@materializecms/server 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -4,6 +4,22 @@ Ogni versione, dalla più recente. Le novità in arrivo si scrivono sotto «Pros
 
 ## Prossima versione
 
+## 0.3.0 — 2026-11-01
+
+- **Backup fuori dal server**, ogni notte e cifrati, su uno spazio S3 compatibile (Cloudflare R2, Backblaze B2, Hetzner, Amazon S3…) o in una cartella WebDAV (Nextcloud, NAS Synology e QNAP…). Si attiva in Impostazioni → Backup; `materialize decrypt` rende di nuovo leggibili i file scaricati.
+- **Email più facile da configurare**: si sceglie il fornitore (Brevo, Postmark, Mailgun, Amazon SES, Gmail…) e il server si compila da solo; se la prova non riesce, il pannello spiega perché (porta bloccata, password rifiutata, mittente non verificato…); **Controlla il dominio** verifica SPF, DKIM e DMARC.
+- **Pannello più chiaro**: Impostazioni → Protezione divisa in Sicurezza, Backup e Registro attività; barra dell'editor a gruppi, con gli elementi meno usati in **⋯**; pannello sinistro dell'editor allargabile; menu a tendina, intestazioni e testi d'aiuto uniformi e più leggibili; pagina dedicata per gli indirizzi del pannello che non esistono; in Persone, chi entra con la sola password si riconosce a colpo d'occhio; accesso e installazione con l'aspetto del pannello.
+- **Chi ha fatto ogni versione**: la cronologia mostra il nome dell'autore accanto alla data.
+- **Informazioni su Materialize** in Impostazioni: versione, autore, licenza, novità, guida e licenze di terzi.
+
+## 0.2.0 — 2026-11-01
+
+- **Password dimenticata?** nella pagina di accesso: un link per email, valido un'ora. Senza email configurata, il comando `materialize reset-password` stampa il link sul server, anche per l'unico amministratore.
+- **Cronologia per le pagine sulla tela**: ogni versione si guarda su desktop, tablet e mobile prima di ripristinarla.
+- **Esporta la pagina in PDF o PNG** dall'editor, per mandarla al cliente: desktop, tablet e mobile, ognuno come un'unica immagine lunga.
+- **Guida per chi usa Materialize**, in `docs/guida`: installazione, editor, contenuti, lingue, SEO, persone, aggiornamenti, backup e problemi comuni.
+- **Sicurezza**: i link degli inviti e delle nuove password puntano sempre all'indirizzo pubblico del sito, mai a quello dichiarato da chi fa la richiesta. Consigliato aggiornare.
+
 ## 0.1.0 — 2026-10-31
 
 La prima versione pubblica.

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Cristiano Casazza
+Copyright (c) 2026 Cristiano Casazza Consulting
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@materializecms/server",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Il server di Materialize: API, accessi, media, backup, aggiornamenti dal pannello e server MCP.",
   "type": "module",
   "license": "MIT",
@@ -20,9 +20,9 @@
   "dependencies": {
     "@anthropic-ai/sdk": "1.3.0",
     "@hono/node-server": "2.1.5",
-    "@materializecms/admin": "0.1.0",
-    "@materializecms/core": "0.1.0",
-    "@materializecms/db": "0.1.0",
+    "@materializecms/admin": "0.3.0",
+    "@materializecms/core": "0.3.0",
+    "@materializecms/db": "0.3.0",
     "@modelcontextprotocol/sdk": "1.32.2",
     "hono": "4.13.14",
     "htmlparser2": "12.0.0",

package/src/app.js

@@ -8,6 +8,7 @@ import { Readable } from 'node:stream';
 import { getConnInfo } from '@hono/node-server/conninfo';
 import { describeCollection, prepare, SLUG_PATTERN, slugify, titleOf, validate, } from '@materializecms/core';
 import { documentSlots, isLocaleCode, mergeTranslation, nodeSlots, untranslatedIds, withLocales, } from '@materializecms/core/i18n';
+import { senderDomain } from '@materializecms/core/mail';
 import { normalizeTheme, sameDesign } from '@materializecms/core/page';
 import { addMove, normalizePath } from '@materializecms/core/seo';
 import { TRACKING_PATTERNS, trackingBlocks } from '@materializecms/core/tracking';
@@ -27,9 +28,10 @@ import { AiError, complete, EMPTY_AI, isReady, publicAi, runTurn, translateTexts
 import { folderEntries, tarGz } from './archive.js';
 import { createBackups, DEFAULT_BACKUPS } from './backups.js';
 import { createFonts, FONT_FILE, FONT_ID } from './fonts.js';
-import { isConfigured, publicMail, sendMail, submissionText } from './mail.js';
+import { checkSenderDomain, explainMailError, isConfigured, publicMail, sendMail, submissionText, } from './mail.js';
 import { createMcpServer } from './mcp.js';
 import { createMediaFiles, fileBody, MAX_UPLOAD, MediaError, mediaUrl } from './media.js';
+import { DEFAULT_OFFSITE, newRecoveryKey, runOffsite, testOffsite, } from './offsite.js';
 import { hashPassword, verifyPassword } from './password.js';
 import { fetchPublicFile, RemoteError, remoteFetch } from './remote.js';
 import { statusPage } from './status-page.js';
@@ -52,6 +54,11 @@ const CHALLENGE_TTL = 5 * 60 * 1000;
 const dummyHash = hashPassword(randomBytes(16).toString('hex'));
 const INVITE_TTL = 7 * 24 * 60 * 60 * 1000;
 const RESET_TTL = 24 * 60 * 60 * 1000;
+/** A link asked for from the sign-in page: shorter, since nobody vouched for the request. */
+const FORGOT_TTL = 60 * 60 * 1000;
+/** Links asked for per email, and per address, before a pause: no one is flooded with emails. */
+const FORGOT_THRESHOLD = 3;
+const FORGOT_IP_THRESHOLD = 10;
 /** Where people open their one-time link: the admin's welcome screen. */
 const linkPath = (token) => `/admin/_invite/${token}`;
 /** The custom code blocks in a document: it runs on the public site, so only admins may change it. */
@@ -198,8 +205,61 @@ export function createApp(base) {
         });
     };
     const backupFailed = (error) => console.error('Materialize: backup not made', error);
-    setTimeout(() => void autoBackup().catch(backupFailed), 60_000).unref?.();
-    setInterval(() => void autoBackup().catch(backupFailed), 60 * 60_000).unref?.();
+    // ---------- the copy outside the server (S3, WebDAV) ----------
+    const offsiteSettings = async () => ({
+        ...DEFAULT_OFFSITE,
+        ...(await settings.get('offsite')),
+    });
+    let offsiteRunning = false;
+    /** One run; the outcome is kept, and administrators hear by email the first time it fails. */
+    const offsiteRun = async (fresh) => {
+        if (offsiteRunning)
+            throw new ApiError(409, 'offsite_running', 'A copy is already being made');
+        offsiteRunning = true;
+        const before = await settings.get('offsite-status');
+        let status;
+        try {
+            status = await runOffsite(await offsiteSettings(), backups, ctx.config().media.dir, fresh);
+        }
+        catch (error) {
+            status = { at: new Date().toISOString(), ok: false, message: error.message };
+            if (before?.ok !== false)
+                for (const admin of (await auth.listUsers()).filter((u) => u.role === 'admin'))
+                    await mailNotice(admin.email, 'Backup fuori dal server non riuscito', [
+                        `La copia dei backup di ${ctx.config().site.name} fuori dal server non è riuscita: ${status.message}`,
+                        'Controlla in Impostazioni → Sicurezza → Backup. Ti scriviamo di nuovo solo quando torna a funzionare e si ferma di nuovo.',
+                    ]);
+        }
+        finally {
+            offsiteRunning = false;
+        }
+        await settings.set('offsite-status', status);
+        await activityLog.record({
+            userId: null,
+            userName: '',
+            action: status.ok ? 'backup.offsite' : 'backup.offsite_failed',
+            target: status.database ?? '',
+            detail: status.ok ? { media: status.media, fonts: status.fonts } : { message: status.message },
+            ip: null,
+        });
+        return status;
+    };
+    /** After the daily copy: once a day, unless the last run failed (then every hour until it works). */
+    const autoOffsite = async () => {
+        const s = await offsiteSettings();
+        if (s.kind === 'off' || !s.key || offsiteRunning)
+            return;
+        const last = await settings.get('offsite-status');
+        if (last?.ok && Date.now() - new Date(last.at).getTime() < 23 * 60 * 60_000)
+            return;
+        await offsiteRun(false);
+    };
+    const nightly = async () => {
+        await autoBackup().catch(backupFailed);
+        await autoOffsite().catch((error) => console.error('Materialize: offsite copy not made', error));
+    };
+    setTimeout(() => void nightly(), 60_000).unref?.();
+    setInterval(() => void nightly(), 60 * 60_000).unref?.();
     const updateSettings = async () => ({
         ...DEFAULT_UPDATES,
         ...(await settings.get('updates')),
@@ -643,6 +703,40 @@ export function createApp(base) {
         const { passwordHash: _, ...user } = found;
         return signIn(c, user);
     });
+    /** For the sign-in page: whether "Password dimenticata?" can send an email, or someone has to help. */
+    app.get('/api/auth/recovery', async (c) => c.json({ mail: isConfigured(await settings.get('mail')) }));
+    /**
+     * A forgotten password: a one-time link by email, valid an hour. The answer is the same whether
+     * the email has an account or not, so nobody can learn who is registered; requests per email and
+     * per address are limited, so nobody can flood an inbox.
+     */
+    app.post('/api/auth/forgot', async (c) => {
+        const input = await body(c, z.object({ email: z.email() }));
+        const email = input.email.trim().toLowerCase();
+        const ip = clientIp(c);
+        await checkLocks(`forgot:${email}`, `forgot-ip:${ip}`);
+        await auth.recordFailure(`forgot:${email}`, FORGOT_THRESHOLD);
+        await auth.recordFailure(`forgot-ip:${ip}`, FORGOT_IP_THRESHOLD);
+        const mail = isConfigured(await settings.get('mail'));
+        const found = mail ? await auth.findForLogin(email) : null;
+        if (found) {
+            const { token } = await auth.createInvite({
+                kind: 'reset',
+                email: found.email,
+                name: found.name,
+                role: found.role,
+                userId: found.id,
+                ttlMs: FORGOT_TTL,
+            });
+            await mailLink(c, found.email, 'Nuova password', [
+                `Qualcuno ha chiesto una nuova password per il tuo account su ${ctx.config().site.name}.`,
+                'Se non sei stato tu, ignora questa email: la password resta quella di prima.',
+                'Per sceglierne una nuova, apri questo link entro un’ora:',
+            ], linkPath(token));
+            await record(c, 'password.forgot', found.email, null, { id: found.id, name: found.name });
+        }
+        return c.json({ ok: true, mail });
+    });
     /** The second step: a code from the app, or a recovery code. */
     app.post('/api/auth/login/verify', async (c) => {
         const input = await body(c, z.object({ ticket: z.string().min(1).max(100), code: z.string().trim().min(6).max(20) }));
@@ -770,7 +864,7 @@ export function createApp(base) {
     app.get('/api/security', requireUser, requireAdmin, async (c) => c.json({ requireTwoFactor: await twoFactorRequired() }));
     /** Groups of the activity log, by the start of their action codes. */
     const ACTIVITY_GROUPS = {
-        access: ['login.', 'logout', 'session.', 'twofactor.', 'token.', 'security.'],
+        access: ['login.', 'logout', 'session.', 'twofactor.', 'token.', 'security.', 'password.'],
         people: ['user.'],
         content: ['document.', 'media.', 'message.'],
         settings: ['settings.', 'backup.', 'update.'],
@@ -941,7 +1035,35 @@ export function createApp(base) {
                         id: 'backups',
                         status: 'ok',
                         title: 'Backup del database ogni giorno',
-                        detail: `Ultima copia ${new Intl.RelativeTimeFormat('it', { numeric: 'auto' }).format(-Math.round(age / 3_600_000), 'hour')}, immagini comprese; ne restano ${b.keep}. Per una copia fuori dal server, scarica l’archivio completo.`,
+                        detail: `Ultima copia ${new Intl.RelativeTimeFormat('it', { numeric: 'auto' }).format(-Math.round(age / 3_600_000), 'hour')}, immagini comprese; ne restano ${b.keep}.`,
+                    });
+        }
+        {
+            const o = await offsiteSettings();
+            const status = await settings.get('offsite-status');
+            checks.push(o.kind === 'off' || !o.key
+                ? {
+                    id: 'offsite',
+                    status: 'warn',
+                    title: 'I backup restano sul server',
+                    detail: 'Se il server si rompe, si perdono anche le copie. Attiva la copia fuori dal server (S3 o WebDAV), oppure scarica ogni tanto l’archivio completo.',
+                    action: 'backups',
+                }
+                : status && !status.ok
+                    ? {
+                        id: 'offsite',
+                        status: 'bad',
+                        title: 'La copia fuori dal server non riesce',
+                        detail: status.message ?? 'Controlla il collegamento.',
+                        action: 'backups',
+                    }
+                    : {
+                        id: 'offsite',
+                        status: 'ok',
+                        title: 'Copia cifrata fuori dal server',
+                        detail: status
+                            ? `Ultima copia ${new Intl.RelativeTimeFormat('it', { numeric: 'auto' }).format(-Math.round((Date.now() - new Date(status.at).getTime()) / 3_600_000), 'hour')}, su ${o.kind === 's3' ? 'S3' : 'WebDAV'}.`
+                            : 'La prima copia parte entro un’ora.',
                     });
         }
         const tokens = await activityLog.tokens();
@@ -1008,6 +1130,100 @@ export function createApp(base) {
         await record(c, 'settings.backups', '', input);
         return c.json(await backupState());
     });
+    /** What the panel may see: no passwords, no secret key, no recovery key. */
+    const offsiteState = async () => {
+        const s = await offsiteSettings();
+        return {
+            kind: s.kind,
+            keep: s.keep,
+            hasKey: !!s.key,
+            s3: s.s3 ? { ...s.s3, secretAccessKey: '', hasSecret: !!s.s3.secretAccessKey } : undefined,
+            webdav: s.webdav ? { ...s.webdav, password: '', hasSecret: !!s.webdav.password } : undefined,
+            status: (await settings.get('offsite-status')) ?? null,
+            running: offsiteRunning,
+        };
+    };
+    const s3Input = z.object({
+        endpoint: z.url({ protocol: /^https?$/ }).max(300),
+        region: z.string().trim().max(60),
+        bucket: z.string().trim().min(1).max(200),
+        prefix: z.string().trim().max(200).optional(),
+        accessKeyId: z.string().trim().min(1).max(200),
+        // Empty: keep the saved one.
+        secretAccessKey: z.string().max(500),
+    });
+    const webdavInput = z.object({
+        url: z.url({ protocol: /^https?$/ }).max(500),
+        user: z.string().trim().max(200),
+        password: z.string().max(500),
+    });
+    const offsiteInput = z.object({
+        kind: z.enum(['off', 's3', 'webdav']),
+        keep: z.number().int().min(1).max(365),
+        s3: s3Input.optional(),
+        webdav: webdavInput.optional(),
+    });
+    /** The settings as sent, with the saved secrets where the panel left them empty. */
+    const withSecrets = (input, saved) => {
+        if (input.kind === 's3' && !input.s3)
+            throw new ApiError(400, 'missing_s3', 'S3 settings are missing');
+        if (input.kind === 'webdav' && !input.webdav)
+            throw new ApiError(400, 'missing_webdav', 'WebDAV settings are missing');
+        return {
+            kind: input.kind,
+            keep: input.keep,
+            key: saved.key,
+            s3: input.s3
+                ? { ...input.s3, secretAccessKey: input.s3.secretAccessKey || saved.s3?.secretAccessKey || '' }
+                : saved.s3,
+            webdav: input.webdav
+                ? { ...input.webdav, password: input.webdav.password || saved.webdav?.password || '' }
+                : saved.webdav,
+        };
+    };
+    app.get('/api/backups/offsite', requireUser, requireSession, requireAdmin, async (c) => c.json(await offsiteState()));
+    /** Saves where the copy goes; the first time, makes the recovery key and returns it, once. */
+    app.put('/api/backups/offsite', requireUser, requireSession, requireAdmin, async (c) => {
+        const next = withSecrets(await body(c, offsiteInput), await offsiteSettings());
+        let shown;
+        if (next.kind !== 'off' && !next.key)
+            next.key = shown = newRecoveryKey();
+        await settings.set('offsite', next, c.get('user').id);
+        await record(c, 'settings.offsite', next.kind);
+        return c.json({ ...(await offsiteState()), recoveryKey: shown });
+    });
+    app.post('/api/backups/offsite/test', requireUser, requireSession, requireAdmin, async (c) => {
+        try {
+            await testOffsite(withSecrets(await body(c, offsiteInput), await offsiteSettings()));
+            return c.json({ ok: true });
+        }
+        catch (error) {
+            if (error instanceof ApiError)
+                throw error;
+            return c.json({ ok: false, message: error.message });
+        }
+    });
+    /** "Esegui ora": a fresh copy of the database and whatever is missing, in the background. */
+    app.post('/api/backups/offsite/run', requireUser, requireSession, requireAdmin, async (c) => {
+        const s = await offsiteSettings();
+        if (s.kind === 'off' || !s.key)
+            throw new ApiError(409, 'offsite_off', 'The copy outside the server is off');
+        if (offsiteRunning)
+            throw new ApiError(409, 'offsite_running', 'A copy is already being made');
+        void offsiteRun(true).catch((error) => console.error('Materialize: offsite copy not made', error));
+        await record(c, 'backup.offsite_started');
+        return c.json(await offsiteState(), 202);
+    });
+    /** The recovery key again, for an administrator who confirms their password. */
+    app.post('/api/backups/offsite/key', requireUser, requireSession, requireAdmin, async (c) => {
+        const input = await body(c, z.object({ password: z.string().min(1).max(500) }));
+        await checkPassword(c.get('user').id, input.password);
+        const s = await offsiteSettings();
+        if (!s.key)
+            throw new ApiError(404, 'no_key', 'There is no recovery key yet');
+        await record(c, 'backup.key_shown');
+        return c.json({ recoveryKey: s.key });
+    });
     app.post('/api/backups', requireUser, requireSession, requireAdmin, async (c) => {
         if (!backups.available())
             throw new ApiError(409, 'backups_unavailable', 'The database is hosted: its provider keeps the backups');
@@ -1448,12 +1664,26 @@ export function createApp(base) {
             return false;
         }
     };
+    /**
+     * The address links in emails point to: the site's own (MATERIALIZE_SITE_URL, site.url) when it
+     * is known. The request's Host header is used only without it, as in local development: anyone
+     * can send a request with a false Host, and a link to their server would carry the token there.
+     */
+    const publicOrigin = (c) => {
+        const site = ctx.config().site.url;
+        try {
+            if (site)
+                return new URL(site).origin;
+        }
+        catch { }
+        return new URL(c.req.url).origin;
+    };
     const mailLink = async (c, to, subject, lines, path) => {
         const mail = await settings.get('mail');
         if (!isConfigured(mail))
             return false;
         try {
-            const url = new URL(path, new URL(c.req.url).origin).toString();
+            const url = new URL(path, publicOrigin(c)).toString();
             await sendMail(mail, { to, subject, text: `${lines.join('\n')}\n\n${url}\n` });
             return true;
         }
@@ -1474,6 +1704,7 @@ export function createApp(base) {
                 pass: z.string().max(500).nullable().optional(),
                 from: z.string().max(200),
                 to: z.string().max(200),
+                provider: z.string().max(40).optional(),
             }),
         }));
         const before = await settings.get('mail');
@@ -1496,10 +1727,19 @@ export function createApp(base) {
             });
         }
         catch (error) {
-            throw new ApiError(422, 'mail_failed', error instanceof Error ? error.message : 'Sending failed');
+            // What went wrong and what to do, in words: a blocked port, a wrong password, an unverified sender…
+            return c.json({ ok: false, to, ...(await explainMailError(error, mail)) });
         }
         return c.json({ ok: true, to });
     });
+    /** The sender's domain as mail servers see it: SPF, DKIM, DMARC. */
+    app.post('/api/mail/domain', requireUser, requireSession, requireAdmin, async (c) => {
+        const input = await body(c, z.object({ from: z.string().max(200), provider: z.string().max(40).optional() }));
+        const domain = senderDomain(input.from);
+        if (!domain)
+            throw new ApiError(422, 'no_domain', 'Write the sender first, for example sito@example.com');
+        return c.json({ domain, checks: await checkSenderDomain(domain, input.provider) });
+    });
     // A form on the site: the message is kept, and sent by email when email is set up.
     // ---------- AI: settings, text actions and the editor's assistant ----------
     const aiSettings = async () => ({ ...EMPTY_AI, ...(await settings.get('ai')) });
@@ -1991,7 +2231,13 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
     });
     app.get('/api/documents/:id/revisions', requireUser, async (c) => {
         const existing = await loadDocument(c.req.param('id'));
-        return c.json({ items: await content.revisions(existing.id) });
+        // Who made each version, by name; null for a person removed since (and for versions with no author).
+        const names = new Map((await auth.listUsers()).map((u) => [u.id, u.name]));
+        const items = (await content.revisions(existing.id)).map((r) => ({
+            ...r,
+            authorName: r.authorId ? (names.get(r.authorId) ?? null) : null,
+        }));
+        return c.json({ items });
     });
     app.post('/api/documents/:id/revisions/:revision/restore', requireUser, async (c) => {
         const existing = await loadDocument(c.req.param('id'));

package/src/index.d.ts

@@ -9,6 +9,7 @@ export { restoreMedia } from './backups.ts';
 export { createFonts, type FontInfo, type Fonts } from './fonts.ts';
 export { createMcpServer, registerTools } from './mcp.ts';
 export { createMediaFiles, type MediaFiles } from './media.ts';
+export { decryptTree, type OffsiteSettings, parseRecoveryKey } from './offsite.ts';
 export { hashPassword, verifyPassword } from './password.ts';
 export { apiCaller, siteTools } from './tools.ts';
 /** Serves the public site: every request outside /api, /admin and /media goes here. */

package/src/index.js

@@ -10,6 +10,7 @@ export { restoreMedia } from './backups.js';
 export { createFonts } from './fonts.js';
 export { createMcpServer, registerTools } from './mcp.js';
 export { createMediaFiles } from './media.js';
+export { decryptTree, parseRecoveryKey } from './offsite.js';
 export { hashPassword, verifyPassword } from './password.js';
 export { apiCaller, siteTools } from './tools.js';
 const OWN = /^\/(api|admin|media|fonts|mcp)(\/|\?|$)/;

package/src/mail.d.ts

@@ -10,6 +10,8 @@ export interface MailSettings {
     from: string;
     /** Where messages from the site's forms arrive. */
     to: string;
+    /** The provider chosen in the panel (core/mail.ts), or empty for "another one". */
+    provider?: string;
 }
 export declare const EMPTY_MAIL: MailSettings;
 export declare function isConfigured(m: MailSettings | null): m is MailSettings;
@@ -21,6 +23,7 @@ export declare function publicMail(m: MailSettings | null): {
     user: string;
     from: string;
     to: string;
+    provider?: string;
     hasPassword: boolean;
 };
 export declare function sendMail(m: MailSettings, message: {
@@ -31,3 +34,27 @@ export declare function sendMail(m: MailSettings, message: {
 }): Promise<void>;
 /** A message from a site form as plain text: one "Label: value" per field. */
 export declare function submissionText(page: string, data: Record<string, string>): string;
+/** Whether the server answers on a port at all: the way to tell a blocked port from a wrong setting. */
+export declare function portOpen(host: string, port: number, timeout?: number): Promise<boolean>;
+export interface MailProblem {
+    message: string;
+    /** What to do about it. */
+    hint?: string;
+}
+/**
+ * A sending error from nodemailer, explained: wrong server name, a port the hosting blocks (then
+ * the ports that do answer), security that does not match the port, credentials refused, a sender
+ * the provider has not verified, a limit reached.
+ */
+export declare function explainMailError(error: unknown, m: MailSettings): Promise<MailProblem>;
+export interface DomainCheck {
+    id: 'spf' | 'dkim' | 'dmarc';
+    state: 'ok' | 'warn' | 'bad' | 'info';
+    title: string;
+    detail: string;
+}
+/**
+ * What mail servers check before trusting a message from this domain. Without SPF and DKIM the
+ * messages tend to end in spam; Gmail and Yahoo also ask for DMARC from whoever sends a lot.
+ */
+export declare function checkSenderDomain(domain: string, providerId?: string): Promise<DomainCheck[]>;

package/src/mail.js

@@ -1,3 +1,6 @@
+import { Resolver } from 'node:dns/promises';
+import { connect } from 'node:net';
+import { COMMON_DKIM, providerByHost, providerById } from '@materializecms/core/mail';
 import nodemailer from 'nodemailer';
 export const EMPTY_MAIL = {
     host: '',
@@ -34,3 +37,170 @@ export function submissionText(page, data) {
     const lines = Object.entries(data).map(([k, v]) => `${k}:\n${v}\n`);
     return `Nuovo messaggio dal modulo del sito${page ? ` (pagina ${page})` : ''}.\n\n${lines.join('\n')}`;
 }
+// ---------- why sending failed, in words ----------
+/** Whether the server answers on a port at all: the way to tell a blocked port from a wrong setting. */
+export function portOpen(host, port, timeout = 4000) {
+    return new Promise((resolve) => {
+        const socket = connect({ host, port, timeout });
+        const done = (ok) => {
+            socket.destroy();
+            resolve(ok);
+        };
+        socket.once('connect', () => done(true));
+        socket.once('timeout', () => done(false));
+        socket.once('error', () => done(false));
+    });
+}
+/**
+ * A sending error from nodemailer, explained: wrong server name, a port the hosting blocks (then
+ * the ports that do answer), security that does not match the port, credentials refused, a sender
+ * the provider has not verified, a limit reached.
+ */
+export async function explainMailError(error, m) {
+    const e = error;
+    const text = [e.message, e.response, ...(e.errors ?? []).flatMap((x) => [x.code, x.message])].join(' ');
+    const provider = providerById(m.provider) ?? providerByHost(m.host);
+    if (e.code === 'EDNS' || /ENOTFOUND|EAI_AGAIN/.test(text))
+        return {
+            message: `Il server «${m.host}» non esiste`,
+            hint: 'Controlla il nome del server: un errore di battitura basta.',
+        };
+    if (/wrong version number|ssl3_get_record|packet length too long|unknown protocol/i.test(text))
+        return {
+            message: 'La sicurezza non corrisponde alla porta',
+            hint: 'Di solito: porta 587 con STARTTLS, porta 465 con TLS.',
+        };
+    if (/certificate|self.signed|CERT_/i.test(text))
+        return {
+            message: 'Il certificato del server di posta non è valido',
+            hint: 'Controlla il nome del server: deve essere esattamente quello indicato dal fornitore.',
+        };
+    if (e.code === 'ETIMEDOUT' ||
+        e.code === 'ECONNECTION' ||
+        (e.code === 'ESOCKET' && e.command === 'CONN') ||
+        /ECONNREFUSED|ETIMEDOUT|ECONNRESET|EHOSTUNREACH|ENETUNREACH|Greeting never received/i.test(text)) {
+        const others = [587, 465, 2525].filter((p) => p !== m.port);
+        const open = [];
+        for (const p of others)
+            if (await portOpen(m.host, p))
+                open.push(p);
+        if (open.length)
+            return {
+                message: `Il server non risponde sulla porta ${m.port}, ma risponde sulla ${open.join(' e sulla ')}`,
+                hint: `Prova la porta ${open[0]}${open[0] === 465 ? ' con TLS' : ' con STARTTLS'}: la ${m.port} potrebbe essere bloccata dal fornitore del server.`,
+            };
+        return {
+            message: `Il server di posta non risponde (porta ${m.port})`,
+            hint: 'Molti fornitori di VPS bloccano le porte della posta in uscita, soprattutto per gli account nuovi: chiedi al loro supporto di sbloccarle, oppure usa un servizio che accetta la porta 2525.',
+        };
+    }
+    if (e.code === 'EAUTH' || e.responseCode === 535 || e.responseCode === 534)
+        return {
+            message: 'Utente o password rifiutati dal server di posta',
+            hint: provider ? `${provider.name}: ${provider.userHint} ${provider.passHint}` : 'Controlla utente e password.',
+        };
+    if (e.code === 'EENVELOPE' || (e.responseCode && e.responseCode >= 550 && e.responseCode <= 554)) {
+        const sender = e.command === 'MAIL FROM' || /sender|from address|not verified|not allowed to send/i.test(text);
+        return sender
+            ? {
+                message: 'Il server di posta non accetta questo mittente',
+                hint: `${provider?.note ?? 'Il mittente deve essere un indirizzo o un dominio verificato presso il fornitore.'}`,
+            }
+            : { message: 'Il destinatario è stato rifiutato', hint: 'Controlla l’indirizzo del destinatario dei moduli.' };
+    }
+    if (e.responseCode && e.responseCode >= 421 && e.responseCode <= 452)
+        return {
+            message: 'Il server di posta ha rimandato l’invio',
+            hint: 'Spesso è un limite di messaggi raggiunto: riprova più tardi o controlla il piano del fornitore.',
+        };
+    return { message: e.message || text.trim() || 'Invio non riuscito' };
+}
+const txt = async (resolver, name) => (await resolver.resolveTxt(name).catch(() => [])).map((parts) => parts.join(''));
+/**
+ * What mail servers check before trusting a message from this domain. Without SPF and DKIM the
+ * messages tend to end in spam; Gmail and Yahoo also ask for DMARC from whoever sends a lot.
+ */
+export async function checkSenderDomain(domain, providerId) {
+    const resolver = new Resolver({ timeout: 3000, tries: 2 });
+    const provider = providerById(providerId);
+    const checks = [];
+    const spf = (await txt(resolver, domain)).filter((r) => /^v=spf1\b/i.test(r));
+    if (!spf.length)
+        checks.push({
+            id: 'spf',
+            state: 'bad',
+            title: 'Manca il record SPF',
+            detail: `Senza SPF le email da ${domain} finiscono spesso nello spam. ${provider?.spf ? `Aggiungi nel DNS un record TXT su ${domain}: v=spf1 include:${provider.spf[0]} ~all` : 'Il fornitore della posta indica quale record TXT aggiungere nel DNS.'}`,
+        });
+    else if (spf.length > 1)
+        checks.push({
+            id: 'spf',
+            state: 'bad',
+            title: 'Ci sono due record SPF',
+            detail: 'I server di posta li scartano entrambi: uniscili in un solo record TXT che inizia con v=spf1.',
+        });
+    else if (!/\b(include:|a\b|a:|mx\b|mx:|ip4:|ip6:|exists:|redirect=)/i.test(spf[0]))
+        checks.push({
+            id: 'spf',
+            state: 'bad',
+            title: 'Il record SPF non autorizza nessun server',
+            detail: `${spf[0]}: così il dominio dichiara di non inviare email, e i messaggi vengono rifiutati. Aggiungi il server del tuo fornitore${provider?.spf ? ` (include:${provider.spf[0]})` : ''}.`,
+        });
+    else if (provider?.spf && !provider.spf.some((h) => spf[0].includes(`include:${h}`)))
+        checks.push({
+            id: 'spf',
+            state: 'warn',
+            title: `Il record SPF non autorizza ${provider.name}`,
+            detail: `Aggiungi include:${provider.spf[0]} al record attuale, prima di ~all o -all: ${spf[0]}`,
+        });
+    else
+        checks.push({ id: 'spf', state: 'ok', title: 'Record SPF presente', detail: spf[0] });
+    const selectors = provider ? provider.dkim : COMMON_DKIM;
+    if (provider && !selectors.length)
+        checks.push({
+            id: 'dkim',
+            state: 'info',
+            title: 'Firma DKIM: da controllare nel pannello del fornitore',
+            detail: `${provider.name} dà a ogni account nomi propri per la firma DKIM: nel suo pannello vedi se il dominio è verificato.`,
+        });
+    else {
+        let found = null;
+        // An empty key (p=) is a revoked one: it means "no signature".
+        for (const s of selectors)
+            if ((await txt(resolver, `${s}._domainkey.${domain}`)).some((r) => /\bp=[A-Za-z0-9+/]/.test(r))) {
+                found = s;
+                break;
+            }
+        checks.push(found
+            ? {
+                id: 'dkim',
+                state: 'ok',
+                title: 'Firma DKIM presente',
+                detail: `Trovata con il nome ${found}._domainkey.${domain}.`,
+            }
+            : {
+                id: 'dkim',
+                state: 'warn',
+                title: 'Firma DKIM non trovata',
+                detail: `Non l’ho trovata con i nomi più comuni${provider ? ` di ${provider.name}` : ''}. Nel pannello del fornitore attiva la firma del dominio: ti dà i record da aggiungere nel DNS.`,
+            });
+    }
+    const dmarc = (await txt(resolver, `_dmarc.${domain}`)).find((r) => /^v=DMARC1\b/i.test(r));
+    if (!dmarc)
+        checks.push({
+            id: 'dmarc',
+            state: 'warn',
+            title: 'Manca il record DMARC',
+            detail: `Gmail e Yahoo lo chiedono a chi invia molte email. Un inizio sicuro, che osserva senza bloccare niente: record TXT su _dmarc.${domain} con v=DMARC1; p=none`,
+        });
+    else {
+        const policy = /\bp=(none|quarantine|reject)/i.exec(dmarc)?.[1]?.toLowerCase();
+        checks.push({
+            id: 'dmarc',
+            state: 'ok',
+            title: 'Record DMARC presente',
+            detail: policy === 'none' ? `Osserva soltanto (p=none): ${dmarc}` : dmarc,
+        });
+    }
+    return checks;
+}

package/src/offsite.d.ts

@@ -0,0 +1,52 @@
+import type { Backups } from './backups.ts';
+import { type RemoteStorage, type S3Target, type WebDavTarget } from './remote-storage.ts';
+/**
+ * A copy of the backups outside the server, encrypted before it leaves: every night the newest
+ * database copy, and the media and fonts not sent yet (uploaded files never change, so they go
+ * once). On the storage the media are only added; database copies beyond `keep` are deleted.
+ *
+ * Encryption: AES-256-GCM with a random key made by Materialize, the "recovery key", shown once
+ * to the administrator. Whoever reads the bucket or the WebDAV folder sees noise. Files are
+ * encrypted in blocks of 1 MiB, each authenticated, the last one marked: a file cut short (an
+ * upload that stopped) is refused instead of giving back half a database.
+ */
+export interface OffsiteSettings {
+    kind: 'off' | 's3' | 'webdav';
+    s3?: S3Target & {
+        prefix?: string;
+    };
+    webdav?: WebDavTarget;
+    /** How many database copies stay on the storage; older ones are deleted. */
+    keep: number;
+    /** The recovery key: base64url of 32 random bytes, with the "mzk1-" mark. */
+    key?: string;
+}
+export interface OffsiteStatus {
+    at: string;
+    ok: boolean;
+    message?: string;
+    database?: string;
+    media?: number;
+    fonts?: number;
+}
+export declare const DEFAULT_OFFSITE: OffsiteSettings;
+/** Encrypted files end with this, so they are told apart from anything else in the folder. */
+export declare const SUFFIX = ".mzb";
+export declare function newRecoveryKey(): string;
+export declare function parseRecoveryKey(text: string): Buffer;
+/** Encrypts `source` into `target` (block by block: large videos never sit in memory). */
+export declare function encryptFile(source: string, target: string, key: Buffer): Promise<void>;
+/** The other way; throws on a wrong key, a changed file or one cut short. */
+export declare function decryptFile(source: string, target: string, key: Buffer): Promise<void>;
+export declare function storageOf(s: OffsiteSettings): RemoteStorage | null;
+/**
+ * One run: what is missing goes up, old database copies go away. `fresh` makes a new database
+ * copy first (the "Esegui ora" button); otherwise the newest daily copy is sent.
+ */
+export declare function runOffsite(s: OffsiteSettings, backups: Backups, mediaDir: string, fresh?: boolean, 
+/** For tests: a storage in memory. */
+storage?: RemoteStorage | null): Promise<OffsiteStatus>;
+/** "Prova il collegamento": writes, reads back, lists and deletes a small file. */
+export declare function testOffsite(s: OffsiteSettings): Promise<void>;
+/** Every encrypted file under a folder (or one file), decrypted next to it without the suffix. */
+export declare function decryptTree(source: string, key: Buffer): Promise<string[]>;

package/src/offsite.js

@@ -0,0 +1,230 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { mkdtemp, open, readdir, rm, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, relative, resolve } from 'node:path';
+import { createS3Storage, createWebDavStorage, } from './remote-storage.js';
+export const DEFAULT_OFFSITE = { kind: 'off', keep: 30 };
+const KEY_MARK = 'mzk1-';
+const MAGIC = Buffer.from('MZB1');
+const BLOCK = 1024 * 1024;
+/** Encrypted files end with this, so they are told apart from anything else in the folder. */
+export const SUFFIX = '.mzb';
+export function newRecoveryKey() {
+    return KEY_MARK + randomBytes(32).toString('base64url');
+}
+export function parseRecoveryKey(text) {
+    const clean = text.trim().replace(/\s+/g, '');
+    const raw = clean.startsWith(KEY_MARK) ? clean.slice(KEY_MARK.length) : clean;
+    const key = Buffer.from(raw, 'base64url');
+    if (key.length !== 32)
+        throw new Error('La chiave di ripristino non è valida: deve iniziare con mzk1-');
+    return key;
+}
+const nonceOf = (prefix, index) => {
+    const n = Buffer.alloc(12);
+    prefix.copy(n, 0);
+    n.writeUInt32BE(index, 8);
+    return n;
+};
+/** Encrypts `source` into `target` (block by block: large videos never sit in memory). */
+export async function encryptFile(source, target, key) {
+    const input = await open(source, 'r');
+    const output = await open(target, 'w');
+    try {
+        const { size } = await input.stat();
+        const blocks = Math.max(1, Math.ceil(size / BLOCK));
+        const prefix = randomBytes(8);
+        await output.write(Buffer.concat([MAGIC, prefix]));
+        const buffer = Buffer.alloc(BLOCK);
+        for (let i = 0; i < blocks; i++) {
+            const { bytesRead } = await input.read(buffer, 0, BLOCK, i * BLOCK);
+            const cipher = createCipheriv('aes-256-gcm', key, nonceOf(prefix, i));
+            cipher.setAAD(Buffer.from([i === blocks - 1 ? 1 : 0]));
+            const sealed = Buffer.concat([cipher.update(buffer.subarray(0, bytesRead)), cipher.final(), cipher.getAuthTag()]);
+            const length = Buffer.alloc(4);
+            length.writeUInt32BE(bytesRead);
+            await output.write(Buffer.concat([length, sealed]));
+        }
+    }
+    finally {
+        await input.close();
+        await output.close();
+    }
+}
+/** The other way; throws on a wrong key, a changed file or one cut short. */
+export async function decryptFile(source, target, key) {
+    const input = await open(source, 'r');
+    const output = await open(target, 'w');
+    let ok = false;
+    try {
+        const head = Buffer.alloc(12);
+        await input.read(head, 0, 12, 0);
+        if (!head.subarray(0, 4).equals(MAGIC))
+            throw new Error('Non è un file di backup cifrato da Materialize');
+        const prefix = head.subarray(4, 12);
+        let position = 12;
+        for (let i = 0;; i++) {
+            const length = Buffer.alloc(4);
+            if ((await input.read(length, 0, 4, position)).bytesRead < 4)
+                throw new Error('Il file è incompleto');
+            const size = length.readUInt32BE();
+            if (size > BLOCK)
+                throw new Error('Il file è danneggiato');
+            const sealed = Buffer.alloc(size + 16);
+            if ((await input.read(sealed, 0, size + 16, position + 4)).bytesRead < size + 16)
+                throw new Error('Il file è incompleto');
+            position += 4 + size + 16;
+            const end = position >= (await input.stat()).size;
+            const decipher = createDecipheriv('aes-256-gcm', key, nonceOf(prefix, i));
+            decipher.setAAD(Buffer.from([end ? 1 : 0]));
+            decipher.setAuthTag(sealed.subarray(size));
+            try {
+                await output.write(Buffer.concat([decipher.update(sealed.subarray(0, size)), decipher.final()]));
+            }
+            catch {
+                throw new Error(end ? 'Chiave sbagliata, oppure il file è stato modificato' : 'Il file è incompleto o è stato modificato');
+            }
+            if (end)
+                break;
+        }
+        ok = true;
+    }
+    finally {
+        await input.close();
+        await output.close();
+        if (!ok)
+            await rm(target, { force: true });
+    }
+}
+export function storageOf(s) {
+    if (s.kind === 's3' && s.s3)
+        return createS3Storage(s.s3, s.s3.prefix ?? '');
+    if (s.kind === 'webdav' && s.webdav)
+        return createWebDavStorage(s.webdav);
+    return null;
+}
+const README = `Backup di Materialize
+
+Questi file sono cifrati (AES-256-GCM): senza la chiave di ripristino non si leggono.
+
+  database/   le copie del database, dalla più recente
+  media/      le immagini e i file caricati
+  fonts/      i caratteri del sito
+
+Per rimetterli su un server:
+  1. scarica la cartella (con lo strumento del servizio, per esempio rclone);
+  2. nella cartella del sito: npx materialize decrypt <cartella scaricata> --key <chiave>
+  3. npx materialize restore <cartella decifrata>/database/content-….db
+     e copia media/ e fonts/ in .materialize/
+
+https://github.com/materializecms/materialize/blob/main/docs/guida/12-aggiornamenti-e-backup.md
+`;
+/** Every file under a folder, as paths relative to it; hidden files and the media cache left out. */
+async function filesUnder(dir) {
+    const out = [];
+    const walk = async (current) => {
+        for (const item of await readdir(current, { withFileTypes: true }).catch(() => [])) {
+            if (item.name.startsWith('.'))
+                continue;
+            const path = join(current, item.name);
+            if (item.isDirectory())
+                await walk(path);
+            else if (item.isFile())
+                out.push(relative(dir, path).split('\\').join('/'));
+        }
+    };
+    await walk(dir);
+    return out;
+}
+/**
+ * One run: what is missing goes up, old database copies go away. `fresh` makes a new database
+ * copy first (the "Esegui ora" button); otherwise the newest daily copy is sent.
+ */
+export async function runOffsite(s, backups, mediaDir, fresh = false, 
+/** For tests: a storage in memory. */
+storage = storageOf(s)) {
+    if (!storage || !s.key)
+        throw new Error('La copia fuori dal server non è configurata');
+    const key = parseRecoveryKey(s.key);
+    const work = await mkdtemp(join(tmpdir(), 'materialize-offsite-'));
+    try {
+        const remote = new Set((await storage.list('')).map((i) => i.key));
+        if (!remote.has('LEGGIMI.txt'))
+            await storage.putText('LEGGIMI.txt', README);
+        const send = async (local, remoteKey) => {
+            const sealed = join(work, 'file');
+            await encryptFile(local, sealed, key);
+            await storage.put(remoteKey, sealed);
+            await rm(sealed, { force: true });
+        };
+        let database;
+        if (backups.available()) {
+            const latest = fresh ? await backups.create('esterno') : (await backups.list())[0];
+            if (latest) {
+                database = latest.name;
+                const target = `database/${latest.name}${SUFFIX}`;
+                if (!remote.has(target))
+                    await send(join(backups.folder(), latest.name), target);
+            }
+        }
+        const media = resolve(mediaDir);
+        let mediaSent = 0;
+        for (const name of await filesUnder(media)) {
+            const target = `media/${name}${SUFFIX}`;
+            if (remote.has(target))
+                continue;
+            await send(join(media, name), target);
+            mediaSent++;
+        }
+        const fonts = join(resolve(mediaDir), '..', 'fonts');
+        let fontsSent = 0;
+        for (const name of await filesUnder(fonts)) {
+            const target = `fonts/${name}${SUFFIX}`;
+            if (remote.has(target))
+                continue;
+            await send(join(fonts, name), target);
+            fontsSent++;
+        }
+        // The newest copies stay; the media are never deleted (an old copy of the database may use them).
+        const copies = (await storage.list('database/'))
+            .filter((i) => i.key.endsWith(SUFFIX))
+            .sort((a, b) => b.key.localeCompare(a.key));
+        for (const old of copies.slice(Math.max(1, s.keep)))
+            await storage.delete(old.key);
+        return { at: new Date().toISOString(), ok: true, database, media: mediaSent, fonts: fontsSent };
+    }
+    finally {
+        await rm(work, { recursive: true, force: true });
+    }
+}
+/** "Prova il collegamento": writes, reads back, lists and deletes a small file. */
+export async function testOffsite(s) {
+    const storage = storageOf(s);
+    if (!storage)
+        throw new Error('Scegli S3 o WebDAV e compila i campi');
+    const key = `.materialize-prova-${randomBytes(4).toString('hex')}.txt`;
+    const text = `Prova di Materialize, ${new Date().toISOString()}`;
+    await storage.putText(key, text);
+    try {
+        if ((await storage.getText(key)) !== text)
+            throw new Error('Il file di prova è tornato diverso');
+        await storage.list('');
+    }
+    finally {
+        await storage.delete(key);
+    }
+}
+/** Every encrypted file under a folder (or one file), decrypted next to it without the suffix. */
+export async function decryptTree(source, key) {
+    const info = await stat(source);
+    const files = info.isDirectory()
+        ? (await filesUnder(source)).filter((f) => f.endsWith(SUFFIX)).map((f) => join(source, f))
+        : [source];
+    const done = [];
+    for (const file of files) {
+        const target = file.endsWith(SUFFIX) ? file.slice(0, -SUFFIX.length) : `${file}.decifrato`;
+        await decryptFile(file, target, key);
+        done.push(target);
+    }
+    return done;
+}

package/src/remote-storage.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Storage outside the server for the backups: any S3-compatible service (Amazon S3, Cloudflare
+ * R2, Backblaze B2, Hetzner, Scaleway, OVH, Wasabi, MinIO…) or a WebDAV folder (Nextcloud,
+ * ownCloud, Synology and QNAP, pCloud, kDrive…). Written with fetch and node:crypto only.
+ */
+export interface S3Target {
+    /** https://… of the service, without the bucket: https://<account>.r2.cloudflarestorage.com */
+    endpoint: string;
+    region: string;
+    bucket: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+export interface WebDavTarget {
+    /** The folder the backups go in: https://cloud.example.com/remote.php/dav/files/nome/backup/ */
+    url: string;
+    user: string;
+    password: string;
+}
+export interface RemoteItem {
+    key: string;
+    size: number;
+    modified: Date;
+}
+export interface RemoteStorage {
+    put(key: string, file: string): Promise<void>;
+    putText(key: string, text: string): Promise<void>;
+    get(key: string, file: string): Promise<void>;
+    getText(key: string): Promise<string>;
+    /** Everything under a folder of the storage ("database/", "media/"), with sizes. */
+    list(prefix: string): Promise<RemoteItem[]>;
+    delete(key: string): Promise<void>;
+}
+export declare class RemoteError extends Error {
+    readonly status?: number;
+    constructor(message: string, status?: number);
+}
+/**
+ * A request signed with AWS Signature Version 4, which every S3-compatible service accepts. The
+ * body is not hashed (UNSIGNED-PAYLOAD): files are streamed over HTTPS, as large as they are.
+ */
+export declare function signS3(target: S3Target, method: string, key: string, query?: Record<string, string>, headers?: Record<string, string>, now?: Date, payloadHash?: string): {
+    url: string;
+    headers: Record<string, string>;
+};
+export declare function createS3Storage(target: S3Target, prefix?: string): RemoteStorage;
+export declare function createWebDavStorage(target: WebDavTarget): RemoteStorage;

package/src/remote-storage.js

@@ -0,0 +1,264 @@
+import { createHash, createHmac } from 'node:crypto';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+export class RemoteError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+/** A human reason for an HTTP failure, the same for both kinds of storage. */
+function failure(what, status, detail = '') {
+    const why = status === 401 || status === 403
+        ? 'accesso rifiutato: controlla le credenziali e i permessi'
+        : status === 404
+            ? 'non trovato: controlla l’indirizzo, il bucket o la cartella'
+            : status === 409
+                ? 'una cartella del percorso non esiste: crea almeno quella che contiene la cartella dei backup'
+                : status === 507 || /QuotaExceeded|InsufficientStorage/i.test(detail)
+                    ? 'spazio esaurito'
+                    : `il servizio ha risposto ${status}`;
+    const code = /<Code>([^<]+)<\/Code>/.exec(detail)?.[1];
+    return new RemoteError(`${what}: ${why}${code ? ` (${code})` : ''}`, status);
+}
+async function reach(url, init) {
+    try {
+        return await fetch(url, { ...init, signal: init.signal ?? AbortSignal.timeout(10 * 60_000) });
+    }
+    catch (error) {
+        const cause = error.cause?.code;
+        throw new RemoteError(cause === 'ENOTFOUND'
+            ? `Il servizio ${new URL(url).host} non si trova: controlla l’indirizzo`
+            : `Il servizio non risponde (${cause ?? error.message})`);
+    }
+}
+const fileBody = (file) => Readable.toWeb(createReadStream(file));
+async function saveBody(res, file) {
+    if (!res.body)
+        throw new RemoteError('Risposta vuota');
+    try {
+        await pipeline(Readable.fromWeb(res.body), createWriteStream(file));
+    }
+    catch (error) {
+        throw new RemoteError(`Il download si è interrotto (${error.message}): riprova`);
+    }
+}
+// ---------- S3 ----------
+const sha256 = (data) => createHash('sha256').update(data).digest('hex');
+const hmac = (key, data) => createHmac('sha256', key).update(data).digest();
+const EMPTY_HASH = sha256('');
+/** RFC 3986 encoding, as Signature Version 4 wants it (keeps / in paths when asked). */
+const encode = (text, slash = true) => encodeURIComponent(text)
+    .replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)
+    .replace(slash ? /%2F/g : /$^/, '/');
+/**
+ * A request signed with AWS Signature Version 4, which every S3-compatible service accepts. The
+ * body is not hashed (UNSIGNED-PAYLOAD): files are streamed over HTTPS, as large as they are.
+ */
+export function signS3(target, method, key, query = {}, headers = {}, now = new Date(), payloadHash = 'UNSIGNED-PAYLOAD') {
+    const endpoint = new URL(target.endpoint);
+    // Amazon wants the bucket in the host name; the others accept it in the path, which needs no DNS.
+    const virtual = /\.amazonaws\.com$/i.test(endpoint.hostname);
+    const host = virtual ? `${target.bucket}.${endpoint.host}` : endpoint.host;
+    const base = endpoint.pathname.replace(/\/+$/, '');
+    // Listing the bucket: "/" on Amazon's host, "/bucket" in the path elsewhere.
+    const bucketPath = `${base}${virtual ? '' : `/${encode(target.bucket)}`}`;
+    const path = key ? `${bucketPath}/${encode(key)}` : bucketPath || '/';
+    const amzDate = now.toISOString().replace(/[-:]|\.\d{3}/g, '');
+    const day = amzDate.slice(0, 8);
+    const region = target.region || 'us-east-1';
+    const all = {
+        ...Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), v])),
+        host,
+        'x-amz-content-sha256': payloadHash,
+        'x-amz-date': amzDate,
+    };
+    const names = Object.keys(all).sort();
+    const canonicalQuery = Object.keys(query)
+        .sort()
+        .map((k) => `${encode(k, false)}=${encode(query[k] ?? '', false)}`)
+        .join('&');
+    const canonical = [
+        method,
+        path,
+        canonicalQuery,
+        names.map((n) => `${n}:${String(all[n]).trim()}\n`).join(''),
+        names.join(';'),
+        payloadHash,
+    ].join('\n');
+    const scope = `${day}/${region}/s3/aws4_request`;
+    const toSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256(canonical)].join('\n');
+    const signingKey = hmac(hmac(hmac(hmac(`AWS4${target.secretAccessKey}`, day), region), 's3'), 'aws4_request');
+    const signature = createHmac('sha256', signingKey).update(toSign).digest('hex');
+    all.authorization = `AWS4-HMAC-SHA256 Credential=${target.accessKeyId}/${scope}, SignedHeaders=${names.join(';')}, Signature=${signature}`;
+    delete all.host;
+    return { url: `${endpoint.protocol}//${host}${path}${canonicalQuery ? `?${canonicalQuery}` : ''}`, headers: all };
+}
+const xmlValue = (xml, tag) => new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`).exec(xml)?.[1] ?? '';
+const unescapeXml = (s) => s
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&amp;/g, '&');
+export function createS3Storage(target, prefix = '') {
+    const full = (key) => `${prefix.replace(/^\/+|\/+$/g, '')}${prefix.trim() ? '/' : ''}${key}`;
+    const call = async (what, method, key, opts = {}) => {
+        const signed = signS3(target, method, key, opts.query, opts.headers, new Date(), opts.payload);
+        const res = await reach(signed.url, {
+            method,
+            headers: signed.headers,
+            body: opts.body,
+            ...(opts.body instanceof ReadableStream ? { duplex: 'half' } : {}),
+        });
+        if (!res.ok && !(method === 'DELETE' && res.status === 404))
+            throw failure(what, res.status, await res.text());
+        return res;
+    };
+    return {
+        async put(key, file) {
+            const { size } = await stat(file);
+            await call(`Caricamento di ${key}`, 'PUT', full(key), {
+                headers: { 'content-length': String(size), 'content-type': 'application/octet-stream' },
+                body: fileBody(file),
+            });
+        },
+        async putText(key, text) {
+            const body = Buffer.from(text);
+            await call(`Caricamento di ${key}`, 'PUT', full(key), {
+                headers: { 'content-length': String(body.length), 'content-type': 'text/plain; charset=utf-8' },
+                body,
+                payload: sha256(body),
+            });
+        },
+        async get(key, file) {
+            await saveBody(await call(`Download di ${key}`, 'GET', full(key), { payload: EMPTY_HASH }), file);
+        },
+        async getText(key) {
+            return (await call(`Download di ${key}`, 'GET', full(key), { payload: EMPTY_HASH })).text();
+        },
+        async list(folder) {
+            const items = [];
+            const strip = full('').length;
+            let token = '';
+            do {
+                const query = { 'list-type': '2', prefix: full(folder) };
+                if (token)
+                    query['continuation-token'] = token;
+                const xml = await (await call('Elenco dei file', 'GET', '', { query, payload: EMPTY_HASH })).text();
+                for (const block of xml.match(/<Contents>[\s\S]*?<\/Contents>/g) ?? [])
+                    items.push({
+                        key: unescapeXml(xmlValue(block, 'Key')).slice(strip),
+                        size: Number(xmlValue(block, 'Size')),
+                        modified: new Date(xmlValue(block, 'LastModified')),
+                    });
+                token = xmlValue(xml, 'IsTruncated') === 'true' ? unescapeXml(xmlValue(xml, 'NextContinuationToken')) : '';
+            } while (token);
+            return items;
+        },
+        async delete(key) {
+            await call(`Eliminazione di ${key}`, 'DELETE', full(key), { payload: EMPTY_HASH });
+        },
+    };
+}
+// ---------- WebDAV ----------
+export function createWebDavStorage(target) {
+    const root = target.url.endsWith('/') ? target.url : `${target.url}/`;
+    const auth = `Basic ${Buffer.from(`${target.user}:${target.password}`).toString('base64')}`;
+    const url = (key) => new URL(key.split('/').map(encodeURIComponent).join('/'), root).toString();
+    const made = new Set();
+    const call = async (what, method, key, init = {}) => {
+        const res = await reach(url(key), { ...init, method, headers: { authorization: auth, ...init.headers } });
+        if (!res.ok && !(method === 'DELETE' && res.status === 404))
+            throw failure(what, res.status, await res.text());
+        return res;
+    };
+    /** The folders of a path, one by one, the backup folder itself first: WebDAV does not make them. */
+    const folders = async (key) => {
+        if (!made.has('')) {
+            const res = await reach(root, { method: 'MKCOL', headers: { authorization: auth } });
+            if (!res.ok && res.status !== 405)
+                throw failure('Creazione della cartella dei backup', res.status, await res.text());
+            made.add('');
+        }
+        const parts = key.split('/').slice(0, -1);
+        for (let i = 1; i <= parts.length; i++) {
+            const dir = `${parts.slice(0, i).join('/')}/`;
+            if (made.has(dir))
+                continue;
+            const res = await reach(url(dir), { method: 'MKCOL', headers: { authorization: auth } });
+            // 405: it exists already.
+            if (!res.ok && res.status !== 405)
+                throw failure(`Creazione della cartella ${dir}`, res.status, await res.text());
+            made.add(dir);
+        }
+    };
+    return {
+        async put(key, file) {
+            await folders(key);
+            const { size } = await stat(file);
+            await call(`Caricamento di ${key}`, 'PUT', key, {
+                headers: { 'content-length': String(size), 'content-type': 'application/octet-stream' },
+                body: fileBody(file),
+                duplex: 'half',
+            });
+        },
+        async putText(key, text) {
+            await folders(key);
+            await call(`Caricamento di ${key}`, 'PUT', key, {
+                headers: { 'content-type': 'text/plain; charset=utf-8' },
+                body: text,
+            });
+        },
+        async get(key, file) {
+            await saveBody(await call(`Download di ${key}`, 'GET', key), file);
+        },
+        async getText(key) {
+            return (await call(`Download di ${key}`, 'GET', key)).text();
+        },
+        async list(folder) {
+            const items = [];
+            const rootPath = decodeURIComponent(new URL(root).pathname);
+            const walk = async (dir) => {
+                const res = await reach(url(dir), {
+                    method: 'PROPFIND',
+                    headers: { authorization: auth, depth: '1', 'content-type': 'application/xml' },
+                    body: '<?xml version="1.0"?><d:propfind xmlns:d="DAV:"><d:prop><d:getcontentlength/><d:getlastmodified/><d:resourcetype/></d:prop></d:propfind>',
+                });
+                if (res.status === 404)
+                    return;
+                if (!res.ok)
+                    throw failure('Elenco dei file', res.status, await res.text());
+                const xml = await res.text();
+                // Namespaces differ between servers (d:, D:, none): matched by local name.
+                for (const block of xml.match(/<(?:\w+:)?response[\s>][\s\S]*?<\/(?:\w+:)?response>/g) ?? []) {
+                    const href = /<(?:\w+:)?href>([^<]+)</.exec(block)?.[1] ?? '';
+                    const path = decodeURIComponent(new URL(href, root).pathname);
+                    if (!path.startsWith(rootPath))
+                        continue;
+                    const key = path.slice(rootPath.length);
+                    if (!key || key === dir)
+                        continue;
+                    // A folder: <d:collection/>, also with attributes (rclone), or an address ending in "/".
+                    if (/<(?:\w+:)?collection[\s/>]/.test(block) || key.endsWith('/')) {
+                        await walk(key.endsWith('/') ? key : `${key}/`);
+                        continue;
+                    }
+                    items.push({
+                        key,
+                        size: Number(/<(?:\w+:)?getcontentlength>(\d+)</.exec(block)?.[1] ?? 0),
+                        modified: new Date(/<(?:\w+:)?getlastmodified>([^<]+)</.exec(block)?.[1] ?? 0),
+                    });
+                }
+            };
+            await walk(folder);
+            return items;
+        },
+        async delete(key) {
+            await call(`Eliminazione di ${key}`, 'DELETE', key);
+        },
+    };
+}