@cardinali-studio/adminkit 2.2.25 → 2.2.34

package/dist/app/lib/delivery-upload.js

@@ -6,26 +6,175 @@
  * - il manifest conserva gli offset dei membri STORE, così la Function pubblica può
  *   servire una singola foto con un GET Range senza duplicarla come oggetto.
  */
-const PART = 16 * 1024 * 1024;
+import { deliveryJson, deliveryPut, deliveryGate, checkCancelled, UploadCancelled } from "./delivery-network.js";
+import { DELIVERY_PART_BYTES, DELIVERY_MAX_ARCHIVE_BYTES, validateDeliverySourceBytes, DELIVERY_V1_MANIFEST_BYTES, DELIVERY_SKIP_REASON_CHARS } from "../../functions/_shared/delivery-limits.js";
+export { UploadCancelled } from "./delivery-network.js";
+const PART = DELIVERY_PART_BYTES;
 const READ = 4 * 1024 * 1024;
 const UPLOAD_CONCURRENCY = 4;
 const IMAGE = /\.(jpe?g|png|webp)$/i;
 const enc = new TextEncoder();
 const droppedPaths = new WeakMap();
-export class UploadCancelled extends Error {
-    constructor() { super("Caricamento annullato"); this.name = "UploadCancelled"; }
+/* Il cancello di pausa e annullamento.
+ *
+ * Chi carica lo passa da fuori (lib/upload-queue.ts) e questo file si limita a bussare: a
+ * ogni file e a ogni PARTE. Le parti contano più dei file — un solo video da 20 GB è un
+ * file solo e mille parti, e senza il controllo lì la pausa non arriverebbe mai.
+ * `gate()` si risolve subito quando non c'è niente da aspettare: sul percorso normale costa
+ * una promise già risolta per parte, cioè niente. */
+export async function uploadDeliveryPackage(deliveryId, packageId, selected, options, onProgress, control = { gate: async () => { } }) {
+    preflightDeliverySelection(selected, options);
+    if (options.manifestVersion !== 2)
+        return performDeliveryPackage(deliveryId, packageId, selected, options, onProgress, control);
+    if (typeof navigator === "undefined" || !navigator.locks)
+        throw new Error("Per la ripresa persistente serve un browser aggiornato con supporto ai blocchi di caricamento.");
+    return navigator.locks.request(`adminkit-delivery:${packageId}`, { ifAvailable: true }, async (lock) => {
+        if (!lock)
+            throw new Error("Il caricamento è già in corso in un’altra scheda.");
+        const key = `adminkit-delivery-writer:${packageId}`;
+        let token;
+        try {
+            token = localStorage.getItem(key) || crypto.randomUUID();
+            localStorage.setItem(key, token);
+        }
+        catch {
+            throw new Error("Il browser non può conservare l’identità del caricamento. Consenti l’archiviazione locale e riprova.");
+        }
+        control.writerToken = token;
+        await deliveryJson("/admin/api/deliveries", { action: "manifestClaim", id: deliveryId, packageId }, control);
+        // Mantiene la proprietà anche durante una pausa; un errore di rete è gestito
+        // dalla prossima mutazione, senza tentativi sovrapposti o errori non osservati.
+        let renewing = false;
+        const timer = setInterval(() => {
+            if (renewing || control.signal?.aborted)
+                return;
+            renewing = true;
+            void fetch("/admin/api/deliveries", { method: "POST", credentials: "same-origin",
+                headers: { "Content-Type": "application/json" }, signal: control.signal,
+                body: JSON.stringify({ action: "manifestClaim", id: deliveryId, packageId, writerToken: token }),
+            }).catch(() => { }).finally(() => { renewing = false; });
+        }, 5 * 60_000);
+        try {
+            return await performDeliveryPackage(deliveryId, packageId, selected, options, onProgress, control);
+        }
+        finally {
+            clearInterval(timer);
+        }
+    });
+}
+async function performDeliveryPackage(deliveryId, packageId, selected, options, onProgress, control) {
+    preflightDeliverySelection(selected, options);
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    control?.signal?.addEventListener("abort", abort, { once: true });
+    if (control?.signal?.aborted)
+        abort();
+    const local = {
+        writerToken: control?.writerToken,
+        signal: controller.signal,
+        networkWaiting: (waiting) => control?.networkWaiting?.(waiting),
+        gate: async () => { await deliveryGate({ ...control, signal: controller.signal, gate: () => control?.gate() || Promise.resolve() }); },
+    };
+    const sinks = [];
+    try {
+        return await buildDeliveryPackage(deliveryId, packageId, selected, options, onProgress, local, sinks);
+    }
+    finally {
+        controller.abort();
+        await Promise.allSettled(sinks.map((sink) => sink.settle()));
+        control?.signal?.removeEventListener("abort", abort);
+    }
 }
-export async function uploadDeliveryPackage(deliveryId, packageId, selected, options, onProgress, control) {
+async function buildDeliveryPackage(deliveryId, packageId, selected, options, onProgress, control, sinks) {
     const startedAt = Date.now();
-    const files = [...selected].sort((a, b) => deliveryRelativeName(a).localeCompare(deliveryRelativeName(b), undefined, { numeric: true, sensitivity: "base" }));
+    const files = [...selected].sort((a, b) => options.manifestVersion === 2
+        ? (deliveryRelativeName(a) < deliveryRelativeName(b) ? -1 : deliveryRelativeName(a) > deliveryRelativeName(b) ? 1 : 0)
+        : deliveryRelativeName(a).localeCompare(deliveryRelativeName(b), undefined, { numeric: true, sensitivity: "base" }));
     if (!files.length)
         throw new Error("Nessun file selezionato");
     const sourceBytes = files.reduce((n, f) => n + f.size, 0);
     const entries = [];
-    let processed = 0;
+    let checkpoint = null;
+    if (options.manifestVersion === 2) {
+        const status = await deliveryJson("/admin/api/deliveries", {
+            action: "manifestStatus", id: deliveryId, packageId,
+        }, control);
+        if (status.state === "sealed" || status.state === "ready")
+            return {
+                manifest: { version: 2, createdAt: "", entries: [], skipped: [] }, fileCount: files.length, sourceBytes, storedBytes: 0,
+            };
+        checkpoint = status.checkpoint;
+        if (checkpoint) {
+            let after = -1;
+            while (entries.length < checkpoint.fileIndex) {
+                const page = await deliveryJson("/admin/api/deliveries", {
+                    action: "manifestDraftPage", id: deliveryId, packageId, after,
+                }, control);
+                if (!page.entries.length)
+                    throw new Error("Il checkpoint non contiene tutti i file precedenti.");
+                for (const row of page.entries) {
+                    if (row.index >= checkpoint.fileIndex)
+                        break;
+                    if (row.index !== entries.length || row.entry.name !== safePath(deliveryRelativeName(files[row.index])) || row.entry.original.length !== files[row.index].size) {
+                        throw new Error("La selezione non corrisponde al checkpoint.");
+                    }
+                    // Le varianti verranno riprese nella loro fase; i batch originali restano immutabili.
+                    entries.push({ name: row.entry.name, type: row.entry.type, original: row.entry.original });
+                    after = row.index;
+                }
+            }
+        }
+    }
+    let processed = checkpoint?.fileIndex || 0;
+    const entryByName = new Map();
+    let metadataBatch = [];
+    let metadataSize = 0;
+    let phase = "originals";
+    let sequence = checkpoint?.sequence || 0;
+    for (let i = 0; i < entries.length; i++)
+        entryByName.set(entries[i].name, i);
+    async function flushMetadata() {
+        if (!metadataBatch.length || options.manifestVersion !== 2)
+            return;
+        await deliveryJson("/admin/api/deliveries", { action: "manifestBatch", id: deliveryId, packageId,
+            phase, batchId: `${phase}-${sequence++}`, entries: metadataBatch }, control);
+        metadataBatch = [];
+        metadataSize = 0;
+    }
+    async function saveMetadata(index, entry) {
+        if (options.manifestVersion !== 2)
+            return;
+        const row = { index, entry };
+        const size = enc.encode(JSON.stringify(row)).length + 1;
+        if (metadataBatch.length >= 200 || metadataSize + size > 250 * 1024)
+            await flushMetadata();
+        metadataBatch.push(row);
+        metadataSize += size;
+    }
     let currentOriginal = "";
-    const originalsSink = new B2Sink(deliveryId, packageId, "originals", reportOriginals, control);
-    const originals = new ZipStream(originalsSink);
+    const originalsSink = new B2Sink(deliveryId, packageId, "originals", reportOriginals, control, options.manifestVersion === 2);
+    sinks.push(originalsSink);
+    const originals = new ZipStream(originalsSink, options.manifestVersion === 2);
+    if (checkpoint) {
+        if (checkpoint.complete) {
+            originalsSink.totalBytes = checkpoint.offset;
+            originalsSink.uploadedBytes = checkpoint.offset;
+        }
+        else {
+            await originalsSink.restore(checkpoint.offset, checkpoint.partsHash);
+            originals.restore(entries, files, checkpoint.offset);
+        }
+    }
+    let lastCheckpoint = checkpoint?.offset || 0;
+    async function saveCheckpoint(current, offset) {
+        if (options.manifestVersion !== 2 || offset - lastCheckpoint < PART * 4)
+            return;
+        await originalsSink.checkpointBoundary();
+        await flushMetadata();
+        await deliveryJson("/admin/api/deliveries", { action: "manifestCheckpoint", id: deliveryId, packageId,
+            checkpoint: { version: 1, fileIndex: processed, offset, sequence, current } }, control);
+        lastCheckpoint = offset;
+    }
     function reportOriginals() {
         onProgress({
             phase: "originals", file: currentOriginal, doneFiles: processed, totalFiles: files.length,
@@ -34,17 +183,27 @@ export async function uploadDeliveryPackage(deliveryId, packageId, selected, opt
             transferStartedAt: originalsSink.transferStartedAt || undefined,
         });
     }
-    for (const file of files) {
+    for (const file of files.slice(processed)) {
         if (control)
             await control.gate();
         const name = safePath(deliveryRelativeName(file));
         currentOriginal = name;
-        const member = await originals.add(name, file, reportOriginals, new Date(file.lastModified));
+        const member = await originals.add(name, file, reportOriginals, new Date(file.lastModified), options.manifestVersion === 2 ? saveCheckpoint : undefined, checkpoint && processed === checkpoint.fileIndex ? checkpoint.current : undefined);
+        entryByName.set(name, entries.length);
         entries.push({ name, type: file.type || mimeFromName(name), original: member });
+        await saveMetadata(entries.length - 1, entries[entries.length - 1]);
         processed++;
         reportOriginals();
     }
-    await originals.close();
+    if (!checkpoint?.complete)
+        await originals.close();
+    await flushMetadata();
+    if (options.manifestVersion === 2 && !checkpoint?.complete) {
+        await deliveryJson("/admin/api/deliveries", { action: "manifestCheckpoint", id: deliveryId, packageId,
+            checkpoint: { version: 1, fileIndex: files.length, offset: originalsSink.totalBytes, sequence, complete: true } }, control);
+    }
+    phase = "variants";
+    sequence = 0;
     const wantWebArchive = options.webEnabled || options.galleryEnabled;
     let webSink = null;
     let thumbsSink = null;
@@ -52,12 +211,14 @@ export async function uploadDeliveryPackage(deliveryId, packageId, selected, opt
     let thumbsZip = null;
     const skipped = [];
     if (wantWebArchive) {
-        webSink = new B2Sink(deliveryId, packageId, "web", undefined, control);
-        webZip = new ZipStream(webSink);
+        webSink = new B2Sink(deliveryId, packageId, "web", undefined, control, options.manifestVersion === 2);
+        sinks.push(webSink);
+        webZip = new ZipStream(webSink, options.manifestVersion === 2);
     }
     if (options.galleryEnabled) {
-        thumbsSink = new B2Sink(deliveryId, packageId, "thumbs", undefined, control);
-        thumbsZip = new ZipStream(thumbsSink);
+        thumbsSink = new B2Sink(deliveryId, packageId, "thumbs", undefined, control, options.manifestVersion === 2);
+        sinks.push(thumbsSink);
+        thumbsZip = new ZipStream(thumbsSink, options.manifestVersion === 2);
     }
     if (webZip) {
         let imageDone = 0;
@@ -66,24 +227,36 @@ export async function uploadDeliveryPackage(deliveryId, packageId, selected, opt
             if (control)
                 await control.gate();
             const sourceName = safePath(deliveryRelativeName(file));
+            let variants;
             try {
-                const variants = await makeVariants(file, !!thumbsZip);
-                const outputName = sourceName.replace(/\.[^.\/]+$/, "") + ".webp";
-                const modified = new Date(file.lastModified);
-                const web = await webZip.add(outputName, variants.display, undefined, modified);
-                const entry = entries.find((it) => it.name === sourceName);
-                if (entry) {
-                    entry.web = web;
-                    entry.width = variants.width;
-                    entry.height = variants.height;
-                    if (thumbsZip && variants.thumb) {
-                        entry.thumb = await thumbsZip.add(outputName, variants.thumb, undefined, modified);
-                    }
-                }
+                variants = await makeVariants(file, !!thumbsZip, options.webEnabled ? options.webFormat : "webp");
             }
             catch (e) {
-                skipped.push({ name: sourceName, reason: e instanceof Error ? e.message : String(e) });
+                checkCancelled(control);
+                if (e instanceof UploadCancelled)
+                    throw e;
+                skipped.push({ name: sourceName, reason: (e instanceof Error ? e.message : String(e)).slice(0, DELIVERY_SKIP_REASON_CHARS) });
+                const index = entryByName.get(sourceName);
+                await saveMetadata(index, { ...entries[index], skipped: skipped[skipped.length - 1].reason });
+                imageDone++;
+                continue;
+            }
+            await control?.gate();
+            const outputBase = options.manifestVersion === 2 ? sourceName : sourceName.replace(/\.[^.\/]+$/, "");
+            const outputName = outputBase + (options.webEnabled && options.webFormat === "jpg" ? ".jpg" : ".webp");
+            const modified = new Date(file.lastModified);
+            const web = await webZip.add(outputName, variants.display, undefined, modified);
+            const index = entryByName.get(sourceName);
+            const entry = entries[index];
+            if (entry) {
+                entry.web = web;
+                entry.width = variants.width;
+                entry.height = variants.height;
+                if (thumbsZip && variants.thumb) {
+                    entry.thumb = await thumbsZip.add(outputBase + ".webp", variants.thumb, undefined, modified);
+                }
             }
+            await saveMetadata(index, entry);
             imageDone++;
             onProgress({
                 phase: "derivatives", file: sourceName, doneFiles: imageDone,
@@ -101,6 +274,7 @@ export async function uploadDeliveryPackage(deliveryId, packageId, selected, opt
         if (thumbsZip)
             await thumbsZip.close();
     }
+    await flushMetadata();
     onProgress({
         phase: "finalizing", file: "", doneFiles: files.length, totalFiles: files.length,
         sourceBytes, uploadedBytes: originalsSink.uploadedBytes + (webSink?.uploadedBytes || 0) +
@@ -111,13 +285,14 @@ export async function uploadDeliveryPackage(deliveryId, packageId, selected, opt
         transferStartedAt: firstStartedAt(originalsSink, webSink, thumbsSink),
     });
     return {
-        manifest: { version: 1, createdAt: new Date().toISOString(), entries, skipped },
+        manifest: { version: options.manifestVersion || 1, createdAt: new Date().toISOString(), entries: options.manifestVersion === 2 ? [] : entries, skipped },
         fileCount: files.length,
         sourceBytes,
         storedBytes: originalsSink.totalBytes + (webSink?.totalBytes || 0) + (thumbsSink?.totalBytes || 0),
     };
 }
 class B2Sink {
+    forceMultipart;
     deliveryId;
     packageId;
     variant;
@@ -134,7 +309,8 @@ class B2Sink {
     failure = null;
     onTransfer;
     control;
-    constructor(deliveryId, packageId, variant, onTransfer, control) {
+    constructor(deliveryId, packageId, variant, onTransfer, control, forceMultipart = false) {
+        this.forceMultipart = forceMultipart;
         this.deliveryId = deliveryId;
         this.packageId = packageId;
         this.variant = variant;
@@ -144,6 +320,9 @@ class B2Sink {
     async write(input) {
         if (!input.byteLength)
             return;
+        if (this.totalBytes + input.byteLength > DELIVERY_MAX_ARCHIVE_BYTES) {
+            throw new Error("L’archivio supera il limite tecnico: dividi i file in più invii.");
+        }
         this.chunks.push(input);
         this.buffered += input.byteLength;
         this.totalBytes += input.byteLength;
@@ -151,47 +330,53 @@ class B2Sink {
             await this.queuePart(this.take(PART));
     }
     async close() {
-        if (this.session?.state === "completed") {
-            const rest = this.take(this.buffered);
-            this.markUploaded(rest.byteLength, false);
-            await this.drain();
-            return;
-        }
+        await this.control?.gate();
+        if (this.forceMultipart && !this.session)
+            await this.ensureSession();
         if (!this.session) {
             const body = this.take(this.buffered);
-            const signed = await postJson({
-                action: "putPresign", id: this.deliveryId, packageId: this.packageId, variant: this.variant,
-            });
             this.startTransfer();
-            const res = await fetch(signed.url, {
-                method: "PUT", body: body.buffer, headers: { "Content-Type": "application/zip" },
-            });
-            if (!res.ok)
-                throw new Error(`Caricamento non riuscito (${res.status}). Riprova fra poco.`);
+            const etag = await deliveryPut(async () => {
+                const signed = await postJson({
+                    action: "putPresign", id: this.deliveryId, packageId: this.packageId, variant: this.variant,
+                }, this.control);
+                return signed.url;
+            }, body.buffer, "application/zip", this.control);
+            await this.control?.gate();
             await postJson({
                 action: "putComplete", id: this.deliveryId, packageId: this.packageId,
-                variant: this.variant, bytes: body.byteLength,
-            });
+                variant: this.variant, bytes: body.byteLength, etag,
+            }, this.control);
             this.markUploaded(body.byteLength, true);
             return;
         }
         if (this.buffered)
             await this.queuePart(this.take(this.buffered));
         await this.drain();
-        await postJson({ action: "complete", uploadId: this.session.id });
+        await this.control?.gate();
+        if (this.session.state === "completed") {
+            if (this.session.bytes !== this.totalBytes || this.priorParts.size !== this.partNumber) {
+                throw new Error("I file non corrispondono all’archivio già caricato. Crea un nuovo caricamento.");
+            }
+            return;
+        }
+        await postJson({ action: "complete", uploadId: this.session.id,
+            bytes: this.totalBytes, partCount: this.partNumber }, this.control);
     }
     async ensureSession() {
         if (this.session)
             return this.session;
         const out = await postJson({
             action: "create", id: this.deliveryId, packageId: this.packageId, variant: this.variant,
-        });
+        }, this.control);
         this.session = out.upload;
-        if (out.upload.state === "completed")
-            return out.upload;
         const reconciled = await postJson({
             action: "reconcile", uploadId: out.upload.id,
-        });
+        }, this.control);
+        if (reconciled.completed) {
+            this.session.state = "completed";
+            this.session.bytes = reconciled.bytes;
+        }
         this.priorParts = new Map(reconciled.parts.map((part) => [part.partNumber, part]));
         return out.upload;
     }
@@ -217,69 +402,59 @@ class B2Sink {
         }
     }
     async uploadPart(body, partNumber, session) {
-        if (session.state === "completed") {
-            this.markUploaded(body.byteLength, false);
-            return;
-        }
         const digest = await digestHex(body);
         const prior = this.priorParts.get(partNumber);
         if (prior?.size === body.byteLength && prior.digest === digest) {
             this.markUploaded(body.byteLength, false);
             return;
         }
-        const signed = await postJson({
-            action: "presign", uploadId: session.id, partNumber,
-        });
-        let res = null;
-        let failure = "errore di rete o CORS";
-        for (let attempt = 0; attempt < 3; attempt++) {
-            this.startTransfer();
-            res = await fetch(signed.url, {
-                method: "PUT", body: body.buffer, headers: { "Content-Type": "application/octet-stream" },
-            }).catch(() => null);
-            if (res?.ok)
-                break;
-            if (res) {
-                const detail = (await res.text().catch(() => "")).replace(/\s+/g, " ").slice(0, 180);
-                failure = `HTTP ${res.status}${detail ? ` · ${detail}` : ""}`;
-            }
-            await delay(500 * 2 ** attempt);
-        }
-        if (!res?.ok) {
-            throw new Error(`Un pezzo del caricamento non è passato (${failure}). Riprova.`);
-        }
-        const etag = res.headers.get("etag");
-        if (!etag) {
-            throw new Error("L’archivio non espone l’header ETag: manca la configurazione CORS del bucket (vedi DELIVERY.md)");
-        }
-        let recorded = false;
-        for (let attempt = 0; attempt < 3 && !recorded; attempt++) {
-            try {
-                await postJson({
-                    action: "record", uploadId: session.id, partNumber, etag,
-                    digest, size: body.byteLength,
-                });
-                recorded = true;
-            }
-            catch {
-                if (attempt === 2)
-                    throw new Error("Un pezzo del caricamento non è stato registrato. Riprova.");
-                await delay(400 * 2 ** attempt);
-            }
+        if (session.state === "completed") {
+            throw new Error("Non posso verificare gli stessi file nell’archivio completato. Crea un nuovo caricamento.");
         }
+        this.startTransfer();
+        const etag = await deliveryPut(async () => {
+            const signed = await postJson({
+                action: "presign", uploadId: session.id, partNumber,
+            }, this.control);
+            return signed.url;
+        }, body.buffer, "application/octet-stream", this.control);
+        if (!etag)
+            throw new Error("L’archivio non espone ETag: verifica la configurazione CORS del bucket.");
+        await postJson({ action: "record", uploadId: session.id, partNumber, etag,
+            digest, size: body.byteLength }, this.control);
         this.markUploaded(body.byteLength, true);
     }
+    async restore(offset, partsHash) {
+        await this.ensureSession();
+        const count = offset / PART;
+        const parts = [...this.priorParts.values()].filter(p => p.partNumber <= count).sort((a, b) => a.partNumber - b.partNumber);
+        const hash = await digestHex(enc.encode(JSON.stringify(parts.map(p => [p.partNumber, p.size, p.digest]))));
+        if (parts.length !== count || hash !== partsHash)
+            throw new Error("Le parti remote non corrispondono al checkpoint. La ripresa è stata fermata per proteggere l’integrità.");
+        this.partNumber = count;
+        this.totalBytes = offset;
+        this.uploadedBytes = offset;
+    }
+    async gate() { await this.control?.gate(); }
+    async checkpointBoundary() {
+        await this.drain();
+        if (this.buffered)
+            throw new Error("Checkpoint fuori dal confine di una parte.");
+    }
+    async settle() { await Promise.allSettled([...this.inFlight]); }
     async drain() {
-        await Promise.all([...this.inFlight]);
+        while (this.inFlight.size) {
+            await Promise.race(this.inFlight);
+            await this.failIfNeeded();
+        }
         await this.failIfNeeded();
     }
     async failIfNeeded() {
         if (this.failure == null)
             return;
-        await Promise.all([...this.inFlight]);
-        const error = this.failure;
-        this.failure = null;
-        throw error;
+        // Il finally del motore abortisce e attende le altre richieste. Attenderle qui
+        // bloccherebbe un errore permanente dietro ai retry di un'altra parte.
+        throw this.failure;
     }
     startTransfer() {
         if (!this.transferStartedAt)
@@ -315,14 +490,28 @@ function firstStartedAt(...sinks) {
     return values.length ? Math.min(...values) : undefined;
 }
 export class ZipStream {
+    utc;
     sink;
     offset = 0;
     entries = [];
-    constructor(sink) { this.sink = sink; }
-    async add(nameValue, blob, progress, modified = new Date()) {
+    constructor(sink, utc = false) {
+        this.utc = utc;
+        this.sink = sink;
+    }
+    restore(entries, files, offset) {
+        this.offset = offset;
+        this.entries = entries.map((entry, i) => {
+            const name = enc.encode(entry.name);
+            const size = entry.original.length;
+            const [time, date] = dosDate(new Date(files[i].lastModified), this.utc);
+            return { name, size, crc: entry.original.crc32, time, date,
+                localOffset: entry.original.offset - 30 - name.length - (size >= 0xffffffff ? 20 : 0) };
+        });
+    }
+    async add(nameValue, blob, progress, modified = new Date(), checkpoint, resume) {
         const name = enc.encode(safePath(nameValue));
         const size = blob.size;
-        const localOffset = this.offset;
+        const localOffset = resume?.localOffset ?? this.offset;
         const zip64 = size >= 0xffffffff;
         const extra = zip64 ? zip64Extra([size, size]) : new Uint8Array();
         const local = bytes(30 + name.length + extra.length);
@@ -331,7 +520,7 @@ export class ZipStream {
         v.setUint16(4, zip64 ? 45 : 20, true);
         v.setUint16(6, 0x0808, true); // descriptor + nomi UTF-8
         v.setUint16(8, 0, true); // STORE
-        const [time, date] = dosDate(modified);
+        const [time, date] = dosDate(modified, this.utc);
         v.setUint16(10, time, true);
         v.setUint16(12, date, true);
         v.setUint32(18, zip64 ? 0xffffffff : 0, true);
@@ -340,15 +529,42 @@ export class ZipStream {
         v.setUint16(28, extra.length, true);
         local.set(name, 30);
         local.set(extra, 30 + name.length);
-        await this.push(local);
-        const dataOffset = this.offset;
+        if (!resume)
+            await this.push(local);
+        const dataOffset = resume?.dataOffset ?? this.offset;
         let crc = 0xffffffff;
         let read = 0;
+        let chain = "";
+        if (resume && (resume.name !== nameValue || resume.size !== size || resume.time !== time || resume.date !== date ||
+            resume.read > size || resume.read < 0 || dataOffset + resume.read !== this.offset))
+            throw new Error("File diverso da quello del checkpoint.");
+        // Verifica il prefisso del solo file interrotto; gli originali già conclusi sono
+        // la copia remota autorevole. Non mescolare un nuovo suffisso a un vecchio prefisso.
+        while (resume && read < resume.read) {
+            const length = Math.min(READ, PART - ((dataOffset + read) % PART), resume.read - read);
+            const chunk = new Uint8Array(await blob.slice(read, read + length).arrayBuffer());
+            if (chunk.length !== length)
+                throw new Error("Lettura sorgente incompleta durante la verifica.");
+            crc = crc32Update(crc, chunk);
+            chain = await digestHex(enc.encode(chain + ":" + await digestHex(chunk)));
+            read += length;
+            // La verifica può essere lunga: il gate deve continuare a rispondere ad annullamento.
+            await this.sinkGate();
+        }
+        if (resume && (chain !== resume.chain || crc !== resume.crc))
+            throw new Error("Il file interrotto è cambiato: impossibile riprenderlo senza alterare i dati.");
         while (read < size) {
-            const chunk = new Uint8Array(await blob.slice(read, Math.min(size, read + READ)).arrayBuffer());
+            const length = Math.min(READ, size - read, checkpoint ? PART - (this.offset % PART) : READ);
+            const chunk = new Uint8Array(await blob.slice(read, read + length).arrayBuffer());
+            if (chunk.length !== length)
+                throw new Error("Lettura sorgente incompleta.");
             crc = crc32Update(crc, chunk);
+            if (checkpoint)
+                chain = await digestHex(enc.encode(chain + ":" + await digestHex(chunk)));
             read += chunk.byteLength;
             await this.push(chunk);
+            if (checkpoint && this.offset % PART === 0)
+                await checkpoint({ name: nameValue, size, read, crc, chain, localOffset, dataOffset, time, date }, this.offset);
             progress?.(read);
         }
         crc = (crc ^ 0xffffffff) >>> 0;
@@ -424,20 +640,21 @@ export class ZipStream {
         await this.push(end);
         await this.sink.close();
     }
+    async sinkGate() { await this.sink.gate?.(); }
     async push(data) {
         await this.sink.write(data);
         this.offset += data.byteLength;
     }
 }
-async function makeVariants(file, wantThumb) {
+async function makeVariants(file, wantThumb, format = "webp") {
     const bitmap = await createImageBitmap(file, { imageOrientation: "from-image" });
     try {
         const displaySize = fit(bitmap.width, bitmap.height, 2048);
-        const display = await drawWebp(bitmap, displaySize.width, displaySize.height, .8);
+        const display = await drawImageBlob(bitmap, displaySize.width, displaySize.height, format === "jpg" ? .82 : .8, format === "jpg" ? "image/jpeg" : "image/webp");
         let thumb;
         if (wantThumb) {
             const thumbSize = fit(bitmap.width, bitmap.height, 640);
-            thumb = await drawWebp(bitmap, thumbSize.width, thumbSize.height, .72);
+            thumb = await drawImageBlob(bitmap, thumbSize.width, thumbSize.height, .72);
         }
         return { display, thumb, width: displaySize.width, height: displaySize.height };
     }
@@ -445,14 +662,21 @@ async function makeVariants(file, wantThumb) {
         bitmap.close();
     }
 }
-async function drawWebp(bitmap, width, height, quality) {
+async function drawImageBlob(bitmap, width, height, quality, type = "image/webp") {
     if (typeof OffscreenCanvas !== "undefined") {
         const canvas = new OffscreenCanvas(width, height);
         const ctx = canvas.getContext("2d", { alpha: false });
         if (!ctx)
             throw new Error("Canvas 2D non disponibile");
+        if (type === "image/jpeg") {
+            ctx.fillStyle = "#ffffff";
+            ctx.fillRect(0, 0, width, height);
+        }
         ctx.drawImage(bitmap, 0, 0, width, height);
-        return canvas.convertToBlob({ type: "image/webp", quality });
+        const blob = await canvas.convertToBlob({ type, quality });
+        if (blob.type !== type)
+            throw new Error("Il browser non supporta il formato richiesto");
+        return blob;
     }
     const canvas = document.createElement("canvas");
     canvas.width = width;
@@ -460,21 +684,19 @@ async function drawWebp(bitmap, width, height, quality) {
     const ctx = canvas.getContext("2d", { alpha: false });
     if (!ctx)
         throw new Error("Canvas 2D non disponibile");
+    if (type === "image/jpeg") {
+        ctx.fillStyle = "#ffffff";
+        ctx.fillRect(0, 0, width, height);
+    }
     ctx.drawImage(bitmap, 0, 0, width, height);
-    return new Promise((resolve, reject) => canvas.toBlob((blob) => blob ? resolve(blob) : reject(new Error("Conversione WebP non riuscita")), "image/webp", quality));
+    return new Promise((resolve, reject) => canvas.toBlob((blob) => blob?.type === type ? resolve(blob) : reject(new Error("Conversione nel formato richiesto non riuscita")), type, quality));
 }
 function fit(width, height, edge) {
     const scale = Math.min(1, edge / Math.max(width, height));
     return { width: Math.max(1, Math.round(width * scale)), height: Math.max(1, Math.round(height * scale)) };
 }
-async function postJson(body) {
-    const res = await fetch("/admin/api/delivery/multipart", {
-        method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
-    });
-    const answer = await res.json().catch(() => ({}));
-    if (!res.ok || answer.ok === false)
-        throw new Error(answer.error || `HTTP ${res.status}`);
-    return answer;
+function postJson(body, control) {
+    return deliveryJson("/admin/api/delivery/multipart", body, control);
 }
 export function setDeliveryRelativePath(file, path) {
     droppedPaths.set(file, safePath(path));
@@ -482,6 +704,60 @@ export function setDeliveryRelativePath(file, path) {
 export function deliveryRelativeName(file) {
     return droppedPaths.get(file) || file.webkitRelativePath || file.name;
 }
+/** Solo metadati: nessuna lettura dei file o richiesta di rete prima del rifiuto. */
+export function preflightDeliverySelection(files, options = { galleryEnabled: true, webEnabled: true }) {
+    if (!files.length)
+        throw new Error("Nessun file selezionato");
+    if (options.manifestVersion === 2 && files.length > 100_000)
+        throw new Error("Troppi file: il limite è 100.000 per invio.");
+    let sourceBytes = 0;
+    // Stima conservativa ZIP64: extra locali/centrali e descriptor per ogni membro.
+    let archiveBytes = 98;
+    let manifestBytes = 128; // envelope, data ISO, delimitatori
+    const names = new Set();
+    const variantNames = new Set();
+    const member = { offset: DELIVERY_MAX_ARCHIVE_BYTES, length: DELIVERY_MAX_ARCHIVE_BYTES, crc32: 0xffffffff };
+    for (const file of files) {
+        validateDeliverySourceBytes(file.size);
+        sourceBytes = validateDeliverySourceBytes(sourceBytes + file.size);
+        const name = safePath(deliveryRelativeName(file));
+        if (names.has(name))
+            throw new Error("Due file hanno lo stesso percorso nell’archivio. Seleziona cartelle con percorsi distinti.");
+        names.add(name);
+        const nameBytes = enc.encode(name).length;
+        if (options.manifestVersion === 2 && (nameBytes > 8192 || /[\x00-\x1f\x7f]/.test(name)))
+            throw new Error("Un percorso supera i limiti del nuovo formato (8 KiB, senza caratteri di controllo).");
+        if (enc.encode(file.type || "").length > 256)
+            throw new Error("Il tipo di un file è troppo lungo.");
+        if ((options.galleryEnabled || options.webEnabled) && IMAGE.test(file.name)) {
+            const variantName = (options.manifestVersion === 2 ? name : name.replace(/\.[^.\/]+$/, "")) + (options.webEnabled && options.webFormat === "jpg" ? ".jpg" : ".webp");
+            if (variantNames.has(variantName))
+                throw new Error("Due immagini produrrebbero lo stesso nome di anteprima. Seleziona cartelle con percorsi distinti.");
+            variantNames.add(variantName);
+        }
+        const entry = { name, type: file.type || mimeFromName(name), original: member };
+        if ((options.galleryEnabled || options.webEnabled) && IMAGE.test(file.name)) {
+            entry.web = member;
+            if (options.galleryEnabled)
+                entry.thumb = member;
+            entry.width = Number.MAX_SAFE_INTEGER;
+            entry.height = Number.MAX_SAFE_INTEGER;
+            // Anche l'errore di conversione ha un budget; conteggiare entrambi è prudente.
+            manifestBytes += enc.encode(JSON.stringify({ name, reason: "\u0000".repeat(DELIVERY_SKIP_REASON_CHARS) })).length + 1;
+        }
+        manifestBytes += enc.encode(JSON.stringify(entry)).length + 1;
+        if (manifestBytes > (options.manifestVersion === 2 ? 64 * 1024 * 1024 : DELIVERY_V1_MANIFEST_BYTES)) {
+            throw new Error("Troppi metadati per questo formato di invio: dividi la selezione in più invii prima di caricare i file.");
+        }
+        if (nameBytes > 65_535)
+            throw new Error("Un percorso è troppo lungo per l’archivio ZIP: accorcialo prima di inviare.");
+        archiveBytes += file.size + 148 + 2 * nameBytes;
+        if (archiveBytes > DELIVERY_MAX_ARCHIVE_BYTES) {
+            throw new Error("I file e i loro percorsi superano il limite dell’archivio: dividi l’invio.");
+        }
+    }
+    return { sourceBytes, archiveBytes, manifestBytes };
+}
 export function deliverySelectionName(files) {
     const first = files[0];
     if (!first)
@@ -512,7 +788,7 @@ async function makeHeroVariant(file) {
     try {
         const size = fit(bitmap.width, bitmap.height, 2560);
         return {
-            blob: await drawWebp(bitmap, size.width, size.height, .82),
+            blob: await drawImageBlob(bitmap, size.width, size.height, .82),
             width: size.width, height: size.height,
         };
     }
@@ -520,9 +796,9 @@ async function makeHeroVariant(file) {
         bitmap.close();
     }
 }
-export async function deliverySourceFingerprint(files) {
+export async function deliverySourceFingerprint(files, version = 1) {
     const lines = [...files]
-        .sort((a, b) => deliveryRelativeName(a).localeCompare(deliveryRelativeName(b), undefined, {
+        .sort((a, b) => version === 2 ? (deliveryRelativeName(a) < deliveryRelativeName(b) ? -1 : deliveryRelativeName(a) > deliveryRelativeName(b) ? 1 : 0) : deliveryRelativeName(a).localeCompare(deliveryRelativeName(b), undefined, {
         numeric: true, sensitivity: "base",
     }))
         .map((file) => `${safePath(deliveryRelativeName(file))}\0${file.size}\0${file.lastModified}`)
@@ -554,12 +830,14 @@ function zip64Extra(values) {
     values.forEach((value, i) => setU64(v, 4 + i * 8, value));
     return out;
 }
-function dosDate(date) {
-    const year = Math.max(1980, date.getFullYear());
-    return [
-        (date.getHours() << 11) | (date.getMinutes() << 5) | Math.floor(date.getSeconds() / 2),
-        ((year - 1980) << 9) | ((date.getMonth() + 1) << 5) | date.getDate(),
-    ];
+function dosDate(date, utc = false) {
+    const year = Math.min(2107, Math.max(1980, utc ? date.getUTCFullYear() : date.getFullYear()));
+    const hour = utc ? date.getUTCHours() : date.getHours();
+    const minute = utc ? date.getUTCMinutes() : date.getMinutes();
+    const second = utc ? date.getUTCSeconds() : date.getSeconds();
+    const month = utc ? date.getUTCMonth() : date.getMonth();
+    const day = utc ? date.getUTCDate() : date.getDate();
+    return [(hour << 11) | (minute << 5) | Math.floor(second / 2), ((year - 1980) << 9) | ((month + 1) << 5) | day];
 }
 const CRC_TABLE = (() => {
     const table = new Uint32Array(256);
@@ -577,7 +855,6 @@ function crc32Update(crc, data) {
         c = CRC_TABLE[(c ^ data[i]) & 0xff] ^ (c >>> 8);
     return c >>> 0;
 }
-function delay(ms) { return new Promise((resolve) => setTimeout(resolve, ms)); }
 async function digestHex(data) {
     const digest = await crypto.subtle.digest("SHA-256", data.buffer);
     return [...new Uint8Array(digest)]