@materializecms/server 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,18 @@ Ogni versione, dalla più recente. Le novità in arrivo si scrivono sotto «Pros
 
 ## Prossima versione
 
+## 0.5.0 — 2026-11-05
+
+- **Nuovo logo**: una M fatta di blocchi che passano da trasparenti a pieni, perché i contenuti prendono forma. Il nome è in Geist. Lo trovi nel pannello, nella favicon, nella pagina di accesso e nel README; i file sono in `docs/assets`.
+- **Pubblicazione programmata**: scegli quando una pagina o un articolo esce, e se vuoi quando torna bozza da solo (offerte, eventi). Dal pulsante con il calendario accanto a «Pubblica», con scorciatoie come «Domani alle 9». Esce la bozza com'è in quel momento; i campi mancanti vengono segnalati subito, e se al momento di uscire qualcosa non va la pagina resta bozza e il pannello dice perché. Le date compaiono anche negli elenchi.
+- **Link di anteprima da condividere**: un link segreto per far vedere una bozza a un cliente o a un collega senza account, con il design vero del sito. Scade dopo 1, 7 o 30 giorni o quando lo revochi, segue le modifiche, non finisce su Google e mostra un'etichetta «Anteprima». Da «Altre azioni» → «Condividi anteprima».
+- **Pronto per le ricerche AI**: il sito pubblica `llms.txt`, l'indice per ChatGPT, Claude, Perplexity e gli altri assistenti, e una copia in Markdown di ogni pagina (per esempio `/chi-siamo.md`), più facile da leggere e citare. Si spegne in Impostazioni → SEO.
+- **Feed RSS** su `/rss.xml` con gli ultimi articoli, annunciato in ogni pagina; in Impostazioni → SEO si scelgono le raccolte.
+- **Blocco dei crawler AI più preciso**: blocca solo chi addestra modelli; le ricerche AI (ChatGPT Search, Claude, Perplexity) restano libere, perché portano visitatori. Prima PerplexityBot veniva bloccato.
+- **Controllo di accessibilità e prestazioni**: la scheda SEO dell'editor diventa **Controlli**, con tre gruppi. Accessibilità: contrasto dei testi misurato sulla pagina vera (WCAG), immagini senza descrizione, pulsanti e icone senza nome, campi senza etichetta, link poco chiari, titoli saltati, video senza pausa. Prestazioni: file da altri siti, GIF e video pesanti, video senza copertina, troppe scene 3D, script esterni, troppi caratteri. Prima di pubblicare, i problemi seri vengono elencati.
+- **Moduli più robusti**: antispam senza CAPTCHA (lo spam va in una cartella recuperabile), controlli dei campi anche sul server con il motivo accanto al campo, **file allegati** privati, destinatari per modulo, **risposta automatica** a chi scrive, **webhook** firmato per Zapier, Make e n8n. In Impostazioni → Messaggi: filtri per modulo, da leggere e spam, ricerca, **esportazione CSV** e cancellazione automatica dei messaggi vecchi. La casella da spuntare può aprire l'informativa privacy.
+- Una pagina riportata com'è sul sito (per esempio con ⌘Z) non risulta più «Modifiche da pubblicare».
+
 ## 0.4.0 — 2026-11-03
 
 - **Immagini di riferimento nell'assistente**: allega, incolla (⌘V) o trascina nella chat lo screenshot di un sito che ti piace, un mockup o uno schizzo, e l'assistente ne riprende impaginazione e atmosfera con le sezioni e lo stile del tuo sito. Fino a 4 immagini per messaggio; non vanno nella libreria e non finiscono sulla pagina.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@materializecms/server",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Il server di Materialize: API, accessi, media, backup, aggiornamenti dal pannello e server MCP.",
   "type": "module",
   "license": "MIT",
@@ -20,9 +20,9 @@
   "dependencies": {
     "@anthropic-ai/sdk": "1.3.0",
     "@hono/node-server": "2.1.5",
-    "@materializecms/admin": "0.4.0",
-    "@materializecms/core": "0.4.0",
-    "@materializecms/db": "0.4.0",
+    "@materializecms/admin": "0.5.0",
+    "@materializecms/core": "0.5.0",
+    "@materializecms/db": "0.5.0",
     "@modelcontextprotocol/sdk": "1.32.2",
     "hono": "4.13.14",
     "htmlparser2": "12.0.0",

package/src/app.d.ts

@@ -29,5 +29,7 @@ export interface ServerContext {
      */
     setupToken?: string;
 }
-export declare function createApp(base: ServerContext): Hono<Env, import("hono/types").BlankSchema, "/">;
+export declare function createApp(base: ServerContext): Hono<Env, import("hono/types").BlankSchema, "/"> & {
+    runSchedules: (now?: Date) => Promise<number>;
+};
 export {};

package/src/app.js

@@ -9,11 +9,11 @@ import { getConnInfo } from '@hono/node-server/conninfo';
 import { describeCollection, prepare, SLUG_PATTERN, slugify, titleOf, validate, } from '@materializecms/core';
 import { documentSlots, isLocaleCode, mergeTranslation, nodeSlots, untranslatedIds, withLocales, } from '@materializecms/core/i18n';
 import { senderDomain } from '@materializecms/core/mail';
-import { normalizeTheme, sameDesign } from '@materializecms/core/page';
+import { expandComponents, expandGlobals, formDefinition, normalizeTheme, sameDesign, walk, } from '@materializecms/core/page';
 import { addMove, normalizePath } from '@materializecms/core/seo';
 import { TRACKING_PATTERNS, trackingBlocks } from '@materializecms/core/tracking';
 import { DEFAULT_UPDATES, isPatch, } from '@materializecms/core/updates';
-import { createActivityStore, createAuthStore, createCommentStore, createContentStore, createMediaStore, createSettingsStore, createSubmissionStore, EmailTakenError, SlugTakenError, } from '@materializecms/db';
+import { createActivityStore, createAuthStore, createCommentStore, createContentStore, createMediaStore, createPreviewLinkStore, createScheduleStore, createSettingsStore, createSubmissionStore, EmailTakenError, SlugTakenError, } from '@materializecms/db';
 import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
 import { Hono } from 'hono';
 import { bodyLimit } from 'hono/body-limit';
@@ -28,6 +28,7 @@ import { AiError, complete, EMPTY_AI, isReady, publicAi, runTurn, translateTexts
 import { folderEntries, tarGz } from './archive.js';
 import { createBackups, DEFAULT_BACKUPS } from './backups.js';
 import { createFonts, FONT_FILE, FONT_ID } from './fonts.js';
+import { fingerprintOf, readSubmission, removeFiles, saveFiles, sendWebhook, spamReason, } from './forms.js';
 import { checkSenderDomain, explainMailError, isConfigured, publicMail, sendMail, submissionText, } from './mail.js';
 import { createMcpServer } from './mcp.js';
 import { createMediaFiles, fileBody, MAX_UPLOAD, MediaError, mediaUrl } from './media.js';
@@ -61,7 +62,10 @@ const FORGOT_THRESHOLD = 3;
 const FORGOT_IP_THRESHOLD = 10;
 /** Where people open their one-time link: the admin's welcome screen. */
 const linkPath = (token) => `/admin/_invite/${token}`;
-/** The custom code blocks in a document: it runs on the public site, so only admins may change it. */
+/**
+ * The custom code blocks in a document (it runs on the public site) and where its forms send
+ * their messages: only admins may change them.
+ */
 function embedsOf(value, out = []) {
     if (Array.isArray(value))
         for (const v of value)
@@ -70,6 +74,10 @@ function embedsOf(value, out = []) {
         const node = value;
         if (node.type === 'embed' && typeof node.id === 'string')
             out.push(`${node.id}:${String(node.html ?? '')}`);
+        // Where a form's messages go: someone who only edits pages must not divert them.
+        const form = node.form;
+        if (form && typeof node.id === 'string' && (form.to || form.webhook))
+            out.push(`form:${node.id}:${form.to ?? ''}:${form.webhook ?? ''}`);
         for (const v of Object.values(node))
             if (v && typeof v === 'object')
                 embedsOf(v, out);
@@ -132,6 +140,8 @@ const siteSeoSchema = z.object({
     })
         .optional(),
     blockAi: z.boolean().optional(),
+    llms: z.boolean().optional(),
+    feed: z.array(z.string().max(80)).max(50).optional(),
     disallow: z.array(z.string().trim().max(300)).max(100).optional(),
     google: short,
     bing: short,
@@ -179,6 +189,8 @@ export function createApp(base) {
     const submissions = createSubmissionStore(ctx.database.db);
     const comments = createCommentStore(ctx.database.db);
     const activityLog = createActivityStore(ctx.database.db);
+    const schedules = createScheduleStore(ctx.database.db);
+    const previewLinks = createPreviewLinkStore(ctx.database.db);
     const backups = createBackups(ctx.database, () => ctx.config().media.dir);
     const backupSettings = async () => ({
         ...DEFAULT_BACKUPS,
@@ -308,12 +320,20 @@ export function createApp(base) {
     const files = createMediaFiles(ctx.config().media.dir);
     // Fonts are cached next to the media library (.materialize/fonts by default).
     const fonts = createFonts(join(dirname(resolve(ctx.config().media.dir)), 'fonts'));
+    // Files sent with the site's forms: next to the database, never served by the public site.
+    const uploadsDir = join(dirname(resolve(ctx.config().media.dir)), 'uploads');
+    let formCache = null;
+    /** The live site changed: rebuild it, and read its forms again. */
+    const sitePublished = () => {
+        formCache = null;
+        ctx.onPublish?.();
+    };
     const app = new Hono();
     const guardEmbeds = (user, before, after) => {
         if (user.role === 'admin')
             return;
         if (JSON.stringify(embedsOf(before).sort()) !== JSON.stringify(embedsOf(after).sort()))
-            throw new ApiError(403, 'embed_admin_only', 'Solo un amministratore può aggiungere o modificare il codice personalizzato');
+            throw new ApiError(403, 'embed_admin_only', 'Solo un amministratore può modificare il codice personalizzato e dove arrivano i messaggi dei moduli');
     };
     /** Editors who may only change contents (Persone → Redattori): words, links and images, not the layout. */
     const contentOnly = async (user) => user.role !== 'admin' && !!(await settings.get('editorial'))?.editorsContentOnly;
@@ -432,13 +452,15 @@ export function createApp(base) {
         return `/${locale}${path === '/' ? '' : path}`;
     };
     /** A document as the admin sees it, with what still needs fixing before it can be published. */
-    const toJson = (doc) => {
+    const toJson = async (doc) => {
         const def = ctx.config().collections.find((x) => x.name === doc.collection);
         const check = def ? validate(def, prepare(def, doc.data)) : null;
         return {
             ...doc,
             url: def?.url ? def.url(doc.data) : null,
             issues: check && !check.ok ? check.issues : [],
+            /** When it goes on or off the site by itself, and the last scheduled action that failed. */
+            schedule: await schedules.forDocument(doc.id),
         };
     };
     /**
@@ -628,7 +650,7 @@ export function createApp(base) {
             : await content.create({ collection: def.name, locale: lang, ...draft });
         if (doc)
             await content.publish(doc.id);
-        ctx.onPublish?.();
+        sitePublished();
     };
     /** The site's name as set in the panel (the settings singleton, published), else the config's. */
     const siteName = async () => {
@@ -1102,6 +1124,7 @@ export function createApp(base) {
         const mediaDir = resolve(ctx.config().media.dir);
         entries.push(...(await folderEntries(mediaDir, 'media')));
         entries.push(...(await folderEntries(join(dirname(mediaDir), 'fonts'), 'fonts')));
+        entries.push(...(await folderEntries(uploadsDir, 'uploads')));
         const manifest = join(work, 'materialize.json');
         await writeFile(manifest, JSON.stringify({
             site: ctx.config().site.name,
@@ -1528,7 +1551,7 @@ export function createApp(base) {
         const input = await body(c, z.object({ theme: z.record(z.string(), z.unknown()) }));
         const theme = normalizeTheme(input.theme);
         await settings.set('theme', theme, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.theme');
         return c.json({ theme });
     });
@@ -1588,7 +1611,7 @@ export function createApp(base) {
                 .filter(([id]) => main[id])
                 .map(([id, n]) => [id, n]));
             await settings.set(`globals:${lang}`, words, c.get('user').id);
-            ctx.onPublish?.();
+            sitePublished();
             return c.json({ globals: await globalsIn(lang) });
         }
         const before = (await settings.get('globals')) ?? {};
@@ -1603,7 +1626,7 @@ export function createApp(base) {
         const ids = [...new Set([...Object.keys(before), ...Object.keys(input.globals)])].sort();
         await guardDesign(c.get('user'), ids.map((id) => before[id] ?? { id, type: 'frame' }), ids.map((id) => input.globals[id] ?? { id, type: 'frame' }));
         await settings.set('globals', input.globals, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         return c.json({ globals: input.globals });
     });
     // ---------- comments and presence ----------
@@ -1982,59 +2005,238 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             }
         });
     });
-    app.post('/api/forms/:form', async (c) => {
+    // ---------- forms ----------
+    /**
+     * Every form on the published site, by id, as the server checks it: canvas pages with their
+     * shared sections and components expanded, like the site renders them. Kept a minute.
+     */
+    const publishedForms = async () => {
+        if (formCache && Date.now() - formCache.at < 60_000)
+            return formCache.forms;
+        const forms = new Map();
+        const globals = (await settings.get('globals')) ?? {};
+        const components = (await settings.get('components')) ?? {};
+        const collect = (nodes) => walk(expandComponents(expandGlobals(nodes, globals), components), (n) => {
+            const def = formDefinition(n);
+            if (def && !forms.has(def.id))
+                forms.set(def.id, def);
+        });
+        for (const def of ctx.config().collections) {
+            const pageFields = Object.entries(def.fields)
+                .filter(([, f]) => f.kind === 'page')
+                .map(([name]) => name);
+            if (!pageFields.length)
+                continue;
+            for (const doc of await content.published(def.name)) {
+                for (const name of pageFields) {
+                    const nodes = doc.publishedData?.[name];
+                    if (Array.isArray(nodes))
+                        collect(nodes);
+                }
+            }
+        }
+        collect(Object.values(globals));
+        formCache = { at: Date.now(), forms };
+        return forms;
+    };
+    const formsSettings = async () => (await settings.get('forms')) ?? {};
+    /** The secret that signs webhook calls, made the first time it is needed. */
+    const webhookSecret = async () => {
+        const current = await formsSettings();
+        if (current.webhookSecret)
+            return current.webhookSecret;
+        const secret = `whsec_${randomBytes(24).toString('base64url')}`;
+        await settings.set('forms', { ...current, webhookSecret: secret });
+        return secret;
+    };
+    app.post('/api/forms/:form', bodyLimit({
+        maxSize: 25 * 1024 * 1024,
+        onError: () => {
+            throw new ApiError(413, 'file_too_large', 'Gli allegati sono troppo grandi');
+        },
+    }), async (c) => {
         const form = c.req.param('form').slice(0, 80);
         const ip = clientIp(c);
         if (!allowForm(`${ip}:${form}`))
             throw new ApiError(429, 'too_many_attempts', 'Troppi messaggi: riprova tra un minuto');
-        const isJson = (c.req.header('content-type') ?? '').includes('application/json');
+        const type = c.req.header('content-type') ?? '';
+        const isJson = type.includes('application/json');
+        const wantsJson = isJson || (c.req.header('accept') ?? '').includes('application/json');
         const raw = (isJson ? await c.req.json().catch(() => ({})) : await c.req.parseBody());
         const page = typeof raw._page === 'string' ? raw._page.slice(0, 300) : (c.req.header('referer') ?? '').slice(0, 300);
-        // A field people never see: bots fill it in.
-        const trap = typeof raw._gotcha === 'string' && raw._gotcha.length > 0;
-        const data = {};
-        for (const [k, v] of Object.entries(raw)) {
-            if (k.startsWith('_') || typeof v !== 'string' || Object.keys(data).length >= 30)
-                continue;
-            data[k.slice(0, 80)] = v.slice(0, 5000);
-        }
-        if (!trap && Object.values(data).some((v) => v.trim())) {
-            const saved = await submissions.add({ form, page, data });
+        const back = (c.req.header('referer') ?? '/').split('#')[0];
+        // A field people never see: bots fill it in. They get the same answer as everyone.
+        if (typeof raw._gotcha === 'string' && raw._gotcha.length > 0)
+            return wantsJson ? c.json({ ok: true }) : c.redirect(`${back}#inviato`, 303);
+        const def = (await publishedForms()).get(form) ?? null;
+        const { data, files, issues } = await readSubmission(raw, def);
+        if (issues.length) {
+            if (!wantsJson)
+                return c.redirect(`${back}#non-inviato`, 303);
+            return c.json({ error: { code: 'invalid', message: 'Controlla i campi evidenziati', issues } }, 422);
+        }
+        if (!Object.values(data).some((v) => v.trim()) && !files.length)
+            return wantsJson ? c.json({ ok: true }) : c.redirect(`${back}#inviato`, 303);
+        const elapsed = typeof raw._t === 'string' && /^\d+$/.test(raw._t) ? Number(raw._t) : null;
+        const fingerprint = fingerprintOf(form, data);
+        const spam = spamReason(data, elapsed) ??
+            ((await submissions.seen(fingerprint, new Date(Date.now() - 86_400_000))) ? 'Messaggio ripetuto' : null);
+        const formName = def?.name?.trim() || def?.subject?.trim() || '';
+        const saved = await submissions.add({ form, formName, page, data, spam, fingerprint });
+        if (files.length)
+            await submissions.setFiles(saved.id, await saveFiles(uploadsDir, saved.id, files));
+        // Spam stays in the panel, recoverable, but nobody is notified.
+        if (!spam) {
             const mail = await settings.get('mail');
-            if (isConfigured(mail) && mail.to) {
-                const replyTo = Object.entries(data).find(([k, v]) => /mail/i.test(k) && /^[^\s@]+@[^\s@]+$/.test(v))?.[1];
+            const to = (def?.to || mail?.to || '').trim();
+            const sender = Object.entries(data).find(([k, v]) => (def?.fields.find((f) => f.name === k)?.kind === 'email' || /mail/i.test(k)) && /^[^\s@]+@[^\s@]+$/.test(v))?.[1];
+            if (isConfigured(mail) && to) {
+                const subject = def?.subject || (typeof raw._subject === 'string' ? raw._subject.slice(0, 120) : '');
+                const attached = files.length
+                    ? `\n\nAllegati (${files.map((f) => f.name).join(', ')}): li trovi in Impostazioni → Messaggi.`
+                    : '';
                 sendMail(mail, {
-                    to: mail.to,
-                    subject: `Nuovo messaggio dal sito${typeof raw._subject === 'string' ? `: ${raw._subject.slice(0, 120)}` : ''}`,
-                    text: submissionText(page, data),
-                    replyTo,
+                    to,
+                    subject: `Nuovo messaggio dal sito${subject ? `: ${subject}` : ''}`,
+                    text: submissionText(page, data) + attached,
+                    replyTo: sender,
                 })
                     .then(() => submissions.markMailed(saved.id))
                     .catch((error) => console.error('Materialize: email not sent', error));
+                // An answer to whoever wrote: the site's own words only, never what was sent.
+                if (sender && def?.autoReply?.text?.trim())
+                    sendMail(mail, {
+                        to: sender,
+                        subject: def.autoReply.subject?.trim() || 'Abbiamo ricevuto il tuo messaggio',
+                        text: def.autoReply.text,
+                        replyTo: to.split(',')[0]?.trim(),
+                    }).catch((error) => console.error('Materialize: automatic reply not sent', error));
+            }
+            if (def?.webhook) {
+                const payload = {
+                    id: saved.id,
+                    form: { id: form, name: formName },
+                    page,
+                    data,
+                    files: files.map((f) => ({ field: f.field, name: f.name, size: f.bytes.length })),
+                    createdAt: saved.createdAt.toISOString(),
+                };
+                void webhookSecret()
+                    .then((secret) => sendWebhook(def.webhook, payload, secret))
+                    .then((ok) => submissions.setWebhook(saved.id, ok ? 'ok' : 'failed'))
+                    .catch((error) => console.error('Materialize: webhook not sent', error));
             }
         }
         // Without JavaScript the browser posted the form itself: back to the page, marked as sent.
-        if (!isJson) {
-            const back = (c.req.header('referer') ?? '/').split('#')[0];
-            return c.redirect(`${back}#inviato`, 303);
-        }
-        return c.json({ ok: true });
+        return wantsJson ? c.json({ ok: true }) : c.redirect(`${back}#inviato`, 303);
+    });
+    const filterOf = (c) => ({
+        form: c.req.query('form') || undefined,
+        status: ['unread', 'spam'].find((s) => s === c.req.query('status')),
+        q: c.req.query('q')?.slice(0, 200) || undefined,
     });
     app.get('/api/submissions', requireUser, async (c) => {
         const limit = Math.min(Number(c.req.query('limit') ?? 50), 200);
         const offset = Math.max(Number(c.req.query('offset') ?? 0), 0);
-        return c.json(await submissions.list(limit, offset));
+        return c.json({
+            ...(await submissions.list(limit, offset, filterOf(c))),
+            forms: await submissions.forms(),
+        });
+    });
+    /** The messages as a spreadsheet (one column per field), with the filters of the list. */
+    app.get('/api/submissions/export.csv', requireUser, async (c) => {
+        const { items } = await submissions.list(10_000, 0, filterOf(c));
+        const fields = [...new Set(items.flatMap((m) => Object.keys(m.data)))];
+        const cell = (v) => {
+            // A leading =, +, - or @ would run as a formula in a spreadsheet.
+            const safe = /^[=+\-@\t\r]/.test(v) ? `'${v}` : v;
+            return /[",\n;]/.test(safe) ? `"${safe.replace(/"/g, '""')}"` : safe;
+        };
+        const rows = [
+            ['Data', 'Modulo', 'Pagina', ...fields],
+            ...items.map((m) => [
+                m.createdAt.toISOString(),
+                m.formName || m.form,
+                m.page,
+                ...fields.map((f) => m.data[f] ?? ''),
+            ]),
+        ];
+        await record(c, 'message.exported', '', { count: items.length });
+        // With the byte order mark, Excel reads accented letters right.
+        return new Response(`${rows.map((r) => r.map(cell).join(',')).join('\r\n')}\r\n`, {
+            headers: {
+                'content-type': 'text/csv; charset=utf-8',
+                'content-disposition': `attachment; filename="messaggi-${new Date().toISOString().slice(0, 10)}.csv"`,
+                'cache-control': 'no-store',
+            },
+        });
     });
     app.patch('/api/submissions/:id', requireUser, async (c) => {
-        const input = await body(c, z.object({ read: z.boolean() }));
-        await submissions.markRead(c.req.param('id'), input.read);
+        const input = await body(c, z.object({ read: z.boolean().optional(), spam: z.boolean().optional() }));
+        const id = c.req.param('id');
+        if (input.read !== undefined)
+            await submissions.markRead(id, input.read);
+        if (input.spam !== undefined)
+            await submissions.markSpam(id, input.spam ? 'Segnato a mano' : null);
         return c.json({ ok: true });
     });
+    /** A file sent with a message: always downloaded, never opened in the panel's own page. */
+    app.get('/api/submissions/:id/files/:n', requireUser, async (c) => {
+        const message = await submissions.get(c.req.param('id'));
+        const file = message?.files[Number(c.req.param('n'))];
+        if (!message || !file)
+            throw new ApiError(404, 'not_found', 'File non trovato');
+        const bytes = await readFile(join(uploadsDir, file.path)).catch(() => null);
+        if (!bytes)
+            throw new ApiError(404, 'not_found', 'Il file non c’è più');
+        return new Response(bytes, {
+            headers: {
+                'content-type': 'application/octet-stream',
+                'content-disposition': `attachment; filename*=UTF-8''${encodeURIComponent(file.name)}`,
+                'x-content-type-options': 'nosniff',
+                'cache-control': 'no-store',
+            },
+        });
+    });
     app.delete('/api/submissions/:id', requireUser, requireAdmin, async (c) => {
         await submissions.remove(c.req.param('id'));
+        await removeFiles(uploadsDir, c.req.param('id'));
         await record(c, 'message.deleted');
         return c.body(null, 204);
     });
+    /** How long messages are kept, and the key to check webhook calls (admins only see the key). */
+    app.get('/api/forms/settings', requireUser, async (c) => {
+        const current = await formsSettings();
+        const admin = c.get('user').role === 'admin';
+        return c.json({
+            keepMonths: current.keepMonths ?? null,
+            webhookSecret: admin ? await webhookSecret() : null,
+        });
+    });
+    app.put('/api/forms/settings', requireUser, requireAdmin, async (c) => {
+        const input = await body(c, z.object({ keepMonths: z.number().int().min(1).max(120).nullable() }));
+        const current = await formsSettings();
+        await settings.set('forms', { ...current, keepMonths: input.keepMonths ?? undefined }, c.get('user').id);
+        await record(c, 'settings.forms', '', { keepMonths: input.keepMonths });
+        void pruneMessages();
+        return c.json({ keepMonths: input.keepMonths });
+    });
+    /** Deletes the messages older than the kept months, with their files. */
+    const pruneMessages = async () => {
+        const months = (await formsSettings()).keepMonths;
+        if (!months)
+            return 0;
+        const before = new Date();
+        before.setMonth(before.getMonth() - months);
+        const old = await submissions.olderThan(before);
+        for (const m of old) {
+            await submissions.remove(m.id);
+            await removeFiles(uploadsDir, m.id);
+        }
+        return old.length;
+    };
+    setTimeout(() => void pruneMessages().catch(() => { }), 10_000).unref?.();
+    setInterval(() => void pruneMessages().catch(() => { }), 6 * 3_600_000).unref?.();
     // Who may change what: editors limited to contents, if the admins want so.
     app.get('/api/editorial', requireUser, async (c) => c.json({ editorial: (await settings.get('editorial')) ?? {} }));
     app.put('/api/editorial', requireUser, requireSession, requireAdmin, async (c) => {
@@ -2087,7 +2289,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             }),
         }));
         await settings.set('tracking', input.tracking, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.tracking', '', {
             services: trackingBlocks(input.tracking).map((b) => b.name),
         });
@@ -2098,7 +2300,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     app.put('/api/seo', requireUser, requireAdmin, async (c) => {
         const input = await body(c, z.object({ seo: siteSeoSchema }));
         await settings.set('seo', input.seo, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.seo');
         return c.json({ seo: input.seo });
     });
@@ -2124,7 +2326,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             .map((r) => ({ ...r, from: normalizePath(r.from), to: /^https?:\/\//.test(r.to) ? r.to : normalizePath(r.to) }))
             .filter((r, i, all) => r.from !== r.to && all.findIndex((o) => o.from === r.from) === i);
         await settings.set('redirects', redirects, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.redirects', '', { count: redirects.length });
         return c.json({ redirects });
     });
@@ -2133,7 +2335,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
     app.put('/api/templates', requireUser, async (c) => {
         const input = await body(c, z.object({ templates: z.record(z.string(), z.string()) }));
         await settings.set('templates', input.templates, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         return c.json({ templates: input.templates });
     });
     // Reusable components with their variants.
@@ -2145,7 +2347,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         if (JSON.stringify(before) !== JSON.stringify(input.components) && (await contentOnly(c.get('user'))))
             throw designLocked();
         await settings.set('components', input.components, c.get('user').id);
-        ctx.onPublish?.();
+        sitePublished();
         return c.json({ components: input.components });
     });
     // Entries with their data, for lists bound to a collection on the canvas.
@@ -2233,7 +2435,18 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                 return null;
             }
         };
-        return c.json({ ...result, items: result.items.map((i) => ({ ...i, url: urlOf(i.slug) })) });
+        // What goes on or off the site by itself, for a label in the list.
+        const pending = await schedules.pending();
+        const when = (id, action) => pending.find((p) => p.documentId === id && p.action === action)?.runAt ?? null;
+        return c.json({
+            ...result,
+            items: result.items.map((i) => ({
+                ...i,
+                url: urlOf(i.slug),
+                publishAt: when(i.id, 'publish'),
+                unpublishAt: when(i.id, 'unpublish'),
+            })),
+        });
     });
     app.post('/api/collections/:name', requireUser, async (c) => {
         const def = collection(c.req.param('name'));
@@ -2246,7 +2459,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         guardEmbeds(c.get('user'), null, draft.data);
         const doc = await slugGuard(() => content.create({ collection: def.name, locale: lang, ...draft, userId: c.get('user').id }));
         await record(c, 'document.created', doc.title, { collection: def.name, id: doc.id });
-        return c.json(toJson(doc), 201);
+        return c.json(await toJson(doc), 201);
     });
     const loadDocument = async (id) => {
         const doc = await content.get(id);
@@ -2254,7 +2467,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             throw new ApiError(404, 'not_found', 'This document does not exist');
         return doc;
     };
-    app.get('/api/documents/:id', requireUser, async (c) => c.json(toJson(await loadDocument(c.req.param('id')))));
+    app.get('/api/documents/:id', requireUser, async (c) => c.json(await toJson(await loadDocument(c.req.param('id')))));
     app.put('/api/documents/:id', requireUser, async (c) => {
         const existing = await loadDocument(c.req.param('id'));
         const input = await body(c, documentBody);
@@ -2265,10 +2478,10 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             if (f.kind === 'page')
                 await guardDesign(c.get('user'), existing.data[name], draft.data[name]);
         const doc = await slugGuard(() => content.update(existing.id, { ...draft, userId: c.get('user').id }));
-        return c.json(toJson(doc));
+        return c.json(await toJson(doc));
     });
-    app.post('/api/documents/:id/publish', requireUser, async (c) => {
-        const existing = await loadDocument(c.req.param('id'));
+    /** Puts a document's draft on the site: the same steps from the button and from a schedule. */
+    const publishDocument = async (existing, userId) => {
         // Validated now, not at save time: drafts may be incomplete and the schema may have changed since.
         const def = collection(existing.collection);
         const data = publishableData(def, existing.data);
@@ -2282,26 +2495,206 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                 ? addMove(redirects, before, after)
                 : redirects.filter((r) => normalizePath(r.from) !== normalizePath(after));
             if (next.length !== redirects.length || next.some((r, i) => r !== redirects[i]))
-                await settings.set('redirects', next, c.get('user').id);
+                await settings.set('redirects', next, userId);
         }
-        const doc = (await content.publish(existing.id, c.get('user').id, data));
-        ctx.onPublish?.();
-        await record(c, 'document.published', doc.title, { collection: def.name, id: doc.id, url: after });
-        return c.json(toJson(doc));
+        const doc = (await content.publish(existing.id, userId, data));
+        sitePublished();
+        return { doc, url: after };
+    };
+    const unpublishDocument = async (existing, userId) => {
+        const doc = (await content.unpublish(existing.id, userId));
+        if (existing.publishedAt)
+            sitePublished();
+        return doc;
+    };
+    app.post('/api/documents/:id/publish', requireUser, async (c) => {
+        const existing = await loadDocument(c.req.param('id'));
+        const { doc, url } = await publishDocument(existing, c.get('user').id);
+        // Published by hand: a publication still waiting would only repeat it.
+        await schedules.cancel(existing.id, 'publish');
+        await record(c, 'document.published', doc.title, { collection: doc.collection, id: doc.id, url });
+        return c.json(await toJson(doc));
     });
     app.post('/api/documents/:id/unpublish', requireUser, async (c) => {
         const existing = await loadDocument(c.req.param('id'));
-        const doc = (await content.unpublish(existing.id, c.get('user').id));
-        if (existing.publishedAt)
-            ctx.onPublish?.();
+        const doc = await unpublishDocument(existing, c.get('user').id);
+        await schedules.cancel(existing.id, 'unpublish');
         await record(c, 'document.unpublished', doc.title, { collection: doc.collection, id: doc.id });
-        return c.json(toJson(doc));
+        return c.json(await toJson(doc));
+    });
+    /**
+     * When a document goes on the site, or comes off it, by itself. `at` null cancels. A publication
+     * is checked now too, so missing fields show up when it is set, not when it fails at night.
+     */
+    app.put('/api/documents/:id/schedule', requireUser, async (c) => {
+        const existing = await loadDocument(c.req.param('id'));
+        const input = await body(c, z.object({ action: z.enum(['publish', 'unpublish']), at: z.iso.datetime({ offset: true }).nullable() }));
+        const user = c.get('user');
+        const label = input.action === 'publish' ? 'publish' : 'unpublish';
+        if (input.at === null) {
+            await schedules.cancel(existing.id, input.action);
+            await record(c, `document.schedule_cancelled`, existing.title, {
+                collection: existing.collection,
+                id: existing.id,
+                action: label,
+            });
+            return c.json(await toJson(existing));
+        }
+        const at = new Date(input.at);
+        if (at.getTime() <= Date.now() + 30_000)
+            throw new ApiError(400, 'past_time', 'Scegli un momento nel futuro, almeno tra un minuto');
+        const current = await schedules.forDocument(existing.id);
+        if (input.action === 'publish')
+            publishableData(collection(existing.collection), existing.data);
+        else {
+            if (!existing.publishedAt && !current.publish)
+                throw new ApiError(409, 'not_published', 'La pagina non è sul sito: programma prima la pubblicazione');
+            if (current.publish && current.publish.runAt >= at)
+                throw new ApiError(400, 'before_publish', 'La pagina verrebbe tolta prima di essere pubblicata');
+        }
+        if (input.action === 'publish' && current.unpublish && current.unpublish.runAt <= at)
+            throw new ApiError(400, 'after_unpublish', 'La pubblicazione verrebbe dopo il momento in cui la pagina va tolta');
+        await schedules.set({ documentId: existing.id, action: input.action, runAt: at, user });
+        await record(c, 'document.scheduled', existing.title, {
+            collection: existing.collection,
+            id: existing.id,
+            action: label,
+            at: at.toISOString(),
+        });
+        return c.json(await toJson(existing));
+    });
+    /**
+     * Runs the actions whose time has come, as the person who set them. A server that was off at the
+     * time catches up when it starts. A publication whose fields are no longer complete fails with a
+     * reason the panel shows, instead of putting a broken page online.
+     */
+    let schedulesRunning = false;
+    const runSchedules = async (now = new Date()) => {
+        if (schedulesRunning)
+            return 0;
+        schedulesRunning = true;
+        let ran = 0;
+        try {
+            for (const item of await schedules.due(now)) {
+                const note = (action, target, detail) => activityLog
+                    .record({
+                    userId: item.createdBy,
+                    userName: item.createdByName,
+                    action,
+                    target,
+                    detail: { ...detail, scheduled: true },
+                    ip: null,
+                })
+                    .catch((error) => console.error('Materialize: activity not recorded', error));
+                const existing = await content.get(item.documentId);
+                if (!existing) {
+                    await schedules.finish(item.id, 'failed', 'La pagina non esiste più');
+                    continue;
+                }
+                try {
+                    if (item.action === 'publish') {
+                        const def = ctx.config().collections.find((x) => x.name === existing.collection);
+                        const check = def ? validate(def, prepare(def, existing.data)) : null;
+                        if (!def || !check?.ok) {
+                            const fields = def && check && !check.ok
+                                ? [...new Set(check.issues.map((i) => def.fields[i.path.split('.')[0] ?? '']?.label ?? i.path))].join(', ')
+                                : '';
+                            throw new Error(def ? `Alcuni campi vanno completati${fields ? `: ${fields}` : ''}` : 'La raccolta non esiste più');
+                        }
+                        const { doc, url } = await publishDocument(existing, item.createdBy ?? undefined);
+                        await schedules.finish(item.id, 'done');
+                        await note('document.published', doc.title, { collection: doc.collection, id: doc.id, url });
+                    }
+                    else {
+                        const doc = await unpublishDocument(existing, item.createdBy ?? undefined);
+                        await schedules.finish(item.id, 'done');
+                        await note('document.unpublished', doc.title, { collection: doc.collection, id: doc.id });
+                    }
+                    ran++;
+                }
+                catch (error) {
+                    const message = error instanceof Error && error.message ? error.message : 'Errore imprevisto';
+                    await schedules.finish(item.id, 'failed', message);
+                    await note('document.schedule_failed', existing.title, {
+                        collection: existing.collection,
+                        id: existing.id,
+                        action: item.action,
+                        message,
+                    });
+                }
+            }
+        }
+        catch (error) {
+            console.error('Materialize: scheduled publishing failed', error);
+        }
+        finally {
+            schedulesRunning = false;
+        }
+        return ran;
+    };
+    setTimeout(() => void runSchedules(), 5_000).unref?.();
+    setInterval(() => void runSchedules(), 30_000).unref?.();
+    /** What is coming: every pending publication and removal, soonest first. */
+    app.get('/api/schedules', requireUser, async (c) => {
+        const items = await schedules.pending();
+        const docs = new Map();
+        for (const i of items)
+            if (!docs.has(i.documentId))
+                docs.set(i.documentId, await content.get(i.documentId));
+        return c.json({
+            items: items.flatMap((i) => {
+                const doc = docs.get(i.documentId);
+                return doc ? [{ ...i, title: doc.title, collection: doc.collection, locale: doc.locale }] : [];
+            }),
+        });
+    });
+    // ---------- shared preview links ----------
+    const previewJson = (c, link) => {
+        const path = `/_materialize/share/${link.token}`;
+        return { ...link, path, url: new URL(path, publicOrigin(c)).toString() };
+    };
+    /** The links that still work for a document, newest first. */
+    app.get('/api/documents/:id/previews', requireUser, async (c) => {
+        const existing = await loadDocument(c.req.param('id'));
+        return c.json({ items: (await previewLinks.forDocument(existing.id)).map((l) => previewJson(c, l)) });
+    });
+    /**
+     * A secret address that shows the latest saved draft with the site's own design, to people
+     * without an account: a client, a colleague. `days` null: until someone revokes it.
+     */
+    app.post('/api/documents/:id/previews', requireUser, async (c) => {
+        const existing = await loadDocument(c.req.param('id'));
+        const input = await body(c, z.object({ days: z.number().int().min(1).max(365).nullable() }));
+        if (!ctx.preview)
+            throw new ApiError(409, 'no_site', 'Questo sito non ha pagine da mostrare in anteprima');
+        if (!collection(existing.collection).url)
+            throw new ApiError(400, 'no_page', 'Questo contenuto non ha una pagina sul sito');
+        const expiresAt = input.days === null ? null : new Date(Date.now() + input.days * 86_400_000);
+        const link = await previewLinks.create({ documentId: existing.id, expiresAt, user: c.get('user') });
+        await record(c, 'document.preview_shared', existing.title, {
+            collection: existing.collection,
+            id: existing.id,
+            expiresAt: expiresAt?.toISOString() ?? null,
+        });
+        return c.json(previewJson(c, link), 201);
+    });
+    app.delete('/api/previews/:id', requireUser, async (c) => {
+        const link = await previewLinks.get(c.req.param('id'));
+        if (!link)
+            throw new ApiError(404, 'not_found', 'Link non trovato');
+        const doc = await content.get(link.documentId);
+        await previewLinks.revoke(link.id);
+        await record(c, 'document.preview_revoked', doc?.title ?? '', { id: link.documentId });
+        return c.body(null, 204);
     });
+    void previewLinks.prune().catch(() => { });
     app.delete('/api/documents/:id', requireUser, requireAdmin, async (c) => {
         const existing = await loadDocument(c.req.param('id'));
         await content.remove(existing.id);
+        await schedules.removeForDocument(existing.id);
+        await previewLinks.removeForDocument(existing.id);
         if (existing.publishedAt)
-            ctx.onPublish?.();
+            sitePublished();
         await record(c, 'document.deleted', existing.title, { collection: existing.collection });
         return c.body(null, 204);
     });
@@ -2321,7 +2714,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         if (!doc)
             throw new ApiError(404, 'not_found', 'This version does not exist');
         await record(c, 'document.restored', doc.title, { collection: doc.collection, id: doc.id });
-        return c.json(toJson(doc));
+        return c.json(await toJson(doc));
     });
     // ---------- languages and translations ----------
     /** How many documents each language has: removing a language hides them from the site. */
@@ -2346,7 +2739,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
         const value = { default: input.default, available: [...new Set(input.available)] };
         await settings.set('locales', value, c.get('user').id);
         languages = value;
-        ctx.onPublish?.();
+        sitePublished();
         await record(c, 'settings.languages', value.available.join(', '));
         return c.json({ locales: ctx.config().locales, documents: await countsByLocale() });
     });
@@ -2409,7 +2802,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             sourceId: original?.id ?? doc.id,
         }));
         await record(c, 'document.translated', created.title, { locale: lang, id: created.id, ai: input.translate });
-        return c.json(toJson(created), 201);
+        return c.json(await toJson(created), 201);
     });
     /**
      * Brings a translation in line with its original: the original's structure and design, with the
@@ -2455,7 +2848,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
                 await guardDesign(c.get('user'), doc.data[name], data[name]);
         const draft = draftData(def, data);
         const saved = await slugGuard(() => content.update(doc.id, { ...draft, userId: c.get('user').id }));
-        return c.json({ document: toJson(saved), added: fresh.size });
+        return c.json({ document: await toJson(saved), added: fresh.size });
     });
     // ---------- importing a WordPress site ----------
     /** Some hosts turn away requests that do not say who they are. */
@@ -2679,7 +3072,7 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             .then(async (result) => {
             await settings.set('imports:media', known, user.id);
             if (result.created.some((d) => d.published) || result.redirects)
-                ctx.onPublish?.();
+                sitePublished();
             await activityLog.record({
                 userId: user.id,
                 userName: user.name,
@@ -2866,5 +3259,6 @@ When done, say in one or two short sentences what you changed. Reply in the pers
             throw new ApiError(404, 'not_found', 'This page is not published');
         return c.json(publicDocument(doc));
     });
-    return app;
+    // runSchedules: for the tests, which cannot wait for the clock.
+    return Object.assign(app, { runSchedules });
 }

package/src/forms.d.ts

@@ -0,0 +1,47 @@
+import { type FormDefinition } from '@materializecms/core/page';
+import type { SubmissionFile } from '@materializecms/db';
+/** Settings for every form, kept in the "forms" setting. */
+export interface FormsSettings {
+    /** Messages older than this many months are deleted with their files; unset keeps them. */
+    keepMonths?: number;
+    /** Signs webhook calls, so the receiver can tell they come from this site. */
+    webhookSecret?: string;
+}
+export interface FieldIssue {
+    field: string;
+    message: string;
+}
+/** A sent file, before it is saved. */
+export interface IncomingFile {
+    field: string;
+    name: string;
+    type: string;
+    bytes: Uint8Array;
+}
+/**
+ * What a form sent, checked against the form on the page: only its fields, the required ones
+ * filled in, emails that look like emails, choices from the list, files of the right kind and
+ * size. Without a definition (a form the site built by hand) the values are taken as they come.
+ */
+export declare function readSubmission(raw: Record<string, unknown>, def: FormDefinition | null): Promise<{
+    data: Record<string, string>;
+    files: IncomingFile[];
+    issues: FieldIssue[];
+}>;
+/**
+ * Why a message looks like spam, without a CAPTCHA: filled in at once, too many links, links
+ * hidden in markup. Null for a message that looks real. Repeats are checked by the caller.
+ */
+export declare function spamReason(data: Record<string, string>, elapsedMs: number | null): string | null;
+/** The same words from the same form: two identical messages in a day are a repeat. */
+export declare const fingerprintOf: (form: string, data: Record<string, string>) => string;
+/** Saves a message's files in its own folder, out of reach of the public site. */
+export declare function saveFiles(dir: string, id: string, files: IncomingFile[]): Promise<SubmissionFile[]>;
+export declare const removeFiles: (dir: string, id: string) => Promise<void>;
+/** The signature of a webhook body: `sha256=` and the HMAC of the body with the site's secret. */
+export declare const webhookSignature: (secret: string, body: string) => string;
+/**
+ * Posts a message to a webhook (Zapier, Make, n8n…), signed; tries three times, waiting a little
+ * longer each time. Resolves with whether it was taken.
+ */
+export declare function sendWebhook(url: string, payload: unknown, secret: string, wait?: (ms: number) => Promise<void>): Promise<boolean>;

package/src/forms.js

@@ -0,0 +1,153 @@
+import { createHash, createHmac } from 'node:crypto';
+import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { extname, join } from 'node:path';
+import { FILE_TYPES, FORM_FILE_MAX } from '@materializecms/core/page';
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const isFile = (v) => typeof v === 'object' && v !== null && 'arrayBuffer' in v && typeof v.name === 'string';
+/**
+ * What a form sent, checked against the form on the page: only its fields, the required ones
+ * filled in, emails that look like emails, choices from the list, files of the right kind and
+ * size. Without a definition (a form the site built by hand) the values are taken as they come.
+ */
+export async function readSubmission(raw, def) {
+    const data = {};
+    const files = [];
+    const issues = [];
+    if (!def) {
+        for (const [k, v] of Object.entries(raw)) {
+            if (k.startsWith('_') || typeof v !== 'string' || Object.keys(data).length >= 30)
+                continue;
+            data[k.slice(0, 80)] = v.slice(0, 5000);
+        }
+        return { data, files, issues };
+    }
+    for (const field of def.fields) {
+        const value = raw[field.name];
+        if (field.kind === 'file') {
+            const file = isFile(value) && value.size > 0 ? value : null;
+            if (!file) {
+                if (field.required)
+                    issues.push({ field: field.name, message: 'Allega un file' });
+                continue;
+            }
+            const allowed = FILE_TYPES[field.accept ?? 'any'];
+            if (!allowed.includes(extname(file.name).toLowerCase())) {
+                issues.push({ field: field.name, message: `Questo tipo di file non è accettato (${allowed.join(', ')})` });
+                continue;
+            }
+            if (file.size > FORM_FILE_MAX) {
+                issues.push({ field: field.name, message: `Il file supera ${FORM_FILE_MAX / 1024 / 1024} MB` });
+                continue;
+            }
+            files.push({
+                field: field.name,
+                name: file.name,
+                type: file.type,
+                bytes: new Uint8Array(await file.arrayBuffer()),
+            });
+            data[field.name] = file.name;
+            continue;
+        }
+        const text = typeof value === 'string' ? value.trim().slice(0, 5000) : '';
+        if (field.kind === 'checkbox') {
+            if (text)
+                data[field.name] = 'sì';
+            else if (field.required)
+                issues.push({ field: field.name, message: 'Va spuntata per inviare' });
+            continue;
+        }
+        if (!text) {
+            if (field.required)
+                issues.push({ field: field.name, message: 'Campo obbligatorio' });
+            continue;
+        }
+        if (field.kind === 'email' && !EMAIL.test(text)) {
+            issues.push({ field: field.name, message: 'Scrivi un indirizzo email valido' });
+            continue;
+        }
+        if (field.kind === 'select' && field.options?.length && !field.options.includes(text)) {
+            issues.push({ field: field.name, message: 'Scegli una delle voci dell’elenco' });
+            continue;
+        }
+        data[field.name] = text;
+    }
+    return { data, files, issues };
+}
+/** A form filled in faster than this is a bot (people need a few seconds at least). */
+const MIN_FILL_MS = 2500;
+/**
+ * Why a message looks like spam, without a CAPTCHA: filled in at once, too many links, links
+ * hidden in markup. Null for a message that looks real. Repeats are checked by the caller.
+ */
+export function spamReason(data, elapsedMs) {
+    if (elapsedMs !== null && elapsedMs >= 0 && elapsedMs < MIN_FILL_MS)
+        return 'Compilato in meno di 3 secondi';
+    const text = Object.values(data).join('\n');
+    if (/\[url=|<a\s+href|\[link=/i.test(text))
+        return 'Link nascosti nel testo';
+    const links = text.match(/https?:\/\/|www\./gi)?.length ?? 0;
+    if (links > 3)
+        return `Troppi link (${links})`;
+    return null;
+}
+/** The same words from the same form: two identical messages in a day are a repeat. */
+export const fingerprintOf = (form, data) => createHash('sha256')
+    .update(form)
+    .update(JSON.stringify(Object.entries(data)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([k, v]) => [k, v.toLowerCase().replace(/\s+/g, ' ')])))
+    .digest('hex');
+/** A file name safe on any disk, keeping its extension. */
+const safeName = (name) => name
+    .normalize('NFKD')
+    .replace(/[^\w.-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(-80) || 'file';
+/** Saves a message's files in its own folder, out of reach of the public site. */
+export async function saveFiles(dir, id, files) {
+    if (!files.length)
+        return [];
+    const folder = join(dir, id);
+    await mkdir(folder, { recursive: true });
+    const saved = [];
+    for (const [i, f] of files.entries()) {
+        const path = `${id}/${i + 1}-${safeName(f.name)}`;
+        await writeFile(join(dir, path), f.bytes);
+        saved.push({ field: f.field, name: f.name, size: f.bytes.length, type: f.type, path });
+    }
+    return saved;
+}
+export const removeFiles = (dir, id) => rm(join(dir, id), { recursive: true, force: true }).catch(() => { });
+/** The signature of a webhook body: `sha256=` and the HMAC of the body with the site's secret. */
+export const webhookSignature = (secret, body) => `sha256=${createHmac('sha256', secret).update(body).digest('hex')}`;
+/**
+ * Posts a message to a webhook (Zapier, Make, n8n…), signed; tries three times, waiting a little
+ * longer each time. Resolves with whether it was taken.
+ */
+export async function sendWebhook(url, payload, secret, wait = (ms) => new Promise((r) => setTimeout(r, ms))) {
+    const body = JSON.stringify(payload);
+    for (const delay of [0, 20_000, 120_000]) {
+        if (delay)
+            await wait(delay);
+        try {
+            const res = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    'user-agent': 'Materialize-Webhook',
+                    'x-materialize-signature': webhookSignature(secret, body),
+                },
+                body,
+                redirect: 'error',
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (res.ok)
+                return true;
+            // The receiver refused it on purpose: trying again would not help.
+            if (res.status >= 400 && res.status < 500 && res.status !== 429)
+                return false;
+        }
+        catch { }
+    }
+    return false;
+}

package/src/tools.js

@@ -257,7 +257,7 @@ export function assistantTools(call, page, brand) {
         },
     });
     return [
-        ...contentTools(call, getSchema).filter((t) => t.name !== 'publish_entry' && t.name !== 'unpublish_entry'),
+        ...contentTools(call, getSchema).filter((t) => !['publish_entry', 'unpublish_entry', 'schedule_entry', 'share_preview'].includes(t.name)),
         ...pageTools({ source, withId: false, brand: async () => brand }),
     ];
 }
@@ -368,6 +368,38 @@ export function contentTools(call, getSchema) {
                 return { id: doc.id, title: doc.title, published: false };
             },
         }),
+        tool({
+            name: 'schedule_entry',
+            title: 'Programmo',
+            description: 'Sets when an entry goes on the public site (publish) or comes off it (unpublish) by itself, as an ISO date with time zone, e.g. 2026-11-10T09:00:00+01:00. at null cancels. The draft as it is at that moment is what gets published.',
+            input: z.object({
+                id: z.string(),
+                action: z.enum(['publish', 'unpublish']),
+                at: z.string().nullable(),
+            }),
+            run: async (input) => {
+                const doc = await call('PUT', `/api/documents/${encodeURIComponent(input.id)}/schedule`, { action: input.action, at: input.at });
+                return {
+                    id: doc.id,
+                    title: doc.title,
+                    publishAt: doc.schedule.publish?.runAt ?? null,
+                    unpublishAt: doc.schedule.unpublish?.runAt ?? null,
+                };
+            },
+        }),
+        tool({
+            name: 'share_preview',
+            title: 'Creo un link di anteprima',
+            description: 'A secret link that shows an entry’s latest saved draft with the site’s design to someone without an account (a client, a colleague). It follows later edits. days: how long it works (default 7), null until revoked.',
+            input: z.object({
+                id: z.string(),
+                days: z.number().int().min(1).max(365).nullable().optional(),
+            }),
+            run: async (input) => {
+                const link = await call('POST', `/api/documents/${encodeURIComponent(input.id)}/previews`, { days: input.days === undefined ? 7 : input.days });
+                return { url: link.url, expiresAt: link.expiresAt };
+            },
+        }),
         tool({
             name: 'list_translations',
             title: 'Guardo le lingue',