for every draft revision generated by an
+ * explicit Media operation. Git is never consulted from this module. */
+import {
+  canonicalChecksum, canonicalJson, contentSaveRequestChecksum, D1ContentRepository,
+} from "../../persistence.js";
+import {
+  D1MediaOperationRepository, prepareMediaCopy,
+} from "../../media.js";
+import { validateContentDocument } from "../site.js";
+import { isKey, moveToTrash, sanitizeName } from "./assets.js";
+
+const MEDIA_PREFIX = "/media/";
+
+function mediaUrl(key) { return MEDIA_PREFIX + key.split("/").map(encodeURIComponent).join("/"); }
+
+function editor(data) {
+  const payload = data?.cloudflareAccess?.JWT?.payload;
+  if (!payload?.sub) throw new Error("unauthenticated");
+  return { subject: String(payload.sub), label: String(payload.email || payload.name || "Admin").slice(0, 200) };
+}
+
+function operationId(value) {
+  if (value === undefined || value === null || value === "") return crypto.randomUUID();
+  if (typeof value !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) throw new Error("invalid_media_operation");
+  return value;
+}
+
+function replaceBoundedUrl(value, from, to) {
+  let cursor = 0;
+  let next = "";
+  while (cursor < value.length) {
+    const found = value.indexOf(from, cursor);
+    if (found < 0) return next + value.slice(cursor);
+    const after = value[found + from.length];
+    /* A media key is a path, not a string prefix. Query/fragment suffixes and
+     * further URL/path characters belong to a different reference and must
+     * not be rewritten accidentally. */
+    if (after && /[A-Za-z0-9._~%!$&'()*+,;=:@/?#-]/.test(after)) {
+      next += value.slice(cursor, found + from.length);
+      cursor = found + from.length;
+      continue;
+    }
+    next += value.slice(cursor, found) + to;
+    cursor = found + from.length;
+  }
+  return next;
+}
+
+function replaceText(value, replacements, removals) {
+  let next = value;
+  for (const [from, to] of Object.entries(replacements)) next = replaceBoundedUrl(next, from, to);
+  for (const from of removals) next = replaceBoundedUrl(next, from, "");
+  return next;
+}
+
+/** JSON Media values are intentionally rewritten only as complete public URLs
+ * (or a URL embedded in Markdown). Arrays lose an exact removed URL; scalar
+ * slots become empty strings and are then validated by the site's schema. */
+function rewriteValue(value, replacements, removals, inArray = false) {
+  if (typeof value === "string") {
+    if (removals.has(value) && inArray) return { changed: true, removed: true };
+    const next = replaceText(value, replacements, removals);
+    return { changed: next !== value, value: next };
+  }
+  if (Array.isArray(value)) {
+    let changed = false;
+    const next = [];
+    for (const item of value) {
+      const result = rewriteValue(item, replacements, removals, true);
+      changed ||= result.changed;
+      if (!result.removed) next.push(result.value);
+    }
+    return { changed, value: next };
+  }
+  if (value && typeof value === "object") {
+    let changed = false;
+    const next = {};
+    for (const [key, item] of Object.entries(value)) {
+      const result = rewriteValue(item, replacements, removals, false);
+      changed ||= result.changed;
+      if (!result.removed) next[key] = result.value;
+    }
+    return { changed, value: next };
+  }
+  return { changed: false, value };
+}
+
+async function effectiveDocuments(db) {
+  return ((await db.prepare(`SELECT document.document_id AS documentId, document.kind, document.locale,
+    document.draft_revision_id AS draftRevisionId, published.revision_id AS publishedRevisionId,
+    draft.payload_json AS draftPayload, draft.is_tombstone AS draftTombstone,
+    published.payload_json AS publishedPayload, published.is_tombstone AS publishedTombstone,
+    COALESCE(draft.schema_version, published.schema_version) AS schemaVersion
+    FROM content_documents document
+    LEFT JOIN content_revisions draft ON draft.document_id = document.document_id AND draft.revision_id = document.draft_revision_id
+    LEFT JOIN content_site_state state ON state.singleton = 1
+    LEFT JOIN content_release_entries entry ON entry.release_id = state.current_release_id AND entry.document_id = document.document_id
+    LEFT JOIN content_revisions published ON published.document_id = entry.document_id AND published.revision_id = entry.revision_id
+    WHERE document.abandoned_at IS NULL ORDER BY document.document_id`).all()).results ?? []);
+}
+
+async function rewriteDocuments({ db, data, replacements = {}, removals = [] }) {
+  const replacementUrls = Object.fromEntries(Object.entries(replacements).map(([from, to]) => [mediaUrl(from), mediaUrl(to)]));
+  const removalUrls = new Set(removals.map(mediaUrl));
+  const commands = [];
+  for (const row of await effectiveDocuments(db)) {
+    const useDraft = row.draftRevisionId !== null;
+    const raw = useDraft ? row.draftPayload : row.publishedPayload;
+    if (!raw || (useDraft ? row.draftTombstone : row.publishedTombstone)) continue;
+    let payload;
+    try { payload = JSON.parse(raw); } catch { throw new Error("invalid_document"); }
+    const rewritten = rewriteValue(payload, replacementUrls, removalUrls);
+    if (!rewritten.changed) continue;
+    const normalized = validateContentDocument({
+      documentId: row.documentId, kind: row.kind, locale: row.locale, schemaVersion: row.schemaVersion,
+      tombstone: false, payload: rewritten.value,
+    });
+    commands.push({
+      revisionId: crypto.randomUUID(), documentId: row.documentId,
+      baseRevisionId: useDraft ? row.draftRevisionId : row.publishedRevisionId,
+      expectedDraftRevisionId: row.draftRevisionId, kind: row.kind, locale: row.locale,
+      schemaVersion: row.schemaVersion, tombstone: false, payload: normalized.payload,
+    });
+  }
+  const who = editor(data);
+  const repository = new D1ContentRepository(db);
+  /* Every command was fully parsed and site-validated before the first write.
+   * A stale CAS leaves sources untouched; an already-created R2 destination is
+   * deliberately a reusable visible asset, never an orphan cleanup target. */
+  const now = Date.now();
+  await repository.saveMany(await Promise.all(commands.map(async (command) => ({
+    ...command, payloadChecksum: await canonicalChecksum(command.payload), requestChecksum: await contentSaveRequestChecksum(command),
+    now, authorSubject: who.subject, authorLabel: who.label,
+  }))));
+  return { documents: commands.map((command) => ({ documentId: command.documentId, kind: command.kind })) };
+}
+
+function keys(input) {
+  const unique = [...new Set((Array.isArray(input) ? input : []).filter(isKey).filter((key) => !key.startsWith("_trash/")))];
+  if (!unique.length) throw new Error("invalid_media_operation");
+  return unique;
+}
+
+async function uniqueOperationKey(bucket, prefix, filename, reserved) {
+  const name = sanitizeName(filename);
+  const dot = name.lastIndexOf(".");
+  const base = dot > 0 ? name.slice(0, dot) : name;
+  const extension = dot > 0 ? name.slice(dot) : "";
+  for (let suffix = 1; suffix <= 999; suffix += 1) {
+    const candidate = suffix === 1 ? `${prefix}${name}` : `${prefix}${base}-${suffix}${extension}`;
+    if (reserved.has(candidate) || await bucket.head(candidate)) continue;
+    reserved.add(candidate);
+    return candidate;
+  }
+  throw new Error("media_destination_collision");
+}
+
+async function createOperation({ db, data, type, id, entries, sourcePrefix = null, destinationPrefix = null, clientChecksum = null }) {
+  const who = editor(data);
+  const requestChecksum = await canonicalChecksum({
+    action: "media.operation", operationId: id, type,
+    sourceKeys: entries.map((entry) => entry.sourceKey), sourcePrefix, destinationPrefix,
+  });
+  if (clientChecksum && clientChecksum !== requestChecksum) throw new Error("invalid_media_operation");
+  const journal = new D1MediaOperationRepository(db);
+  const created = await journal.create({ operationId: id, requestChecksum, type, entries, sourcePrefix, destinationPrefix, authorSubject: who.subject, now: Date.now() });
+  return { journal, created };
+}
+
+async function inspectSource(bucket, entry) {
+  const object = await bucket.get(entry.sourceKey);
+  if (!object) throw new Error("media_source_missing");
+  const bytes = await object.arrayBuffer();
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  const objectChecksum = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+  return {
+    ...entry,
+    objectChecksum,
+    etag: object.etag ?? null,
+    metadataJson: canonicalJson({ httpMetadata: object.httpMetadata ?? {}, customMetadata: object.customMetadata ?? {} }),
+  };
+}
+
+export async function d1MoveMedia({ env, data, body }) {
+  if (!env.CONTENT_DB || !env.MEDIA) throw new Error("content_unavailable");
+  let destination = String(body.dest || "").trim();
+  if (destination && !destination.endsWith("/")) destination += "/";
+  if (!destination || !/^(?:[A-Za-z0-9._-]+\/)+$/.test(destination) || destination.startsWith("_trash/")) throw new Error("invalid_media_operation");
+  const sourceKeys = keys(body.keys).filter((key) => key.slice(0, key.lastIndexOf("/") + 1) !== destination);
+  const id = operationId(body.operationId);
+  if (!sourceKeys.length) return { operationId: id, repeated: false, moved: 0, urlMap: {}, documents: [] };
+  const entries = [];
+  const reserved = new Set();
+  for (const sourceKey of sourceKeys) {
+    const base = sourceKey.split("/").pop();
+    const destinationKey = await uniqueOperationKey(env.MEDIA, destination, base, reserved);
+    entries.push({ entryId: crypto.randomUUID(), sourceKey, destinationKey });
+  }
+  const { journal, created } = await createOperation({ db: env.CONTENT_DB, data, type: "move", id, entries, sourcePrefix: null, destinationPrefix: destination, clientChecksum: body.requestChecksum });
+  if (created === "repeated") {
+    const stored = await journal.entries(id);
+    return {
+      operationId: id, repeated: true, moved: stored.length,
+      urlMap: Object.fromEntries(stored.filter((entry) => entry.destinationKey).map((entry) => [mediaUrl(entry.sourceKey), mediaUrl(entry.destinationKey)])),
+      documents: [],
+    };
+  }
+  try {
+    for (const entry of entries) await prepareMediaCopy({ bucket: env.MEDIA, journal, operationId: id, entryId: entry.entryId, sourceKey: entry.sourceKey, destinationKey: entry.destinationKey, now: Date.now() });
+    const rewritten = await rewriteDocuments({ db: env.CONTENT_DB, data, replacements: Object.fromEntries(entries.map((entry) => [entry.sourceKey, entry.destinationKey])) });
+    return { operationId: id, repeated: false, moved: entries.length, urlMap: Object.fromEntries(entries.map((entry) => [mediaUrl(entry.sourceKey), mediaUrl(entry.destinationKey)])), documents: rewritten.documents };
+  } catch (error) {
+    await journal.cancel(id, Date.now()).catch(() => null);
+    throw error;
+  }
+}
+
+export async function d1DeleteMedia({ env, data, body }) {
+  if (!env.CONTENT_DB || !env.MEDIA) throw new Error("content_unavailable");
+  const sourceKeys = keys(body.keys);
+  const id = operationId(body.operationId);
+  const entries = sourceKeys.map((sourceKey) => ({ entryId: crypto.randomUUID(), sourceKey }));
+  const { journal, created } = await createOperation({ db: env.CONTENT_DB, data, type: "delete", id, entries, clientChecksum: body.requestChecksum });
+  if (created === "repeated") return { operationId: id, repeated: true, trashed: (await journal.entries(id)).length, documents: [] };
+  try {
+    const inspected = await Promise.all(entries.map((entry) => inspectSource(env.MEDIA, entry)));
+    const rewritten = await rewriteDocuments({ db: env.CONTENT_DB, data, removals: sourceKeys });
+    for (const entry of inspected) await journal.readyDeleteEntry({ ...entry, operationId: id, now: Date.now() });
+    return { operationId: id, repeated: false, trashed: entries.length, documents: rewritten.documents };
+  } catch (error) {
+    await journal.cancel(id, Date.now()).catch(() => null);
+    throw error;
+  }
+}
+
+export async function d1PendingSourceKeys(db) {
+  return new Set(await new D1MediaOperationRepository(db).activeSourceKeys());
+}
+
+/** Usage is read from the public release, every current draft, and an
+ * in-flight immutable candidate. It never reads Git in D1 mode. */
+export async function d1MediaUsage(db, sourceKeys) {
+  const keys = [...new Set(sourceKeys.filter(isKey))];
+  if (!keys.length) return { usage: {}, pages: [], count: 0, selectedCount: 0, blockers: [] };
+  const rows = (await db.prepare(`SELECT document.kind, document.document_id AS documentId, revision.payload_json AS payload
+    FROM content_documents document
+    JOIN content_revisions revision ON revision.document_id = document.document_id AND revision.revision_id = document.draft_revision_id
+    UNION
+    SELECT document.kind, document.document_id AS documentId, revision.payload_json AS payload
+    FROM content_site_state state
+    JOIN content_release_entries entry ON entry.release_id = state.current_release_id
+    JOIN content_documents document ON document.document_id = entry.document_id
+    JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
+    UNION
+    SELECT document.kind, document.document_id AS documentId, revision.payload_json AS payload
+    FROM content_releases release
+    JOIN content_release_entries entry ON entry.release_id = release.release_id
+    JOIN content_documents document ON document.document_id = entry.document_id
+    JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
+    WHERE release.status = 'publishing'`).all()).results ?? [];
+  const usage = {};
+  const pages = new Set();
+  for (const key of keys) {
+    const url = mediaUrl(key);
+    const locations = [...new Set(rows.filter((row) => typeof row.payload === "string" && row.payload.includes(url))
+      .map((row) => `${row.kind} · ${row.documentId}`))];
+    if (locations.length) { usage[key] = locations; locations.forEach((location) => pages.add(location)); }
+  }
+  return { usage, pages: [...pages], count: Object.keys(usage).length, selectedCount: keys.length, blockers: [] };
+}
+
+export async function finalizeD1MediaRelease({ env, releaseId, now = Date.now() }) {
+  if (!env.CONTENT_DB || !env.MEDIA) return { completed: 0, failed: 0, skipped: "binding non configurati" };
+  const journal = new D1MediaOperationRepository(env.CONTENT_DB);
+  const work = await journal.finalizationWork(releaseId);
+  const byOperation = new Map();
+  for (const entry of work) {
+    const group = byOperation.get(entry.operationId) || [];
+    group.push(entry); byOperation.set(entry.operationId, group);
+  }
+  let completed = 0, failed = 0;
+  for (const [id, entries] of byOperation) {
+    const first = entries[0];
+    if (first.operationState === "completed_with_warning") await journal.resumeFinalization(id, releaseId, now);
+    else await journal.beginFinalization(id, releaseId, now);
+    for (const entry of entries) {
+      try {
+        if (entry.type === "delete") await moveToTrash(env.MEDIA, entry.sourceKey);
+        else await env.MEDIA.delete(entry.sourceKey);
+        await journal.recordFinalizedEntry({ operationId: id, entryId: entry.entryId, now, outcome: "completed" });
+        completed += 1;
+      } catch {
+        await journal.recordFinalizedEntry({ operationId: id, entryId: entry.entryId, now, outcome: "failed", safeError: "La pulizia del Media verrà ritentata." });
+        failed += 1;
+      }
+    }
+  }
+  return { completed, failed };
+}
+
+export async function resumeD1MediaOperation({ env, data, operationId: id, releaseId }) {
+  if (!env.CONTENT_DB || !env.MEDIA) throw new Error("content_unavailable");
+  editor(data);
+  if (typeof id !== "string" || typeof releaseId !== "string") throw new Error("invalid_media_operation");
+  const journal = new D1MediaOperationRepository(env.CONTENT_DB);
+  await journal.resumeFinalization(id, releaseId, Date.now());
+  return finalizeD1MediaRelease({ env, releaseId, now: Date.now() });
+}
+
+export async function cancelD1MediaOperation({ env, data, operationId: id }) {
+  if (!env.CONTENT_DB) throw new Error("content_unavailable");
+  editor(data);
+  if (typeof id !== "string") throw new Error("invalid_media_operation");
+  await new D1MediaOperationRepository(env.CONTENT_DB).cancel(id, Date.now());
+  return { cancelled: true };
+}

package/dist/functions/api/assets/delete.js

@@ -23,6 +23,8 @@ import { mediaUrl } from "../../_shared/refs.js";
 import { rewriteMediaReferences } from "../../_shared/media-content.js";
 import { getBase, DRAFT } from "../../_shared/github.js";
 import { finalizePendingMedia, recordPendingMedia } from "../../_shared/pending-media.js";
+import { contentPersistenceMode } from "../../site.js";
+import { d1DeleteMedia, d1PendingSourceKeys } from "../../_shared/d1-media.js";
 
 const enc = new TextEncoder();
 
@@ -90,7 +92,7 @@ export async function verifyRefsPreflight(env, token, keys, currentCommit) {
   return keys.every((key) => allowed.has(key));
 }
 
-export async function onRequestPost({ request, env }) {
+export async function onRequestPost({ request, env, data }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
   let body;
   try { body = await request.json(); } catch { return json({ ok: false, error: "JSON non valido" }, 400); }
@@ -115,6 +117,22 @@ export async function onRequestPost({ request, env }) {
   const keyList = [...keys].filter((k) => !k.startsWith("_trash/"));
   if (!keyList.length && !keepKeys.length) return json({ ok: true, trashed: 0, pagesUpdated: [] });
 
+  if (contentPersistenceMode() === "d1") {
+    try {
+      /* A legacy client may repeat its old refsOnly/skipRefs sequence. Once a
+       * D1 operation owns a source, later chunks can only remove .keep files;
+       * they cannot manufacture a second destructive operation. */
+      const pending = await d1PendingSourceKeys(env.CONTENT_DB);
+      const operable = keyList.filter((key) => !pending.has(key));
+      const result = operable.length ? await d1DeleteMedia({ env, data, body: { ...body, keys: operable } }) : null;
+      for (const keepKey of keepKeys) await env.MEDIA.delete(keepKey);
+      return json({ ok: true, trashed: result?.trashed ?? keyList.length, operationId: result?.operationId, pagesUpdated: result?.documents.map((document) => document.kind) ?? [], deferred: Boolean(result), d1: true, warning: result ? "I file resteranno disponibili fino alla pubblicazione." : undefined });
+    } catch (error) {
+      const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_source_busy" ? "media_source_busy" : "media_operation_unavailable";
+      return json({ ok: false, code, error: code === "media_source_busy" ? "Questo Media è già in un'operazione in corso." : "Non riesco a registrare l'operazione Media D1." }, code === "unauthenticated" ? 401 : 409);
+    }
+  }
+
   const refsOnly = body.refsOnly === true;
   const skipRefs = body.skipRefs === true;
   if (keyList.length && (!env.GITHUB_TOKEN || !env.GITHUB_REPO)) {

package/dist/functions/api/assets/folders.js

@@ -4,14 +4,17 @@
  */
 import { json, TRASH, listKeysUnder } from "../../_shared/assets.js";
 import { pendingSourceKeys } from "../../_shared/pending-media.js";
+import { contentPersistenceMode } from "../../site.js";
+import { d1PendingSourceKeys } from "../../_shared/d1-media.js";
 
 export async function onRequestGet({ env }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
   const keys = await listKeysUnder(env.MEDIA, "");
-  const pending = await pendingSourceKeys(env.MEDIA);
+  const pending = contentPersistenceMode() === "d1" ? await d1PendingSourceKeys(env.CONTENT_DB) : await pendingSourceKeys(env.MEDIA);
   const counts = {};
   for (const k of keys) {
-    if (k.startsWith(TRASH) || k.startsWith("_pending-media/") || pending.has(k)) continue;
+    if (k.startsWith(TRASH) || k.startsWith("_pending-media/") ||
+        k.startsWith("_adminkit/") || pending.has(k)) continue;
     const slash = k.indexOf("/");
     if (slash < 0) continue; // file in root: non appartiene a una cartella
     const top = k.slice(0, slash);

package/dist/functions/api/assets/media.js

@@ -0,0 +1,30 @@
+/* D1 Media operation status and bounded recovery. These routes exist only
+ * after D1 cutover; Git-mode Media keeps its established pending-marker flow. */
+import { json } from "../../_shared/assets.js";
+import { D1MediaOperationRepository } from "../../../media.js";
+import { contentPersistenceMode } from "../../site.js";
+import { cancelD1MediaOperation, resumeD1MediaOperation } from "../../_shared/d1-media.js";
+
+function unavailable() { return json({ ok: false, code: "feature_inactive", error: "Journal Media D1 non attivo." }, 404); }
+function failure(error) {
+  const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_operation_unavailable" ? "media_operation_unavailable" : "media_operation_invalid";
+  return json({ ok: false, code, error: code === "unauthenticated" ? "Sessione non valida: ricarica la pagina per rientrare." : "L'operazione Media non può essere completata." }, code === "unauthenticated" ? 401 : 409);
+}
+
+export async function onRequestGet({ env }) {
+  if (contentPersistenceMode() !== "d1") return unavailable();
+  if (!env.CONTENT_DB) return json({ ok: false, code: "content_unavailable", error: "Persistenza contenuti non disponibile." }, 503);
+  try { return json({ ok: true, operations: await new D1MediaOperationRepository(env.CONTENT_DB).statuses() }); }
+  catch (error) { return failure(error); }
+}
+
+export async function onRequestPost({ request, env, data }) {
+  if (contentPersistenceMode() !== "d1") return unavailable();
+  let body;
+  try { body = await request.json(); } catch { return json({ ok: false, code: "media_operation_invalid", error: "JSON non valido." }, 400); }
+  try {
+    if (body?.action === "cancel") return json({ ok: true, ...(await cancelD1MediaOperation({ env, data, operationId: body.operationId })) });
+    if (body?.action === "resume") return json({ ok: true, ...(await resumeD1MediaOperation({ env, data, operationId: body.operationId, releaseId: body.releaseId })) });
+    throw new Error("invalid_media_operation");
+  } catch (error) { return failure(error); }
+}