@cardinali-studio/adminkit 2.2.25 → 2.2.33

package/dist/functions/api/delivery/multipart.js

@@ -6,14 +6,20 @@
 
 import {
   b2AbortMultipart, b2CompleteMultipart, b2CreateMultipart, b2ListParts,
-  b2ObjectKey, b2PresignPutObject, b2PresignUploadPart,
+  b2ObjectKey, b2PresignPutObject, b2PresignUploadPart, b2Head, multipartEtag,
 } from "../../_shared/b2.js";
 
+import { validateDeliverySourceBytes, DELIVERY_PART_BYTES, DELIVERY_MAX_ARCHIVE_BYTES } from "../../_shared/delivery-limits.js";
+
+import { manifestVersion, assertManifestWriter, assertCheckpointParts } from "../../_shared/delivery-manifest.js";
+
 const FILENAMES = {
   originals: "originals.zip",
   web: "web.zip",
   thumbs: "thumbs.zip",
 };
+const stableOriginals = upload => upload.variant === 'originals' && manifestVersion(upload) === 2;
+const confirmedDigest = value => /^[a-f0-9]{64}$/.test(value || '');
 
 export async function onRequestPost({ request, env }) {
   if (!env.DB) return json({ ok: false, error: "D1 non configurato" }, 500);
@@ -28,14 +34,14 @@ export async function onRequestPost({ request, env }) {
       case "heroPresign": return json({ ok: true, ...(await heroPresign(env, body)) });
       case "presign": return json({ ok: true, ...(await presign(env, body)) });
       case "record": return json({ ok: true, ...(await record(env, body)) });
-      case "reconcile": return json({ ok: true, parts: await reconcile(env, body) });
+      case "reconcile": return json({ ok: true, ...(await reconcile(env, body)) });
       case "complete": return json({ ok: true, ...(await complete(env, body)) });
       case "abort": return json({ ok: true, ...(await abort(env, body)) });
       default: return json({ ok: false, error: "Azione multipart non valida" }, 400);
     }
   } catch (e) {
     console.error("delivery multipart:", e);
-    return json({ ok: false, error: e instanceof Error ? e.message : String(e) }, 500);
+    return json({ ok: false, error: e instanceof Error ? e.message : String(e), retryable: e.retryable !== false }, e.status || 500);
   }
 }
 
@@ -64,26 +70,46 @@ async function heroPresign(env, body) {
 
 async function putPresign(env, body) {
   const pkg = await packageFor(env, body);
+  if (manifestVersion(pkg) === 2) throw invalid("Il formato v2 richiede multipart anche per archivi piccoli");
   const variant = String(body.variant || "");
-  if (!FILENAMES[variant]) throw new Error("variante upload non valida");
+  if (!FILENAMES[variant]) throw invalid("variante upload non valida");
   if (variant === "web" && !pkg.web_enabled && !pkg.gallery_enabled) {
-    throw new Error("versione web non richiesta");
+    throw invalid("versione web non richiesta");
   }
-  if (variant === "thumbs" && !pkg.gallery_enabled) throw new Error("gallery non richiesta");
+  if (variant === "thumbs" && !pkg.gallery_enabled) throw invalid("gallery non richiesta");
   const key = b2ObjectKey(pkg.storage_prefix, FILENAMES[variant]);
+  // La chiave deve essere nota alla pulizia anche se PUT o putComplete perdono la risposta.
+  const now = new Date().toISOString();
+  await env.DB.prepare(`
+    INSERT INTO delivery_uploads
+      (id,delivery_id,package_id,variant,object_key,b2_upload_id,bytes,state,created_at,updated_at)
+    SELECT ?,?,?,?,?,'single',0,'uploading',?,?
+    WHERE NOT EXISTS (SELECT 1 FROM delivery_uploads WHERE package_id=? AND variant=?)
+  `).bind(crypto.randomUUID(), pkg.delivery_id, pkg.id, variant, key, now, now, pkg.id, variant).run();
+  const previous = await env.DB.prepare("SELECT * FROM delivery_uploads WHERE package_id=? AND variant=?")
+    .bind(pkg.id, variant).first();
+  if (previous?.b2_upload_id !== "single") throw invalid("La variante usa già un caricamento multipart");
   return { url: await b2PresignPutObject(env, key), key, variant, expiresIn: 900 };
 }
 
 async function putComplete(env, body) {
   const pkg = await packageFor(env, body);
+  if (manifestVersion(pkg) === 2) throw invalid("Il formato v2 richiede multipart");
   const variant = String(body.variant || "");
-  if (!FILENAMES[variant]) throw new Error("variante upload non valida");
+  if (!FILENAMES[variant]) throw invalid("variante upload non valida");
   const key = b2ObjectKey(pkg.storage_prefix, FILENAMES[variant]);
+  const head = await b2Head(env, key);
+  const expectedBytes = Number(body.bytes);
+  if (expectedBytes > DELIVERY_PART_BYTES) throw invalid("Dimensione non valida per un caricamento singolo");
+  const etag = String(body.etag || "").replaceAll('"', "");
+  if (!Number.isSafeInteger(expectedBytes) || expectedBytes < 1 || !head || head.bytes !== expectedBytes ||
+      (etag && head.etag !== etag)) throw invalid("L’oggetto caricato non corrisponde ai byte confermati");
   const id = crypto.randomUUID();
   const now = new Date().toISOString();
   const previous = await env.DB.prepare(
-    "SELECT id FROM delivery_uploads WHERE package_id=? AND variant=?"
+    "SELECT * FROM delivery_uploads WHERE package_id=? AND variant=?"
   ).bind(pkg.id, variant).first();
+  if (previous?.b2_upload_id && previous.b2_upload_id !== "single") throw invalid("Variante multipart incompatibile");
   if (previous) {
     await env.DB.batch([
       env.DB.prepare("DELETE FROM delivery_upload_parts WHERE upload_id=?").bind(previous.id),
@@ -105,15 +131,16 @@ async function putComplete(env, body) {
 async function create(env, body) {
   const pkg = await packageFor(env, body);
   const variant = String(body.variant || "");
-  if (!FILENAMES[variant]) throw new Error("variante multipart non valida");
+  if (!FILENAMES[variant]) throw invalid("variante multipart non valida");
   if (variant === "web" && !pkg.web_enabled && !pkg.gallery_enabled) {
-    throw new Error("versione web non richiesta");
+    throw invalid("versione web non richiesta");
   }
-  if (variant === "thumbs" && !pkg.gallery_enabled) throw new Error("gallery non richiesta");
+  if (variant === "thumbs" && !pkg.gallery_enabled) throw invalid("gallery non richiesta");
 
   const previous = await env.DB.prepare(
     "SELECT * FROM delivery_uploads WHERE package_id=? AND variant=?"
   ).bind(pkg.id, variant).first();
+  if (previous?.b2_upload_id === "single") throw invalid("La variante usa già un caricamento singolo");
   if (previous?.state === "uploading") {
     return normalizeUpload(previous);
   }
@@ -124,29 +151,46 @@ async function create(env, body) {
   const b2UploadId = await b2CreateMultipart(env, key);
   const now = new Date().toISOString();
   const id = previous?.id || crypto.randomUUID();
-  if (previous) {
-    await env.DB.batch([
-      env.DB.prepare("DELETE FROM delivery_upload_parts WHERE upload_id=?").bind(id),
-      env.DB.prepare(`
-        UPDATE delivery_uploads SET object_key=?,b2_upload_id=?,state='uploading',
-          created_at=?,updated_at=?,completed_at=NULL WHERE id=?
-      `).bind(key, b2UploadId, now, now, id),
-    ]);
-  } else {
-    await env.DB.prepare(`
-      INSERT INTO delivery_uploads
-        (id,delivery_id,package_id,variant,object_key,b2_upload_id,state,created_at,updated_at)
-      VALUES (?,?,?,?,?,?,'uploading',?,?)
-    `).bind(id, pkg.delivery_id, pkg.id, variant, key, b2UploadId, now, now).run();
+  try {
+    if (previous) {
+      await env.DB.batch([
+        env.DB.prepare("DELETE FROM delivery_upload_parts WHERE upload_id=? AND EXISTS (SELECT 1 FROM delivery_uploads WHERE id=? AND state='aborted')").bind(id, id),
+        env.DB.prepare(`UPDATE delivery_uploads SET object_key=?,b2_upload_id=?,state='uploading',
+          bytes=0,created_at=?,updated_at=?,completed_at=NULL WHERE id=? AND state='aborted'`)
+          .bind(key, b2UploadId, now, now, id),
+      ]);
+    } else {
+      await env.DB.prepare(`
+        INSERT INTO delivery_uploads
+          (id,delivery_id,package_id,variant,object_key,b2_upload_id,state,created_at,updated_at)
+        SELECT ?,?,?,?,?,?,'uploading',?,?
+        WHERE NOT EXISTS (SELECT 1 FROM delivery_uploads WHERE package_id=? AND variant=?)
+      `).bind(id, pkg.delivery_id, pkg.id, variant, key, b2UploadId, now, now, pkg.id, variant).run();
+    }
+  } catch (error) {
+    // Se la risposta D1 è incerta, non abortire una sessione effettivamente registrata.
+    const saved = await env.DB.prepare("SELECT * FROM delivery_uploads WHERE package_id=? AND variant=?")
+      .bind(pkg.id, variant).first();
+    if (saved?.b2_upload_id === b2UploadId) return normalizeUpload(saved);
+    await b2AbortMultipart(env, key, b2UploadId);
+    throw error;
   }
-  return { id, deliveryId: pkg.delivery_id, packageId: pkg.id, variant, key, state: "uploading" };
+  const saved = await env.DB.prepare("SELECT * FROM delivery_uploads WHERE package_id=? AND variant=?")
+    .bind(pkg.id, variant).first();
+  if (saved?.b2_upload_id !== b2UploadId) await b2AbortMultipart(env, key, b2UploadId);
+  if (!saved) throw new Error("Sessione non registrata");
+  return normalizeUpload(saved);
 }
 
 async function presign(env, body) {
   const upload = await uploadFor(env, body);
   const partNumber = Number(body.partNumber);
   if (!Number.isInteger(partNumber) || partNumber < 1 || partNumber > 10_000) {
-    throw new Error("numero parte non valido");
+    throw invalid("numero parte non valido");
+  }
+  if (stableOriginals(upload)) {
+    const part = await env.DB.prepare('SELECT digest FROM delivery_upload_parts WHERE upload_id=? AND part_number=?').bind(upload.id, partNumber).first();
+    if (confirmedDigest(part?.digest)) throw invalid('Parte originale già confermata: non può essere sovrascritta');
   }
   return {
     url: await b2PresignUploadPart(env, upload.object_key, upload.b2_upload_id, partNumber),
@@ -161,10 +205,29 @@ async function record(env, body) {
   const size = Number(body.size);
   const etag = String(body.etag || "").trim();
   const digest = String(body.digest || "").trim();
-  if (!Number.isInteger(partNumber) || partNumber < 1 || !Number.isFinite(size) || size < 1 || !etag) {
-    throw new Error("metadati parte non validi");
+  if (!Number.isInteger(partNumber) || partNumber < 1 || partNumber > 10_000 || !Number.isSafeInteger(size) || size < 1 || size > DELIVERY_PART_BYTES || !etag) {
+    throw invalid("metadati parte non validi");
   }
   const now = new Date().toISOString();
+  if (stableOriginals(upload)) {
+    if (!confirmedDigest(digest)) throw invalid('Digest della parte originale non valido');
+    const matches = part => part?.etag === etag && part.size === size && part.digest === digest;
+    const query = () => env.DB.prepare('SELECT etag,size,digest FROM delivery_upload_parts WHERE upload_id=? AND part_number=?').bind(upload.id, partNumber).first();
+    const previous = await query();
+    if (matches(previous)) return { partNumber, etag, size };
+    if (confirmedDigest(previous?.digest)) throw invalid('Parte originale già confermata con contenuto diverso');
+    await env.DB.prepare(`INSERT INTO delivery_upload_parts(upload_id,part_number,etag,digest,size,created_at)
+      SELECT ?,?,?,?,?,? WHERE EXISTS(SELECT 1 FROM delivery_uploads u JOIN delivery_packages p ON p.id=u.package_id
+        JOIN delivery_manifest_state s ON s.package_id=p.id
+        WHERE u.id=? AND u.state='uploading' AND p.state='uploading' AND s.writer_token=?)
+      ON CONFLICT(upload_id,part_number) DO UPDATE SET digest=excluded.digest
+      WHERE (delivery_upload_parts.digest IS NULL OR delivery_upload_parts.digest='')
+        AND delivery_upload_parts.etag=excluded.etag AND delivery_upload_parts.size=excluded.size`)
+      .bind(upload.id, partNumber, etag, digest, size, now, upload.id, body.writerToken).run();
+    if (!matches(await query())) throw invalid('Parte originale cambiata o caricamento annullato');
+    await env.DB.prepare("UPDATE delivery_uploads SET updated_at=? WHERE id=? AND state='uploading'").bind(now, upload.id).run();
+    return { partNumber, etag, size };
+  }
   await env.DB.batch([
     env.DB.prepare(`
       INSERT INTO delivery_upload_parts(upload_id,part_number,etag,digest,size,created_at)
@@ -177,45 +240,106 @@ async function record(env, body) {
   return { partNumber, etag, size };
 }
 
+async function savedParts(env, upload) {
+  const { results } = await env.DB.prepare(
+    "SELECT part_number,etag,digest,size FROM delivery_upload_parts WHERE upload_id=? ORDER BY part_number"
+  ).bind(upload.id).all();
+  return (results || []).map((p) => ({ partNumber: Number(p.part_number), etag: p.etag,
+    digest: p.digest || "", size: Number(p.size) }));
+}
+
+async function markCompleted(env, upload, bytes) {
+  const now = new Date().toISOString();
+  await env.DB.prepare(`UPDATE delivery_uploads SET state='completed',bytes=?,completed_at=?,updated_at=?
+    WHERE id=? AND state='uploading'
+      AND EXISTS (SELECT 1 FROM delivery_packages WHERE id=delivery_uploads.package_id AND state='uploading')`)
+    .bind(bytes, now, now, upload.id).run();
+}
+
+async function recoverCompleted(env, upload) {
+  const parts = await savedParts(env, upload);
+  if (!parts.length || parts.some((p, n) => p.partNumber !== n + 1)) return null;
+  if (stableOriginals(upload) && parts.some(p => !confirmedDigest(p.digest))) return null;
+  const bytes = parts.reduce((sum, p) => sum + p.size, 0);
+  const head = await b2Head(env, upload.object_key);
+  const etag = await multipartEtag(parts);
+  if (!head || !etag || head.bytes !== bytes || head.etag !== etag) return null;
+  await assertCheckpointParts(env, upload, parts);
+  await markCompleted(env, upload, bytes);
+  return { parts, completed: true, bytes };
+}
+
 async function reconcile(env, body) {
-  const upload = await uploadFor(env, body);
-  const parts = await b2ListParts(env, upload.object_key, upload.b2_upload_id);
+  const upload = await uploadFor(env, body, true, true);
+  if (upload.state === "completed") return { parts: await savedParts(env, upload), completed: true, bytes: Number(upload.bytes) };
+  let parts;
+  try { parts = await b2ListParts(env, upload.object_key, upload.b2_upload_id); }
+  catch (error) {
+    if (error.status !== 404) throw error;
+    const recovered = await recoverCompleted(env, upload);
+    if (recovered) return recovered;
+    throw invalid("Sessione non disponibile e archivio non verificabile. Crea un nuovo caricamento.");
+  }
+  const previous = new Map((await savedParts(env, upload)).map((p) => [p.partNumber, p]));
   const now = new Date().toISOString();
-  for (let at = 0; at < parts.length; at += 50) {
-    await env.DB.batch(parts.slice(at, at + 50).map((part) => env.DB.prepare(`
+  const present = new Set(parts.map((p) => p.partNumber));
+  const missing = [...previous.values()].filter((p) => !present.has(p.partNumber));
+  const stable = stableOriginals(upload);
+  const remote = new Map(parts.map(p => [p.partNumber, p]));
+  const assertConfirmed = saved => {
+    if (stable && saved.some(p => confirmedDigest(p.digest) &&
+        (remote.get(p.partNumber)?.etag !== p.etag || remote.get(p.partNumber)?.size !== p.size))) {
+      throw invalid('Le parti originali confermate non corrispondono a Backblaze');
+    }
+  };
+  assertConfirmed([...previous.values()]);
+  for (let at = 0; at < missing.length; at += 50) {
+    await env.DB.batch(missing.slice(at, at + 50).map((part) => env.DB.prepare(
+      `DELETE FROM delivery_upload_parts WHERE upload_id=? AND part_number=? AND etag=?
+        ${stable ? "AND (digest IS NULL OR digest='')" : ''}`
+    ).bind(upload.id, part.partNumber, part.etag)));
+  }
+  const changed = parts.filter((p) => previous.get(p.partNumber)?.etag !== p.etag || previous.get(p.partNumber)?.size !== p.size);
+  for (let at = 0; at < changed.length; at += 50) {
+    await env.DB.batch(changed.slice(at, at + 50).map((part) => env.DB.prepare(`
       INSERT INTO delivery_upload_parts(upload_id,part_number,etag,size,created_at)
       VALUES (?,?,?,?,?)
       ON CONFLICT(upload_id,part_number) DO UPDATE SET
-        etag=excluded.etag,size=excluded.size,created_at=excluded.created_at
+        digest=NULL,etag=excluded.etag,size=excluded.size,created_at=excluded.created_at
+        ${stable ? "WHERE delivery_upload_parts.digest IS NULL OR delivery_upload_parts.digest=''" : ''}
     `).bind(upload.id, part.partNumber, part.etag, part.size, now)));
   }
-  const saved = await env.DB.prepare(
-    "SELECT part_number,etag,digest,size FROM delivery_upload_parts WHERE upload_id=? ORDER BY part_number"
-  ).bind(upload.id).all();
-  return (saved.results || []).map((part) => ({
-    partNumber: Number(part.part_number), etag: part.etag,
-    digest: part.digest || "", size: Number(part.size),
-  }));
+  if (stable) {
+    // A record may have committed while ListParts was in flight. Never clear its
+    // digest using the older snapshot, and never silently accept a remote change.
+    const saved = await savedParts(env, upload);
+    assertConfirmed(saved);
+    const current = new Map(saved.map(p => [p.partNumber, p]));
+    return { parts: parts.map(p => ({ ...p, digest:
+      current.get(p.partNumber)?.etag === p.etag && current.get(p.partNumber)?.size === p.size
+        ? current.get(p.partNumber).digest : '' })), completed: false };
+  }
+  // Solo le parti remote sono autorevoli; le righe locali obsolete non entrano nel completamento.
+  return { parts: parts.map((p) => ({ ...p, digest:
+    previous.get(p.partNumber)?.etag === p.etag && previous.get(p.partNumber)?.size === p.size
+      ? previous.get(p.partNumber).digest : "" })), completed: false };
 }
 
 async function complete(env, body) {
-  const upload = await uploadFor(env, body);
-  /* ListParts è la fonte autorevole: una PUT può riuscire e la successiva chiamata
-     `record` interrompersi. Riconciliare sempre evita di lasciare fuori quella parte. */
-  await reconcile(env, body);
-  const { results } = await env.DB.prepare(
-    "SELECT part_number,etag,size FROM delivery_upload_parts WHERE upload_id=? ORDER BY part_number"
-  ).bind(upload.id).all();
-  if (!results?.length) throw new Error("nessuna parte caricata");
-  const parts = results.map((p) => ({
-    partNumber: Number(p.part_number), etag: p.etag, size: Number(p.size),
-  }));
-  const answer = await b2CompleteMultipart(env, upload.object_key, upload.b2_upload_id, parts);
-  const now = new Date().toISOString();
-  await env.DB.prepare(
-    "UPDATE delivery_uploads SET state='completed',bytes=?,completed_at=?,updated_at=? WHERE id=?"
-  ).bind(parts.reduce((n, p) => n + p.size, 0), now, now, upload.id).run();
-  return { uploadId: upload.id, key: upload.object_key, bytes: parts.reduce((n, p) => n + p.size, 0), ...answer };
+  if (!Number.isSafeInteger(body.bytes) || body.bytes < 1 || body.bytes > DELIVERY_MAX_ARCHIVE_BYTES) throw invalid("Dimensione archivio non valida");
+  const upload = await uploadFor(env, body, true, true);
+  const reconciled = await reconcile(env, body);
+  const parts = reconciled.parts;
+  const bytes = parts.reduce((n, p) => n + p.size, 0);
+  if (!parts.length || parts.some((p, n) => p.partNumber !== n + 1) ||
+      (body.partCount != null && Number(body.partCount) !== parts.length) ||
+      (body.bytes != null && Number(body.bytes) !== bytes)) throw invalid("L’archivio è incompleto: riprendi il caricamento");
+  if (reconciled.completed) return { uploadId: upload.id, key: upload.object_key, bytes };
+  if (stableOriginals(upload) && parts.some(p => !confirmedDigest(p.digest))) throw invalid('Parti originali non ancora confermate');
+  await assertCheckpointParts(env, upload, parts);
+  await b2CompleteMultipart(env, upload.object_key, upload.b2_upload_id, parts);
+  await markCompleted(env, upload, bytes);
+  return { uploadId: upload.id, key: upload.object_key, bytes };
 }
 
 async function abort(env, body) {
@@ -232,28 +356,36 @@ async function packageFor(env, body) {
     SELECT p.* FROM delivery_packages p JOIN deliveries d ON d.id=p.delivery_id
     WHERE p.id=? AND p.delivery_id=? AND p.state='uploading' AND d.status!='deleted'
   `).bind(String(body.packageId || ""), String(body.id || "")).first();
-  if (!pkg) throw new Error("pacchetto in caricamento non trovato");
+  if (!pkg) throw invalid("pacchetto in caricamento non trovato");
+  validateDeliverySourceBytes(pkg.source_bytes ?? 0);
+  if (manifestVersion(pkg) === 2) await assertManifestWriter(env, pkg.id, body.writerToken);
   return pkg;
 }
 
-async function uploadFor(env, body, required = true) {
+async function uploadFor(env, body, required = true, allowCompleted = false) {
   const upload = await env.DB.prepare(`
-    SELECT u.* FROM delivery_uploads u
+    SELECT u.*,p.manifest_json,p.source_bytes declared_source_bytes FROM delivery_uploads u
     JOIN delivery_packages p ON p.id=u.package_id
     JOIN deliveries d ON d.id=u.delivery_id
-    WHERE u.id=? AND u.state='uploading' AND p.state='uploading' AND d.status!='deleted'
+    WHERE u.id=? AND u.state IN (${allowCompleted ? "'uploading','completed'" : "'uploading'"})
+      AND p.state IN (${allowCompleted ? "'uploading','ready'" : "'uploading'"}) AND d.status!='deleted'
   `).bind(String(body.uploadId || "")).first();
-  if (!upload && required) throw new Error("sessione multipart non trovata");
+  if (!upload && required) throw invalid("sessione multipart non trovata");
+  // L'annullamento deve restare disponibile anche per vecchie sessioni fuori limite.
+  if (upload && body.action !== "abort") validateDeliverySourceBytes(upload.declared_source_bytes ?? 0);
+  if (upload && manifestVersion(upload) === 2 && body.action !== "abort") await assertManifestWriter(env, upload.package_id, body.writerToken);
   return upload;
 }
 
 function normalizeUpload(row) {
   return {
     id: row.id, deliveryId: row.delivery_id, packageId: row.package_id,
-    variant: row.variant, key: row.object_key, state: row.state,
+    variant: row.variant, key: row.object_key, state: row.state, bytes: Number(row.bytes || 0),
   };
 }
 
+function invalid(message) { return Object.assign(new Error(message), { status: 409, retryable: false }); }
+
 function json(data, status = 200) {
   return new Response(JSON.stringify(data), {
     status, headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },

package/dist/functions/delivery-public/assets/client.js

@@ -0,0 +1,246 @@
+/* Pagina di consegna — il guscio.
+ *
+ * Il guscio HTML lo genera Hugo (layouts/index.deliveryshell.html) e la Function
+ * functions/c/[[path]].js ci inietta i dati come <script type="application/json">. Qui si
+ * accende ciò che serve e si spegne il resto: codice di accesso, download, scadenze,
+ * messaggi. Le fotografie le montano stage.js (la colonna destra) e gallery.js (sotto):
+ * girano DOPO questo file — gli script `defer` eseguono nell'ordine del documento — e
+ * leggono `window.DC.data`, che viene messo qui.
+ *
+ * Niente stato locale, niente cronologia: dopo lo sblocco si ricarica. È il server a
+ * decidere cosa può essere visto, e ricaricare è l'unico modo per chiederglielo davvero.
+ */
+(function () {
+  "use strict";
+  var source = document.getElementById("dc-data");
+  var data = null;
+  try { data = JSON.parse((source && source.textContent) || "null"); } catch (e) { data = null; }
+  if (!data) data = { state: "message", message: { title: "Consegna non disponibile", body: "Riprova fra poco." } };
+  window.DC = { data: data, base: location.pathname.replace(/\/+$/, "") };
+
+  var el = {
+    shell: document.querySelector("[data-dc]"),
+    intro: document.querySelector("[data-dc-intro]"),
+    notice: document.querySelector("[data-dc-notice]"),
+    gate: document.querySelector("[data-dc-gate]"),
+    gateError: document.querySelector("[data-dc-gate-error]"),
+    downloads: document.querySelector("[data-dc-downloads]"),
+    expiry: document.querySelector("[data-dc-expiry]"),
+    close: document.querySelector("[data-dc-close]"),
+    notes: document.querySelector("[data-dc-notes]"),
+    notesBody: document.querySelector("[data-dc-notes-body]"),
+    final: document.querySelector("[data-dc-final]"),
+    msg: document.querySelector("[data-dc-msg]"),
+    msgEyebrow: document.querySelector("[data-dc-msg-eyebrow]"),
+    msgTitle: document.querySelector("[data-dc-msg-title]"),
+    msgBody: document.querySelector("[data-dc-msg-body]")
+  };
+
+  if (data.state === "message") renderMessage(data.message || {});
+  else renderDelivery();
+
+  // Il monogramma è montato con `manual`: si accende adesso, quando la pagina ha i suoi
+  // contenuti. `dark` vale sempre: questa pagina è nera dappertutto, quindi a menu aperto
+  // (blend sospeso) le lettere devono restare bianche.
+  if (window.BrandMenu) {
+    window.BrandMenu.config({ dark: function () { return true; } });
+    window.BrandMenu.show();
+  }
+
+  /* ---- messaggio a tutta pagina ------------------------------------------------------ */
+  function renderMessage(message) {
+    document.body.classList.add("is-message");
+    show(el.msg);
+    text(el.msgEyebrow, message.eyebrow || "Consegna file");
+    text(el.msgTitle, message.title || "Consegna non disponibile");
+    text(el.msgBody, message.body || "");
+  }
+
+  /* ---- la consegna ------------------------------------------------------------------- */
+  function renderDelivery() {
+    show(el.shell);
+
+    if (data.intro) { text(el.intro, data.intro); show(el.intro); }
+    // La chiusura (note d'uso + recensione) esiste solo se ha qualcosa da dire.
+    if (data.notes) { text(el.notesBody, data.notes); show(el.notes); show(el.close); }
+    if (data.final && data.final.url) {
+      el.final.href = data.final.url;
+      text(el.final, data.final.label || "Lascia una recensione");
+      show(el.final); show(el.close);
+    }
+
+    var notice = noticeText();
+    if (notice) { text(el.notice, notice); show(el.notice); }
+    renderExpiry();
+
+    if (data.state === "locked") {
+      // Prima dello sblocco non c'è nessuna fotografia da mostrare: la pagina torna a una
+      // colonna sola invece di lasciare metà schermo vuoto (il CSS fa il resto).
+      document.body.classList.add("is-locked");
+      setupGate();
+      return;
+    }
+    renderDownloads();
+    if (data.preparing) pollUntilReady();
+  }
+
+  function noticeText() {
+    if (data.filesExpired) {
+      return "I file di questa consegna hanno superato la data di scadenza e non sono più " +
+        "scaricabili. Scrivi a Emanuele Cardinali se ti servono ancora.";
+    }
+    if (data.preparing) {
+      return "I file stanno arrivando. Il link è già valido: questa pagina si " +
+        "aggiorna da sola appena sono pronte.";
+    }
+    if (data.archived) {
+      return "Gli originali sono stati archiviati per liberare spazio. Scrivi a Emanuele Cardinali " +
+        "per richiederne il ripristino.";
+    }
+    return "";
+  }
+
+  function renderExpiry() {
+    var when = data.expiry || {};
+    if (!when.filesAt && !when.linkAt) return;
+    if (when.filesAt && !data.filesExpired) {
+      var days = (new Date(when.filesAt).getTime() - Date.now()) / 86400000;
+      text(el.expiry, "Scaricabili fino al " + formatDate(when.filesAt) +
+        (days <= 7 ? " · ultimi giorni" : ""));
+      if (days <= 7) el.expiry.classList.add("is-soon");
+    } else if (when.filesAt) {
+      text(el.expiry, "File scaduti il " + formatDate(when.filesAt));
+    } else {
+      text(el.expiry, "Link valido fino al " + formatDate(when.linkAt));
+    }
+    show(el.expiry);
+  }
+
+  /* ---- codice di accesso -------------------------------------------------------------- */
+  function setupGate() {
+    show(el.gate);
+    var input = el.gate.querySelector(".dc-gate-input");
+    var button = el.gate.querySelector("button");
+    /* Il campo parte `readonly` (vedi il commento nel guscio): l'autofill non tocca un
+       campo di sola lettura, così non può rimandare un codice vecchio al posto di quello
+       appena digitato. Diventa scrivibile — e vuoto — appena lo si tocca. */
+    var wake = function () { input.value = ""; input.removeAttribute("readonly"); };
+    input.addEventListener("focus", wake);
+    input.addEventListener("pointerdown", wake);
+
+    el.gate.addEventListener("submit", function (event) {
+      event.preventDefault();
+      var label = button.textContent;
+      button.disabled = true; button.textContent = "Verifico…";
+      hide(el.gateError);
+      post("/unlock", { pin: input.value }).then(function (out) {
+        if (out.ok) { location.reload(); return; }
+        text(el.gateError, out.body.error || "Codice non corretto.");
+        show(el.gateError);
+        button.disabled = false; button.textContent = label;
+        input.select();
+      });
+    });
+  }
+
+  /* ---- download ---------------------------------------------------------------------- */
+  function renderDownloads() {
+    var labels = data.downloadLabels || {};
+    var packages = (data.packages || []).filter(function (pkg) {
+      return pkg.originals || pkg.light;   // una scheda senza niente da premere non si disegna
+    });
+    if (!packages.length) return;
+    packages.forEach(function (pkg) {
+      var box = document.createElement("div");
+      box.className = "dc-pack";
+      if (packages.length > 1 && pkg.label) {
+        var name = document.createElement("p");
+        name.className = "dc-pack-name";
+        name.textContent = pkg.label;
+        box.appendChild(name);
+      }
+      var actions = document.createElement("div");
+      actions.className = "dc-pack-actions";
+      // Gli originali sono ciò per cui il cliente è qui: sono il pulsante pieno. La
+      // versione leggera diventa primaria solo se gli originali non ci sono più.
+      if (pkg.originals) actions.appendChild(button(pkg, "originals", labels.originals || "Scarica i file", true));
+      if (pkg.light) actions.appendChild(button(pkg, "web", labels.web || "Versione leggera", !pkg.originals));
+      box.appendChild(actions);
+
+      var note = document.createElement("p");
+      note.className = "dc-dl-note";
+      note.textContent = [
+        pkg.fileCount ? pkg.fileCount + " file" : "",
+        pkg.bytes ? bytes(pkg.bytes) : ""
+      ].filter(Boolean).join(" · ");
+      if (note.textContent) box.appendChild(note);
+
+      el.downloads.appendChild(box);
+    });
+    show(el.downloads);
+  }
+
+  function button(pkg, variant, label, primary) {
+    var node = document.createElement("button");
+    node.type = "button";
+    node.className = "dc-btn " + (primary ? "dc-btn-solid" : "dc-btn-line");
+    node.textContent = label;
+    node.addEventListener("click", function () {
+      var box = node.closest(".dc-pack");
+      var previous = box.querySelector(".dc-error");
+      if (previous) previous.remove();
+      node.disabled = true; node.textContent = "Preparo…";
+      post("/ticket", { packageId: pkg.id, variant: variant }).then(function (out) {
+        if (out.ok && out.body.url) { location.href = out.body.url; return; }
+        var error = document.createElement("p");
+        error.className = "dc-error";
+        error.textContent = out.body.error || "Non è stato possibile avviare il download.";
+        box.appendChild(error);
+      }).then(function () {
+        node.disabled = false; node.textContent = label;
+      });
+    });
+    return node;
+  }
+
+  /* ---- transfer in preparazione ------------------------------------------------------- */
+  /* Il link è valido prima che i file siano finiti: invece di chiedere al cliente di
+     ricaricare, si chiede al server. La sonda non incrementa nessun contatore. */
+  function pollUntilReady() {
+    var timer = setInterval(check, 20000);
+    document.addEventListener("visibilitychange", function () { if (!document.hidden) check(); });
+    function check() {
+      if (document.hidden) return;
+      fetch(window.DC.base + "/state", { credentials: "same-origin", cache: "no-store" })
+        .then(function (res) { return res.ok ? res.json() : null; })
+        .then(function (out) { if (out && out.ready) { clearInterval(timer); location.reload(); } })
+        .catch(function () {});
+    }
+  }
+
+  /* ---- utilità ------------------------------------------------------------------------ */
+  function post(path, body) {
+    return fetch(window.DC.base + path, {
+      method: "POST", headers: { "Content-Type": "application/json" },
+      credentials: "same-origin", body: JSON.stringify(body)
+    }).then(function (res) {
+      return res.json().catch(function () { return {}; }).then(function (parsed) {
+        return { ok: res.ok && parsed.ok !== false, body: parsed };
+      });
+    }).catch(function () {
+      return { ok: false, body: { error: "Connessione assente. Riprova." } };
+    });
+  }
+  function show(node) { if (node) node.hidden = false; }
+  function hide(node) { if (node) node.hidden = true; }
+  function text(node, value) { if (node) node.textContent = value; }
+  function bytes(value) {
+    var units = ["B", "KB", "MB", "GB", "TB"], n = Number(value) || 0, i = 0;
+    while (n >= 1024 && i < units.length - 1) { n /= 1024; i++; }
+    return (n < 10 && i ? n.toFixed(1) : Math.round(n)) + " " + units[i];
+  }
+  function formatDate(value) {
+    return new Intl.DateTimeFormat("it-IT", { day: "numeric", month: "long", year: "numeric" })
+      .format(new Date(value));
+  }
+})();