@materializecms/server 0.3.0 → 0.5.0

package/src/app.js

@@ -9,11 +9,11 @@ import { getConnInfo } from '@hono/node-server/conninfo';
 import { describeCollection, prepare, SLUG_PATTERN, slugify, titleOf, validate, } from '@materializecms/core';
 import { documentSlots, isLocaleCode, mergeTranslation, nodeSlots, untranslatedIds, withLocales, } from '@materializecms/core/i18n';
 import { senderDomain } from '@materializecms/core/mail';
-import { normalizeTheme, sameDesign } from '@materializecms/core/page';
+import { expandComponents, expandGlobals, formDefinition, normalizeTheme, sameDesign, walk, } from '@materializecms/core/page';
 import { addMove, normalizePath } from '@materializecms/core/seo';
 import { TRACKING_PATTERNS, trackingBlocks } from '@materializecms/core/tracking';
 import { DEFAULT_UPDATES, isPatch, } from '@materializecms/core/updates';
-import { createActivityStore, createAuthStore, createCommentStore, createContentStore, createMediaStore, createSettingsStore, createSubmissionStore, EmailTakenError, SlugTakenError, } from '@materializecms/db';
+import { createActivityStore, createAuthStore, createCommentStore, createContentStore, createMediaStore, createPreviewLinkStore, createScheduleStore, createSettingsStore, createSubmissionStore, EmailTakenError, SlugTakenError, } from '@materializecms/db';
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
 import { Hono } from 'hono';
 import { bodyLimit } from 'hono/body-limit';
@@ -28,6 +28,7 @@ import { AiError, complete, EMPTY_AI, isReady, publicAi, runTurn, translateTexts
 import { folderEntries, tarGz } from './archive.js';
 import { createBackups, DEFAULT_BACKUPS } from './backups.js';
 import { createFonts, FONT_FILE, FONT_ID } from './fonts.js';
+import { fingerprintOf, readSubmission, removeFiles, saveFiles, sendWebhook, spamReason, } from './forms.js';
 import { checkSenderDomain, explainMailError, isConfigured, publicMail, sendMail, submissionText, } from './mail.js';
 import { createMcpServer } from './mcp.js';
 import { createMediaFiles, fileBody, MAX_UPLOAD, MediaError, mediaUrl } from './media.js';
@@ -61,7 +62,10 @@ const FORGOT_THRESHOLD = 3;
 const FORGOT_IP_THRESHOLD = 10;
 /** Where people open their one-time link: the admin's welcome screen. */
 const linkPath = (token) => `/admin/_invite/${token}`;
-/** The custom code blocks in a document: it runs on the public site, so only admins may change it. */
+/**
+ * The custom code blocks in a document (it runs on the public site) and where its forms send
+ * their messages: only admins may change them.
+ */
 function embedsOf(value, out = []) {
     if (Array.isArray(value))
         for (const v of value)
@@ -70,6 +74,10 @@ function embedsOf(value, out = []) {
         const node = value;
         if (node.type === 'embed' && typeof node.id === 'string')
             out.push(`${node.id}:${String(node.html ?? '')}`);
+        // Where a form's messages go: someone who only edits pages must not divert them.
+        const form = node.form;
+        if (form && typeof node.id === 'string' && (form.to || form.webhook))
+            out.push(`form:${node.id}:${form.to ?? ''}:${form.webhook ?? ''}`);
         for (const v of Object.values(node))
             if (v && typeof v === 'object')
                 embedsOf(v, out);
@@ -132,6 +140,8 @@ const siteSeoSchema = z.object({
     })
         .optional(),
     blockAi: z.boolean().optional(),
+    llms: z.boolean().optional(),
+    feed: z.array(z.string().max(80)).max(50).optional(),
     disallow: z.array(z.string().trim().max(300)).max(100).optional(),
     google: short,
     bing: short,
@@ -179,6 +189,8 @@ export function createApp(base) {
     const submissions = createSubmissionStore(ctx.database.db);
     const comments = createCommentStore(ctx.database.db);
     const activityLog = createActivityStore(ctx.database.db);
+    const schedules = createScheduleStore(ctx.database.db);
+    const previewLinks = createPreviewLinkStore(ctx.database.db);
     const backups = createBackups(ctx.database, () => ctx.config().media.dir);
     const backupSettings = async () => ({
         ...DEFAULT_BACKUPS,
@@ -308,12 +320,20 @@ export function createApp(base) {
     const files = createMediaFiles(ctx.config().media.dir);
     // Fonts are cached next to the media library (.materialize/fonts by default).
     const fonts = createFonts(join(dirname(resolve(ctx.config().media.dir)), 'fonts'));
+    // Files sent with the site's forms: next to the database, never served by the public site.
+    const uploadsDir = join(dirname(resolve(ctx.config().media.dir)), 'uploads');
+    let formCache = null;
+    /** The live site changed: rebuild it, and read its forms again. */
+    const sitePublished = () => {
+        formCache = null;
+        ctx.onPublish?.();
+    };
     const app = new Hono();
     const guardEmbeds = (user, before, after) => {
         if (user.role === 'admin')
             return;
         if (JSON.stringify(embedsOf(before).sort()) !== JSON.stringify(embedsOf(after).sort()))
-            throw new ApiError(403, 'embed_admin_only', 'Solo un amministratore può aggiungere o modificare il codice personalizzato');
+            throw new ApiError(403, 'embed_admin_only', 'Solo un amministratore può modificare il codice personalizzato e dove arrivano i messaggi dei moduli');
     };
     /** Editors who may only change contents (Persone → Redattori): words, links and images, not the layout. */
     const contentOnly = async (user) => user.role !== 'admin' && !!(await settings.get('editorial'))?.editorsContentOnly;
@@ -432,13 +452,15 @@ export function createApp(base) {
         return `/${locale}${path === '/' ? '' : path}`;
     };
     /** A document as the admin sees it, with what still needs fixing before it can be published. */
-    const toJson = (doc) => {
+    const toJson = async (doc) => {
         const def = ctx.config().collections.find((x) => x.name === doc.collection);
         const check = def ? validate(def, prepare(def, doc.data)) : null;
         return {
             ...doc,
             url: def?.url ? def.url(doc.data) : null,
             issues: check && !check.ok ? check.issues : [],
+            /** When it goes on or off the site by itself, and the last scheduled action that failed. */
+            schedule: await schedules.forDocument(doc.id),
         };
     };
     /**
@@ -628,7 +650,7 @@ export function createApp(base) {
             : await content.create({ collection: def.name, locale: lang, ...draft });
         if (doc)
             await content.publish(doc.id);
-        ctx.onPublish?.();
+        sitePublished();
     };
     /** The site's name as set in the panel (the settings singleton, published), else the config's. */
     const siteName = async () => {
@@ -1102,6 +1124,7 @@ export function createApp(base) {
         const mediaDir = resolve(ctx.config().media.dir);
         entries.push(...(await folderEntries(mediaDir, 'media')));
         entries.push(...(await folderEntries(join(dirname(mediaDir), 'fonts'), 'fonts')));
+        entries.push(...(await folderEntries(uploadsDir, 'uploads')));
         const manifest = join(work, 'materialize.json');
         await writeFile(manifest, JSON.stringify({
             site: ctx.config().site.name,
@@ -1528,7 +1551,7 @@ export function createApp(base) {
         const input = await body(c, z.object({ theme: z.record(z.string(), z.unknown()) }));
         const theme = normalizeTheme(input.theme);
         await settings.set('theme', theme, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.theme');
         return c.json({ theme });
     });
@@ -1588,7 +1611,7 @@ export function createApp(base) {
                 .filter(([id]) => main[id])
                 .map(([id, n]) => [id, n]));
             await settings.set(`globals:${lang}`, words, c.get('user').id);
-            ctx.onPublish?.();
+            sitePublished();
             return c.json({ globals: await globalsIn(lang) });
         }
         const before = (await settings.get('globals')) ?? {};
@@ -1603,7 +1626,7 @@ export function createApp(base) {
         const ids = [...new Set([...Object.keys(before), ...Object.keys(input.globals)])].sort();
         await guardDesign(c.get('user'), ids.map((id) => before[id] ?? { id, type: 'frame' }), ids.map((id) => input.globals[id] ?? { id, type: 'frame' }));
         await settings.set('globals', input.globals, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         return c.json({ globals: input.globals });
     });
     // ---------- comments and presence ----------
@@ -1743,11 +1766,29 @@ export function createApp(base) {
     // A form on the site: the message is kept, and sent by email when email is set up.
     // ---------- AI: settings, text actions and the editor's assistant ----------
     const aiSettings = async () => ({ ...EMPTY_AI, ...(await settings.get('ai')) });
+    const thisMonth = () => new Date().toISOString().slice(0, 7);
+    const monthUsage = async () => {
+        const saved = await settings.get('ai-usage');
+        const month = thisMonth();
+        return saved?.month === month ? saved : { month, requests: 0, input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+    };
+    // One write at a time: the steps of a turn and parallel requests all count.
+    let usageWrites = Promise.resolve();
+    const countUsage = (u) => {
+        usageWrites = usageWrites
+            .then(async () => {
+            const total = await monthUsage();
+            for (const k of ['requests', 'input', 'output', 'cacheRead', 'cacheWrite'])
+                total[k] += u[k];
+            await settings.set('ai-usage', total);
+        })
+            .catch((error) => console.error(error));
+    };
     const readyAi = async () => {
         const ai = await aiSettings();
         if (!isReady(ai))
             throw new ApiError(400, 'ai_not_configured', 'L’AI non è configurata: Impostazioni → AI e MCP');
-        return ai;
+        return { ...ai, onUsage: countUsage };
     };
     const aiFailed = (error) => {
         if (error instanceof AiError)
@@ -1757,7 +1798,7 @@ export function createApp(base) {
     const allowAi = createLimiter(40, 60_000);
     app.get('/api/ai', requireUser, async (c) => {
         const ai = await aiSettings();
-        return c.json(c.get('user').role === 'admin' ? { ai: publicAi(ai) } : { ai: { ready: isReady(ai) } });
+        return c.json(c.get('user').role === 'admin' ? { ai: publicAi(ai), usage: await monthUsage() } : { ai: { ready: isReady(ai) } });
     });
     app.put('/api/ai', requireUser, requireSession, requireAdmin, async (c) => {
         const input = await body(c, z.object({
@@ -1767,6 +1808,7 @@ export function createApp(base) {
                 apiKey: z.string().max(500).nullable().optional(),
                 baseUrl: z.union([z.url().max(500), z.literal('')]),
                 model: z.string().trim().max(120),
+                fastModel: z.string().trim().max(120).default(''),
             }),
         }));
         const before = await aiSettings();
@@ -1778,13 +1820,16 @@ export function createApp(base) {
     });
     app.post('/api/ai/test', requireUser, requireSession, requireAdmin, async (c) => {
         const ai = await readyAi();
-        const reply = await complete(ai, { system: 'Answer with one short word.', prompt: 'Say: ok' }).catch(aiFailed);
+        const probe = { system: 'Answer with one short word.', prompt: 'Say: ok' };
+        // Both models: a wrong name for the quick actions shows up here, not at the first ✨.
+        const reply = await complete(ai, probe).catch(aiFailed);
+        await complete(ai, { ...probe, fast: true }).catch(aiFailed);
         return c.json({ ok: true, reply });
     });
     const TEXT_ACTIONS = {
         rewrite: 'Rewrite it so it reads better: same meaning, similar length.',
-        shorten: 'Make it shorter, keeping what matters.',
-        expand: 'Make it a little longer and richer, without inventing facts.',
+        shorten: 'Make it shorter, keeping what matters most.',
+        expand: 'Make it longer and richer, without inventing facts.',
         fix: 'Fix spelling, grammar and punctuation only; change nothing else.',
         formal: 'Make the tone more formal and professional.',
         friendly: 'Make the tone warmer and more conversational.',
@@ -1801,6 +1846,10 @@ export function createApp(base) {
             src: z.string().max(1000).optional(),
             /** The site's language, for texts written from scratch. */
             locale: z.string().max(20).optional(),
+            /** rich: the text is rich text as lines of markup (richTextMarkup), and so is the reply. */
+            format: z.enum(['plain', 'rich']).default('plain'),
+            /** The most characters the field takes. */
+            max: z.number().int().positive().max(100_000).optional(),
         }));
         if (!allowAi(c.get('user').id))
             throw new ApiError(429, 'too_many_requests', 'Troppe richieste: aspetta un minuto');
@@ -1813,9 +1862,14 @@ export function createApp(base) {
             if (!file)
                 throw new ApiError(400, 'no_image', 'Scegli prima un’immagine della libreria');
             const data = (await readFile(file.path)).toString('base64');
+            // The text already there may credit the photographer or the source: that part stays.
+            const current = input.text.trim()
+                ? `\n\nThe current alternative text is:\n<text>\n${input.text}\n</text>\nWrite in its language. If it credits a photographer, an author or a source (such as "photo by … on Unsplash"), keep that credit at the end, in the same form.`
+                : '';
             const text = await complete(ai, {
                 system,
-                prompt: `Write the alternative text (alt) for this image on a website, in the language with code "${lang}": one sentence, at most 125 characters, describing what matters for someone who cannot see it. No "image of".`,
+                fast: true,
+                prompt: `Write the alternative text (alt) for this image on a website, in the language with code "${lang}"${current ? ' unless said otherwise below' : ''}: one sentence, at most 125 characters (besides any credit), describing what matters for someone who cannot see it. No "image of".${current}`,
                 image: { data, mime: 'image/jpeg' },
             }).catch(aiFailed);
             return c.json({ text });
@@ -1827,7 +1881,37 @@ export function createApp(base) {
             : input.action === 'custom'
                 ? (input.instruction ?? 'Improve it.')
                 : TEXT_ACTIONS[input.action];
-        const text = await complete(ai, { system, prompt: `${task}\n\n<text>\n${input.text}\n</text>` }).catch(aiFailed);
+        const rich = input.format === 'rich'
+            ? '\n\nThe text is markup, one block per line: <p>, <h2>, <h3>, <h4>, <blockquote>, <li>, with <b>, <i> and numbered links (<a1>…</a1>) inside, and <img1>, <img2>… for images. Reply in the same markup: you may change, merge, split or add blocks; keep each link around the matching words and every image line.'
+            : '';
+        // Shorter and longer by how much: as words, small models barely touch a short text or
+        // multiply it. A length in characters (the words alone, without markup) they follow.
+        const length = input.text.replace(/<[^>]+>/g, '').length;
+        let max = input.max;
+        let target = '';
+        if (input.action === 'shorten') {
+            target = `\n\nThe text has ${length} characters: aim for about ${Math.round(length * 0.65)}.`;
+            max = Math.min(max ?? Number.POSITIVE_INFINITY, Math.round(length * 0.8));
+        }
+        else if (input.action === 'expand')
+            target = `\n\nThe text has ${length} characters: aim for about ${Math.round(length * 1.5)}, never more than ${length * 2}.`;
+        const limit = max ? `\n\nThe result must be at most ${max} characters, spaces included.` : '';
+        let text = await complete(ai, {
+            system,
+            fast: true,
+            prompt: `${task}${target}${limit}${rich}\n\n<text>\n${input.text}\n</text>`,
+        }).catch(aiFailed);
+        // Models count characters loosely: another pass when the result is too long, then one on the
+        // main model when the quick one still does not get there (a small model may return the text as is).
+        for (const fast of [true, false]) {
+            if (!max || input.format !== 'plain' || text.length <= max)
+                break;
+            text = await complete(ai, {
+                system,
+                fast,
+                prompt: `Shorten this text to at most ${max} characters, spaces included (it has ${text.length}), keeping its meaning and tone.\n\n<text>\n${text}\n</text>`,
+            }).catch(aiFailed);
+        }
         return c.json({ text });
     });
     /** Conversations with the assistant, per person and chat, kept for two hours in memory. */
@@ -1844,6 +1928,14 @@ export function createApp(base) {
                 url: z.string().max(500).nullish(),
             }),
             selected: z.array(z.string().max(100)).max(50).optional(),
+            /** Reference pictures (a screenshot, a mockup, a sketch), already made smaller by the panel. */
+            images: z
+                .array(z.object({
+                mime: z.enum(['image/png', 'image/jpeg', 'image/webp']),
+                data: z.base64().max(4_000_000),
+            }))
+                .max(4)
+                .default([]),
         }));
         const user = c.get('user');
         if (!allowAi(user.id))
@@ -1869,17 +1961,24 @@ export function createApp(base) {
             auth.cookie = cookie;
         const tools = assistantTools(apiCaller(app.fetch, auth), page, ctx.config().site.name);
         const limited = await contentOnly(user);
-        const system = `You are the assistant inside Materialize, the visual editor of the website "${ctx.config().site.name}". The person (${user.name}) is editing the page "${input.page.title}" (collection ${input.page.collection}${input.page.url ? `, address ${input.page.url}` : ''}).
+        // The instructions stay the same for the whole conversation: the model's earlier reasoning is
+        // tied to them (a change is refused) and they are read from the prompt cache. What changes
+        // from turn to turn, the page and what is selected, goes with each message instead.
+        const system = `You are the assistant inside Materialize, the visual editor of the website "${ctx.config().site.name}". The person (${user.name}) is editing a page; each of their messages starts with a <context> note on the page and on what is selected on the canvas.
 Use the tools to look at the page (get_page, get_node) and change it (edit_page). Your changes go into the editor, where the person sees them at once and can undo them; they are not published.
 Read the page before changing it. Make the changes asked, consistent with the design already there (theme colors and text styles, spacing, the look of nearby sections); prefer the section library for new sections. Keep ids of existing nodes.
-${limited ? 'This person may change only contents (texts, links, images, alt texts), not the layout or the design: do not add, remove or move nodes, and do not change styles.\n' : ''}When done, say in one or two short sentences what you changed. Reply in the person's language. If something cannot be done with the tools, say so.
-${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')} (what "this" refers to).` : ''}`;
+${limited ? 'This person may change only contents (texts, links, images, alt texts), not the layout or the design: do not add, remove or move nodes, and do not change styles.\n' : ''}Pictures the person attaches are references (a site they like, a mockup, a sketch): take their layout, hierarchy and mood, and build it with this site's sections, theme and texts; never copy their brand, logos or texts, and do not put the pictures on the page.
+When done, say in one or two short sentences what you changed. Reply in the person's language. If something cannot be done with the tools, say so.`;
+        const context = `<context>Page "${input.page.title}" (collection ${input.page.collection}${input.page.url ? `, address ${input.page.url}` : ''}). ${input.selected?.length
+            ? `Selected on the canvas: ${input.selected.join(', ')} (what "this" refers to).`
+            : 'Nothing selected on the canvas.'}</context>`;
         return streamSSE(c, async (stream) => {
             const send = (data) => stream.writeSSE({ data: JSON.stringify(data) });
             try {
                 const reply = await runTurn(ai, conv, {
                     system,
-                    text: input.message,
+                    text: `${context}\n\n${input.message}`,
+                    images: input.images,
                     tools,
                     onEvent: (e) => void send(e),
                 });
@@ -1906,59 +2005,238 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
             }
         });
     });
-    app.post('/api/forms/:form', async (c) => {
+    // ---------- forms ----------
+    /**
+     * Every form on the published site, by id, as the server checks it: canvas pages with their
+     * shared sections and components expanded, like the site renders them. Kept a minute.
+     */
+    const publishedForms = async () => {
+        if (formCache && Date.now() - formCache.at < 60_000)
+            return formCache.forms;
+        const forms = new Map();
+        const globals = (await settings.get('globals')) ?? {};
+        const components = (await settings.get('components')) ?? {};
+        const collect = (nodes) => walk(expandComponents(expandGlobals(nodes, globals), components), (n) => {
+            const def = formDefinition(n);
+            if (def && !forms.has(def.id))
+                forms.set(def.id, def);
+        });
+        for (const def of ctx.config().collections) {
+            const pageFields = Object.entries(def.fields)
+                .filter(([, f]) => f.kind === 'page')
+                .map(([name]) => name);
+            if (!pageFields.length)
+                continue;
+            for (const doc of await content.published(def.name)) {
+                for (const name of pageFields) {
+                    const nodes = doc.publishedData?.[name];
+                    if (Array.isArray(nodes))
+                        collect(nodes);
+                }
+            }
+        }
+        collect(Object.values(globals));
+        formCache = { at: Date.now(), forms };
+        return forms;
+    };
+    const formsSettings = async () => (await settings.get('forms')) ?? {};
+    /** The secret that signs webhook calls, made the first time it is needed. */
+    const webhookSecret = async () => {
+        const current = await formsSettings();
+        if (current.webhookSecret)
+            return current.webhookSecret;
+        const secret = `whsec_${randomBytes(24).toString('base64url')}`;
+        await settings.set('forms', { ...current, webhookSecret: secret });
+        return secret;
+    };
+    app.post('/api/forms/:form', bodyLimit({
+        maxSize: 25 * 1024 * 1024,
+        onError: () => {
+            throw new ApiError(413, 'file_too_large', 'Gli allegati sono troppo grandi');
+        },
+    }), async (c) => {
         const form = c.req.param('form').slice(0, 80);
         const ip = clientIp(c);
         if (!allowForm(`${ip}:${form}`))
             throw new ApiError(429, 'too_many_attempts', 'Troppi messaggi: riprova tra un minuto');
-        const isJson = (c.req.header('content-type') ?? '').includes('application/json');
+        const type = c.req.header('content-type') ?? '';
+        const isJson = type.includes('application/json');
+        const wantsJson = isJson || (c.req.header('accept') ?? '').includes('application/json');
         const raw = (isJson ? await c.req.json().catch(() => ({})) : await c.req.parseBody());
         const page = typeof raw._page === 'string' ? raw._page.slice(0, 300) : (c.req.header('referer') ?? '').slice(0, 300);
-        // A field people never see: bots fill it in.
-        const trap = typeof raw._gotcha === 'string' && raw._gotcha.length > 0;
-        const data = {};
-        for (const [k, v] of Object.entries(raw)) {
-            if (k.startsWith('_') || typeof v !== 'string' || Object.keys(data).length >= 30)
-                continue;
-            data[k.slice(0, 80)] = v.slice(0, 5000);
-        }
-        if (!trap && Object.values(data).some((v) => v.trim())) {
-            const saved = await submissions.add({ form, page, data });
+        const back = (c.req.header('referer') ?? '/').split('#')[0];
+        // A field people never see: bots fill it in. They get the same answer as everyone.
+        if (typeof raw._gotcha === 'string' && raw._gotcha.length > 0)
+            return wantsJson ? c.json({ ok: true }) : c.redirect(`${back}#inviato`, 303);
+        const def = (await publishedForms()).get(form) ?? null;
+        const { data, files, issues } = await readSubmission(raw, def);
+        if (issues.length) {
+            if (!wantsJson)
+                return c.redirect(`${back}#non-inviato`, 303);
+            return c.json({ error: { code: 'invalid', message: 'Controlla i campi evidenziati', issues } }, 422);
+        }
+        if (!Object.values(data).some((v) => v.trim()) && !files.length)
+            return wantsJson ? c.json({ ok: true }) : c.redirect(`${back}#inviato`, 303);
+        const elapsed = typeof raw._t === 'string' && /^\d+$/.test(raw._t) ? Number(raw._t) : null;
+        const fingerprint = fingerprintOf(form, data);
+        const spam = spamReason(data, elapsed) ??
+            ((await submissions.seen(fingerprint, new Date(Date.now() - 86_400_000))) ? 'Messaggio ripetuto' : null);
+        const formName = def?.name?.trim() || def?.subject?.trim() || '';
+        const saved = await submissions.add({ form, formName, page, data, spam, fingerprint });
+        if (files.length)
+            await submissions.setFiles(saved.id, await saveFiles(uploadsDir, saved.id, files));
+        // Spam stays in the panel, recoverable, but nobody is notified.
+        if (!spam) {
             const mail = await settings.get('mail');
-            if (isConfigured(mail) && mail.to) {
-                const replyTo = Object.entries(data).find(([k, v]) => /mail/i.test(k) && /^[^\s@]+@[^\s@]+$/.test(v))?.[1];
+            const to = (def?.to || mail?.to || '').trim();
+            const sender = Object.entries(data).find(([k, v]) => (def?.fields.find((f) => f.name === k)?.kind === 'email' || /mail/i.test(k)) && /^[^\s@]+@[^\s@]+$/.test(v))?.[1];
+            if (isConfigured(mail) && to) {
+                const subject = def?.subject || (typeof raw._subject === 'string' ? raw._subject.slice(0, 120) : '');
+                const attached = files.length
+                    ? `\n\nAllegati (${files.map((f) => f.name).join(', ')}): li trovi in Impostazioni → Messaggi.`
+                    : '';
                 sendMail(mail, {
-                    to: mail.to,
-                    subject: `Nuovo messaggio dal sito${typeof raw._subject === 'string' ? `: ${raw._subject.slice(0, 120)}` : ''}`,
-                    text: submissionText(page, data),
-                    replyTo,
+                    to,
+                    subject: `Nuovo messaggio dal sito${subject ? `: ${subject}` : ''}`,
+                    text: submissionText(page, data) + attached,
+                    replyTo: sender,
                 })
                     .then(() => submissions.markMailed(saved.id))
                     .catch((error) => console.error('Materialize: email not sent', error));
+                // An answer to whoever wrote: the site's own words only, never what was sent.
+                if (sender && def?.autoReply?.text?.trim())
+                    sendMail(mail, {
+                        to: sender,
+                        subject: def.autoReply.subject?.trim() || 'Abbiamo ricevuto il tuo messaggio',
+                        text: def.autoReply.text,
+                        replyTo: to.split(',')[0]?.trim(),
+                    }).catch((error) => console.error('Materialize: automatic reply not sent', error));
+            }
+            if (def?.webhook) {
+                const payload = {
+                    id: saved.id,
+                    form: { id: form, name: formName },
+                    page,
+                    data,
+                    files: files.map((f) => ({ field: f.field, name: f.name, size: f.bytes.length })),
+                    createdAt: saved.createdAt.toISOString(),
+                };
+                void webhookSecret()
+                    .then((secret) => sendWebhook(def.webhook, payload, secret))
+                    .then((ok) => submissions.setWebhook(saved.id, ok ? 'ok' : 'failed'))
+                    .catch((error) => console.error('Materialize: webhook not sent', error));
             }
         }
         // Without JavaScript the browser posted the form itself: back to the page, marked as sent.
-        if (!isJson) {
-            const back = (c.req.header('referer') ?? '/').split('#')[0];
-            return c.redirect(`${back}#inviato`, 303);
-        }
-        return c.json({ ok: true });
+        return wantsJson ? c.json({ ok: true }) : c.redirect(`${back}#inviato`, 303);
+    });
+    const filterOf = (c) => ({
+        form: c.req.query('form') || undefined,
+        status: ['unread', 'spam'].find((s) => s === c.req.query('status')),
+        q: c.req.query('q')?.slice(0, 200) || undefined,
     });
     app.get('/api/submissions', requireUser, async (c) => {
         const limit = Math.min(Number(c.req.query('limit') ?? 50), 200);
         const offset = Math.max(Number(c.req.query('offset') ?? 0), 0);
-        return c.json(await submissions.list(limit, offset));
+        return c.json({
+            ...(await submissions.list(limit, offset, filterOf(c))),
+            forms: await submissions.forms(),
+        });
+    });
+    /** The messages as a spreadsheet (one column per field), with the filters of the list. */
+    app.get('/api/submissions/export.csv', requireUser, async (c) => {
+        const { items } = await submissions.list(10_000, 0, filterOf(c));
+        const fields = [...new Set(items.flatMap((m) => Object.keys(m.data)))];
+        const cell = (v) => {
+            // A leading =, +, - or @ would run as a formula in a spreadsheet.
+            const safe = /^[=+\-@\t\r]/.test(v) ? `'${v}` : v;
+            return /[",\n;]/.test(safe) ? `"${safe.replace(/"/g, '""')}"` : safe;
+        };
+        const rows = [
+            ['Data', 'Modulo', 'Pagina', ...fields],
+            ...items.map((m) => [
+                m.createdAt.toISOString(),
+                m.formName || m.form,
+                m.page,
+                ...fields.map((f) => m.data[f] ?? ''),
+            ]),
+        ];
+        await record(c, 'message.exported', '', { count: items.length });
+        // With the byte order mark, Excel reads accented letters right.
+        return new Response(`${rows.map((r) => r.map(cell).join(',')).join('\r\n')}\r\n`, {
+            headers: {
+                'content-type': 'text/csv; charset=utf-8',
+                'content-disposition': `attachment; filename="messaggi-${new Date().toISOString().slice(0, 10)}.csv"`,
+                'cache-control': 'no-store',
+            },
+        });
     });
     app.patch('/api/submissions/:id', requireUser, async (c) => {
-        const input = await body(c, z.object({ read: z.boolean() }));
-        await submissions.markRead(c.req.param('id'), input.read);
+        const input = await body(c, z.object({ read: z.boolean().optional(), spam: z.boolean().optional() }));
+        const id = c.req.param('id');
+        if (input.read !== undefined)
+            await submissions.markRead(id, input.read);
+        if (input.spam !== undefined)
+            await submissions.markSpam(id, input.spam ? 'Segnato a mano' : null);
         return c.json({ ok: true });
     });
+    /** A file sent with a message: always downloaded, never opened in the panel's own page. */
+    app.get('/api/submissions/:id/files/:n', requireUser, async (c) => {
+        const message = await submissions.get(c.req.param('id'));
+        const file = message?.files[Number(c.req.param('n'))];
+        if (!message || !file)
+            throw new ApiError(404, 'not_found', 'File non trovato');
+        const bytes = await readFile(join(uploadsDir, file.path)).catch(() => null);
+        if (!bytes)
+            throw new ApiError(404, 'not_found', 'Il file non c’è più');
+        return new Response(bytes, {
+            headers: {
+                'content-type': 'application/octet-stream',
+                'content-disposition': `attachment; filename*=UTF-8''${encodeURIComponent(file.name)}`,
+                'x-content-type-options': 'nosniff',
+                'cache-control': 'no-store',
+            },
+        });
+    });
     app.delete('/api/submissions/:id', requireUser, requireAdmin, async (c) => {
         await submissions.remove(c.req.param('id'));
+        await removeFiles(uploadsDir, c.req.param('id'));
         await record(c, 'message.deleted');
         return c.body(null, 204);
     });
+    /** How long messages are kept, and the key to check webhook calls (admins only see the key). */
+    app.get('/api/forms/settings', requireUser, async (c) => {
+        const current = await formsSettings();
+        const admin = c.get('user').role === 'admin';
+        return c.json({
+            keepMonths: current.keepMonths ?? null,
+            webhookSecret: admin ? await webhookSecret() : null,
+        });
+    });
+    app.put('/api/forms/settings', requireUser, requireAdmin, async (c) => {
+        const input = await body(c, z.object({ keepMonths: z.number().int().min(1).max(120).nullable() }));
+        const current = await formsSettings();
+        await settings.set('forms', { ...current, keepMonths: input.keepMonths ?? undefined }, c.get('user').id);
+        await record(c, 'settings.forms', '', { keepMonths: input.keepMonths });
+        void pruneMessages();
+        return c.json({ keepMonths: input.keepMonths });
+    });
+    /** Deletes the messages older than the kept months, with their files. */
+    const pruneMessages = async () => {
+        const months = (await formsSettings()).keepMonths;
+        if (!months)
+            return 0;
+        const before = new Date();
+        before.setMonth(before.getMonth() - months);
+        const old = await submissions.olderThan(before);
+        for (const m of old) {
+            await submissions.remove(m.id);
+            await removeFiles(uploadsDir, m.id);
+        }
+        return old.length;
+    };
+    setTimeout(() => void pruneMessages().catch(() => { }), 10_000).unref?.();
+    setInterval(() => void pruneMessages().catch(() => { }), 6 * 3_600_000).unref?.();
     // Who may change what: editors limited to contents, if the admins want so.
     app.get('/api/editorial', requireUser, async (c) => c.json({ editorial: (await settings.get('editorial')) ?? {} }));
     app.put('/api/editorial', requireUser, requireSession, requireAdmin, async (c) => {
@@ -2011,7 +2289,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
             }),
         }));
         await settings.set('tracking', input.tracking, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.tracking', '', {
             services: trackingBlocks(input.tracking).map((b) => b.name),
         });
@@ -2022,7 +2300,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
     app.put('/api/seo', requireUser, requireAdmin, async (c) => {
         const input = await body(c, z.object({ seo: siteSeoSchema }));
         await settings.set('seo', input.seo, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.seo');
         return c.json({ seo: input.seo });
     });
@@ -2048,7 +2326,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
             .map((r) => ({ ...r, from: normalizePath(r.from), to: /^https?:\/\//.test(r.to) ? r.to : normalizePath(r.to) }))
             .filter((r, i, all) => r.from !== r.to && all.findIndex((o) => o.from === r.from) === i);
         await settings.set('redirects', redirects, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.redirects', '', { count: redirects.length });
         return c.json({ redirects });
     });
@@ -2057,7 +2335,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
     app.put('/api/templates', requireUser, async (c) => {
         const input = await body(c, z.object({ templates: z.record(z.string(), z.string()) }));
         await settings.set('templates', input.templates, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         return c.json({ templates: input.templates });
     });
     // Reusable components with their variants.
@@ -2069,7 +2347,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
         if (JSON.stringify(before) !== JSON.stringify(input.components) && (await contentOnly(c.get('user'))))
             throw designLocked();
         await settings.set('components', input.components, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         return c.json({ components: input.components });
     });
     // Entries with their data, for lists bound to a collection on the canvas.
@@ -2157,7 +2435,18 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
                 return null;
             }
         };
-        return c.json({ ...result, items: result.items.map((i) => ({ ...i, url: urlOf(i.slug) })) });
+        // What goes on or off the site by itself, for a label in the list.
+        const pending = await schedules.pending();
+        const when = (id, action) => pending.find((p) => p.documentId === id && p.action === action)?.runAt ?? null;
+        return c.json({
+            ...result,
+            items: result.items.map((i) => ({
+                ...i,
+                url: urlOf(i.slug),
+                publishAt: when(i.id, 'publish'),
+                unpublishAt: when(i.id, 'unpublish'),
+            })),
+        });
     });
     app.post('/api/collections/:name', requireUser, async (c) => {
         const def = collection(c.req.param('name'));
@@ -2170,7 +2459,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
         guardEmbeds(c.get('user'), null, draft.data);
         const doc = await slugGuard(() => content.create({ collection: def.name, locale: lang, ...draft, userId: c.get('user').id }));
         await record(c, 'document.created', doc.title, { collection: def.name, id: doc.id });
-        return c.json(toJson(doc), 201);
+        return c.json(await toJson(doc), 201);
     });
     const loadDocument = async (id) => {
         const doc = await content.get(id);
@@ -2178,7 +2467,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
             throw new ApiError(404, 'not_found', 'This document does not exist');
         return doc;
     };
-    app.get('/api/documents/:id', requireUser, async (c) => c.json(toJson(await loadDocument(c.req.param('id')))));
+    app.get('/api/documents/:id', requireUser, async (c) => c.json(await toJson(await loadDocument(c.req.param('id')))));
     app.put('/api/documents/:id', requireUser, async (c) => {
         const existing = await loadDocument(c.req.param('id'));
         const input = await body(c, documentBody);
@@ -2189,10 +2478,10 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
             if (f.kind === 'page')
                 await guardDesign(c.get('user'), existing.data[name], draft.data[name]);
         const doc = await slugGuard(() => content.update(existing.id, { ...draft, userId: c.get('user').id }));
-        return c.json(toJson(doc));
+        return c.json(await toJson(doc));
     });
-    app.post('/api/documents/:id/publish', requireUser, async (c) => {
-        const existing = await loadDocument(c.req.param('id'));
+    /** Puts a document's draft on the site: the same steps from the button and from a schedule. */
+    const publishDocument = async (existing, userId) => {
         // Validated now, not at save time: drafts may be incomplete and the schema may have changed since.
         const def = collection(existing.collection);
         const data = publishableData(def, existing.data);
@@ -2206,26 +2495,206 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
                 ? addMove(redirects, before, after)
                 : redirects.filter((r) => normalizePath(r.from) !== normalizePath(after));
             if (next.length !== redirects.length || next.some((r, i) => r !== redirects[i]))
-                await settings.set('redirects', next, c.get('user').id);
+                await settings.set('redirects', next, userId);
         }
-        const doc = (await content.publish(existing.id, c.get('user').id, data));
-        ctx.onPublish?.();
-        await record(c, 'document.published', doc.title, { collection: def.name, id: doc.id, url: after });
-        return c.json(toJson(doc));
+        const doc = (await content.publish(existing.id, userId, data));
+        sitePublished();
+        return { doc, url: after };
+    };
+    const unpublishDocument = async (existing, userId) => {
+        const doc = (await content.unpublish(existing.id, userId));
+        if (existing.publishedAt)
+            sitePublished();
+        return doc;
+    };
+    app.post('/api/documents/:id/publish', requireUser, async (c) => {
+        const existing = await loadDocument(c.req.param('id'));
+        const { doc, url } = await publishDocument(existing, c.get('user').id);
+        // Published by hand: a publication still waiting would only repeat it.
+        await schedules.cancel(existing.id, 'publish');
+        await record(c, 'document.published', doc.title, { collection: doc.collection, id: doc.id, url });
+        return c.json(await toJson(doc));
     });
     app.post('/api/documents/:id/unpublish', requireUser, async (c) => {
         const existing = await loadDocument(c.req.param('id'));
-        const doc = (await content.unpublish(existing.id, c.get('user').id));
-        if (existing.publishedAt)
-            ctx.onPublish?.();
+        const doc = await unpublishDocument(existing, c.get('user').id);
+        await schedules.cancel(existing.id, 'unpublish');
         await record(c, 'document.unpublished', doc.title, { collection: doc.collection, id: doc.id });
-        return c.json(toJson(doc));
+        return c.json(await toJson(doc));
     });
+    /**
+     * When a document goes on the site, or comes off it, by itself. `at` null cancels. A publication
+     * is checked now too, so missing fields show up when it is set, not when it fails at night.
+     */
+    app.put('/api/documents/:id/schedule', requireUser, async (c) => {
+        const existing = await loadDocument(c.req.param('id'));
+        const input = await body(c, z.object({ action: z.enum(['publish', 'unpublish']), at: z.iso.datetime({ offset: true }).nullable() }));
+        const user = c.get('user');
+        const label = input.action === 'publish' ? 'publish' : 'unpublish';
+        if (input.at === null) {
+            await schedules.cancel(existing.id, input.action);
+            await record(c, `document.schedule_cancelled`, existing.title, {
+                collection: existing.collection,
+                id: existing.id,
+                action: label,
+            });
+            return c.json(await toJson(existing));
+        }
+        const at = new Date(input.at);
+        if (at.getTime() <= Date.now() + 30_000)
+            throw new ApiError(400, 'past_time', 'Scegli un momento nel futuro, almeno tra un minuto');
+        const current = await schedules.forDocument(existing.id);
+        if (input.action === 'publish')
+            publishableData(collection(existing.collection), existing.data);
+        else {
+            if (!existing.publishedAt && !current.publish)
+                throw new ApiError(409, 'not_published', 'La pagina non è sul sito: programma prima la pubblicazione');
+            if (current.publish && current.publish.runAt >= at)
+                throw new ApiError(400, 'before_publish', 'La pagina verrebbe tolta prima di essere pubblicata');
+        }
+        if (input.action === 'publish' && current.unpublish && current.unpublish.runAt <= at)
+            throw new ApiError(400, 'after_unpublish', 'La pubblicazione verrebbe dopo il momento in cui la pagina va tolta');
+        await schedules.set({ documentId: existing.id, action: input.action, runAt: at, user });
+        await record(c, 'document.scheduled', existing.title, {
+            collection: existing.collection,
+            id: existing.id,
+            action: label,
+            at: at.toISOString(),
+        });
+        return c.json(await toJson(existing));
+    });
+    /**
+     * Runs the actions whose time has come, as the person who set them. A server that was off at the
+     * time catches up when it starts. A publication whose fields are no longer complete fails with a
+     * reason the panel shows, instead of putting a broken page online.
+     */
+    let schedulesRunning = false;
+    const runSchedules = async (now = new Date()) => {
+        if (schedulesRunning)
+            return 0;
+        schedulesRunning = true;
+        let ran = 0;
+        try {
+            for (const item of await schedules.due(now)) {
+                const note = (action, target, detail) => activityLog
+                    .record({
+                    userId: item.createdBy,
+                    userName: item.createdByName,
+                    action,
+                    target,
+                    detail: { ...detail, scheduled: true },
+                    ip: null,
+                })
+                    .catch((error) => console.error('Materialize: activity not recorded', error));
+                const existing = await content.get(item.documentId);
+                if (!existing) {
+                    await schedules.finish(item.id, 'failed', 'La pagina non esiste più');
+                    continue;
+                }
+                try {
+                    if (item.action === 'publish') {
+                        const def = ctx.config().collections.find((x) => x.name === existing.collection);
+                        const check = def ? validate(def, prepare(def, existing.data)) : null;
+                        if (!def || !check?.ok) {
+                            const fields = def && check && !check.ok
+                                ? [...new Set(check.issues.map((i) => def.fields[i.path.split('.')[0] ?? '']?.label ?? i.path))].join(', ')
+                                : '';
+                            throw new Error(def ? `Alcuni campi vanno completati${fields ? `: ${fields}` : ''}` : 'La raccolta non esiste più');
+                        }
+                        const { doc, url } = await publishDocument(existing, item.createdBy ?? undefined);
+                        await schedules.finish(item.id, 'done');
+                        await note('document.published', doc.title, { collection: doc.collection, id: doc.id, url });
+                    }
+                    else {
+                        const doc = await unpublishDocument(existing, item.createdBy ?? undefined);
+                        await schedules.finish(item.id, 'done');
+                        await note('document.unpublished', doc.title, { collection: doc.collection, id: doc.id });
+                    }
+                    ran++;
+                }
+                catch (error) {
+                    const message = error instanceof Error && error.message ? error.message : 'Errore imprevisto';
+                    await schedules.finish(item.id, 'failed', message);
+                    await note('document.schedule_failed', existing.title, {
+                        collection: existing.collection,
+                        id: existing.id,
+                        action: item.action,
+                        message,
+                    });
+                }
+            }
+        }
+        catch (error) {
+            console.error('Materialize: scheduled publishing failed', error);
+        }
+        finally {
+            schedulesRunning = false;
+        }
+        return ran;
+    };
+    setTimeout(() => void runSchedules(), 5_000).unref?.();
+    setInterval(() => void runSchedules(), 30_000).unref?.();
+    /** What is coming: every pending publication and removal, soonest first. */
+    app.get('/api/schedules', requireUser, async (c) => {
+        const items = await schedules.pending();
+        const docs = new Map();
+        for (const i of items)
+            if (!docs.has(i.documentId))
+                docs.set(i.documentId, await content.get(i.documentId));
+        return c.json({
+            items: items.flatMap((i) => {
+                const doc = docs.get(i.documentId);
+                return doc ? [{ ...i, title: doc.title, collection: doc.collection, locale: doc.locale }] : [];
+            }),
+        });
+    });
+    // ---------- shared preview links ----------
+    const previewJson = (c, link) => {
+        const path = `/_materialize/share/${link.token}`;
+        return { ...link, path, url: new URL(path, publicOrigin(c)).toString() };
+    };
+    /** The links that still work for a document, newest first. */
+    app.get('/api/documents/:id/previews', requireUser, async (c) => {
+        const existing = await loadDocument(c.req.param('id'));
+        return c.json({ items: (await previewLinks.forDocument(existing.id)).map((l) => previewJson(c, l)) });
+    });
+    /**
+     * A secret address that shows the latest saved draft with the site's own design, to people
+     * without an account: a client, a colleague. `days` null: until someone revokes it.
+     */
+    app.post('/api/documents/:id/previews', requireUser, async (c) => {
+        const existing = await loadDocument(c.req.param('id'));
+        const input = await body(c, z.object({ days: z.number().int().min(1).max(365).nullable() }));
+        if (!ctx.preview)
+            throw new ApiError(409, 'no_site', 'Questo sito non ha pagine da mostrare in anteprima');
+        if (!collection(existing.collection).url)
+            throw new ApiError(400, 'no_page', 'Questo contenuto non ha una pagina sul sito');
+        const expiresAt = input.days === null ? null : new Date(Date.now() + input.days * 86_400_000);
+        const link = await previewLinks.create({ documentId: existing.id, expiresAt, user: c.get('user') });
+        await record(c, 'document.preview_shared', existing.title, {
+            collection: existing.collection,
+            id: existing.id,
+            expiresAt: expiresAt?.toISOString() ?? null,
+        });
+        return c.json(previewJson(c, link), 201);
+    });
+    app.delete('/api/previews/:id', requireUser, async (c) => {
+        const link = await previewLinks.get(c.req.param('id'));
+        if (!link)
+            throw new ApiError(404, 'not_found', 'Link non trovato');
+        const doc = await content.get(link.documentId);
+        await previewLinks.revoke(link.id);
+        await record(c, 'document.preview_revoked', doc?.title ?? '', { id: link.documentId });
+        return c.body(null, 204);
+    });
+    void previewLinks.prune().catch(() => { });
     app.delete('/api/documents/:id', requireUser, requireAdmin, async (c) => {
         const existing = await loadDocument(c.req.param('id'));
         await content.remove(existing.id);
+        await schedules.removeForDocument(existing.id);
+        await previewLinks.removeForDocument(existing.id);
         if (existing.publishedAt)
-            ctx.onPublish?.();
+            sitePublished();
         await record(c, 'document.deleted', existing.title, { collection: existing.collection });
         return c.body(null, 204);
     });
@@ -2245,7 +2714,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
         if (!doc)
             throw new ApiError(404, 'not_found', 'This version does not exist');
         await record(c, 'document.restored', doc.title, { collection: doc.collection, id: doc.id });
-        return c.json(toJson(doc));
+        return c.json(await toJson(doc));
     });
     // ---------- languages and translations ----------
     /** How many documents each language has: removing a language hides them from the site. */
@@ -2270,7 +2739,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
         const value = { default: input.default, available: [...new Set(input.available)] };
         await settings.set('locales', value, c.get('user').id);
         languages = value;
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.languages', value.available.join(', '));
         return c.json({ locales: ctx.config().locales, documents: await countsByLocale() });
     });
@@ -2333,7 +2802,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
             sourceId: original?.id ?? doc.id,
         }));
         await record(c, 'document.translated', created.title, { locale: lang, id: created.id, ai: input.translate });
-        return c.json(toJson(created), 201);
+        return c.json(await toJson(created), 201);
     });
     /**
      * Brings a translation in line with its original: the original's structure and design, with the
@@ -2379,7 +2848,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
                 await guardDesign(c.get('user'), doc.data[name], data[name]);
         const draft = draftData(def, data);
         const saved = await slugGuard(() => content.update(doc.id, { ...draft, userId: c.get('user').id }));
-        return c.json({ document: toJson(saved), added: fresh.size });
+        return c.json({ document: await toJson(saved), added: fresh.size });
     });
     // ---------- importing a WordPress site ----------
     /** Some hosts turn away requests that do not say who they are. */
@@ -2603,7 +3072,7 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
             .then(async (result) => {
             await settings.set('imports:media', known, user.id);
             if (result.created.some((d) => d.published) || result.redirects)
-                ctx.onPublish?.();
+                sitePublished();
             await activityLog.record({
                 userId: user.id,
                 userName: user.name,
@@ -2790,5 +3259,6 @@ ${input.selected?.length ? `Selected on the canvas: ${input.selected.join(', ')}
             throw new ApiError(404, 'not_found', 'This page is not published');
         return c.json(publicDocument(doc));
     });
-    return app;
+    // runSchedules: for the tests, which cannot wait for the clock.
+    return Object.assign(app, { runSchedules });
 }