@cardinali-studio/adminkit 2.2.25 → 2.2.33

package/dist/direct-publication.js

@@ -0,0 +1,75 @@
+import { canonicalChecksum, } from "./persistence.js";
+import { createReleaseExport } from "./release.js";
+/** A SELECT guard belongs inside the batch: a failed conditional must abort
+ * every mutation, including when an UPDATE would silently affect zero rows. */
+export function transactionAssertion(db, condition, values = []) {
+    return db
+        .prepare(`SELECT CASE WHEN (${condition}) THEN 1 ELSE json('adminkit assertion failed') END AS passed`)
+        .bind(...values);
+}
+export async function previewCandidateChecksum(baseReleaseId, entries) {
+    return canonicalChecksum({
+        baseReleaseId,
+        entries: entries
+            .map(({ documentId, revisionId, payloadChecksum }) => ({
+            documentId,
+            revisionId,
+            payloadChecksum,
+        }))
+            .sort((a, b) => a.documentId.localeCompare(b.documentId)),
+    });
+}
+export async function commitDirectRelease(db, input) {
+    const { release, selectedDrafts, expectedBaseReleaseId, authorSubject, now } = input;
+    const checked = await createReleaseExport(release);
+    if (checked.manifestChecksum !== release.manifestChecksum ||
+        !selectedDrafts.length ||
+        release.siteAccess)
+        throw new Error("invalid_release_export");
+    for (const selected of selectedDrafts)
+        if (!release.entries.some((e) => e.documentId === selected.documentId &&
+            e.revisionId === selected.revisionId))
+            throw new Error("invalid_release_export");
+    const statements = [
+        transactionAssertion(db, `EXISTS(SELECT 1 FROM content_site_state WHERE singleton=1 AND current_release_id=?) AND NOT EXISTS(SELECT 1 FROM content_release_site_access WHERE release_id=?) AND NOT EXISTS(SELECT 1 FROM production_deployment_attempts WHERE phase NOT IN ('succeeded','failed','superseded'))`, [expectedBaseReleaseId, expectedBaseReleaseId]),
+    ];
+    for (const d of selectedDrafts)
+        statements.push(transactionAssertion(db, "EXISTS(SELECT 1 FROM content_documents WHERE document_id=? AND draft_revision_id=?)", [d.documentId, d.revisionId]));
+    for (const e of release.entries)
+        statements.push(transactionAssertion(db, `EXISTS(SELECT 1 FROM content_revisions r JOIN content_documents d ON d.document_id=r.document_id WHERE r.document_id=? AND r.revision_id=? AND r.payload_checksum=? AND r.schema_version=? AND r.is_tombstone=? AND d.kind=? AND d.locale=?)`, [
+            e.documentId,
+            e.revisionId,
+            e.payloadChecksum,
+            e.schemaVersion,
+            e.tombstone ? 1 : 0,
+            e.kind,
+            e.locale,
+        ]));
+    // Every unselected document must retain the exact public revision. New
+    // documents and removals must be explicitly selected, never implicit edits.
+    const selectedIds = new Set(selectedDrafts.map((d) => d.documentId));
+    for (const e of release.entries)
+        if (!selectedIds.has(e.documentId))
+            statements.push(transactionAssertion(db, "EXISTS(SELECT 1 FROM content_release_entries WHERE release_id=? AND document_id=? AND revision_id=?)", [expectedBaseReleaseId, e.documentId, e.revisionId]));
+    const placeholders = release.entries.map(() => "?").join(",");
+    statements.push(transactionAssertion(db, `NOT EXISTS(SELECT 1 FROM content_release_entries WHERE release_id=? AND document_id NOT IN (${placeholders}))`, [expectedBaseReleaseId, ...release.entries.map((e) => e.documentId)]));
+    statements.push(db
+        .prepare(`INSERT INTO content_releases(release_id,base_release_id,request_checksum,status,active_slot,manifest_checksum,schema_package_version,materializer_version,created_by_subject,created_at,finished_at) VALUES(?,?,?,'published',NULL,?,?,?,?,?,?)`)
+        .bind(release.releaseId, expectedBaseReleaseId, await canonicalChecksum({
+        releaseId: release.releaseId,
+        manifestChecksum: release.manifestChecksum,
+    }), release.manifestChecksum, release.schemaPackageVersion, release.materializerVersion, authorSubject, now, now));
+    for (const e of release.entries)
+        statements.push(db
+            .prepare("INSERT INTO content_release_entries(release_id,document_id,revision_id) VALUES(?,?,?)")
+            .bind(release.releaseId, e.documentId, e.revisionId));
+    for (const d of selectedDrafts)
+        statements.push(db
+            .prepare("UPDATE content_documents SET draft_revision_id=NULL,updated_at=? WHERE document_id=? AND draft_revision_id=?")
+            .bind(now, d.documentId, d.revisionId));
+    statements.push(db
+        .prepare("UPDATE content_site_state SET current_release_id=?,updated_at=? WHERE singleton=1 AND current_release_id=?")
+        .bind(release.releaseId, now, expectedBaseReleaseId));
+    statements.push(transactionAssertion(db, "EXISTS(SELECT 1 FROM content_site_state WHERE singleton=1 AND current_release_id=?)", [release.releaseId]));
+    await db.batch(statements);
+}

package/dist/functions/_shared/b2.js

@@ -50,7 +50,7 @@ export async function b2Request(env, method, key, options = {}) {
     `AWS4-HMAC-SHA256 Credential=${env.B2_APPLICATION_KEY_ID}/${scope}, ` +
     `SignedHeaders=${signedNames.join(";")}, Signature=${signature}`);
 
-  return fetch(url, { method, headers, body });
+  return fetch(url, { method, headers, body, signal: method === "GET" && !options.query?.uploadId ? undefined : AbortSignal.timeout(60_000) });
 }
 
 export async function b2PresignUploadPart(env, key, uploadId, partNumber, expires = 900) {
@@ -121,7 +121,7 @@ export async function b2CompleteMultipart(env, key, uploadId, parts) {
     body,
   });
   const text = await res.text();
-  if (!res.ok) throw new Error(`B2 complete multipart ${res.status}: ${text.slice(0, 300)}`);
+  if (!res.ok || /<Error[>\s]/.test(text)) throw new Error(`B2 complete multipart ${res.status}: ${text.slice(0, 300)}`);
   return { etag: xml(text, "ETag"), versionId: xml(text, "VersionId") };
 }
 
@@ -140,7 +140,7 @@ export async function b2ListParts(env, key, uploadId) {
     if (marker) query["part-number-marker"] = marker;
     const res = await b2Request(env, "GET", key, { query });
     const text = await res.text();
-    if (!res.ok) throw new Error(`B2 list parts ${res.status}: ${text.slice(0, 300)}`);
+    if (!res.ok) throw Object.assign(new Error(`B2 list parts ${res.status}: ${text.slice(0, 300)}`), { status: res.status });
     for (const block of text.matchAll(/<Part>([\s\S]*?)<\/Part>/g)) {
       parts.push({
         partNumber: Number(xml(block[1], "PartNumber")),
@@ -189,6 +189,25 @@ export function b2Get(env, key, range) {
   return b2Request(env, "GET", key, { headers });
 }
 
+export async function b2Head(env, key) {
+  const res = await b2Request(env, "HEAD", key);
+  if (res.status === 404) return null;
+  if (!res.ok) throw new Error(`B2 head ${res.status}`);
+  return { bytes: Number(res.headers.get("content-length")), etag: (res.headers.get("etag") || "").replaceAll('"', "") };
+}
+
+/** ETag multipart S3: MD5 dei digest binari delle parti. MD5 è supportato da Workers
+ * per interoperabilità; non viene usato per autenticazione o hashing di segreti. */
+export async function multipartEtag(parts) {
+  const tags = parts.map((p) => String(p.etag).replaceAll('"', ""));
+  if (tags.some((tag) => !/^[a-f0-9]{32}$/i.test(tag))) return null;
+  const binary = new Uint8Array(tags.length * 16);
+  tags.forEach((tag, n) => {
+    for (let i = 0; i < 16; i++) binary[n * 16 + i] = parseInt(tag.slice(i * 2, i * 2 + 2), 16);
+  });
+  return `${hex(await crypto.subtle.digest("MD5", binary))}-${parts.length}`;
+}
+
 export async function b2Delete(env, key) {
   const res = await b2Request(env, "DELETE", key);
   if (!res.ok && res.status !== 404) {

package/dist/functions/_shared/delivery-crypto.js

@@ -8,6 +8,11 @@
 const enc = new TextEncoder();
 const dec = new TextDecoder();
 
+// Public bearer links: 12 cryptographically random bytes = 16 base64url chars
+// (96 bits). Keep other tokens at their existing lengths; never truncate old links.
+export const DELIVERY_LINK_TOKEN_BYTES = 12;
+export const DELIVERY_LINK_MIN_LENGTH = 16;
+
 export function b64url(bytes) {
   let s = "";
   const a = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);

package/dist/functions/_shared/delivery-limits.d.ts

@@ -0,0 +1,9 @@
+export const DELIVERY_MAX_SOURCE_BYTES: number;
+export const DELIVERY_PART_BYTES: number;
+export const DELIVERY_MAX_PARTS: number;
+export const DELIVERY_MAX_ARCHIVE_BYTES: number;
+export function validateDeliverySourceBytes(value: unknown): number;
+
+export const DELIVERY_V1_MANIFEST_BYTES: number;
+export const DELIVERY_SKIP_REASON_CHARS: number;
+export function validateDeliveryManifestV1(json: string): void;

package/dist/functions/_shared/delivery-limits.js

@@ -0,0 +1,29 @@
+// Contratto condiviso tra browser e API. GB decimali, per pacchetto di originali.
+export const DELIVERY_MAX_SOURCE_BYTES = 150_000_000_000;
+export const DELIVERY_PART_BYTES = 16 * 1024 * 1024;
+export const DELIVERY_MAX_PARTS = 10_000;
+export const DELIVERY_MAX_ARCHIVE_BYTES = DELIVERY_PART_BYTES * DELIVERY_MAX_PARTS;
+
+export function validateDeliverySourceBytes(value) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw limitError("La dimensione dei file non è valida", 400);
+  }
+  if (value > DELIVERY_MAX_SOURCE_BYTES) {
+    throw limitError("Il limite è 150 GB per invio di file. Dividi i file in più invii; questo caricamento non può essere avviato o ripreso.", 413);
+  }
+  return value;
+}
+
+function limitError(message, status) {
+  return Object.assign(new Error(message), { status, code: "delivery_size_limit", retryable: false });
+}
+
+// Il margine lascia spazio agli altri campi della riga D1 (limite 2 MB).
+export const DELIVERY_V1_MANIFEST_BYTES = 1_800_000;
+export const DELIVERY_SKIP_REASON_CHARS = 256;
+export function validateDeliveryManifestV1(json) {
+  if (new TextEncoder().encode(json).byteLength > DELIVERY_V1_MANIFEST_BYTES) {
+    throw Object.assign(new Error("L’elenco dei file supera la capacità di questo formato di invio. Dividi la selezione in più invii."),
+      { status: 413, code: "delivery_manifest_limit", retryable: false });
+  }
+}

package/dist/functions/_shared/delivery-manifest-v2.sql

@@ -0,0 +1,49 @@
+-- Apply to the consumer's delivery DB AFTER its delivery_packages migration.
+-- Separate from AdminKit's editorial CONTENT_DB migrations. Idempotent.
+CREATE TABLE IF NOT EXISTS delivery_manifest_state (
+  package_id TEXT PRIMARY KEY REFERENCES delivery_packages(id) ON DELETE CASCADE,
+  state TEXT NOT NULL DEFAULT 'uploading' CHECK(state IN ('uploading','sealed','ready')),
+  created_at TEXT NOT NULL,
+  writer_token TEXT,
+  writer_until INTEGER NOT NULL DEFAULT 0,
+  metadata_bytes INTEGER NOT NULL DEFAULT 0 CHECK(metadata_bytes BETWEEN 0 AND 67108864),
+  cursor INTEGER NOT NULL DEFAULT 0,
+  page_count INTEGER NOT NULL DEFAULT 0,
+  root_json TEXT
+);
+CREATE TABLE IF NOT EXISTS delivery_manifest_entries (
+  package_id TEXT NOT NULL REFERENCES delivery_manifest_state(package_id) ON DELETE CASCADE,
+  entry_id INTEGER NOT NULL CHECK(entry_id>=0),
+  name TEXT NOT NULL,
+  has_preview INTEGER NOT NULL DEFAULT 0,
+  requires_variant INTEGER NOT NULL DEFAULT 0,
+  variant_done INTEGER NOT NULL DEFAULT 0,
+  source_bytes INTEGER NOT NULL CHECK(source_bytes>=0),
+  entry_json TEXT NOT NULL CHECK(length(CAST(entry_json AS BLOB))<=131072),
+  PRIMARY KEY(package_id,entry_id), UNIQUE(package_id,name)
+);
+CREATE INDEX IF NOT EXISTS delivery_manifest_gallery ON delivery_manifest_entries(package_id,has_preview,entry_id);
+CREATE TABLE IF NOT EXISTS delivery_manifest_receipts (
+  package_id TEXT NOT NULL REFERENCES delivery_manifest_state(package_id) ON DELETE CASCADE,
+  batch_id TEXT NOT NULL, digest TEXT NOT NULL,
+  PRIMARY KEY(package_id,batch_id)
+);
+CREATE TABLE IF NOT EXISTS delivery_manifest_objects (
+  package_id TEXT NOT NULL REFERENCES delivery_manifest_state(package_id) ON DELETE CASCADE,
+  page_number INTEGER NOT NULL,
+  object_key TEXT NOT NULL UNIQUE, digest TEXT NOT NULL,
+  end_cursor INTEGER NOT NULL, entry_count INTEGER NOT NULL,
+  verified INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY(package_id,page_number)
+);
+
+CREATE TABLE IF NOT EXISTS delivery_manifest_claims (
+  package_id TEXT NOT NULL REFERENCES delivery_manifest_state(package_id) ON DELETE CASCADE,
+  phase TEXT NOT NULL, entry_id INTEGER NOT NULL,
+  PRIMARY KEY(package_id,phase,entry_id)
+);
+CREATE TABLE IF NOT EXISTS delivery_checkpoints (
+  package_id TEXT PRIMARY KEY REFERENCES delivery_manifest_state(package_id) ON DELETE CASCADE,
+  offset INTEGER NOT NULL,
+  checkpoint_json TEXT NOT NULL CHECK(length(CAST(checkpoint_json AS BLOB))<=32768)
+);

package/dist/functions/_shared/delivery-manifest.js

@@ -0,0 +1,392 @@
+/* V2: bounded metadata ingestion, immutable snapshots and recoverable publication.
+ * The consumer must install delivery-manifest-v2.sql and all public readers before
+ * explicitly enabling DELIVERY_MANIFEST_V2. Readers remain available when disabled.
+ */
+import { b2ObjectKey, b2PutSmall, b2Head } from './b2.js';
+import { sha256 } from './delivery-crypto.js';
+import { DELIVERY_MAX_ARCHIVE_BYTES, validateDeliverySourceBytes } from './delivery-limits.js';
+export const MANIFEST_BATCH_ENTRIES = 200;
+export const MANIFEST_BATCH_BYTES = 256 * 1024;
+export const MANIFEST_MAX_ENTRIES = 100_000;
+export const MANIFEST_MAX_BYTES = 64 * 1024 * 1024;
+const enc = new TextEncoder();
+const bytes = value => enc.encode(value).length;
+const fail = (message, status = 400) => Object.assign(new Error(message), { status, code: 'delivery_manifest', retryable: false });
+export function manifestVersion(pkg) { return parseManifest(pkg?.manifest_json).version === 2 ? 2 : 1; }
+export function parseManifest(json) { try { return JSON.parse(json || '{}'); } catch { return {}; } }
+export function v2Enabled(env) { return env.DELIVERY_MANIFEST_V2 === 'true'; }
+
+export async function readManifestEntry(env, pkg, index) {
+  if (!Number.isSafeInteger(index) || index < 0) return null;
+  if (manifestVersion(pkg) === 1) return parseManifest(pkg.manifest_json).entries?.[index] || null;
+  const row = await env.DB.prepare('SELECT entry_json FROM delivery_manifest_entries WHERE package_id=? AND entry_id=?')
+    .bind(pkg.id, index).first();
+  return row ? JSON.parse(row.entry_json) : null;
+}
+export async function readManifestPage(env, pkg, after = -1, limit = 100, imagesOnly = true) {
+  if (!Number.isSafeInteger(after) || after < -1 || !Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw fail('Pagina non valida');
+  let rows;
+  if (manifestVersion(pkg) === 1) {
+    rows = (parseManifest(pkg.manifest_json).entries || []).map((entry, index) => ({ index, entry }))
+      .filter(row => row.index > after && (!imagesOnly || row.entry.web)).slice(0, limit + 1);
+  } else {
+    const out = await env.DB.prepare(`SELECT entry_id,entry_json FROM delivery_manifest_entries
+      WHERE package_id=? ${imagesOnly ? 'AND has_preview=1' : ''} AND entry_id>? ORDER BY entry_id LIMIT ?`)
+      .bind(pkg.id, after, limit + 1).all();
+    rows = (out.results || []).map(row => ({ index: row.entry_id, entry: JSON.parse(row.entry_json) }));
+  }
+  const more = rows.length > limit;
+  rows = rows.slice(0, limit);
+  return { entries: rows, nextCursor: more ? rows.at(-1).index : null };
+}
+async function activePackage(env, body, write = false) {
+  const pkg = await env.DB.prepare(`SELECT p.* FROM delivery_packages p JOIN deliveries d ON d.id=p.delivery_id
+    WHERE p.id=? AND p.delivery_id=? AND p.state IN ('uploading','ready') AND d.status!='deleted'`)
+    .bind(String(body.packageId || ''), String(body.id || '')).first();
+  if (!pkg || manifestVersion(pkg) !== 2) throw fail('Pacchetto v2 non disponibile', 409);
+  if (write) await assertManifestWriter(env, pkg.id, body.writerToken);
+  return pkg;
+}
+function member(value) {
+  if (!value || !['offset','length','crc32'].every(key => Number.isSafeInteger(value[key]) && value[key] >= 0) ||
+      value.crc32 > 0xffffffff || value.offset + value.length > DELIVERY_MAX_ARCHIVE_BYTES) throw fail('Intervallo archivio non valido');
+  return { offset: value.offset, length: value.length, crc32: value.crc32 };
+}
+function entry(value) {
+  if (!value || typeof value.name !== 'string' || !value.name || bytes(value.name) > 8192 ||
+      value.name.startsWith('/') || value.name.includes('\\') || value.name.split('/').some(x => !x || x === '.' || x === '..') || /[\x00-\x1f\x7f]/.test(value.name)) throw fail('Percorso non valido');
+  if (typeof value.type !== 'string' || bytes(value.type) > 256) throw fail('Tipo file non valido');
+  const out = { name: value.name, type: value.type, original: member(value.original) };
+  for (const kind of ['web','thumb']) if (value[kind]) out[kind] = member(value[kind]);
+  for (const dim of ['width','height']) if (value[dim] != null) {
+    if (!Number.isSafeInteger(value[dim]) || value[dim] < 1) throw fail('Dimensioni immagine non valide');
+    out[dim] = value[dim];
+  }
+  if (value.skipped != null) {
+    if (typeof value.skipped !== 'string' || value.skipped.length > 256) throw fail('Errore conversione troppo lungo');
+    out.skipped = value.skipped;
+  }
+  if (bytes(JSON.stringify(out)) > 131072) throw fail('Metadati del file troppo grandi', 413);
+  return out;
+}
+
+export async function ingestManifest(env, body) {
+  const pkg = await activePackage(env, body, true);
+  if (!['originals', 'variants'].includes(body.phase) || !Array.isArray(body.entries) || !body.entries.length ||
+      body.entries.length > MANIFEST_BATCH_ENTRIES || bytes(JSON.stringify(body.entries)) > MANIFEST_BATCH_BYTES) throw fail('Batch manifest non valido', 413);
+  if (typeof body.batchId !== 'string' || !/^[a-zA-Z0-9_-]{1,80}$/.test(body.batchId)) throw fail('Identità batch non valida');
+  const seen = new Set();
+  const rows = body.entries.map(row => {
+    if (!Number.isSafeInteger(row.index) || row.index < 0 || row.index >= pkg.file_count || seen.has(row.index)) throw fail('Indice file non valido');
+    seen.add(row.index);
+    const clean = entry(row.entry);
+    if (body.phase === 'originals' && (clean.web || clean.thumb || clean.skipped != null)) throw fail('Originali e varianti richiedono fasi distinte');
+    if (body.phase === 'variants' && clean.skipped == null && (!clean.web || (pkg.gallery_enabled && !clean.thumb))) throw fail('Varianti incomplete');
+    return { index: row.index, entry: clean, requiresVariant: Number(!!(pkg.web_enabled || pkg.gallery_enabled) && /\.(jpe?g|png|webp)$/i.test(clean.name)) };
+  });
+  const payload = JSON.stringify(rows);
+  const digest = await sha256(body.phase + ':' + payload);
+  const receipt = await env.DB.prepare('SELECT digest FROM delivery_manifest_receipts WHERE package_id=? AND batch_id=?').bind(pkg.id, body.batchId).first();
+  if (receipt) {
+    if (receipt.digest !== digest) throw fail('Il batch esiste con contenuti diversi', 409);
+    return { accepted: true };
+  }
+  const state = await env.DB.prepare('SELECT * FROM delivery_manifest_state WHERE package_id=?').bind(pkg.id).first();
+  if (pkg.state !== 'uploading' || state?.state !== 'uploading') throw fail('Il manifest è già congelato', 409);
+  const prior = await env.DB.prepare(`SELECT entry_id,entry_json FROM delivery_manifest_entries WHERE package_id=?
+    AND entry_id IN (SELECT json_extract(value,'$.index') FROM json_each(?))`).bind(pkg.id, payload).all();
+  const previous = new Map((prior.results || []).map(row => [row.entry_id, JSON.parse(row.entry_json)]));
+  for (const row of rows) {
+    const old = previous.get(row.index);
+    if (body.phase === 'originals' && old) throw fail('Originale già registrato da un altro batch', 409);
+    if (body.phase === 'variants' && (!old || old.name !== row.entry.name || old.type !== row.entry.type ||
+        JSON.stringify(old.original) !== JSON.stringify(row.entry.original))) throw fail('La variante non corrisponde all’originale', 409);
+  }
+  const delta = rows.reduce((n, row) => n + bytes(JSON.stringify(row.entry)) -
+    (previous.has(row.index) ? bytes(JSON.stringify(previous.get(row.index))) : 0), 0);
+  if (state.metadata_bytes + delta > MANIFEST_MAX_BYTES) throw fail('Troppi metadati per questo invio', 413);
+  // Budget computable before mutation; the transaction also rechecks it to close races.
+  const guard = `EXISTS (SELECT 1 FROM delivery_manifest_state s JOIN delivery_packages p ON p.id=s.package_id
+    WHERE s.package_id=? AND s.state='uploading' AND p.state='uploading')
+    AND NOT EXISTS (SELECT 1 FROM delivery_manifest_receipts WHERE package_id=? AND batch_id=?)`;
+  // Unique receipt + atomic statements: conflicting concurrent originals fail via PK,
+  // variants are accepted only once per index (a complete replacement, not mutable patches).
+  const statement = body.phase === 'originals' ? `INSERT INTO delivery_manifest_entries
+    (package_id,entry_id,name,has_preview,requires_variant,source_bytes,entry_json)
+    SELECT ?,json_extract(value,'$.index'),json_extract(value,'$.entry.name'),0,json_extract(value,'$.requiresVariant'),
+      json_extract(value,'$.entry.original.length'),json_extract(value,'$.entry') FROM json_each(?) WHERE ${guard}` :
+    `UPDATE delivery_manifest_entries SET variant_done=1,entry_json=(SELECT json_extract(value,'$.entry') FROM json_each(?) WHERE json_extract(value,'$.index')=entry_id),
+      has_preview=(SELECT COALESCE(json_type(value,'$.entry.web')='object',0) FROM json_each(?) WHERE json_extract(value,'$.index')=entry_id)
+    WHERE package_id=? AND entry_id IN (SELECT json_extract(value,'$.index') FROM json_each(?)) AND ${guard}`;
+  const write = body.phase === 'originals' ? env.DB.prepare(statement).bind(pkg.id, payload, pkg.id, pkg.id, body.batchId) :
+    env.DB.prepare(statement).bind(payload, payload, pkg.id, payload, pkg.id, pkg.id, body.batchId);
+  await env.DB.batch([
+    env.DB.prepare(`INSERT INTO delivery_manifest_claims(package_id,phase,entry_id)
+      SELECT ?,?,json_extract(value,'$.index') FROM json_each(?) WHERE ${guard}`)
+      .bind(pkg.id, body.phase, payload, pkg.id, pkg.id, body.batchId),
+    write,
+    env.DB.prepare(`UPDATE delivery_manifest_state SET metadata_bytes=metadata_bytes+? WHERE package_id=? AND ${guard}`)
+      .bind(delta, pkg.id, pkg.id, pkg.id, body.batchId),
+    env.DB.prepare(`INSERT INTO delivery_manifest_receipts(package_id,batch_id,digest)
+      SELECT ?,?,? WHERE ${guard}`).bind(pkg.id, body.batchId, digest, pkg.id, pkg.id, body.batchId),
+
+  ]);
+  const saved = await env.DB.prepare('SELECT digest FROM delivery_manifest_receipts WHERE package_id=? AND batch_id=?').bind(pkg.id, body.batchId).first();
+  if (saved?.digest !== digest) throw fail('Il manifest è cambiato durante il salvataggio', 409);
+  return { accepted: true };
+}
+
+export async function finalizeManifestStep(env, body) {
+  const pkg = await activePackage(env, body, true);
+  if (pkg.state === 'ready') return { done: true };
+  validateDeliverySourceBytes(pkg.source_bytes);
+  const uploads = (await env.DB.prepare('SELECT * FROM delivery_uploads WHERE package_id=?').bind(pkg.id).all()).results || [];
+  const byVariant = Object.fromEntries(uploads.map(u => [u.variant, u]));
+  for (const kind of ['originals', ...(pkg.web_enabled || pkg.gallery_enabled ? ['web'] : []), ...(pkg.gallery_enabled ? ['thumbs'] : [])]) {
+    if (byVariant[kind]?.state !== 'completed') throw fail('Gli archivi non sono ancora completi', 409);
+  }
+  let state = await env.DB.prepare('SELECT * FROM delivery_manifest_state WHERE package_id=?').bind(pkg.id).first();
+  if (state?.state === 'uploading') {
+    const totals = await env.DB.prepare(`SELECT COUNT(*) n,COALESCE(SUM(source_bytes),0) bytes,
+    MIN(entry_id) lo,MAX(entry_id) hi,SUM(CASE WHEN requires_variant=1 AND variant_done=0 THEN 1 ELSE 0 END) pending FROM delivery_manifest_entries WHERE package_id=?`).bind(pkg.id).first();
+  if (totals.pending || totals.n !== pkg.file_count || totals.bytes !== pkg.source_bytes || totals.lo !== 0 || totals.hi !== pkg.file_count - 1) throw fail('Elenco dei file incompleto', 409);
+  await env.DB.prepare(`UPDATE delivery_manifest_state SET state='sealed' WHERE package_id=? AND state='uploading'
+    AND EXISTS (SELECT 1 FROM delivery_packages WHERE id=? AND state='uploading')`).bind(pkg.id, pkg.id).run();
+    state = await env.DB.prepare('SELECT * FROM delivery_manifest_state WHERE package_id=?').bind(pkg.id).first();
+  }
+  if (!state || !['sealed','ready'].includes(state.state)) throw fail('Finalizzazione non disponibile', 409);
+  if (state.cursor < pkg.file_count) {
+    const result = await readManifestPage(env, pkg, state.cursor - 1, 200, false);
+    const rows = [];
+    let size = 128;
+    for (const row of result.entries) {
+      const n = bytes(JSON.stringify(row)) + 1;
+      if (rows.length && size + n > MANIFEST_BATCH_BYTES) break;
+      for (const [kind, field] of [['originals','original'],['web','web'],['thumbs','thumb']]) {
+        const m = row.entry[field];
+        if (m && (!byVariant[kind] || m.offset + m.length > byVariant[kind].bytes)) throw fail('Il manifest supera i byte dell’archivio');
+      }
+      rows.push(row); size += n;
+    }
+    const json = JSON.stringify({ version: 2, generation: pkg.id, entries: rows });
+    const digest = await sha256(json);
+    const key = b2ObjectKey(pkg.storage_prefix, `manifest-v2/${state.page_count}-${digest}.json`);
+    const end = rows.at(-1).index + 1;
+    await env.DB.prepare(`INSERT OR IGNORE INTO delivery_manifest_objects
+      (package_id,page_number,object_key,digest,end_cursor,entry_count)
+      SELECT ?,?,?,?,?,? WHERE EXISTS (SELECT 1 FROM delivery_packages WHERE id=? AND state='uploading')`)
+      .bind(pkg.id, state.page_count, key, digest, end, rows.length, pkg.id).run();
+    const reserved = await env.DB.prepare('SELECT * FROM delivery_manifest_objects WHERE package_id=? AND page_number=?').bind(pkg.id, state.page_count).first();
+    if (reserved?.object_key !== key) throw fail('Generazione modificata o annullata', 409);
+    await b2PutSmall(env, key, json, 'application/json');
+    await env.DB.batch([
+      env.DB.prepare('UPDATE delivery_manifest_objects SET verified=1 WHERE package_id=? AND page_number=? AND digest=?').bind(pkg.id, state.page_count, digest),
+      env.DB.prepare(`UPDATE delivery_manifest_state SET cursor=?,page_count=page_count+1 WHERE package_id=? AND cursor=? AND state='sealed'
+        AND EXISTS (SELECT 1 FROM delivery_packages WHERE id=? AND state='uploading')`).bind(end, pkg.id, state.cursor, pkg.id),
+    ]);
+    return { done: false, cursor: end, total: pkg.file_count };
+  }
+  const pages = (await env.DB.prepare('SELECT page_number,object_key,digest,entry_count FROM delivery_manifest_objects WHERE package_id=? AND page_number>=0 AND verified=1 ORDER BY page_number').bind(pkg.id).all()).results || [];
+  if (pages.length !== state.page_count || pages.reduce((n,p) => n + p.entry_count, 0) !== pkg.file_count) throw fail('Pagine del manifest incomplete', 409);
+  const archives = {};
+  for (const upload of uploads) {
+    const head = await b2Head(env, upload.object_key);
+    if (!head || head.bytes !== upload.bytes) throw fail('Dimensione remota diversa dall’archivio completato', 409);
+    archives[upload.variant] = { key: upload.object_key, bytes: upload.bytes, etag: head.etag };
+  }
+  const json = JSON.stringify({ version: 2, generation: pkg.id, createdAt: state.created_at,
+    fileCount: pkg.file_count, sourceBytes: pkg.source_bytes, archives, pages });
+  if (bytes(json) > MANIFEST_BATCH_BYTES) throw fail('Descrittore del manifest troppo grande', 413);
+  const digest = await sha256(json);
+  const key = b2ObjectKey(pkg.storage_prefix, `manifest-v2/root-${digest}.json`);
+  await env.DB.prepare(`INSERT OR IGNORE INTO delivery_manifest_objects(package_id,page_number,object_key,digest,end_cursor,entry_count)
+    SELECT ?,-1,?,?,?,0 WHERE EXISTS(SELECT 1 FROM delivery_packages WHERE id=? AND state='uploading')`)
+    .bind(pkg.id, key, digest, pkg.file_count, pkg.id).run();
+  const reserved = await env.DB.prepare('SELECT object_key FROM delivery_manifest_objects WHERE package_id=? AND page_number=-1').bind(pkg.id).first();
+  if (reserved?.object_key !== key) throw fail('Descrittore finale in conflitto', 409);
+  await b2PutSmall(env, key, json, 'application/json');
+  const marker = JSON.stringify({ version: 2, generation: pkg.id, root: key, digest });
+  await env.DB.batch([
+    env.DB.prepare(`UPDATE delivery_packages SET state='ready',manifest_json=?,manifest_key=?,originals_key=?,web_key=?,thumbs_key=?,stored_bytes=?,updated_at=?
+      WHERE id=? AND state='uploading' AND EXISTS(SELECT 1 FROM delivery_manifest_state WHERE package_id=? AND state='sealed' AND cursor=?)`)
+      .bind(marker, key, byVariant.originals.object_key, byVariant.web?.object_key || null, byVariant.thumbs?.object_key || null,
+        uploads.reduce((n,u) => n + u.bytes,0), new Date().toISOString(), pkg.id, pkg.id, pkg.file_count),
+    env.DB.prepare(`UPDATE delivery_manifest_state SET state='ready',root_json=? WHERE package_id=?
+      AND EXISTS(SELECT 1 FROM delivery_packages WHERE id=? AND state='ready' AND manifest_json=?)`).bind(json, pkg.id, pkg.id, marker),
+  ]);
+  const done = await env.DB.prepare("SELECT manifest_json FROM delivery_packages WHERE id=? AND state='ready'").bind(pkg.id).first();
+  if (done?.manifest_json !== marker) throw fail('Completamento annullato o in conflitto', 409);
+  return { done: true };
+}
+
+export async function manifestStatus(env, body) {
+  const pkg = await activePackage(env, body);
+  const state = await env.DB.prepare('SELECT state FROM delivery_manifest_state WHERE package_id=?').bind(pkg.id).first();
+  const row = await env.DB.prepare('SELECT checkpoint_json FROM delivery_checkpoints WHERE package_id=?').bind(pkg.id).first();
+  const cp = row ? JSON.parse(row.checkpoint_json) : null;
+  if (cp?.validation && !cp.complete) {
+    const upload = await env.DB.prepare("SELECT * FROM delivery_uploads WHERE package_id=? AND variant='originals'").bind(pkg.id).first();
+    if (!upload) throw fail('Archivio del checkpoint non disponibile', 409);
+    const parts = await checkpointParts(env, upload.id, 0, cp.validation.partCount);
+    await verifyCheckpointProof(cp, upload, parts);
+    // Keep the existing browser protocol. The full hash is needed only on resume,
+    // never on each checkpoint. Check the stored proof before deriving this hash.
+    cp.partsHash = await sha256(JSON.stringify(parts.map(partTuple)));
+  }
+  if (cp) delete cp.validation;
+  return { state: state.state, checkpoint: cp };
+}
+export async function manifestDraftPage(env, body) {
+  return readManifestPage(env, await activePackage(env, body), body.after ?? -1, 200, false);
+}
+const CHECKPOINT_PART_BYTES = 16 * 1024 * 1024;
+// A bounded tail fits with the interrupted member in the existing 32 KiB row.
+// Hash 128-part blocks: O(N) work, including a full verification on real resume.
+const PROOF_BLOCK_PARTS = 128;
+const partTuple = p => [p.part_number, p.size, p.digest];
+function emptyProof(upload) {
+  return { version: 2, uploadId: upload.id, sessionId: upload.b2_upload_id ?? null, partCount: 0, chain: '', tail: [] };
+}
+async function extendProof(proof, parts) {
+  const next = { ...proof, tail: [...proof.tail] };
+  for (const part of parts) {
+    next.tail.push(partTuple(part));
+    next.partCount++;
+    if (next.tail.length === PROOF_BLOCK_PARTS) {
+      next.chain = await sha256(next.chain + ':' + JSON.stringify(next.tail));
+      next.tail = [];
+    }
+  }
+  return next;
+}
+async function checkpointParts(env, uploadId, after, through) {
+  return (await env.DB.prepare(`SELECT part_number,size,digest FROM delivery_upload_parts
+    WHERE upload_id=? AND part_number>? AND part_number<=? ORDER BY part_number`)
+    .bind(uploadId, after, through).all()).results || [];
+}
+function checkParts(parts, after, through) {
+  if (parts.length !== through - after || parts.some((p, i) => p.part_number !== after + i + 1 ||
+      p.size !== CHECKPOINT_PART_BYTES || !/^[a-f0-9]{64}$/.test(p.digest || ''))) {
+    throw fail('Parti del checkpoint non confermate', 409);
+  }
+}
+async function verifyCheckpointProof(cp, upload, parts) {
+  const count = cp.offset / CHECKPOINT_PART_BYTES;
+  checkParts(parts, 0, count);
+  if (cp.validation) {
+    const actual = await extendProof(emptyProof(upload), parts);
+    if (JSON.stringify(actual) !== JSON.stringify(cp.validation)) throw fail('Le parti del checkpoint sono cambiate', 409);
+  } else if (await sha256(JSON.stringify(parts.map(partTuple))) !== cp.partsHash) {
+    throw fail('Le parti del checkpoint sono cambiate', 409);
+  }
+}
+// Called before accepting the remote completion, including lost-response recovery.
+export async function assertCheckpointParts(env, upload, parts) {
+  if (upload.variant !== 'originals' || manifestVersion(upload) !== 2) return;
+  const row = await env.DB.prepare('SELECT checkpoint_json FROM delivery_checkpoints WHERE package_id=?').bind(upload.package_id).first();
+  const cp = row ? JSON.parse(row.checkpoint_json) : null;
+  if (!cp || cp.complete) return;
+  const prefix = parts.filter(p => p.partNumber <= cp.offset / CHECKPOINT_PART_BYTES)
+    .map(p => ({ part_number: p.partNumber, size: p.size, digest: p.digest }));
+  await verifyCheckpointProof(cp, upload, prefix);
+}
+function checkpointPayload(cp) {
+  return { version: 1, fileIndex: cp.fileIndex, offset: cp.offset, sequence: cp.sequence,
+    complete: cp.complete === true, current: cp.current ?? null };
+}
+export async function saveManifestCheckpoint(env, body) {
+  const pkg = await activePackage(env, body, true);
+  const cp = body.checkpoint;
+  const partBytes = CHECKPOINT_PART_BYTES;
+  if (!cp || cp.version !== 1 || (cp.complete !== undefined && typeof cp.complete !== 'boolean') || !Number.isSafeInteger(cp.fileIndex) || cp.fileIndex < 0 || cp.fileIndex > pkg.file_count ||
+      !Number.isSafeInteger(cp.offset) || cp.offset < 0 || cp.offset > DELIVERY_MAX_ARCHIVE_BYTES ||
+      !Number.isSafeInteger(cp.sequence) || cp.sequence < 0 || bytes(JSON.stringify(cp)) > 30000) throw fail('Checkpoint non valido');
+  const upload = await env.DB.prepare("SELECT * FROM delivery_uploads WHERE package_id=? AND variant='originals'").bind(pkg.id).first();
+  if (!upload) throw fail('Archivio del checkpoint non disponibile', 409);
+  const previousRow = await env.DB.prepare('SELECT checkpoint_json FROM delivery_checkpoints WHERE package_id=?').bind(pkg.id).first();
+  const previous = previousRow ? JSON.parse(previousRow.checkpoint_json) : null;
+  if (previous && (cp.offset < previous.offset || cp.fileIndex < previous.fileIndex || cp.sequence < previous.sequence)) {
+    throw fail('Checkpoint precedente a quello confermato', 409);
+  }
+  if (previous && cp.offset === previous.offset) {
+    if (JSON.stringify(checkpointPayload(cp)) !== JSON.stringify(checkpointPayload(previous))) throw fail('Checkpoint diverso allo stesso offset', 409);
+    return { accepted: true };
+  }
+  if (previous?.complete) throw fail('Checkpoint già completo', 409);
+  let proof = emptyProof(upload);
+  let firstFile = 0;
+  if (previous?.validation) {
+    if (previous.validation.uploadId !== upload.id || previous.validation.sessionId !== (upload.b2_upload_id ?? null)) {
+      throw fail('Sessione del checkpoint cambiata', 409);
+    }
+    proof = previous.validation;
+    firstFile = previous.fileIndex;
+  }
+  // Original entries are insert-only. Variant updates preserve their original
+  // identity; PK + the interval count prove continuity of just the new suffix.
+  const count = await env.DB.prepare(`SELECT COUNT(*) n FROM delivery_manifest_entries
+    WHERE package_id=? AND entry_id>=? AND entry_id<?`).bind(pkg.id, firstFile, cp.fileIndex).first();
+  if (count.n !== cp.fileIndex - firstFile) throw fail('Metadati precedenti al checkpoint incompleti', 409);
+  if (cp.complete) {
+    if (cp.fileIndex !== pkg.file_count || upload.state !== 'completed' || cp.offset !== upload.bytes) throw fail('Archivio del checkpoint incompleto', 409);
+    if (previous) await verifyCheckpointProof(previous, upload, await checkpointParts(env, upload.id, 0, previous.offset / partBytes));
+  } else {
+    if (!cp.offset || cp.offset % partBytes || cp.fileIndex >= pkg.file_count || !cp.current ||
+        !Number.isSafeInteger(cp.current.read) || cp.current.read < 1 || cp.current.dataOffset + cp.current.read !== cp.offset ||
+        !/^[a-f0-9]{64}$/.test(cp.current.chain || '')) throw fail('Checkpoint non allineato');
+    const n = cp.offset / partBytes;
+    const parts = await checkpointParts(env, upload.id, proof.partCount, n);
+    checkParts(parts, proof.partCount, n);
+    if (previous && !previous.validation) {
+      // One full check when upgrading a legacy checkpoint; subsequent saves use
+      // only the suffix. A stored legacy hash must never be silently replaced.
+      await verifyCheckpointProof(previous, upload, parts.filter(p => p.part_number <= previous.offset / partBytes));
+    }
+    proof = await extendProof(proof, parts);
+  }
+  const json = JSON.stringify({ ...checkpointPayload(cp), partsHash: null, ...(cp.complete ? {} : { validation: proof }) });
+  if (bytes(json) > 32768) throw fail('Checkpoint troppo grande', 413);
+  await env.DB.prepare(`INSERT INTO delivery_checkpoints(package_id,offset,checkpoint_json)
+    SELECT ?,?,? WHERE EXISTS(SELECT 1 FROM delivery_packages p JOIN delivery_manifest_state s ON s.package_id=p.id
+      WHERE p.id=? AND p.state='uploading' AND s.writer_token=?)
+    ON CONFLICT(package_id) DO UPDATE SET offset=excluded.offset,checkpoint_json=excluded.checkpoint_json
+    WHERE delivery_checkpoints.checkpoint_json=? AND excluded.offset>delivery_checkpoints.offset`)
+    .bind(pkg.id, cp.offset, json, pkg.id, body.writerToken, previousRow?.checkpoint_json ?? null).run();
+  const saved = await env.DB.prepare('SELECT checkpoint_json FROM delivery_checkpoints WHERE package_id=?').bind(pkg.id).first();
+  if (!saved || saved.checkpoint_json !== json) throw fail('Checkpoint cambiato o annullato', 409);
+  return { accepted: true };
+}
+
+// La lease supera la durata massima delle URL PUT (15 min) e dei PUT in volo
+// (30 min). La stessa identità locale recupera subito; un altro dispositivo deve
+// attendere un'ora senza attività, evitando un takeover con scritture ancora vive.
+const WRITER_RENEW_MS = 5 * 60_000;
+// With renewal every five minutes, retain at least one full hour of protection
+// after the last authorized operation (takeover may wait up to 65 minutes).
+const WRITER_LEASE_MS = 65 * 60_000;
+export async function claimManifestWriter(env, body) {
+  const pkg = await activePackage(env, body);
+  const token = body.writerToken;
+  if (typeof token !== 'string' || !/^[a-zA-Z0-9-]{16,80}$/.test(token)) throw fail('Identità del caricamento non valida');
+  const now = Date.now();
+  await env.DB.prepare(`UPDATE delivery_manifest_state SET writer_token=?,writer_until=? WHERE package_id=?
+    AND (writer_token IS NULL OR writer_token=? OR writer_until<?)`)
+    .bind(token, now + WRITER_LEASE_MS, pkg.id, token, now).run();
+  await assertManifestWriter(env, pkg.id, token);
+  return { claimed: true };
+}
+export async function assertManifestWriter(env, packageId, token) {
+  if (!token) throw fail('Identità del caricamento mancante', 409);
+  const now = Date.now();
+  const current = await env.DB.prepare('SELECT writer_token,writer_until FROM delivery_manifest_state WHERE package_id=?').bind(packageId).first();
+  const fenced = () => fail('Il caricamento è aperto in un altro browser. Riprendilo lì oppure attendi circa un’ora senza attività prima di cambiare dispositivo.', 409);
+  if (!current || current.writer_token !== token) throw fenced();
+  if (current.writer_until > now + WRITER_LEASE_MS - WRITER_RENEW_MS) return;
+  const result = await env.DB.prepare(`UPDATE delivery_manifest_state SET writer_until=?
+    WHERE package_id=? AND writer_token=? AND writer_until=?`)
+    .bind(now + WRITER_LEASE_MS, packageId, token, current.writer_until).run();
+  if (result.meta.changes !== 1) {
+    const renewed = await env.DB.prepare('SELECT writer_token,writer_until FROM delivery_manifest_state WHERE package_id=?').bind(packageId).first();
+    if (!renewed || renewed.writer_token !== token || renewed.writer_until <= now) throw fenced();
+  }
+}