@cardinali-studio/adminkit 2.2.20 → 2.2.22

package/dist/functions/_shared/d1-media.js

@@ -5,15 +5,11 @@ import {
   canonicalChecksum, canonicalJson, contentSaveRequestChecksum, D1ContentRepository,
 } from "../../persistence.js";
 import {
-  D1MediaOperationRepository, prepareMediaCopy,
+  D1MediaOperationRepository, mediaPublicUrl, prepareMediaCopy, rewriteMediaValue,
 } from "../../media.js";
 import { validateContentDocument } from "../site.js";
 import { isKey, moveToTrash, sanitizeName } from "./assets.js";
 
-const MEDIA_PREFIX = "/media/";
-
-function mediaUrl(key) { return MEDIA_PREFIX + key.split("/").map(encodeURIComponent).join("/"); }
-
 function editor(data) {
   const payload = data?.cloudflareAccess?.JWT?.payload;
   if (!payload?.sub) throw new Error("unauthenticated");
@@ -26,67 +22,7 @@ function operationId(value) {
   return value;
 }
 
-function replaceBoundedUrl(value, from, to) {
-  let cursor = 0;
-  let next = "";
-  while (cursor < value.length) {
-    const found = value.indexOf(from, cursor);
-    if (found < 0) return next + value.slice(cursor);
-    const after = value[found + from.length];
-    /* A media key is a path, not a string prefix. Query/fragment suffixes and
-     * further URL/path characters belong to a different reference and must
-     * not be rewritten accidentally. */
-    if (after && /[A-Za-z0-9._~%!$&'()*+,;=:@/?#-]/.test(after)) {
-      next += value.slice(cursor, found + from.length);
-      cursor = found + from.length;
-      continue;
-    }
-    next += value.slice(cursor, found) + to;
-    cursor = found + from.length;
-  }
-  return next;
-}
-
-function replaceText(value, replacements, removals) {
-  let next = value;
-  for (const [from, to] of Object.entries(replacements)) next = replaceBoundedUrl(next, from, to);
-  for (const from of removals) next = replaceBoundedUrl(next, from, "");
-  return next;
-}
-
-/** JSON Media values are intentionally rewritten only as complete public URLs
- * (or a URL embedded in Markdown). Arrays lose an exact removed URL; scalar
- * slots become empty strings and are then validated by the site's schema. */
-function rewriteValue(value, replacements, removals, inArray = false) {
-  if (typeof value === "string") {
-    if (removals.has(value) && inArray) return { changed: true, removed: true };
-    const next = replaceText(value, replacements, removals);
-    return { changed: next !== value, value: next };
-  }
-  if (Array.isArray(value)) {
-    let changed = false;
-    const next = [];
-    for (const item of value) {
-      const result = rewriteValue(item, replacements, removals, true);
-      changed ||= result.changed;
-      if (!result.removed) next.push(result.value);
-    }
-    return { changed, value: next };
-  }
-  if (value && typeof value === "object") {
-    let changed = false;
-    const next = {};
-    for (const [key, item] of Object.entries(value)) {
-      const result = rewriteValue(item, replacements, removals, false);
-      changed ||= result.changed;
-      if (!result.removed) next[key] = result.value;
-    }
-    return { changed, value: next };
-  }
-  return { changed: false, value };
-}
-
-async function effectiveDocuments(db) {
+async function mediaDocuments(db) {
   return ((await db.prepare(`SELECT document.document_id AS documentId, document.kind, document.locale,
     document.draft_revision_id AS draftRevisionId, published.revision_id AS publishedRevisionId,
     draft.payload_json AS draftPayload, draft.is_tombstone AS draftTombstone,
@@ -101,16 +37,33 @@ async function effectiveDocuments(db) {
 }
 
 async function rewriteDocuments({ db, data, replacements = {}, removals = [] }) {
-  const replacementUrls = Object.fromEntries(Object.entries(replacements).map(([from, to]) => [mediaUrl(from), mediaUrl(to)]));
-  const removalUrls = new Set(removals.map(mediaUrl));
   const commands = [];
-  for (const row of await effectiveDocuments(db)) {
-    const useDraft = row.draftRevisionId !== null;
-    const raw = useDraft ? row.draftPayload : row.publishedPayload;
-    if (!raw || (useDraft ? row.draftTombstone : row.publishedTombstone)) continue;
-    let payload;
-    try { payload = JSON.parse(raw); } catch { throw new Error("invalid_document"); }
-    const rewritten = rewriteValue(payload, replacementUrls, removalUrls);
+  const publishedDocuments = [];
+  for (const row of await mediaDocuments(db)) {
+    /* Validate the exact published patch now, before the operation can become
+     * ready. Publication later starts from this same immutable release side,
+     * never from an unrelated editorial draft. */
+    if (row.publishedPayload && !row.publishedTombstone) {
+      let publishedPayload;
+      try { publishedPayload = JSON.parse(row.publishedPayload); } catch { throw new Error("invalid_document"); }
+      const published = rewriteMediaValue(publishedPayload, { replacements, removals });
+      if (published.changed) {
+        validateContentDocument({
+          documentId: row.documentId, kind: row.kind, locale: row.locale, schemaVersion: row.schemaVersion,
+          tombstone: false, payload: published.value,
+        });
+        publishedDocuments.push({ documentId: row.documentId, kind: row.kind });
+      }
+    }
+
+    /* Existing drafts keep every unrelated edit but must not be able to
+     * reintroduce a source after the isolated Media release. No draft is
+     * manufactured when none existed: the detached published patch owns that
+     * side of the operation. */
+    if (row.draftRevisionId === null || !row.draftPayload || row.draftTombstone) continue;
+    let draftPayload;
+    try { draftPayload = JSON.parse(row.draftPayload); } catch { throw new Error("invalid_document"); }
+    const rewritten = rewriteMediaValue(draftPayload, { replacements, removals });
     if (!rewritten.changed) continue;
     const normalized = validateContentDocument({
       documentId: row.documentId, kind: row.kind, locale: row.locale, schemaVersion: row.schemaVersion,
@@ -118,14 +71,14 @@ async function rewriteDocuments({ db, data, replacements = {}, removals = [] })
     });
     commands.push({
       revisionId: crypto.randomUUID(), documentId: row.documentId,
-      baseRevisionId: useDraft ? row.draftRevisionId : row.publishedRevisionId,
+      baseRevisionId: row.draftRevisionId,
       expectedDraftRevisionId: row.draftRevisionId, kind: row.kind, locale: row.locale,
       schemaVersion: row.schemaVersion, tombstone: false, payload: normalized.payload,
     });
   }
   /* Nessun riferimento è un esito valido: l'operazione Media deve proseguire
    * senza costruire una transazione editoriale vuota, che `saveMany` rifiuta. */
-  if (!commands.length) return { documents: [] };
+  if (!commands.length) return { documents: [], publishedDocuments };
   const who = editor(data);
   const repository = new D1ContentRepository(db);
   /* Every command was fully parsed and site-validated before the first write.
@@ -136,7 +89,10 @@ async function rewriteDocuments({ db, data, replacements = {}, removals = [] })
     ...command, payloadChecksum: await canonicalChecksum(command.payload), requestChecksum: await contentSaveRequestChecksum(command),
     now, authorSubject: who.subject, authorLabel: who.label,
   }))));
-  return { documents: commands.map((command) => ({ documentId: command.documentId, kind: command.kind })) };
+  return {
+    documents: commands.map((command) => ({ documentId: command.documentId, kind: command.kind })),
+    publishedDocuments,
+  };
 }
 
 function keys(input) {
@@ -205,14 +161,22 @@ export async function d1MoveMedia({ env, data, body }) {
     const stored = await journal.entries(id);
     return {
       operationId: id, repeated: true, moved: stored.length,
-      urlMap: Object.fromEntries(stored.filter((entry) => entry.destinationKey).map((entry) => [mediaUrl(entry.sourceKey), mediaUrl(entry.destinationKey)])),
-      documents: [],
+      urlMap: Object.fromEntries(stored.filter((entry) => entry.destinationKey).map((entry) => [mediaPublicUrl(entry.sourceKey), mediaPublicUrl(entry.destinationKey)])),
+      documents: [], publishedDocuments: [], requiresPublication: true,
     };
   }
   try {
     for (const entry of entries) await prepareMediaCopy({ bucket: env.MEDIA, journal, operationId: id, entryId: entry.entryId, sourceKey: entry.sourceKey, destinationKey: entry.destinationKey, now: Date.now() });
     const rewritten = await rewriteDocuments({ db: env.CONTENT_DB, data, replacements: Object.fromEntries(entries.map((entry) => [entry.sourceKey, entry.destinationKey])) });
-    return { operationId: id, repeated: false, moved: entries.length, urlMap: Object.fromEntries(entries.map((entry) => [mediaUrl(entry.sourceKey), mediaUrl(entry.destinationKey)])), documents: rewritten.documents };
+    const immediate = rewritten.publishedDocuments.length
+      ? { requiresPublication: true }
+      : await finalizeUnpublishedD1MediaOperation({ env, operationId: id });
+    return {
+      operationId: id, repeated: false, moved: entries.length,
+      urlMap: Object.fromEntries(entries.map((entry) => [mediaPublicUrl(entry.sourceKey), mediaPublicUrl(entry.destinationKey)])),
+      documents: rewritten.documents, publishedDocuments: rewritten.publishedDocuments,
+      ...immediate,
+    };
   } catch (error) {
     await journal.cancel(id, Date.now()).catch(() => null);
     throw error;
@@ -225,12 +189,22 @@ export async function d1DeleteMedia({ env, data, body }) {
   const id = operationId(body.operationId);
   const entries = sourceKeys.map((sourceKey) => ({ entryId: crypto.randomUUID(), sourceKey }));
   const { journal, created } = await createOperation({ db: env.CONTENT_DB, data, type: "delete", id, entries, clientChecksum: body.requestChecksum });
-  if (created === "repeated") return { operationId: id, repeated: true, trashed: (await journal.entries(id)).length, documents: [] };
+  if (created === "repeated") return {
+    operationId: id, repeated: true, trashed: (await journal.entries(id)).length,
+    documents: [], publishedDocuments: [], requiresPublication: true,
+  };
   try {
     const inspected = await Promise.all(entries.map((entry) => inspectSource(env.MEDIA, entry)));
     const rewritten = await rewriteDocuments({ db: env.CONTENT_DB, data, removals: sourceKeys });
     for (const entry of inspected) await journal.readyDeleteEntry({ ...entry, operationId: id, now: Date.now() });
-    return { operationId: id, repeated: false, trashed: entries.length, documents: rewritten.documents };
+    const immediate = rewritten.publishedDocuments.length
+      ? { requiresPublication: true }
+      : await finalizeUnpublishedD1MediaOperation({ env, operationId: id });
+    return {
+      operationId: id, repeated: false, trashed: entries.length,
+      documents: rewritten.documents, publishedDocuments: rewritten.publishedDocuments,
+      ...immediate,
+    };
   } catch (error) {
     await journal.cancel(id, Date.now()).catch(() => null);
     throw error;
@@ -246,28 +220,42 @@ export async function d1PendingSourceKeys(db) {
 export async function d1MediaUsage(db, sourceKeys) {
   const keys = [...new Set(sourceKeys.filter(isKey))];
   if (!keys.length) return { usage: {}, pages: [], count: 0, selectedCount: 0, blockers: [] };
-  const rows = (await db.prepare(`SELECT document.kind, document.document_id AS documentId, revision.payload_json AS payload
+  const rows = (await db.prepare(`SELECT document.kind, document.document_id AS documentId,
+      revision.payload_json AS payload, 0 AS locationRank
     FROM content_documents document
     JOIN content_revisions revision ON revision.document_id = document.document_id AND revision.revision_id = document.draft_revision_id
     UNION
-    SELECT document.kind, document.document_id AS documentId, revision.payload_json AS payload
+    SELECT document.kind, document.document_id AS documentId,
+      revision.payload_json AS payload, 1 AS locationRank
     FROM content_site_state state
     JOIN content_release_entries entry ON entry.release_id = state.current_release_id
     JOIN content_documents document ON document.document_id = entry.document_id
     JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
     UNION
-    SELECT document.kind, document.document_id AS documentId, revision.payload_json AS payload
+    SELECT document.kind, document.document_id AS documentId,
+      revision.payload_json AS payload, 2 AS locationRank
     FROM content_releases release
     JOIN content_release_entries entry ON entry.release_id = release.release_id
     JOIN content_documents document ON document.document_id = entry.document_id
     JOIN content_revisions revision ON revision.document_id = entry.document_id AND revision.revision_id = entry.revision_id
-    WHERE release.status = 'publishing'`).all()).results ?? [];
+    WHERE release.status = 'publishing'
+    ORDER BY locationRank, documentId`).all()).results ?? [];
   const usage = {};
   const pages = new Set();
   for (const key of keys) {
-    const url = mediaUrl(key);
-    const locations = [...new Set(rows.filter((row) => typeof row.payload === "string" && row.payload.includes(url))
-      .map((row) => `${row.kind} · ${row.documentId}`))];
+    const url = mediaPublicUrl(key);
+    const documents = new Map();
+    for (const row of rows) {
+      if (documents.has(row.documentId) || typeof row.payload !== "string" || !row.payload.includes(url)) continue;
+      let payload;
+      try { payload = JSON.parse(row.payload); } catch { payload = null; }
+      const candidate = payload && typeof payload === "object" && !Array.isArray(payload)
+        ? [payload.title, payload.name, payload.label, payload.slug]
+          .find((value) => typeof value === "string" && value.trim())
+        : null;
+      documents.set(row.documentId, candidate ? String(candidate).trim().slice(0, 200) : `${row.kind} · ${row.documentId}`);
+    }
+    const locations = [...documents.values()];
     if (locations.length) { usage[key] = locations; locations.forEach((location) => pages.add(location)); }
   }
   return { usage, pages: [...pages], count: Object.keys(usage).length, selectedCount: keys.length, blockers: [] };
@@ -302,10 +290,36 @@ export async function finalizeD1MediaRelease({ env, releaseId, now = Date.now()
   return { completed, failed };
 }
 
+async function finalizeUnpublishedD1MediaOperation({ env, operationId: id, now = Date.now(), resume = false }) {
+  if (!env.CONTENT_DB || !env.MEDIA) throw new Error("content_unavailable");
+  const journal = new D1MediaOperationRepository(env.CONTENT_DB);
+  if (resume) await journal.resumeUnboundFinalization(id, now);
+  else if (!await journal.beginUnpublishedFinalization(id, now)) return { requiresPublication: true, completed: 0, failed: 0 };
+  const entries = await journal.unboundFinalizationWork(id);
+  let completed = 0;
+  let failed = 0;
+  for (const entry of entries) {
+    try {
+      if (entry.type === "delete") await moveToTrash(env.MEDIA, entry.sourceKey);
+      else await env.MEDIA.delete(entry.sourceKey);
+      await journal.recordFinalizedEntry({ operationId: id, entryId: entry.entryId, now, outcome: "completed" });
+      completed += 1;
+    } catch {
+      await journal.recordFinalizedEntry({
+        operationId: id, entryId: entry.entryId, now, outcome: "failed",
+        safeError: "La pulizia del Media verrà ritentata.",
+      });
+      failed += 1;
+    }
+  }
+  return { requiresPublication: false, completed, failed };
+}
+
 export async function resumeD1MediaOperation({ env, data, operationId: id, releaseId }) {
   if (!env.CONTENT_DB || !env.MEDIA) throw new Error("content_unavailable");
   editor(data);
-  if (typeof id !== "string" || typeof releaseId !== "string") throw new Error("invalid_media_operation");
+  if (typeof id !== "string" || !(releaseId === null || releaseId === undefined || typeof releaseId === "string")) throw new Error("invalid_media_operation");
+  if (!releaseId) return finalizeUnpublishedD1MediaOperation({ env, operationId: id, now: Date.now(), resume: true });
   const journal = new D1MediaOperationRepository(env.CONTENT_DB);
   await journal.resumeFinalization(id, releaseId, Date.now());
   return finalizeD1MediaRelease({ env, releaseId, now: Date.now() });

package/dist/functions/_shared/media-alt.js

@@ -0,0 +1,61 @@
+/* Testi alternativi associati al file Media.
+ *
+ * Vivono nei custom metadata dell'oggetto R2: in questo modo seguono già le copie usate da
+ * spostamento, cestino e ripristino, senza una seconda tabella da tenere sincronizzata con le
+ * chiavi del bucket. Il valore è JSON perché R2 accetta solo stringhe nei custom metadata.
+ */
+
+export const MEDIA_ALT_METADATA_KEY = "adminkitAlt";
+export const MEDIA_UPLOADED_METADATA_KEY = "adminkitUploadedAt";
+
+const EMPTY = Object.freeze({ decorative: false, texts: Object.freeze({}) });
+
+export function altLocales(languageConfig) {
+  return languageConfig?.available?.length ? [...languageConfig.available] : ["default"];
+}
+
+/** Legge in modo difensivo anche metadati scritti da una versione futura o incompleta. */
+export function mediaAltFromMetadata(customMetadata, locales = null) {
+  const raw = customMetadata?.[MEDIA_ALT_METADATA_KEY];
+  if (!raw) return EMPTY;
+  let value;
+  try { value = JSON.parse(raw); } catch { return EMPTY; }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return EMPTY;
+  const allowed = locales ? new Set(locales) : null;
+  const texts = {};
+  if (value.texts && typeof value.texts === "object" && !Array.isArray(value.texts)) {
+    for (const [locale, text] of Object.entries(value.texts)) {
+      if ((!allowed || allowed.has(locale)) && typeof text === "string" && text.trim()) {
+        texts[locale] = text.trim();
+      }
+    }
+  }
+  return { decorative: value.decorative === true, texts };
+}
+
+/** Valida il comando editoriale. Il limite è solo tecnico (dimensione dei metadata R2), non
+ * una falsa regola SEO: l'interfaccia non impone un maxlength al testo. */
+export function normalizeMediaAlt(value, locales) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || typeof value.decorative !== "boolean") {
+    throw new Error("invalid_media_alt");
+  }
+  if (!value.texts || typeof value.texts !== "object" || Array.isArray(value.texts)) {
+    throw new Error("invalid_media_alt");
+  }
+  const allowed = new Set(locales);
+  const texts = {};
+  for (const [locale, text] of Object.entries(value.texts)) {
+    if (!allowed.has(locale) || typeof text !== "string") throw new Error("invalid_media_alt");
+    const normalized = text.trim();
+    if (normalized) texts[locale] = normalized;
+  }
+  const result = { decorative: value.decorative, texts: value.decorative ? {} : texts };
+  if (new TextEncoder().encode(JSON.stringify(result)).byteLength > 1600) {
+    throw new Error("media_alt_too_large");
+  }
+  return result;
+}
+
+export function mediaAltMetadataValue(value) {
+  return value.decorative || Object.keys(value.texts).length ? JSON.stringify(value) : null;
+}

package/dist/functions/api/assets/delete.js

@@ -126,10 +126,27 @@ export async function onRequestPost({ request, env, data }) {
       const operable = keyList.filter((key) => !pending.has(key));
       const result = operable.length ? await d1DeleteMedia({ env, data, body: { ...body, keys: operable } }) : null;
       for (const keepKey of keepKeys) await env.MEDIA.delete(keepKey);
-      return json({ ok: true, trashed: result?.trashed ?? keyList.length, operationId: result?.operationId, pagesUpdated: result?.documents.map((document) => document.kind) ?? [], deferred: Boolean(result), d1: true, warning: result ? "I file resteranno disponibili fino alla pubblicazione." : undefined });
+      return json({
+        ok: true,
+        trashed: result?.trashed ?? keyList.length,
+        operationId: result?.operationId,
+        pagesUpdated: result?.publishedDocuments?.map((document) => document.kind) ?? [],
+        requiresPublication: result?.requiresPublication === true,
+        deferred: result?.requiresPublication === true || Number(result?.failed ?? 0) > 0,
+        completed: result ? Number(result.completed ?? 0) : keyList.length,
+        failed: Number(result?.failed ?? 0),
+        d1: true,
+        warning: result?.requiresPublication ? "Le pagine verranno pubblicate senza questi Media prima di spostarli nel cestino." : undefined,
+      });
     } catch (error) {
-      const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_source_busy" ? "media_source_busy" : "media_operation_unavailable";
-      return json({ ok: false, code, error: code === "media_source_busy" ? "Questo Media è già in un'operazione in corso." : "Non riesco a registrare l'operazione Media D1." }, code === "unauthenticated" ? 401 : 409);
+      const code = error?.message === "unauthenticated" ? "unauthenticated"
+        : error?.message === "media_source_busy" ? "media_source_busy"
+          : error?.message === "invalid_document" ? "media_replacement_required"
+            : "media_operation_unavailable";
+      const message = code === "media_source_busy" ? "Questo Media è già in un'operazione in corso."
+        : code === "media_replacement_required" ? "Una pagina richiede questa immagine: sostituiscila prima di eliminarla."
+          : "Non riesco a registrare l'operazione Media D1.";
+      return json({ ok: false, code, error: message }, code === "unauthenticated" ? 401 : code === "media_replacement_required" ? 422 : 409);
     }
   }
 

package/dist/functions/api/assets/media.js

@@ -1,9 +1,13 @@
 /* D1 Media operation status and bounded recovery. These routes exist only
  * after D1 cutover; Git-mode Media keeps its established pending-marker flow. */
-import { json } from "../../_shared/assets.js";
+import { guessMime, isKey, json } from "../../_shared/assets.js";
 import { D1MediaOperationRepository } from "../../../media.js";
-import { contentPersistenceMode } from "../../site.js";
+import { contentPersistenceMode, languages } from "../../site.js";
 import { cancelD1MediaOperation, resumeD1MediaOperation } from "../../_shared/d1-media.js";
+import {
+  altLocales, mediaAltMetadataValue, normalizeMediaAlt,
+  MEDIA_ALT_METADATA_KEY, MEDIA_UPLOADED_METADATA_KEY,
+} from "../../_shared/media-alt.js";
 
 function unavailable() { return json({ ok: false, code: "feature_inactive", error: "Journal Media D1 non attivo." }, 404); }
 function failure(error) {
@@ -11,6 +15,57 @@ function failure(error) {
   return json({ ok: false, code, error: code === "unauthenticated" ? "Sessione non valida: ricarica la pagina per rientrare." : "L'operazione Media non può essere completata." }, code === "unauthenticated" ? 401 : 409);
 }
 
+/** Aggiorna solo i metadata editoriali del file. R2 richiede di riscrivere l'oggetto per
+ * cambiare customMetadata: conserviamo quindi esplicitamente la data originaria, oltre a tutti
+ * i metadata HTTP/EXIF già presenti. */
+export async function onRequestPatch({ request, env }) {
+  if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
+  let body;
+  try { body = await request.json(); } catch { return json({ ok: false, code: "media_alt_invalid", error: "JSON non valido." }, 400); }
+  const key = typeof body?.key === "string" ? body.key : "";
+  if (!isKey(key) || key.startsWith("_trash/") || key.startsWith("_adminkit/")) {
+    return json({ ok: false, code: "media_alt_invalid", error: "File Media non valido." }, 400);
+  }
+  const object = await env.MEDIA.get(key);
+  if (!object) return json({ ok: false, code: "media_not_found", error: "Il file non esiste più." }, 404);
+  const type = object.httpMetadata?.contentType || guessMime(key);
+  if (!type.startsWith("image/")) {
+    return json({ ok: false, code: "media_alt_not_applicable", error: "Il testo alternativo si applica alle immagini." }, 422);
+  }
+  let alt;
+  try { alt = normalizeMediaAlt(body.alt, altLocales(languages())); }
+  catch (error) {
+    const tooLarge = error?.message === "media_alt_too_large";
+    return json({
+      ok: false,
+      code: tooLarge ? "media_alt_too_large" : "media_alt_invalid",
+      error: tooLarge ? "I testi alternativi sono troppo estesi per i metadati del file." : "Testo alternativo non valido.",
+    }, 400);
+  }
+  const customMetadata = { ...(object.customMetadata || {}) };
+  const encoded = mediaAltMetadataValue(alt);
+  if (encoded) customMetadata[MEDIA_ALT_METADATA_KEY] = encoded;
+  else delete customMetadata[MEDIA_ALT_METADATA_KEY];
+  if (!customMetadata[MEDIA_UPLOADED_METADATA_KEY]) {
+    customMetadata[MEDIA_UPLOADED_METADATA_KEY] = object.uploaded instanceof Date
+      ? object.uploaded.toISOString()
+      : new Date().toISOString();
+  }
+  const saved = await env.MEDIA.put(key, object.body, {
+    httpMetadata: object.httpMetadata || {},
+    customMetadata,
+    ...(object.etag ? { onlyIf: { etagMatches: object.etag } } : {}),
+  });
+  if (object.etag && saved === null) {
+    return json({
+      ok: false,
+      code: "media_alt_conflict",
+      error: "Il file è cambiato durante il salvataggio. Riaprilo e riprova.",
+    }, 409);
+  }
+  return json({ ok: true, key, alt });
+}
+
 export async function onRequestGet({ env }) {
   if (contentPersistenceMode() !== "d1") return unavailable();
   if (!env.CONTENT_DB) return json({ ok: false, code: "content_unavailable", error: "Persistenza contenuti non disponibile." }, 503);

package/dist/functions/api/assets/move.js

@@ -145,7 +145,11 @@ export async function onRequestPost({ request, env, data }) {
     if (Object.hasOwn(body, "applyRefs")) return json({ ok: true, moved: 0, pagesUpdated: [], failed: [], d1: true });
     try {
       const result = await d1MoveMedia({ env, data, body });
-      return json({ ok: true, ...result, pagesUpdated: result.documents.map((document) => document.kind), failed: [], warning: "Le sorgenti restano disponibili fino alla pubblicazione." });
+      return json({
+        ok: true, ...result,
+        pagesUpdated: result.publishedDocuments.map((document) => document.kind), failed: [],
+        warning: result.requiresPublication ? "Le pagine verranno pubblicate con i nuovi indirizzi prima di rimuovere le sorgenti." : undefined,
+      });
     } catch (error) {
       const code = error?.message === "unauthenticated" ? "unauthenticated" : error?.message === "media_source_busy" ? "media_source_busy" : "media_operation_unavailable";
       return json({ ok: false, code, error: code === "media_source_busy" ? "Questo Media è già in un'operazione in corso." : "Non riesco a registrare l'operazione Media D1." }, code === "unauthenticated" ? 401 : 409);

package/dist/functions/api/assets/upload.js

@@ -5,6 +5,7 @@
 import { isPrefix, json, guessMime, uniqueKey } from "../../_shared/assets.js";
 import { extractCapturedAt } from "../../_shared/exif.js";
 import { sizeFromBuffer } from "../../_shared/imagesize.js";
+import { MEDIA_UPLOADED_METADATA_KEY } from "../../_shared/media-alt.js";
 
 export async function onRequestPost({ request, env }) {
   if (!env.MEDIA) return json({ ok: false, error: "Binding MEDIA non configurato" }, 500);
@@ -21,7 +22,7 @@ export async function onRequestPost({ request, env }) {
   if (!ctype || ctype === "application/octet-stream") ctype = guessMime(key);
 
   // data di scatto (EXIF) per l'ordinamento "Data scatto"
-  const custom = {};
+  const custom = { [MEDIA_UPLOADED_METADATA_KEY]: new Date().toISOString() };
   const suppliedCapturedAt = request.headers.get("X-Captured-At") || "";
   if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}$/.test(suppliedCapturedAt)) {
     custom.capturedAt = suppliedCapturedAt;
@@ -52,6 +53,7 @@ export async function onRequestPost({ request, env }) {
     capturedAt: custom.capturedAt || null,
     w: wh ? wh[0] : null,
     h: wh ? wh[1] : null,
+    alt: { decorative: false, texts: {} },
     url: "/media/" + key.split("/").map(encodeURIComponent).join("/"),
   });
 }

package/dist/functions/api/assets.js

@@ -4,8 +4,9 @@
 import { isPrefix, json, listKeysUnder } from "../_shared/assets.js";
 import { sizeFromBucket } from "../_shared/imagesize.js";
 import { pendingSourceKeys } from "../_shared/pending-media.js";
-import { contentPersistenceMode } from "../site.js";
+import { contentPersistenceMode, languages } from "../site.js";
 import { d1PendingSourceKeys } from "../_shared/d1-media.js";
+import { altLocales, mediaAltFromMetadata, MEDIA_UPLOADED_METADATA_KEY } from "../_shared/media-alt.js";
 
 const IMG = /\.(webp|jpe?g|png|avif|gif)$/i;
 
@@ -15,6 +16,7 @@ export async function onRequestGet({ request, env }) {
   let prefix = (url.searchParams.get("prefix") || "").trim();
   if (!isPrefix(prefix)) return json({ ok: false, error: `prefisso non valido: ${prefix}` }, 400);
   const pending = contentPersistenceMode() === "d1" ? await d1PendingSourceKeys(env.CONTENT_DB) : await pendingSourceKeys(env.MEDIA);
+  const locales = altLocales(languages());
 
   /* `recursive=1` guarda TUTTO quello che c'è sotto, a qualunque profondità: serve a chi deve
    * spostare o cancellare una cartella intera, che altrimenti si porterebbe dietro solo il primo
@@ -82,11 +84,12 @@ export async function onRequestGet({ request, env }) {
       name: o.key.slice(prefix.length),
       size: o.size,
       url: "/media/" + o.key.split("/").map(encodeURIComponent).join("/"),
-      uploaded: o.uploaded,
+      uploaded: cm[MEDIA_UPLOADED_METADATA_KEY] || o.uploaded,
       capturedAt: cm.capturedAt || null,
       type: (o.httpMetadata && o.httpMetadata.contentType) || "",
       w: w > 0 ? w : null,
       h: h > 0 ? h : null,
+      alt: mediaAltFromMetadata(cm, locales),
     };
   }));
 

package/dist/gallery.d.ts

@@ -3,6 +3,8 @@ export type GalleryImage = {
     w?: number | null;
     h?: number | null;
     hidden?: boolean;
+    /** Copia iniziale del default Media, modificabile nel contesto della singola gallery. */
+    alt?: string;
 };
 export type SectionType = "header" | "text" | "image" | "gallery";
 /** Una sezione della pagina gallery. Ha TUTTI i campi qualunque sia il tipo: Zod e React vogliono

package/dist/media.d.ts

@@ -1,4 +1,16 @@
 import type { D1DatabaseLike } from "./persistence.js";
+export declare function mediaPublicUrl(key: string): string;
+/** Rewrites exactly the Media references owned by one operation. Exact array
+ * values are removed as array items; scalar slots become an empty string and
+ * are then accepted or rejected by the site's complete schema validator. */
+export declare function rewriteMediaValue(value: unknown, input: {
+    replacements?: Readonly<Record<string, string>>;
+    removals?: readonly string[];
+}): {
+    changed: boolean;
+    value?: unknown;
+    removed?: boolean;
+};
 export declare const mediaOperationStates: readonly ["preparing", "ready", "blocked_in_use", "bound", "finalizing", "completed", "completed_with_warning", "cancelled", "failed"];
 export type MediaOperationState = typeof mediaOperationStates[number];
 export type MediaOperationType = "move" | "delete";
@@ -95,6 +107,11 @@ export declare class D1MediaOperationRepository {
         metadataJson: string | null;
     }): Promise<"pending" | "ready">;
     beginFinalization(operationId: string, releaseId: string, now: number): Promise<void>;
+    /** An operation whose sources occur in neither the public manifest nor any
+     * current draft needs no content release. The same guarded transition closes
+     * the last race before R2 cleanup; a concurrent reference makes it stay
+     * ready for the isolated-publication path instead. */
+    beginUnpublishedFinalization(operationId: string, now: number): Promise<boolean>;
     /** Individual cleanup writes are retryable. A single failed entry reaches
      * `completed_with_warning` only after every entry has a terminal result;
      * the already-live release is never rolled back. */
@@ -124,9 +141,11 @@ export declare class D1MediaOperationRepository {
     /** Work is named by its immutable release binding: there is intentionally no
      * "latest operation" cleanup path. */
     finalizationWork(releaseId: string): Promise<readonly BoundMediaEntry[]>;
+    unboundFinalizationWork(operationId: string): Promise<readonly BoundMediaEntry[]>;
     /** A warning is a live release with incomplete housekeeping. Retrying resets
      * only failed effects, never an already-completed entry. */
     resumeFinalization(operationId: string, releaseId: string, now: number): Promise<void>;
+    resumeUnboundFinalization(operationId: string, now: number): Promise<void>;
     readyDeleteEntry(input: {
         operationId: string;
         entryId: string;