@cardinali-studio/adminkit 2.2.25 → 2.2.33

package/dist/functions/_shared/delivery-purge.js

@@ -12,7 +12,8 @@
  * nudo, con le sole `env.DB` e le variabili B2.
  */
 
-import { b2AbortMultipart, b2Delete } from "./b2.js";
+import { manifestVersion } from "./delivery-manifest.js";
+import { b2AbortMultipart, b2Delete, b2ObjectKey } from "./b2.js";
 
 const DAY = 86_400_000;
 
@@ -42,8 +43,23 @@ async function purgePackages(env, rows, calls) {
         await b2AbortMultipart(env, upload.object_key, upload.b2_upload_id);
       }
     }
+    // Una PUT firmata prima dell’annullamento può ancora terminare: conserva la tombstone.
+    if (pkg.purge_after && pkg.purge_after > new Date().toISOString()) return false;
+    if (manifestVersion(pkg) === 2) {
+      const pages = await env.DB.prepare("SELECT page_number,object_key FROM delivery_manifest_objects WHERE package_id=? LIMIT ?")
+        .bind(pkg.id, Math.max(0, calls.left)).all();
+      for (const page of pages.results || []) {
+        calls.left -= 1;
+        await b2Delete(env, page.object_key);
+        await env.DB.prepare("DELETE FROM delivery_manifest_objects WHERE package_id=? AND page_number=?")
+          .bind(pkg.id, page.page_number).run();
+      }
+      const remaining = await env.DB.prepare("SELECT 1 n FROM delivery_manifest_objects WHERE package_id=? LIMIT 1").bind(pkg.id).first();
+      if (remaining || calls.left <= 0) return false;
+    }
     const keys = new Set([
       pkg.originals_key, pkg.web_key, pkg.thumbs_key, pkg.manifest_key,
+      ...["originals.zip", "web.zip", "thumbs.zip", "manifest.json"].map((name) => b2ObjectKey(pkg.storage_prefix, name)),
       ...(uploads.results || []).map((upload) => upload.object_key),
     ].filter(Boolean));
     for (const key of keys) {

package/dist/functions/api/deliveries.js

@@ -1,19 +1,22 @@
 /* CRUD immediato delle consegne.
  *
  * Sta sotto /admin/: Access + verifica JWT sono già applicati dal middleware.
- * Nessun salvataggio tocca Git. Le operazioni sui byte sono versionate e i delete
- * cancellano subito, nella stessa richiesta: non c'è un cestino dei transfer, e
- * rimandare non serviva a nessuno. La tombstone D1 sopravvive solo il tempo del
- * lavoro su B2, come punto di ripresa se una chiamata fallisce.
+ * Nessun salvataggio tocca Git. Le operazioni sui byte sono versionate. I delete
+ * nascondono subito i pacchetti; quelli ancora in upload conservano una tombstone
+ * per un'ora, così la pulizia può raccogliere scritture tardive. La tombstone resta
+ * anche il punto di ripresa se una chiamata a B2 fallisce.
  */
 
 import { b2ObjectKey, b2PutSmall } from "../_shared/b2.js";
-import { randomToken, seal, sha256, unseal } from "../_shared/delivery-crypto.js";
+import { validateDeliverySourceBytes, validateDeliveryManifestV1 } from "../_shared/delivery-limits.js";
+import { DELIVERY_LINK_MIN_LENGTH, DELIVERY_LINK_TOKEN_BYTES, randomToken, seal, sha256, unseal } from "../_shared/delivery-crypto.js";
 /* Il lavoro di cancellazione sta in _shared perché lo condivide con il cron:
  * workers/delivery-housekeeping. Qui si usa nelle due direzioni — subito dopo
  * una delete, e in coda a una GET per finire ciò che si fosse fermato. */
 import { purgeDeliveryNow, purgeDue, purgePackageNow } from "../_shared/delivery-purge.js";
 
+import { claimManifestWriter, manifestStatus, manifestDraftPage, saveManifestCheckpoint, manifestVersion, readManifestEntry, readManifestPage, ingestManifest, finalizeManifestStep, v2Enabled, MANIFEST_MAX_ENTRIES } from "../_shared/delivery-manifest.js";
+
 const DAY = 86_400_000;
 
 export async function onRequestGet({ request, env, waitUntil }) {
@@ -23,6 +26,7 @@ export async function onRequestGet({ request, env, waitUntil }) {
   }
   const id = new URL(request.url).searchParams.get("id");
   try {
+    if (new URL(request.url).searchParams.get("capabilities") === "1") return json({ ok: true, manifestVersion: v2Enabled(env) ? 2 : 1, jpegEnabled: env.DELIVERY_JPEG_ENABLED === "true", downloadLabelsEnabled: env.DELIVERY_DOWNLOAD_LABELS === "true" });
     if (id) {
       const delivery = await deliveryDetail(env, id, new URL(request.url).origin);
       return delivery ? json({ ok: true, delivery }) : json({ ok: false, error: "Transfer non trovato" }, 404);
@@ -57,6 +61,7 @@ export async function onRequestPost({ request, env }) {
   const action = String(body?.action || "");
   try {
     switch (action) {
+      case "capabilities": return json({ ok: true, manifestVersion: v2Enabled(env) ? 2 : 1, jpegEnabled: env.DELIVERY_JPEG_ENABLED === "true", downloadLabelsEnabled: env.DELIVERY_DOWNLOAD_LABELS === "true" });
       case "create": return json({ ok: true, delivery: await createDelivery(env, body, new URL(request.url).origin) });
       case "quickCreate": return json({ ok: true, delivery: await createQuickDelivery(env, body, new URL(request.url).origin) });
       case "update": return json({ ok: true, delivery: await updateDelivery(env, body, new URL(request.url).origin) });
@@ -66,35 +71,50 @@ export async function onRequestPost({ request, env }) {
       case "duplicate": return json({ ok: true, delivery: await duplicateDelivery(env, body, new URL(request.url).origin) });
       case "delete": return json({ ok: true, ...(await deleteDelivery(env, body)) });
       case "createPackage": return json({ ok: true, package: await createPackage(env, body) });
+      case "manifestClaim": return json({ ok: true, ...(await claimManifestWriter(env, body)) });
+      case "manifestStatus": return json({ ok: true, ...(await manifestStatus(env, body)) });
+      case "manifestDraftPage": return json({ ok: true, ...(await manifestDraftPage(env, body)) });
+      case "manifestCheckpoint": return json({ ok: true, ...(await saveManifestCheckpoint(env, body)) });
+      case "manifestBatch": return json({ ok: true, ...(await ingestManifest(env, body)) });
+      case "manifestFinalize": return json({ ok: true, ...(await finalizeManifestStep(env, body)) });
+      case "manifestPage": {
+        const pkg = await env.DB.prepare("SELECT * FROM delivery_packages WHERE id=? AND delivery_id=? AND state='ready'").bind(body.packageId, body.id).first();
+        if (!pkg) throw new InputError("Pacchetto non disponibile");
+        const page = await readManifestPage(env, pkg, body.after ?? -1);
+        return json({ ok: true, images: page.entries.map(({ entry, index }) => packageImage(pkg.id, entry, index)), nextCursor: page.nextCursor });
+      }
       case "finalizePackage": return json({ ok: true, package: await finalizePackage(env, body) });
       case "deletePackage": return json({ ok: true, ...(await deletePackage(env, body)) });
       case "commitHeroes": return json({ ok: true, delivery: await commitHeroes(env, body, new URL(request.url).origin) });
       case "saveSettings": return json({ ok: true, settings: await saveSettings(env, body) });
       case "createLink": return json({ ok: true, link: await createLink(env, body, new URL(request.url).origin) });
+      case "shortenLink": return json({ ok: true, link: await shortenLink(env, body, new URL(request.url).origin) });
       case "updateLink": return json({ ok: true, link: await updateLink(env, body, new URL(request.url).origin) });
       case "revokeLink": return json({ ok: true, ...(await revokeLink(env, body)) });
       default: return json({ ok: false, error: "Azione non valida" }, 400);
     }
   } catch (e) {
     console.error(`deliveries ${action}:`, e);
-    const status = e instanceof InputError ? 400 : e instanceof ConflictError ? 409 : 500;
-    return json({ ok: false, error: message(e), code: status === 409 ? "conflict" : "invalid" }, status);
+    const status = ["delivery_size_limit", "delivery_manifest_limit", "delivery_manifest"].includes(e.code) ? e.status : e instanceof InputError ? 400 : e instanceof ConflictError ? 409 : 500;
+    return json({ ok: false, error: message(e), code: e.code || (status === 409 ? "conflict" : "invalid"), retryable: status >= 500 }, status);
   }
 }
 
 async function createQuickDelivery(env, body, origin) {
+  const labels = downloadLabelFields(env, body);
   const title = required(body.title, "Il nome del transfer è obbligatorio");
   const id = crypto.randomUUID();
   const now = new Date().toISOString();
   await env.DB.prepare(`
     INSERT INTO deliveries
-      (id,client_name,title,files_expires_at,status,created_at,updated_at)
-    VALUES (?,'',?,?,'uploading',?,?)
-  `).bind(id, title, nullableDate(body.filesExpiresAt), now, now).run();
+      (id,client_name,title,files_expires_at,status,created_at,updated_at${labels.columns.map(c => ',' + c).join('')})
+    VALUES (?,'',?,?,'uploading',?,?${labels.columns.map(() => ',?').join('')})
+  `).bind(id, title, nullableDate(body.filesExpiresAt), now, now, ...labels.values).run();
   return deliveryDetail(env, id, origin);
 }
 
 async function createDelivery(env, body, origin) {
+  const labels = downloadLabelFields(env, body);
   const client = required(body.clientName, "Il cliente è obbligatorio");
   const title = required(body.title, "Il transfer ha bisogno di un nome");
   const id = crypto.randomUUID();
@@ -102,18 +122,19 @@ async function createDelivery(env, body, origin) {
   await env.DB.prepare(`
     INSERT INTO deliveries
       (id,client_name,title,description,license_notes,cta_enabled,cta_label,cta_url,
-       expires_at,files_expires_at,status,created_at,updated_at)
-    VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?)
+       expires_at,files_expires_at,status,created_at,updated_at${labels.columns.map(c => ',' + c).join('')})
+    VALUES (?,?,?,?,?,?,?,?,?,?,'draft',?,?${labels.columns.map(() => ',?').join('')})
   `).bind(
     id, client, title, text(body.description), text(body.licenseNotes),
     bool(body.ctaEnabled), text(body.ctaLabel) || "Lascia una recensione",
     optionalHttpUrl(body.ctaUrl), nullableDate(body.expiresAt),
-    nullableDate(body.filesExpiresAt), now, now,
+    nullableDate(body.filesExpiresAt), now, now, ...labels.values,
   ).run();
   return deliveryDetail(env, id, origin);
 }
 
 async function updateDelivery(env, body, origin) {
+  const labels = downloadLabelFields(env, body);
   const id = required(body.id, "id del transfer mancante");
   const current = await env.DB.prepare("SELECT version,status FROM deliveries WHERE id=? AND status!='deleted'")
     .bind(id).first();
@@ -127,13 +148,13 @@ async function updateDelivery(env, body, origin) {
     UPDATE deliveries SET
       client_name=?, title=?, description=?, license_notes=?,
       cta_enabled=?, cta_label=?, cta_url=?, expires_at=?, files_expires_at=?,
-      version=version+1, updated_at=?
+      version=version+1, updated_at=?${labels.columns.map(c => ',' + c + '=?').join('')}
     WHERE id=? AND status!='deleted'
   `).bind(
     client, title, text(body.description), text(body.licenseNotes),
     bool(body.ctaEnabled), text(body.ctaLabel) || "Lascia una recensione",
     optionalHttpUrl(body.ctaUrl), nullableDate(body.expiresAt), nullableDate(body.filesExpiresAt),
-    new Date().toISOString(), id,
+    new Date().toISOString(), ...labels.values, id,
   ).run();
   if (body.syncPackageLabel) {
     await env.DB.prepare(`
@@ -148,6 +169,12 @@ async function updateDelivery(env, body, origin) {
 
 async function activateDelivery(env, body, origin) {
   const id = required(body.id, "id del transfer mancante");
+  const packageId = body.packageId ? String(body.packageId) : null;
+  if (packageId) {
+    const pkg = await env.DB.prepare("SELECT id FROM delivery_packages WHERE id=? AND delivery_id=? AND state='ready'")
+      .bind(packageId, id).first();
+    if (!pkg) throw new InputError("Caricamento annullato o non ancora pronto");
+  }
   const ready = await env.DB.prepare(
     "SELECT COUNT(*) n FROM delivery_packages WHERE delivery_id=? AND state='ready' AND originals_key IS NOT NULL"
   ).bind(id).first();
@@ -156,8 +183,9 @@ async function activateDelivery(env, body, origin) {
   await env.DB.batch([
     env.DB.prepare(`
       UPDATE deliveries SET status='active', activated_at=COALESCE(activated_at,?),
-        updated_at=?, version=version+1 WHERE id=? AND status!='deleted'
-    `).bind(now, now, id),
+        updated_at=?, version=version+1 WHERE id=? AND status NOT IN ('deleted','active')
+        AND (? IS NULL OR EXISTS (SELECT 1 FROM delivery_packages WHERE id=? AND delivery_id=deliveries.id AND state='ready'))
+    `).bind(now, now, id, packageId, packageId),
     env.DB.prepare(`
       UPDATE delivery_packages SET originals_purge_after=NULL
       WHERE delivery_id=? AND originals_key IS NOT NULL
@@ -166,7 +194,7 @@ async function activateDelivery(env, body, origin) {
   const link = await env.DB.prepare(
     "SELECT id FROM delivery_links WHERE delivery_id=? AND revoked_at IS NULL LIMIT 1"
   ).bind(id).first();
-  if (!link) await createLink(env, { id, label: "Link principale" }, origin);
+  if (!link) await createLink(env, { id, label: "Link principale", ensurePrimary: true }, origin);
   return deliveryDetail(env, id, origin);
 }
 
@@ -220,6 +248,8 @@ async function duplicateDelivery(env, body, origin) {
     ctaEnabled: !!source.cta_enabled,
     ctaLabel: source.cta_label,
     ctaUrl: source.cta_url,
+    downloadOriginalsLabel: source.download_originals_label,
+    downloadWebLabel: source.download_web_label,
     expiresAt: source.expires_at,
     filesExpiresAt: source.files_expires_at,
   }, origin);
@@ -239,8 +269,8 @@ async function deleteDelivery(env, body) {
       .bind(now, now, now, id),
     env.DB.prepare("UPDATE delivery_links SET revoked_at=COALESCE(revoked_at,?) WHERE delivery_id=?")
       .bind(now, id),
-    env.DB.prepare("UPDATE delivery_packages SET state='deleted',deleted_at=?,purge_after=? WHERE delivery_id=? AND state!='deleted'")
-      .bind(now, now, id),
+    env.DB.prepare("UPDATE delivery_packages SET state='deleted',deleted_at=?,purge_after=CASE WHEN state='uploading' THEN ? ELSE ? END WHERE delivery_id=? AND state!='deleted'")
+      .bind(now, new Date(Date.now() + 60 * 60_000).toISOString(), now, id),
     env.DB.prepare("UPDATE delivery_hero_objects SET state='deleted',purge_after=?,updated_at=? WHERE delivery_id=? AND state!='deleted'")
       .bind(now, now, id),
   ]);
@@ -248,6 +278,14 @@ async function deleteDelivery(env, body) {
 }
 
 async function createPackage(env, body) {
+  if (body.webFormat != null && !["webp", "jpg"].includes(body.webFormat)) throw new InputError("Formato della versione leggera non valido");
+  const webFormat = bool(body.webEnabled) && body.webFormat === "jpg" ? "jpg" : "webp";
+  if (webFormat === "jpg" && env.DELIVERY_JPEG_ENABLED !== "true") throw new InputError("La versione JPG non è ancora abilitata su questo sito");
+  const version = body.manifestVersion === 2 ? 2 : 1;
+  if (version === 2 && !v2Enabled(env)) throw new ConflictError("Il formato v2 non è ancora abilitato su questo sito");
+  if (version === 2 && body.fileCount > MANIFEST_MAX_ENTRIES) throw new InputError("Troppi file in un singolo invio");
+  const sourceBytes = validateDeliverySourceBytes(body.sourceBytes);
+  if (!Number.isSafeInteger(body.fileCount) || body.fileCount < 1) throw new InputError("Numero dei file non valido");
   const deliveryId = required(body.id, "id del transfer mancante");
   const delivery = await env.DB.prepare("SELECT id,status FROM deliveries WHERE id=? AND status!='deleted'")
     .bind(deliveryId).first();
@@ -268,10 +306,16 @@ async function createPackage(env, body) {
       id, deliveryId, text(body.label) || "Fotografie", Number(pos?.n || 0),
       bool(body.galleryEnabled), bool(body.webEnabled), prefix,
       required(body.sourceFingerprint, "impronta dei file mancante"),
-      Number(body.fileCount || 0), Number(body.sourceBytes || 0), now, now,
+      body.fileCount, sourceBytes, now, now,
     ),
+    ...(webFormat === "jpg" ? [env.DB.prepare("UPDATE delivery_packages SET web_format='jpg' WHERE id=?").bind(id)] : []),
     env.DB.prepare("UPDATE deliveries SET status=CASE WHEN status='draft' THEN 'uploading' ELSE status END,updated_at=? WHERE id=?")
       .bind(now, deliveryId),
+    ...(version === 2 ? [
+      env.DB.prepare("INSERT INTO delivery_manifest_state(package_id,created_at) VALUES (?,?)").bind(id, now),
+      env.DB.prepare("UPDATE delivery_packages SET manifest_json=? WHERE id=? AND state='uploading'")
+        .bind(JSON.stringify({ version: 2, generation: id }), id),
+    ] : []),
   ]);
   return normalizePackage(await env.DB.prepare("SELECT * FROM delivery_packages WHERE id=?").bind(id).first());
 }
@@ -280,9 +324,16 @@ async function finalizePackage(env, body) {
   const deliveryId = required(body.id, "id del transfer mancante");
   const packageId = required(body.packageId, "id dei file mancante");
   const pkg = await env.DB.prepare(
-    "SELECT * FROM delivery_packages WHERE id=? AND delivery_id=? AND state='uploading'"
+    "SELECT * FROM delivery_packages WHERE id=? AND delivery_id=? AND state IN ('uploading','ready')"
   ).bind(packageId, deliveryId).first();
   if (!pkg) throw new InputError("Non trovo il caricamento da completare");
+  if (manifestVersion(pkg) === 2) throw new ConflictError("Usa il completamento a passi per questo pacchetto");
+  if (pkg.state === "ready") {
+    if (JSON.stringify(body.manifest) !== pkg.manifest_json) throw new ConflictError("Il pacchetto è già completo con un manifest diverso");
+    return normalizePackage(pkg);
+  }
+  validateDeliverySourceBytes(pkg.source_bytes ?? 0);
+  const sourceBytes = validateDeliverySourceBytes(body.sourceBytes ?? 0);
   const uploads = await env.DB.prepare(
     "SELECT variant,object_key,state FROM delivery_uploads WHERE package_id=?"
   ).bind(packageId).all();
@@ -295,8 +346,17 @@ async function finalizePackage(env, body) {
 
   const manifest = body.manifest && typeof body.manifest === "object" ? body.manifest : null;
   if (!manifest || !Array.isArray(manifest.entries)) throw new InputError("L’elenco delle foto è arrivato incompleto");
+  let manifestBytes = 0;
+  for (const entry of manifest.entries) {
+    manifestBytes = validateDeliverySourceBytes(manifestBytes + validateDeliverySourceBytes(entry?.original?.length));
+  }
+  if (manifestBytes !== sourceBytes || (pkg.source_bytes != null && sourceBytes !== pkg.source_bytes) ||
+      (pkg.file_count != null && manifest.entries.length !== pkg.file_count) ||
+      (body.fileCount != null && body.fileCount !== manifest.entries.length)) {
+    throw new InputError("Dimensioni o numero dei file diversi dal caricamento dichiarato");
+  }
   const manifestJson = JSON.stringify(manifest);
-  if (manifestJson.length > 1_800_000) throw new InputError("Troppe foto in un transfer solo: dividile in due invii");
+  validateDeliveryManifestV1(manifestJson);
   const manifestKey = b2ObjectKey(pkg.storage_prefix, "manifest.json");
   await b2PutSmall(env, manifestKey, manifestJson, "application/json");
 
@@ -304,15 +364,17 @@ async function finalizePackage(env, body) {
   await env.DB.prepare(`
     UPDATE delivery_packages SET state='ready', originals_key=?, web_key=?, thumbs_key=?,
       manifest_key=?, manifest_json=?, file_count=?, source_bytes=?, stored_bytes=?, updated_at=?
-    WHERE id=?
+    WHERE id=? AND state='uploading'
   `).bind(
     byVariant.originals.object_key,
     byVariant.web?.object_key || null,
     byVariant.thumbs?.object_key || null,
     manifestKey, manifestJson, Number(body.fileCount || manifest.entries.length),
-    Number(body.sourceBytes || 0), Number(body.storedBytes || 0), now, packageId,
+    sourceBytes, Number(body.storedBytes || 0), now, packageId,
   ).run();
-  return normalizePackage(await env.DB.prepare("SELECT * FROM delivery_packages WHERE id=?").bind(packageId).first());
+  const completed = await env.DB.prepare("SELECT * FROM delivery_packages WHERE id=?").bind(packageId).first();
+  if (completed?.state !== "ready") throw new ConflictError("Il caricamento è stato annullato durante la finalizzazione");
+  return normalizePackage(completed);
 }
 
 async function deletePackage(env, body) {
@@ -320,12 +382,24 @@ async function deletePackage(env, body) {
   const now = new Date().toISOString();
   await env.DB.batch([
     env.DB.prepare(`
-      UPDATE delivery_packages SET state='deleted',deleted_at=?,purge_after=?,updated_at=? WHERE id=?
-    `).bind(now, now, now, packageId),
+      UPDATE delivery_packages SET state='deleted',deleted_at=?,
+        purge_after=CASE WHEN state='uploading' THEN ? ELSE COALESCE(purge_after,?) END,updated_at=? WHERE id=?
+    `).bind(now, new Date(Date.now() + 60 * 60_000).toISOString(), now, now, packageId),
     env.DB.prepare(`
       UPDATE delivery_hero_objects SET state='deleted',purge_after=?,updated_at=?
       WHERE package_id=? AND state!='deleted'
     `).bind(now, now, packageId),
+    // L'attivazione può essere già riuscita mentre il client ne attende la risposta.
+    // Cancellare l'ultimo pacchetto deve togliere anche lo stato «Pronto».
+    env.DB.prepare(`
+      UPDATE deliveries SET status=CASE
+        WHEN EXISTS (SELECT 1 FROM delivery_packages WHERE delivery_id=deliveries.id AND state='uploading')
+        THEN 'uploading' ELSE 'draft' END,updated_at=?,version=version+1
+      WHERE id=(SELECT delivery_id FROM delivery_packages WHERE id=?) AND status IN ('active','uploading')
+        AND NOT EXISTS (SELECT 1 FROM delivery_packages WHERE delivery_id=deliveries.id AND state='ready')
+        AND (status='active' OR NOT EXISTS
+          (SELECT 1 FROM delivery_packages WHERE delivery_id=deliveries.id AND state='uploading'))
+    `).bind(now, packageId),
   ]);
   return { purged: await purgePackageNow(env, packageId) };
 }
@@ -342,11 +416,11 @@ async function commitHeroes(env, body, origin) {
   for (const item of requested) {
     if (item?.type === "package") {
       const pkg = await env.DB.prepare(`
-        SELECT manifest_json FROM delivery_packages
+        SELECT id,manifest_json FROM delivery_packages
         WHERE id=? AND delivery_id=? AND state='ready' AND web_key IS NOT NULL
       `).bind(text(item.packageId), deliveryId).first();
       const index = Number(item.index);
-      const entry = parseManifest(pkg?.manifest_json)?.entries?.[index];
+      const entry = pkg ? await readManifestEntry(env, pkg, index) : null;
       if (!pkg || !Number.isInteger(index) || index < 0 || !entry?.web) {
         throw new InputError("Una delle foto di copertina non è più disponibile");
       }
@@ -419,19 +493,20 @@ async function createLink(env, body, origin) {
   const exists = await env.DB.prepare("SELECT id FROM deliveries WHERE id=? AND status!='deleted'")
     .bind(deliveryId).first();
   if (!exists) throw new InputError("Transfer non trovato");
-  const token = randomToken(24);
+  const token = randomToken(DELIVERY_LINK_TOKEN_BYTES);
   const id = crypto.randomUUID();
   const now = new Date().toISOString();
   const pin = text(body.pin);
   await env.DB.prepare(`
     INSERT INTO delivery_links
       (id,delivery_id,label,token_hash,token_ciphertext,pin_ciphertext,expires_at,created_at)
-    VALUES (?,?,?,?,?,?,?,?)
+    SELECT ?,?,?,?,?,?,?,?
+    WHERE (?=0 OR NOT EXISTS (SELECT 1 FROM delivery_links WHERE delivery_id=? AND revoked_at IS NULL))
   `).bind(
     id, deliveryId, text(body.label) || "Link principale", await sha256(token),
     await seal(env.DELIVERY_SECRET, token),
     pin ? await seal(env.DELIVERY_SECRET, pin) : null,
-    nullableDate(body.expiresAt), now,
+    nullableDate(body.expiresAt), now, bool(body.ensurePrimary), deliveryId,
   ).run();
   return {
     id, label: text(body.label) || "Link principale", token,
@@ -440,6 +515,38 @@ async function createLink(env, body, origin) {
   };
 }
 
+async function shortenLink(env, body, origin) {
+  if (env.DELIVERY_LINK_ALIASES !== "true") throw new InputError("Link brevi preesistenti non ancora abilitati");
+  const deliveryId = required(body.id, "id del transfer mancante");
+  const linkId = required(body.linkId, "id link mancante");
+  const read = () => env.DB.prepare(`
+    SELECT l.* FROM delivery_links l JOIN deliveries d ON d.id=l.delivery_id
+    WHERE l.id=? AND l.delivery_id=? AND l.revoked_at IS NULL AND d.status!='deleted'
+  `).bind(linkId, deliveryId).first();
+  let link = await read();
+  if (!link) throw new InputError("Link non trovato");
+  let token = await unseal(env.DELIVERY_SECRET, link.token_ciphertext);
+  if (token.length > DELIVERY_LINK_MIN_LENGTH) {
+    const next = randomToken(DELIVERY_LINK_TOKEN_BYTES);
+    // Compare-and-swap makes concurrent requests/retries return the one saved
+    // token. The alias and replacement commit together, so no old URL is lost.
+    await env.DB.batch([
+      env.DB.prepare(`INSERT INTO delivery_link_aliases(token_hash,link_id,created_at)
+        SELECT token_hash,id,? FROM delivery_links
+        WHERE id=? AND delivery_id=? AND token_hash=? AND revoked_at IS NULL
+        ON CONFLICT(token_hash) DO NOTHING
+      `).bind(new Date().toISOString(), linkId, deliveryId, link.token_hash),
+      env.DB.prepare(`UPDATE delivery_links SET token_hash=?,token_ciphertext=?
+        WHERE id=? AND delivery_id=? AND token_hash=? AND revoked_at IS NULL
+      `).bind(await sha256(next), await seal(env.DELIVERY_SECRET, next), linkId, deliveryId, link.token_hash),
+    ]);
+    link = await read();
+    if (!link) throw new InputError("Link non più disponibile");
+    token = await unseal(env.DELIVERY_SECRET, link.token_ciphertext);
+  }
+  return { id: link.id, token, url: `${origin}/c/${token}` };
+}
+
 async function updateLink(env, body, origin) {
   const deliveryId = required(body.id, "id del transfer mancante");
   const linkId = required(body.linkId, "id link mancante");
@@ -500,7 +607,8 @@ async function deliveryDetail(env, id, origin) {
   }
   return {
     ...normalizeDelivery(row),
-    packages: (packagesResult.results || []).map(packageDetail),
+    canShortenLinks: env.DELIVERY_LINK_ALIASES === "true",
+    packages: await Promise.all((packagesResult.results || []).map(pkg => packageDetail(env, pkg))),
     heroes: await normalizeHeroes(env, row.hero_json),
     links,
   };
@@ -512,6 +620,8 @@ function normalizeDelivery(row) {
     description: row.description || "", licenseNotes: row.license_notes || "",
     ctaEnabled: !!row.cta_enabled, ctaLabel: row.cta_label || "",
     ctaUrl: row.cta_url || "", expiresAt: row.expires_at,
+    downloadOriginalsLabel: row.download_originals_label || "",
+    downloadWebLabel: row.download_web_label || "",
     filesExpiresAt: row.files_expires_at || null,
     heroes: [],
     status: row.status, version: Number(row.version || 1),
@@ -524,24 +634,24 @@ function normalizeDelivery(row) {
 function normalizePackage(row) {
   return {
     id: row.id, deliveryId: row.delivery_id, label: row.label, position: Number(row.position || 0),
-    galleryEnabled: !!row.gallery_enabled, webEnabled: !!row.web_enabled, state: row.state,
-    sourceFingerprint: row.source_fingerprint || "",
+    galleryEnabled: !!row.gallery_enabled, webEnabled: !!row.web_enabled, webFormat: row.web_format === "jpg" ? "jpg" : "webp", state: row.state,
+    sourceFingerprint: row.source_fingerprint || "", manifestVersion: manifestVersion(row),
     fileCount: Number(row.file_count || 0), sourceBytes: Number(row.source_bytes || 0),
     storedBytes: Number(row.stored_bytes || 0), createdAt: row.created_at, updatedAt: row.updated_at,
   };
 }
 
-function packageDetail(row) {
-  const pkg = normalizePackage(row);
-  const manifest = parseManifest(row.manifest_json);
-  return {
-    ...pkg,
-    images: (manifest?.entries || []).map((entry, index) => entry?.web ? {
-      index, name: entry.name || `Immagine ${index + 1}`,
-      previewUrl: `/admin/api/delivery/image?packageId=${encodeURIComponent(row.id)}` +
-        `&variant=${entry.thumb ? "thumb" : "web"}&index=${index}`,
-    } : null).filter(Boolean),
-  };
+function packageImage(packageId, entry, index) {
+  return { index, name: entry.name || `Immagine ${index + 1}`,
+    width: entry.width, height: entry.height,
+    previewUrl: `/admin/api/delivery/image?packageId=${encodeURIComponent(packageId)}&variant=${entry.thumb ? "thumb" : "web"}&index=${index}` };
+}
+async function packageDetail(env, row) {
+  // Metadata can arrive before the ZIP is published. Do not issue image URLs
+  // until the image endpoint can actually serve them (otherwise img keeps a 404).
+  if (row.state !== "ready") return { ...normalizePackage(row), images: [], nextCursor: null };
+  const page = await readManifestPage(env, row);
+  return { ...normalizePackage(row), images: page.entries.map(({ entry, index }) => packageImage(row.id, entry, index)), nextCursor: page.nextCursor };
 }
 
 async function normalizeHeroes(env, value) {
@@ -549,11 +659,11 @@ async function normalizeHeroes(env, value) {
   for (const ref of parseHeroRefs(value)) {
     if (ref.type === "package") {
       const pkg = await env.DB.prepare(`
-        SELECT manifest_json FROM delivery_packages
+        SELECT id,manifest_json FROM delivery_packages
         WHERE id=? AND state='ready' AND web_key IS NOT NULL
       `).bind(text(ref.packageId)).first();
       const index = Number(ref.index);
-      if (pkg && Number.isInteger(index) && parseManifest(pkg.manifest_json)?.entries?.[index]?.web) {
+      if (pkg && Number.isInteger(index) && (await readManifestEntry(env, pkg, index))?.web) {
         out.push({
           type: "package", packageId: text(ref.packageId), index,
           previewUrl: `/admin/api/delivery/image?packageId=${encodeURIComponent(ref.packageId)}` +
@@ -595,6 +705,24 @@ function positiveInt(value) {
   return Number.isFinite(n) && n > 0 ? Math.round(n) : 0;
 }
 
+// Explicit fields only: an older client saving other metadata must keep custom labels.
+function downloadLabelFields(env, body) {
+  const columns = [], values = [];
+  for (const [field, column] of [["downloadOriginalsLabel", "download_originals_label"], ["downloadWebLabel", "download_web_label"]]) {
+    if (body[field] === undefined) continue;
+    if (typeof body[field] !== "string" || body[field].length > 80 || /[\x00-\x1f\x7f]/.test(body[field])) {
+      throw new InputError("Il testo dei pulsanti deve contenere al massimo 80 caratteri, su una sola riga");
+    }
+    const value = body[field].trim();
+    if (env.DELIVERY_DOWNLOAD_LABELS !== "true") {
+      if (value) throw new InputError("I testi personalizzati dei download non sono ancora abilitati su questo sito");
+      continue;
+    }
+    columns.push(column); values.push(value);
+  }
+  return { columns, values };
+}
+
 function text(value) { return String(value ?? "").trim(); }
 function bool(value) { return value ? 1 : 0; }
 function required(value, error) {

package/dist/functions/api/delivery/image.js

@@ -3,6 +3,8 @@
  */
 import { b2Get } from "../../_shared/b2.js";
 
+import { readManifestEntry } from "../../_shared/delivery-manifest.js";
+
 export async function onRequestGet({ request, env }) {
   if (!env.DB) return new Response("D1 non configurato", { status: 500 });
   const url = new URL(request.url);
@@ -10,19 +12,22 @@ export async function onRequestGet({ request, env }) {
   const variant = url.searchParams.get("variant") === "thumb" ? "thumb" : "web";
   const index = Number(url.searchParams.get("index"));
   const pkg = await env.DB.prepare(`
-    SELECT web_key,thumbs_key,manifest_json FROM delivery_packages
+    SELECT * FROM delivery_packages
     WHERE id=? AND state='ready'
   `).bind(packageId).first();
-  const manifest = parseManifest(pkg?.manifest_json);
-  const entry = Number.isInteger(index) && index >= 0 ? manifest.entries?.[index] : null;
+  const entry = pkg ? await readManifestEntry(env, pkg, index) : null;
   const member = variant === "thumb" ? entry?.thumb : entry?.web;
   const key = variant === "thumb" ? pkg?.thumbs_key : pkg?.web_key;
-  if (!member || !key) return new Response("Not found", { status: 404 });
+  if (!member || !key) return new Response("Not found", { status: 404, headers: { "Cache-Control": "no-store" } });
   const upstream = await b2Get(env, key, `bytes=${member.offset}-${member.offset + member.length - 1}`);
-  if (!upstream.ok) return new Response("Not found", { status: upstream.status });
+  if (upstream.ok && (upstream.status !== 206 || upstream.headers.get("Content-Range")?.split("/")[0] !== `bytes ${member.offset}-${member.offset + member.length - 1}` || Number(upstream.headers.get("Content-Length")) !== member.length)) {
+    await upstream.body?.cancel();
+    return new Response("Risposta archivio non valida", { status: 502, headers: { "Cache-Control": "no-store" } });
+  }
+  if (!upstream.ok) return new Response("Not found", { status: upstream.status, headers: { "Cache-Control": "no-store" } });
   return new Response(upstream.body, {
     headers: {
-      "Content-Type": "image/webp",
+      "Content-Type": variant === "web" && pkg.web_format === "jpg" ? "image/jpeg" : "image/webp",
       "Content-Length": String(member.length),
       "Cache-Control": "private, max-age=3600",
       "X-Content-Type-Options": "nosniff",