@cardinali-studio/adminkit 2.2.25 → 2.2.34

package/dist/functions/delivery-public/index.js

@@ -0,0 +1,637 @@
+/* Consegna pubblica: /c/<token>.
+ *
+ * Il token casuale identifica un link D1. Il bucket B2 resta privato: gli ZIP
+ * completi usano un redirect breve verso una GET SigV4, mentre le foto della
+ * gallery passano dalla Function come Range del relativo ZIP.
+ * Gli oggetti ZIP sono STORE; gli offset nel manifest permettono di servire una
+ * singola fotografia con Range senza conservarne una seconda copia.
+ *
+ * La PAGINA non viene scritta qui. Il guscio lo genera il consumer (Astro, Hugo o altro generatore) (/_delivery/shell.html: testata,
+ * identità e CSS dedicato) e questa Function ci sostituisce dentro i segnaposto `%DC_*%`.
+ * Così la consegna resta una pagina del sito invece di una copia isolata dal build.
+ */
+
+import {
+  b2AbortMultipart, b2Delete, b2Get, b2PresignGetObject,
+} from "../_shared/b2.js";
+import {
+  DELIVERY_LINK_MIN_LENGTH, sha256, signValue, unseal, verifyValue,
+} from "../_shared/delivery-crypto.js";
+
+import { readManifestEntry, readManifestPage } from "../_shared/delivery-manifest.js";
+import { purgeDeliveryNow } from "../_shared/delivery-purge.js";
+
+const COOKIE = "adminkit_delivery";
+const HOUR = 3_600_000;
+const DAY = 86_400_000;
+const SHELL = "/delivery-shell/";
+
+/* Il guscio cambia solo con un deploy, e un deploy crea isolate nuovi: tenerlo qui
+   significa una lettura sola per isolate invece di una per richiesta. */
+let shellCache = null;
+
+export async function onRequestGet(context) {
+  try { return await get(context); }
+  catch (e) {
+    console.error("delivery public get:", e);
+    return message(context, {
+      title: "Consegna non disponibile",
+      body: "Non è stato possibile aprire questa consegna. Riprova fra poco.",
+    }, 500);
+  }
+}
+
+export async function onRequestHead(context) {
+  const response = await onRequestGet(context);
+  return new Response(null, { status: response.status, headers: response.headers });
+}
+
+export async function onRequestPost(context) {
+  try { return await post(context); }
+  catch (e) {
+    console.error("delivery public post:", e);
+    return json({ ok: false, error: "Operazione non riuscita. Riprova." }, 500);
+  }
+}
+
+async function get(context) {
+  const { request, env, params, waitUntil } = context;
+  if (!env.DB || !env.DELIVERY_SECRET) {
+    return message(context, {
+      title: "Consegna non disponibile",
+      body: "Il servizio non è ancora attivo. Riprova fra poco.",
+    }, 503);
+  }
+  const seg = segments(params.path);
+  const token = seg[0] || "";
+  if (!token || token.length < DELIVERY_LINK_MIN_LENGTH) {
+    return message(context, {
+      title: "Link non valido",
+      body: "Controlla di aver copiato tutto l’indirizzo, fino all’ultimo carattere.",
+    }, 404);
+  }
+  const access = await accessFor(env, request, token);
+  if (!access) {
+    return message(context, {
+      title: "Link non valido",
+      body: "Questa consegna non esiste più, oppure il link è stato disattivato.",
+    }, 404);
+  }
+  if (access.expired) {
+    return message(context, {
+      title: "Questa consegna è scaduta",
+      body: "I file non sono più disponibili da questo link. Contatta chi ti ha inviato il link per riceverne uno nuovo.",
+    }, 410);
+  }
+  if (access.filesExpired && typeof waitUntil === "function") {
+    waitUntil(purgeExpiredBytes(env, access.delivery.id).catch((error) =>
+      console.error("delivery expired purge:", error)));
+  }
+
+  if (seg.length === 1) {
+    /* I contatori raccontano il CLIENTE, non i robot: l'anteprima di link generata da
+       WhatsApp o iMessage fa un GET su questa pagina e gonfierebbe le aperture. */
+    if (request.method !== "HEAD" && looksHuman(request)) {
+      const now = new Date().toISOString();
+      await env.DB.batch([
+        env.DB.prepare("UPDATE delivery_links SET opened_count=opened_count+1,last_opened_at=? WHERE id=?")
+          .bind(now, access.link.id),
+        env.DB.prepare("INSERT INTO delivery_events(delivery_id,link_id,kind,created_at) VALUES (?,?,'open',?)")
+          .bind(access.delivery.id, access.link.id, now),
+      ]);
+    }
+    return deliveryPage(context, access, token);
+  }
+
+  if (!access.authorized) return json({ ok: false, error: "Codice richiesto" }, 401);
+  /* Sonda del transfer in preparazione: la pagina la interroga da sola invece di chiedere
+     al cliente di ricaricare. Non tocca nessun contatore. */
+  if (seg[1] === "state" && seg.length === 2) {
+    return json({ ok: true, ready: isReady(access) });
+  }
+  if (seg[1] === "images" && seg.length === 3) {
+    const pkg = access.packages.find(p => p.id === seg[2] && p.gallery_enabled);
+    if (!pkg) return json({ ok: false, error: "Pacchetto non disponibile" }, 404);
+    const after = Number(new URL(request.url).searchParams.get("after") ?? -1);
+    if (!Number.isSafeInteger(after) || after < -1) return json({ ok: false, error: "Cursore non valido" }, 400);
+    return json({ ok: true, ...(await publicImages(env, pkg, token, after)) });
+  }
+  if (seg[1] === "download" && seg.length === 4) {
+    return download(env, request, access, seg[2], seg[3]);
+  }
+  if (seg[1] === "image" && seg.length === 5) {
+    return image(env, request, access, seg[2], seg[3], Number(seg[4]));
+  }
+  if (seg[1] === "hero" && seg.length === 3) {
+    return hero(env, access, seg[2]);
+  }
+  return message(context, {
+    title: "File non trovato",
+    body: "Il file richiesto non appartiene a questa consegna.",
+  }, 404);
+}
+
+async function post({ request, env, params }) {
+  if (!env.DB || !env.DELIVERY_SECRET) return json({ ok: false, error: "Servizio non attivo" }, 503);
+  const seg = segments(params.path);
+  const token = seg[0] || "";
+  const action = seg[1] || "";
+  const access = await accessFor(env, request, token);
+  if (!access || access.expired) return json({ ok: false, error: "Link non valido o scaduto" }, 410);
+  const body = await request.json().catch(() => ({}));
+
+  if (action === "unlock") return unlock(env, request, token, access, body);
+  if (action === "ticket") {
+    if (!access.authorized) return json({ ok: false, error: "Codice richiesto" }, 401);
+    if (access.filesExpired) {
+      return json({ ok: false, error: "I file di questa consegna sono scaduti" }, 410);
+    }
+    const packageId = String(body.packageId || "");
+    const variant = body.variant === "web" ? "web" : "originals";
+    const pkg = access.packages.find((p) => p.id === packageId);
+    if (!pkg || (variant === "web" && !pkg.web_key) ||
+        (variant === "originals" && (!pkg.originals_key || access.delivery.status === "archived"))) {
+      return json({ ok: false, error: "Questo download non è più disponibile" }, 404);
+    }
+    const ticket = await signValue(env.DELIVERY_SECRET, {
+      kind: "download", linkId: access.link.id, deliveryId: access.delivery.id,
+      packageId, variant,
+    }, 300);
+    const now = new Date().toISOString();
+    await env.DB.batch([
+      env.DB.prepare("UPDATE delivery_links SET download_count=download_count+1,last_download_at=? WHERE id=?")
+        .bind(now, access.link.id),
+      env.DB.prepare(`
+        INSERT INTO delivery_events(delivery_id,link_id,package_id,kind,variant,created_at)
+        VALUES (?,?,?,'download_started',?,?)
+      `).bind(access.delivery.id, access.link.id, packageId, variant, now),
+    ]);
+    return json({
+      ok: true,
+      url: `/c/${encodeURIComponent(token)}/download/${encodeURIComponent(packageId)}/${variant}?ticket=${encodeURIComponent(ticket)}`,
+    });
+  }
+  return json({ ok: false, error: "Operazione non valida" }, 400);
+}
+
+async function unlock(env, request, token, access, body) {
+  if (!access.link.pin_ciphertext) return json({ ok: true });
+  const ip = request.headers.get("CF-Connecting-IP") || "";
+  const ipHash = await sha256(`${ip}|${env.DELIVERY_SECRET}`);
+  const now = Date.now();
+  await env.DB.prepare("DELETE FROM delivery_pin_throttle WHERE seen_at<?").bind(now - DAY).run();
+  const attempts = await env.DB.prepare(
+    "SELECT COUNT(*) n FROM delivery_pin_throttle WHERE link_id=? AND ip_hash=? AND seen_at>?"
+  ).bind(access.link.id, ipHash, now - HOUR).first();
+  if (Number(attempts?.n || 0) >= 10) {
+    return json({ ok: false, error: "Troppi tentativi. Riprova fra un’ora." }, 429);
+  }
+  await env.DB.prepare("INSERT INTO delivery_pin_throttle(link_id,ip_hash,seen_at) VALUES (?,?,?)")
+    .bind(access.link.id, ipHash, now).run();
+  const expected = await unseal(env.DELIVERY_SECRET, access.link.pin_ciphertext);
+  if (!safeEqual(normalizePin(body.pin), normalizePin(expected))) {
+    return json({ ok: false, error: "Codice non corretto." }, 401);
+  }
+  const maxAge = Math.max(60, Math.min(6 * 3600, expirySeconds(access)));
+  const cookie = await signValue(env.DELIVERY_SECRET, {
+    kind: "delivery-session", linkId: access.link.id, deliveryId: access.delivery.id,
+  }, maxAge);
+  return new Response(JSON.stringify({ ok: true }), {
+    headers: {
+      "Content-Type": "application/json", "Cache-Control": "no-store",
+      "Set-Cookie": `${COOKIE}=${encodeURIComponent(cookie)}; Path=/c/${encodeURIComponent(token)}; ` +
+        `Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`,
+    },
+  });
+}
+
+async function accessFor(env, request, token) {
+  const tokenHash = await sha256(token);
+  const lookup = env.DB.prepare(`
+    SELECT
+      l.id link_id,l.delivery_id,l.pin_ciphertext,l.expires_at link_expires,l.revoked_at,
+      d.client_name,d.title,d.description,d.license_notes,d.cta_enabled,d.cta_label,d.cta_url,
+      d.expires_at delivery_expires,d.files_expires_at,d.status,d.hero_json
+      ${env.DELIVERY_DOWNLOAD_LABELS === "true" ? ",d.download_originals_label,d.download_web_label" : ""}
+    FROM delivery_links l JOIN deliveries d ON d.id=l.delivery_id
+    WHERE l.token_hash=? AND l.revoked_at IS NULL AND d.status IN ('uploading','active','archived')
+  `);
+  let row = await lookup.bind(tokenHash).first();
+  if (!row && env.DELIVERY_LINK_ALIASES === "true") {
+    const alias = await env.DB.prepare(`
+      SELECT l.token_hash FROM delivery_link_aliases a
+      JOIN delivery_links l ON l.id=a.link_id WHERE a.token_hash=?
+    `).bind(tokenHash).first();
+    if (alias) row = await lookup.bind(alias.token_hash).first();
+  }
+  if (!row) return null;
+  const expiry = earliest(row.link_expires, row.delivery_expires);
+  const expired = !!expiry && new Date(expiry).getTime() < Date.now();
+  const packagesResult = await env.DB.prepare(`
+    SELECT * FROM delivery_packages WHERE delivery_id=? AND state='ready' ORDER BY position
+  `).bind(row.delivery_id).all();
+  let authorized = !row.pin_ciphertext;
+  if (!authorized) {
+    const cookie = getCookie(request, COOKIE);
+    const session = await verifyValue(env.DELIVERY_SECRET, cookie);
+    authorized = session?.kind === "delivery-session" &&
+      session.linkId === row.link_id && session.deliveryId === row.delivery_id;
+  }
+  const filesExpired = !!row.files_expires_at &&
+    new Date(row.files_expires_at).getTime() <= Date.now();
+  const packages = (filesExpired ? [] : (packagesResult.results || [])).map((p) => ({
+    ...p,
+  }));
+  return {
+    expired, expiry, authorized,
+    link: {
+      id: row.link_id, delivery_id: row.delivery_id,
+      pin_ciphertext: row.pin_ciphertext, expires_at: row.link_expires,
+    },
+    delivery: {
+      id: row.delivery_id, clientName: row.client_name, title: row.title,
+      description: row.description || "", licenseNotes: row.license_notes || "",
+      ctaEnabled: !!row.cta_enabled, ctaLabel: row.cta_label || "",
+      downloadOriginalsLabel: row.download_originals_label || "Scarica i file",
+      downloadWebLabel: row.download_web_label || "Versione leggera",
+      ctaUrl: row.cta_url || "", expiresAt: row.delivery_expires,
+      filesExpiresAt: row.files_expires_at, status: row.status,
+    },
+    packages,
+    filesExpired,
+    protectedLink: !!row.pin_ciphertext,
+    heroes: await resolveHeroes(env, filesExpired ? "[]" : row.hero_json, packages),
+  };
+}
+
+/* ---- la pagina ---------------------------------------------------------------------- */
+
+async function publicImages(env, pkg, token, after = -1) {
+  const page = await readManifestPage(env, pkg, after);
+  return { images: page.entries.filter(row => row.entry.thumb).map(({ entry, index }) => ({
+    name: entry.name, width: entry.width, height: entry.height,
+    thumb: `/c/${encodeURIComponent(token)}/image/${encodeURIComponent(pkg.id)}/thumb/${index}`,
+    display: `/c/${encodeURIComponent(token)}/image/${encodeURIComponent(pkg.id)}/web/${index}`,
+    download: `/c/${encodeURIComponent(token)}/image/${encodeURIComponent(pkg.id)}/web/${index}?download=1`,
+  })), nextCursor: page.nextCursor };
+}
+
+async function deliveryPage(context, access, token) {
+  const d = access.delivery;
+  const locked = !access.authorized;
+  const preparing = d.status === "uploading";
+  const heroes = access.heroes.map((item) => item.kind === "media"
+    ? item.url
+    : item.kind === "object"
+      ? `/c/${encodeURIComponent(token)}/hero/${encodeURIComponent(item.id)}`
+      : `/c/${encodeURIComponent(token)}/image/${encodeURIComponent(item.packageId)}/web/${item.index}`);
+
+  const data = locked ? {
+    state: "locked",
+    preparing, archived: false, filesExpired: access.filesExpired,
+    intro: "", notes: "", final: null,
+    expiry: { filesAt: d.filesExpiresAt || null, linkAt: access.expiry || null },
+    heroes: [], packages: [],
+  } : {
+    state: "ready",
+    preparing,
+    archived: d.status === "archived",
+    filesExpired: access.filesExpired,
+    intro: d.description,
+    notes: d.licenseNotes,
+    final: d.ctaEnabled && d.ctaUrl ? { label: d.ctaLabel, url: d.ctaUrl } : null,
+    expiry: { filesAt: d.filesExpiresAt || null, linkAt: access.expiry || null },
+    heroes,
+    downloadLabels: { originals: d.downloadOriginalsLabel, web: d.downloadWebLabel },
+    packages: await Promise.all(access.packages.map(async (p) => ({
+      id: p.id,
+      label: p.label,
+      fileCount: Number(p.file_count || 0),
+      bytes: Number(p.source_bytes || 0),
+      originals: d.status !== "archived" && !!p.originals_key,
+      light: !!p.web_enabled && !!p.web_key,
+      ...(p.gallery_enabled ? await publicImages(context.env, p, token) : { images: [], nextCursor: null }),
+    }))),
+  };
+
+  const name = d.clientName || d.title;
+  const work = d.clientName ? d.title : "";
+  /* L'anteprima del link (WhatsApp, iMessage) porta il nome del lavoro sempre, la FOTO solo
+     se la consegna non è protetta: un'immagine nei metadati la vede chiunque riceva o
+     inoltri il link, e i server che generano l'anteprima, senza passare dal codice. */
+  const ogImage = !access.protectedLink && heroes.length
+    ? new URL(heroes[0], context.request.url).toString() : "";
+
+  return shellResponse(context, {
+    DC_TITLE: [name, work].filter(Boolean).join(" – ") + " — " + (context.env.DELIVERY_BRAND || "Transfer"),
+    DC_DESC: locked
+      ? "Consegna file protetta da un codice di accesso."
+      : (d.clientName ? `File per ${d.clientName}` : "Consegna file"),
+    DC_IMAGE: ogImage,
+    DC_EYEBROW: "Consegna file",
+    DC_CLIENT: name,
+    DC_WORK: work,
+  }, data, 200);
+}
+
+async function message(context, { title, body, eyebrow }, status) {
+  return shellResponse(context, {
+    DC_TITLE: `${title} — ${context.env.DELIVERY_BRAND || "Transfer"}`,
+    DC_DESC: body,
+    DC_IMAGE: "",
+    DC_EYEBROW: "",
+    DC_CLIENT: "",
+    DC_WORK: "",
+  }, {
+    state: "message",
+    message: { eyebrow: eyebrow || "Consegna file", title, body },
+  }, status);
+}
+
+async function shellResponse(context, values, data, status) {
+  const shell = await shellHtml(context);
+  const encoded = JSON.stringify(data).replace(/</g, "\\u003c");
+  const script = `<script id="dc-data" type="application/json">${encoded}</script>`;
+  const html = shell
+    ? fill(shell, { ...values, DC_DATA: script })
+    : bareShell(values, script);
+  return new Response(html, { status, headers: securityHeaders("text/html; charset=utf-8") });
+}
+
+async function shellHtml({ env, request }) {
+  if (shellCache) return shellCache;
+  const url = new URL(SHELL, request.url).toString();
+  let response = null;
+  try {
+    if (env.ASSETS?.fetch) response = await env.ASSETS.fetch(new Request(url));
+    if (!env.ASSETS?.fetch) response = await fetch(url);
+  } catch (e) {
+    console.error("delivery shell:", e);
+    return null;
+  }
+  if (!response?.ok) return null;
+  const text = await response.text();
+  if (!text.includes("%DC_DATA%")) return null;
+  shellCache = text;
+  return shellCache;
+}
+
+/* Sostituzione in UN passaggio solo: ciò che viene inserito non viene riletto, quindi un
+   nome cliente che contenesse `%DC_...%` non può innescare una seconda sostituzione.
+   Senza immagine social, i due <meta> che la portano vengono tolti interi — li si trova
+   dal segnaposto, così non serve sapere come il minificatore ha virgolettato gli attributi. */
+function fill(shell, values) {
+  const html = values.DC_IMAGE ? shell : shell.replace(/<meta[^>]*%DC_IMAGE%[^>]*>/g, "");
+  return html.replace(/%DC_([A-Z_]+)%/g, (whole, key) => {
+    const value = values[`DC_${key}`];
+    if (value === undefined) return "";
+    return key === "DATA" ? value : escapeHtml(value);
+  });
+}
+
+/* Ripiego se il guscio non è raggiungibile (deploy a metà, asset mancante): la pagina resta
+   leggibile e i download funzionano, ma senza monogramma né menu. */
+function bareShell(values, script) {
+  return `<!doctype html><html lang="it"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="robots" content="noindex,nofollow,noarchive">
+<title>${escapeHtml(values.DC_TITLE)}</title>
+<link rel="stylesheet" href="/css/delivery.css">
+</head><body class="is-delivery"><main>
+<div class="dc" data-dc hidden><div class="dc-info">
+<p class="dc-eyebrow">${escapeHtml(values.DC_EYEBROW)}</p>
+<h1 class="dc-client">${escapeHtml(values.DC_CLIENT)}</h1>
+<p class="dc-work">${escapeHtml(values.DC_WORK)}</p>
+<p class="dc-intro" data-dc-intro hidden></p>
+<div class="dc-notice" data-dc-notice role="status" hidden></div>
+<form class="dc-gate" data-dc-gate hidden><label class="dc-label" for="dc-pin">Codice di accesso</label>
+<div class="dc-gate-row"><input class="dc-gate-input" id="dc-pin" name="pin" type="text"
+autocomplete="one-time-code" autocapitalize="characters" spellcheck="false" readonly>
+<button class="dc-btn dc-btn-solid" type="submit">Entra</button></div>
+<p class="dc-error" data-dc-gate-error role="alert" hidden></p></form>
+<div class="dc-downloads" data-dc-downloads hidden></div>
+<p class="dc-expiry" data-dc-expiry hidden></p>
+</div><div class="dc-stage" data-dc-stage aria-hidden="true"></div></div>
+<section class="dc-gallery" data-dc-gallery hidden><p class="dc-label">Le fotografie</p>
+<div class="dc-grid" data-dc-grid></div></section>
+<section class="dc-close" data-dc-close hidden><div class="dc-notes" data-dc-notes hidden>
+<p class="dc-label">Utilizzo</p><div class="dc-notes-body" data-dc-notes-body></div></div>
+<a class="dc-btn dc-btn-line" data-dc-final target="_blank" rel="noopener noreferrer" hidden></a></section>
+<section class="dc-msg" data-dc-msg hidden><p class="dc-eyebrow" data-dc-msg-eyebrow></p>
+<h1 data-dc-msg-title></h1><p class="dc-msg-body" data-dc-msg-body></p>
+<a class="dc-btn dc-btn-line" href="/">Torna alla pagina iniziale</a></section>
+</main>
+<script src="/js/delivery/client.js" defer></script>
+<script src="/js/delivery/stage.js" defer></script>
+<script src="/js/delivery/gallery.js" defer></script>
+${script}
+</body></html>`;
+}
+
+/* ---- file ----------------------------------------------------------------------------- */
+
+async function download(env, request, access, packageId, variant) {
+  const ticket = await verifyValue(env.DELIVERY_SECRET, new URL(request.url).searchParams.get("ticket") || "");
+  if (!ticket || ticket.kind !== "download" || ticket.linkId !== access.link.id ||
+      ticket.deliveryId !== access.delivery.id || ticket.packageId !== packageId ||
+      ticket.variant !== variant) {
+    return new Response("Download non autorizzato", { status: 401, headers: securityHeaders("text/plain; charset=utf-8") });
+  }
+  const pkg = access.packages.find((p) => p.id === packageId);
+  const key = variant === "web" ? pkg?.web_key : pkg?.originals_key;
+  if (!pkg || !key) {
+    return new Response("Non disponibile", { status: 404, headers: securityHeaders("text/plain; charset=utf-8") });
+  }
+  const filename = `${safeFilename(pkg.label)}${variant === "web" ? "-web" : ""}.zip`;
+  const direct = await b2PresignGetObject(env, key, {
+    contentDisposition: disposition(filename),
+    contentType: "application/zip",
+    expires: directDownloadSeconds(access),
+  });
+  return new Response(null, {
+    status: 302,
+    headers: {
+      "Location": direct,
+      "Cache-Control": "private, no-store",
+      "Referrer-Policy": "no-referrer",
+      "X-Robots-Tag": "noindex, nofollow, noarchive",
+    },
+  });
+}
+
+async function image(env, request, access, packageId, variant, index) {
+  const pkg = access.packages.find((p) => p.id === packageId);
+  const entry = pkg ? await readManifestEntry(env, pkg, index) : null;
+  if (!["thumb", "web", "original"].includes(variant) || (variant === "original" && access.delivery.status === "archived")) return new Response("Not found", { status: 404 });
+  const member = variant === "thumb" ? entry?.thumb : variant === "web" ? entry?.web : entry?.original;
+  const key = variant === "thumb" ? pkg?.thumbs_key : variant === "web" ? pkg?.web_key : pkg?.originals_key;
+  if (!pkg || !entry || !member || !key) return new Response("Not found", { status: 404 });
+  if (member.length === 0) return new Response(null, { headers: { "Content-Length": "0", "Cache-Control": "private, no-store" } });
+  const upstream = await b2Get(env, key, `bytes=${member.offset}-${member.offset + member.length - 1}`);
+  if (upstream.ok && (upstream.status !== 206 || upstream.headers.get("Content-Range")?.split("/")[0] !== `bytes ${member.offset}-${member.offset + member.length - 1}` || Number(upstream.headers.get("Content-Length")) !== member.length)) {
+    await upstream.body?.cancel();
+    return new Response("Risposta archivio non valida", { status: 502 });
+  }
+  if (!upstream.ok) return new Response("Not found", { status: upstream.status });
+  const headers = new Headers({
+    "Content-Type": variant === "original" ? (entry.type || "application/octet-stream") : variant === "web" && pkg.web_format === "jpg" ? "image/jpeg" : "image/webp",
+    "Content-Length": String(member.length),
+    "Cache-Control": "private, max-age=86400",
+    "X-Content-Type-Options": "nosniff",
+  });
+  if (new URL(request.url).searchParams.get("download") === "1") {
+    const name = variant === "original" ? entry.name.split("/").pop() : entry.name.replace(/\.[^.]+$/, "") + (variant === "web" && pkg.web_format === "jpg" ? ".jpg" : ".webp");
+    headers.set("Content-Disposition", disposition(name));
+  }
+  return new Response(upstream.body, { status: 200, headers });
+}
+
+async function hero(env, access, id) {
+  const selected = access.heroes.find((item) => item.kind === "object" && item.id === id);
+  if (!selected) return new Response("Not found", { status: 404 });
+  const upstream = await b2Get(env, selected.objectKey);
+  if (!upstream.ok) return new Response("Not found", { status: upstream.status });
+  const headers = new Headers({
+    "Content-Type": "image/webp",
+    "Cache-Control": "private, max-age=86400",
+    "X-Content-Type-Options": "nosniff",
+  });
+  const length = upstream.headers.get("content-length") || (selected.bytes ? String(selected.bytes) : "");
+  if (length) headers.set("Content-Length", length);
+  return new Response(upstream.body, { headers });
+}
+
+async function resolveHeroes(env, value, packages) {
+  const out = [];
+  for (const ref of parseArray(value).slice(0, 8)) {
+    if (ref?.type === "package") {
+      const pkg = packages.find((item) => item.id === String(ref.packageId || ""));
+      const index = Number(ref.index);
+      if (pkg && (await readManifestEntry(env, pkg, index))?.web && pkg.web_key) {
+        out.push({ kind: "package", packageId: pkg.id, index });
+      }
+    } else if (ref?.type === "object") {
+      const row = await env.DB.prepare(`
+        SELECT id,object_key,bytes FROM delivery_hero_objects
+        WHERE id=? AND state='ready'
+      `).bind(String(ref.id || "")).first();
+      if (row) out.push({
+        kind: "object", id: row.id, objectKey: row.object_key, bytes: Number(row.bytes || 0),
+      });
+    }
+  }
+  if (out.length) return out;
+  const setting = await env.DB.prepare(
+    "SELECT value_json FROM delivery_settings WHERE key='default_heroes'"
+  ).first();
+  return parseArray(setting?.value_json).filter((url) =>
+    typeof url === "string" && /^\/media\/[^?#]+$/.test(url)
+  ).slice(0, 8).map((url) => ({ kind: "media", url }));
+}
+
+async function purgeExpiredBytes(env, deliveryId) {
+  const now = new Date().toISOString();
+  await env.DB.batch([
+    env.DB.prepare(`
+      UPDATE delivery_packages SET state='deleted',deleted_at=?,purge_after=?,updated_at=?
+      WHERE delivery_id=? AND state!='deleted' AND EXISTS(SELECT 1 FROM deliveries WHERE id=delivery_id AND files_expires_at<=?)
+    `).bind(now, now, now, deliveryId, now),
+    env.DB.prepare(`
+      UPDATE delivery_hero_objects SET state='deleted',purge_after=?,updated_at=?
+      WHERE delivery_id=? AND state!='deleted' AND EXISTS(SELECT 1 FROM deliveries WHERE id=delivery_id AND files_expires_at<=?)
+    `).bind(now, now, deliveryId, now),
+  ]);
+  await purgeDeliveryNow(env, deliveryId);
+}
+
+/* ---- utilità -------------------------------------------------------------------------- */
+
+function securityHeaders(contentType) {
+  return {
+    "Content-Type": contentType,
+    "Cache-Control": "private, no-store",
+    "X-Robots-Tag": "noindex, nofollow, noarchive",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+    /* `style-src` ammette anche l'inline: il monogramma condiviso porta `style="--i:N"`
+       su ogni lettera e su ogni voce del menu (è l'indice dello stagger), e senza questo
+       il menu del sito qui si comporterebbe diversamente che altrove. Quella che conta —
+       `script-src 'self'` — resta stretta: in pagina non c'è un solo script inline. */
+    "Content-Security-Policy": "default-src 'self'; img-src 'self' data: blob:; " +
+      "style-src 'self' 'unsafe-inline'; script-src 'self'; base-uri 'none'; " +
+      "frame-ancestors 'none'; form-action 'self'",
+  };
+}
+
+function isReady(access) {
+  return access.delivery.status !== "uploading" && access.packages.length > 0;
+}
+
+/* Un browser vero manda `Sec-Fetch-Mode: navigate` quando apre una pagina; i generatori di
+   anteprima dei link non mandano gli header Sec-Fetch- del tutto. Chi non li manda passa
+   solo se non si dichiara robot. */
+function looksHuman(request) {
+  const mode = request.headers.get("Sec-Fetch-Mode");
+  if (mode) return mode === "navigate";
+  const agent = request.headers.get("User-Agent") || "";
+  if (!agent) return false;
+  return !/bot|crawl|spider|preview|facebookexternalhit|whatsapp|telegram|slack|discord|twitter|linkedin|embed|curl|wget|python|node-fetch|go-http|okhttp|headless|monitor/i.test(agent);
+}
+
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status, headers: { ...securityHeaders("application/json"), "Cache-Control": "no-store" },
+  });
+}
+function segments(value) {
+  return (Array.isArray(value) ? value : String(value || "").split("/")).filter(Boolean).map(decodeURIComponent);
+}
+function parseManifest(value) {
+  try { return JSON.parse(value || "{}"); } catch { return { entries: [] }; }
+}
+function parseArray(value) {
+  try {
+    const parsed = JSON.parse(value || "[]");
+    return Array.isArray(parsed) ? parsed : [];
+  } catch { return []; }
+}
+function earliest(a, b) {
+  if (!a) return b || null;
+  if (!b) return a;
+  return new Date(a) < new Date(b) ? a : b;
+}
+function expirySeconds(access) {
+  if (!access.expiry) return 6 * 3600;
+  return Math.floor((new Date(access.expiry).getTime() - Date.now()) / 1000);
+}
+function directDownloadSeconds(access) {
+  if (!access.expiry) return 24 * 3600;
+  return Math.max(60, Math.min(24 * 3600, expirySeconds(access)));
+}
+function getCookie(request, name) {
+  for (const part of (request.headers.get("Cookie") || "").split(/;\s*/)) {
+    const at = part.indexOf("=");
+    if (at > 0 && part.slice(0, at) === name) return decodeURIComponent(part.slice(at + 1));
+  }
+  return "";
+}
+function normalizePin(value) { return String(value || "").toUpperCase().replace(/[\s-]+/g, ""); }
+function safeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let n = 0;
+  for (let i = 0; i < a.length; i++) n |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return n === 0;
+}
+function disposition(name) {
+  const safe = String(name).replace(/["\\\r\n]/g, "_");
+  return `attachment; filename="${safe}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+function safeFilename(value) {
+  return String(value || "file").normalize("NFKD").replace(/[^a-zA-Z0-9._-]+/g, "-")
+    .replace(/^-+|-+$/g, "") || "file";
+}
+function escapeHtml(value) {
+  return String(value ?? "").replace(/[&<>"']/g, (c) => ({
+    "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;",
+  })[c]);
+}