@acms-subir/core 0.1.0 → 0.3.0

package/src/lib/email/providers.ts

@@ -0,0 +1,89 @@
+import { createHash, createHmac } from 'node:crypto';
+import { emailBinding, parseFrom, validAddress } from './config';
+import type { Mail, ResolvedConfig, SendResult } from './types';
+const hash = (s: string) => createHash('sha256').update(s).digest('hex');
+const hmac = (key: string | Buffer, data: string) => createHmac('sha256', key).update(data).digest();
+const b64 = (s: string) => Buffer.from(s, 'utf8').toString('base64');
+
+// SES v2 uses standard SigV4 over the exact body sent. No Node HTTP client:
+// fetch + crypto work in Workers (nodejs_compat) and Node alike.
+export function signSes(url: URL, body: string, c: ResolvedConfig, now = new Date()): Headers {
+  const timestamp = now.toISOString().replace(/[:-]|\.\d{3}/g, ''), day = timestamp.slice(0, 8);
+  const values: Record<string, string> = { 'content-type': 'application/json', host: url.host, 'x-amz-date': timestamp };
+  if (c.credentials.sessionToken) values['x-amz-security-token'] = c.credentials.sessionToken;
+  const names = Object.keys(values).sort(), signed = names.join(';');
+  const canonical = ['POST', url.pathname, '', names.map((n) => `${n}:${values[n].trim()}\n`).join(''), signed, hash(body)].join('\n');
+  const scope = `${day}/${c.config.region}/ses/aws4_request`;
+  const key = hmac(hmac(hmac(hmac(`AWS4${c.credentials.secretAccessKey}`, day), c.config.region), 'ses'), 'aws4_request');
+  const signature = hmac(key, `AWS4-HMAC-SHA256\n${timestamp}\n${scope}\n${hash(canonical)}`).toString('hex');
+  const headers = new Headers(values);
+  headers.set('authorization', `AWS4-HMAC-SHA256 Credential=${c.credentials.accessKeyId}/${scope}, SignedHeaders=${signed}, Signature=${signature}`);
+  return headers;
+}
+async function responseObject(response: Response): Promise<Record<string, unknown>> {
+  const reader = response.body?.getReader(); if (!reader) return {};
+  let text = '', size = 0; const decoder = new TextDecoder();
+  try { while (true) { const { value, done } = await reader.read(); if (done) break; size += value.byteLength; if (size > 65536) { await reader.cancel(); return {}; } text += decoder.decode(value, { stream: true }); } }
+  finally { reader.releaseLock(); }
+  try { return JSON.parse(text + decoder.decode()); } catch { return {}; }
+}
+export async function sendWithProvider(mail: Mail, c: ResolvedConfig, id: string, locals?: unknown): Promise<SendResult> {
+  if (!c.config.enabled || c.provider === 'none' || c.error) return { state: 'failed', error: c.error || 'Email sending is disabled.' };
+  const recipients = (Array.isArray(mail.to) ? mail.to : [mail.to]).map((x) => x.trim());
+  if (!recipients.length || recipients.some((x) => !validAddress(x)) || /[\r\n]/.test(mail.subject)) return { state: 'failed', error: 'Invalid recipient or subject.' };
+  const replyTo = mail.replyTo || c.config.replyTo || undefined;
+  if (replyTo && !parseFrom(replyTo)) return { state: 'failed', error: 'Invalid reply-to address.' };
+  const from = c.config.from, attachments = mail.attachments || [];
+  let response: Response;
+  try {
+    if (c.provider === 'cloudflare') {
+      const address = (raw: string) => { const parsed = parseFrom(raw)!; return parsed.name ? { email: parsed.email, name: parsed.name } : parsed.email; };
+      const result = await emailBinding(locals)!.send({ from: address(from), to: recipients, subject: mail.subject, html: mail.html, text: mail.text,
+        ...(replyTo ? { replyTo: address(replyTo) } : {}), attachments: attachments.map((a) => ({ ...a, disposition: 'attachment' as const })) });
+      return result?.messageId ? { state: 'accepted', providerId: result.messageId } : { state: 'unknown', error: 'Cloudflare returned no message ID; review its delivery log.' };
+    }
+    const signal = AbortSignal.timeout(10_000);
+    if (c.provider === 'resend') {
+      response = await fetch('https://api.resend.com/emails', { method: 'POST', signal,
+        headers: { authorization: `Bearer ${c.credentials.apiKey}`, 'content-type': 'application/json', 'Idempotency-Key': id },
+        body: JSON.stringify({ from, to: recipients, subject: mail.subject, html: mail.html, text: mail.text, reply_to: replyTo,
+          tags: [{ name: 'acms_id', value: id }], attachments: attachments.map((a) => ({ filename: a.filename, content: b64(a.content), content_type: a.type })) }) });
+    } else if (c.provider === 'mailgun') {
+      const form = new FormData();
+      for (const [key, value] of Object.entries({ from, subject: mail.subject, html: mail.html, text: mail.text, 'v:acms_id': id, 'o:tracking': 'no' })) form.set(key, value);
+      for (const recipient of recipients) form.append('to', recipient);
+      if (replyTo) form.set('h:Reply-To', replyTo);
+      for (const a of attachments) form.append('attachment', new Blob([a.content], { type: a.type }), a.filename);
+      response = await fetch(`https://${c.config.region === 'eu' ? 'api.eu.mailgun.net' : 'api.mailgun.net'}/v3/${c.config.domain}/messages`, {
+        method: 'POST', signal, headers: { authorization: `Basic ${b64(`api:${c.credentials.apiKey}`)}` }, body: form });
+    } else {
+      const url = new URL(`https://email.${c.config.region}.amazonaws.com/v2/email/outbound-emails`);
+      const body = JSON.stringify({ FromEmailAddress: from, Destination: { ToAddresses: recipients }, ReplyToAddresses: replyTo ? [replyTo] : undefined,
+        ConfigurationSetName: c.config.configurationSet || undefined, EmailTags: [{ Name: 'acms_id', Value: id }],
+        ConfigurationOverrides: { Tracking: { ClickTrackingEnabled: 'DISABLED', OpenTrackingEnabled: 'DISABLED' } },
+        Content: { Simple: { Subject: { Data: mail.subject, Charset: 'UTF-8' }, Body: { Html: { Data: mail.html, Charset: 'UTF-8' }, Text: { Data: mail.text, Charset: 'UTF-8' } },
+          Attachments: attachments.map((a) => ({ FileName: a.filename, ContentType: a.type, RawContent: b64(a.content), ContentDisposition: 'ATTACHMENT', ContentTransferEncoding: 'BASE64' })) } } });
+      response = await fetch(url, { method: 'POST', signal, headers: signSes(url, body, c), body });
+    }
+    const data = await responseObject(response);
+    if (response.ok) {
+      const providerId = data.id || data.MessageId;
+      return typeof providerId === 'string' ? { state: 'accepted', providerId: c.provider === 'mailgun' ? providerId.replace(/^<|>$/g,'') : providerId } : { state: 'unknown', error: 'Provider accepted the request without a message ID; review its log.' };
+    }
+    // Never persist a provider response: it can echo secrets or account links.
+    const error = `${c.provider} rejected the request (HTTP ${response.status}).`;
+    if (response.status === 429) {
+      const raw = response.headers.get('retry-after') || '';
+      const delay = /^\d+$/.test(raw) ? Number(raw) * 1000 : Date.parse(raw) - Date.now();
+      return { state: 'retrying', error, retryAfter: Number.isFinite(delay) ? Math.max(1000, delay) : undefined };
+    }
+    if (response.status >= 500 || response.status === 408) return { state: c.provider === 'resend' ? 'retrying' : 'unknown', error };
+    return { state: 'failed', error };
+  } catch (e) {
+    const code = String((e as { code?: string })?.code || '');
+    if (code.startsWith('E_') && !['E_INTERNAL_SERVER_ERROR', 'E_DELIVERY_FAILED'].includes(code)) {
+      return { state: /LIMIT_EXCEEDED/.test(code) ? 'retrying' : 'failed', error: `Cloudflare: ${code}` };
+    }
+    return { state: c.provider === 'resend' ? 'retrying' : 'unknown', error: 'No conclusive provider response. Delivery may have been accepted.' };
+  }
+}

package/src/lib/email/service.ts

@@ -0,0 +1,78 @@
+import type { ContentRepository } from '../repo/types';
+import { resolveConfig, decrypt, encrypt, runtimeValue } from './config';
+import { sendWithProvider } from './providers';
+import { accountMail, canonicalOrigin } from './templates';
+import { bookingMail } from '../booking/service';
+import type { EmailJob, Mail } from './types';
+
+async function render(repo: ContentRepository, job: EmailJob, locals?: unknown, from = ''): Promise<Mail | null> {
+  const settings = await repo.getSettings();
+  if (job.kind === 'test') return accountMail('test', job.recipient, settings.siteTitle);
+  const origin = canonicalOrigin(settings.siteUrl);
+  if (job.kind === 'booking') {
+    const payload = JSON.parse(job.payload);
+    const b = await repo.getBooking(payload.bookingId);
+    if (!b || (b.notificationVersion ?? 0) !== payload.version) return null;
+    if (payload.kind === 'reminder' && (b.status !== 'confirmed' || b.start <= Date.now())) return null;
+    const mail = await bookingMail(repo, b, payload.kind, origin, from, payload);
+    return { ...mail, to: job.recipient };
+  }
+  if (job.kind === 'auth') {
+    const payload = JSON.parse(job.payload);
+    const token = await repo.email.token(payload.tokenId);
+    if (!token || token.revoked || token.used_by || Number(token.expires_at) <= Date.now() || !token.encrypted) return null;
+    const raw = decrypt<string>(String(token.encrypted), `token:${token.id}`, locals);
+    return accountMail(payload.purpose, job.recipient, settings.siteTitle, `${origin}/account/${payload.purpose}?token=${encodeURIComponent(raw)}`);
+  }
+  if (job.kind === 'welcome' || job.kind === 'password-changed') return accountMail(job.kind, job.recipient, settings.siteTitle, `${origin}/admin/login`);
+  return null;
+}
+export async function dispatchEmail(repo: ContentRepository, locals?: unknown, limit = 10): Promise<number> {
+  if (runtimeValue('EMAIL_DISPATCH_PAUSED', locals) === 'true') return 0;
+  let processed = 0;
+  for (let i=0;i<limit;i++) {
+    const j = await repo.email.claim(); if (!j) break;
+    let handedToProvider = false;
+    try {
+      let config = await repo.email.config(j.configVersion || undefined);
+      const resolved = resolveConfig(config, locals);
+      const current = resolveConfig(await repo.email.config(), locals);
+      if (!current.config.enabled || current.config.provider === 'none') {
+        await repo.email.finish(j,{state:'cancelled',error:'Email is disabled.'}); continue;
+      }
+      if (j.fingerprint && j.fingerprint !== resolved.fingerprint) {
+        await repo.email.finish(j,{state:'failed',error:'Provider configuration changed. Restore the original environment credentials before retrying this job.'}); continue;
+      }
+      await repo.email.pin(j,resolved.provider,resolved.fingerprint,config?.version || 0);
+      if (await repo.email.suppressed(j.recipient)) { await repo.email.finish(j,{state:'suppressed',error:'Recipient is suppressed after a bounce or complaint.'}); continue; }
+      if (j.kind === 'booking') {
+        const payload = JSON.parse(j.payload);
+        if ((payload.kind === 'reminder' && !current.config.reminders) || (payload.kind === 'staff-new' && !current.config.staffNotifications)) {
+          await repo.email.finish(j,{state:'cancelled',error:'Optional notification disabled.'}); continue;
+        }
+      }
+      const mail = await render(repo,j,locals,resolved.config.from);
+      if (!mail) { await repo.email.finish(j,{state:'cancelled',error:'Notification no longer applies.'}); continue; }
+      // Retries must reuse exactly the same request body, including calendar
+      // timestamps, for Resend's idempotency key to remain valid. Encrypt the
+      // snapshot because account and booking links are bearer credentials.
+      const frozen = j.rendered ? decrypt<Mail>(j.rendered,`job:${j.id}`,locals) : mail;
+      if (!await repo.email.prepare(j,j.rendered || encrypt(frozen,`job:${j.id}`,locals))) continue;
+      handedToProvider = true;
+      const result = await sendWithProvider(frozen,resolved,j.id,locals);
+      await repo.email.finish(j,result);
+      // Purge the recoverable raw account token once the provider accepted it.
+      // The verifier hash remains so the recipient can redeem the link.
+      if (result.state === 'accepted') processed++;
+    } catch {
+      await repo.email.finish(j,{state:handedToProvider?'unknown':'failed',error:handedToProvider?'Provider handoff could not be recorded. Review delivery before retrying.':'Unable to prepare email. Check canonical site URL and encryption configuration.'});
+    }
+  }
+  await repo.email.reconcile();
+  await repo.email.maintenance();
+  return processed;
+}
+export async function kickEmail(repo: ContentRepository, locals?: unknown, waitUntil?: (p: Promise<unknown>) => void) {
+  const work = dispatchEmail(repo,locals,3).catch(() => 0);
+  if (waitUntil) waitUntil(work); else await work;
+}

package/src/lib/email/store.ts

@@ -0,0 +1,167 @@
+import type { SqlDriver, SqlStatement } from '../repo/sql';
+import type { ConfigRecord, EmailConfig, EmailJob, Invitation, NewEmailJob, SendResult } from './types';
+const record = (r: Record<string, unknown>): ConfigRecord => ({ version: Number(r.version), config: JSON.parse(String(r.config)), encrypted: String(r.encrypted), createdAt: Number(r.created_at) });
+function job(r: Record<string, unknown>): EmailJob {
+  return { id: String(r.id), dedupe: String(r.dedupe), kind: String(r.kind), recipient: String(r.recipient), payload: String(r.payload), configVersion: Number(r.config_version), state: r.state as EmailJob['state'], attempts: Number(r.attempts), nextAt: Number(r.next_at), expiresAt: r.expires_at == null ? null : Number(r.expires_at), createdAt: Number(r.created_at), lease: String(r.lease), leaseUntil: r.lease_until == null ? null : Number(r.lease_until), provider: String(r.provider), providerId: String(r.provider_id), error: String(r.error), acceptedAt: r.accepted_at == null ? null : Number(r.accepted_at), updatedAt: Number(r.updated_at), fingerprint: String(r.fingerprint), rendered: String(r.rendered || '') };
+}
+export function jobStatement(j: NewEmailJob, condition = '1', args: unknown[] = []): SqlStatement {
+  const now = Date.now();
+  return { sql: `INSERT OR IGNORE INTO email_jobs (id,dedupe,kind,recipient,payload,config_version,next_at,expires_at,created_at,updated_at) SELECT ?,?,?,?,?,?,?,?,?,? WHERE ${condition}`, args: [j.id || crypto.randomUUID(), j.dedupe, j.kind, j.recipient.toLowerCase(), j.payload, j.configVersion, j.nextAt ?? now, j.expiresAt ?? null, now, now, ...args] };
+}
+// INSERT...SELECT is evaluated inside the same batch as the guarded booking
+// mutation. Losing a capacity/slot race cannot enqueue a confirmation.
+export function bookingJobs(id: string, kind: string, version?: number, staff = false, mutation = '', message = ''): SqlStatement[] {
+  const now = Date.now();
+  const select = (recipient: string, from: string, event: string): SqlStatement => ({
+    sql: `INSERT OR IGNORE INTO email_jobs (id,dedupe,kind,recipient,payload,config_version,next_at,expires_at,created_at,updated_at)
+      SELECT lower(hex(randomblob(16))), b.id || ':' || b.notification_version || ':' || ? || ':' || lower(${recipient}), 'booking', lower(${recipient}),
+      json_object('bookingId',b.id,'version',b.notification_version,'kind',?,'message',?,
+        'eventTitle',(SELECT title FROM events WHERE id=b.event_id),
+        'eventLocation',(SELECT location FROM events WHERE id=b.event_id),
+        'eventAllDay',(SELECT all_day FROM events WHERE id=b.event_id)),
+      COALESCE((SELECT MAX(version) FROM email_configs),0), ?, CASE WHEN ? = 'reminder' THEN b.start_at ELSE NULL END, ?, ?
+      FROM ${from} WHERE b.id = ? AND b.kind != 'block' AND ${recipient} != '' ${version === undefined ? '' : 'AND b.notification_version = ?'} ${mutation ? 'AND b.email_mutation = ?' : ''}`,
+    args: [event, event, message.slice(0,2000), now, event, now, now, id, ...(version === undefined ? [] : [version]), ...(mutation ? [mutation] : [])],
+  });
+  return [select('b.email', 'bookings b', kind), ...(staff ? [select('j.value', 'bookings b JOIN resources r ON r.id = b.resource_id, json_each(r.notify_emails) j', 'staff-new')] : [])];
+}
+export class EmailStore {
+  constructor(private getDriver: () => Promise<SqlDriver>) {}
+  async config(version?: number): Promise<ConfigRecord | null> {
+    const d = await this.getDriver(); const rows = await d.all(version ? 'SELECT * FROM email_configs WHERE version = ?' : 'SELECT * FROM email_configs ORDER BY version DESC LIMIT 1', version ? [version] : []);
+    return rows[0] ? record(rows[0]) : null;
+  }
+  async configs(): Promise<ConfigRecord[]> { return (await (await this.getDriver()).all('SELECT * FROM email_configs ORDER BY version DESC LIMIT 100')).map(record); }
+  async saveConfig(config: EmailConfig, encrypted: string): Promise<ConfigRecord> {
+    const d = await this.getDriver();
+    const rows = await d.all('INSERT INTO email_configs (config,encrypted,created_at) VALUES (?,?,?) RETURNING *', [JSON.stringify(config), encrypted, Date.now()]);
+    return record(rows[0]);
+  }
+  async enqueue(j: NewEmailJob): Promise<void> { await (await this.getDriver()).batch([jobStatement(j)]); }
+  async get(id: string): Promise<EmailJob | null> { const rows = await (await this.getDriver()).all('SELECT * FROM email_jobs WHERE id = ?', [id]); return rows[0] ? job(rows[0]) : null; }
+  async list(): Promise<EmailJob[]> { return (await (await this.getDriver()).all('SELECT * FROM email_jobs ORDER BY created_at DESC LIMIT 100')).map(job); }
+  async claim(now = Date.now()): Promise<EmailJob | null> {
+    const d = await this.getDriver();
+    // A dead worker may have sent already. Only Resend can retry with the
+    // same key within its 24h window. Other uncertain outcomes need review.
+    await d.run(`UPDATE email_jobs SET state = CASE WHEN provider='resend' AND created_at > ? THEN 'retrying' ELSE 'unknown' END,
+      error='Dispatcher interrupted; provider acceptance may have occurred.', lease='',lease_until=NULL WHERE state='sending' AND lease_until < ?`, [now - 23 * 3600000, now]);
+    await d.run("UPDATE email_jobs SET state='cancelled',payload='',rendered='',error='Expired before delivery.',updated_at=? WHERE state IN ('queued','retrying','failed','unknown') AND expires_at <= ?", [now, now]);
+    await d.run("UPDATE email_jobs SET state='unknown',error='Retry window exhausted. Review provider delivery logs.',updated_at=? WHERE state='retrying' AND (attempts >= 8 OR created_at <= ?)",[now,now-23*3600000]);
+    const lease = crypto.randomUUID();
+    const rows = await d.all(`UPDATE email_jobs SET state='sending',lease=?,lease_until=?,attempts=attempts+1,updated_at=? WHERE id =
+      (SELECT id FROM email_jobs WHERE state IN ('queued','retrying') AND next_at <= ? ORDER BY CASE WHEN kind='auth' THEN 0 ELSE 1 END,next_at LIMIT 1) AND state IN ('queued','retrying') RETURNING *`, [lease, now + 120000, now, now]);
+    return rows[0] ? job(rows[0]) : null;
+  }
+  async pin(j: EmailJob, provider: string, fingerprint: string, version: number) {
+    await (await this.getDriver()).run('UPDATE email_jobs SET provider=?,fingerprint=?,config_version=? WHERE id=? AND lease=? AND state=\'sending\'', [provider, fingerprint, version, j.id, j.lease]);
+  }
+  async prepare(j: EmailJob, encrypted: string): Promise<boolean> {
+    const rows = await (await this.getDriver()).all("UPDATE email_jobs SET rendered=? WHERE id=? AND lease=? AND state='sending' RETURNING id",[encrypted,j.id,j.lease]);
+    return rows.length > 0;
+  }
+  async finish(j: EmailJob, result: SendResult | { state: 'cancelled' | 'suppressed'; error: string }, now = Date.now()) {
+    const accepted = result.state === 'accepted';
+    let state: EmailJob['state'] = result.state;
+    if (state === 'retrying' && (j.attempts >= 8 || now - j.createdAt > 23 * 3600000)) state = 'unknown';
+    const error = accepted ? '' : result.error;
+    const delay = result.state === 'retrying' ? Math.max(result.retryAfter || 0, Math.min(3600000, 30000 * 2 ** Math.min(j.attempts, 7)) + Math.floor(Math.random() * 5000)) : 0;
+    const d = await this.getDriver();
+    await d.batch([
+      { sql: `INSERT INTO email_attempts (job_id,attempt,state,error,created_at) SELECT ?,?,?,?,? WHERE EXISTS(SELECT 1 FROM email_jobs WHERE id=? AND lease=?)`, args: [j.id,j.attempts,state,error,now,j.id,j.lease] },
+      { sql: `UPDATE email_jobs SET state=?,provider_id=?,error=?,next_at=?,accepted_at=?,updated_at=?,lease='',lease_until=NULL,
+        rendered=CASE WHEN ? IN ('accepted','cancelled','suppressed') THEN '' ELSE rendered END,
+        payload=CASE WHEN ? IN ('accepted','cancelled','suppressed') AND kind != 'booking' THEN '' ELSE payload END
+        WHERE id=? AND lease=? AND state='sending'`, args: [state, accepted ? result.providerId : '', error, now+delay, accepted ? now : null, now,state,state,j.id,j.lease] },
+    ]);
+    if (accepted && j.kind === 'auth') {
+      const p = JSON.parse(j.payload);
+      await d.run("UPDATE email_tokens SET encrypted='' WHERE id=?", [p.tokenId]);
+    }
+    if (accepted && j.kind === 'booking') {
+      const p = JSON.parse(j.payload);
+      if (p.kind === 'reminder') await d.run('UPDATE bookings SET reminder_sent_at=? WHERE id=? AND notification_version=?', [now,p.bookingId,p.version]);
+    }
+  }
+  async retry(id: string): Promise<boolean> {
+    const d = await this.getDriver();
+    const rows = await d.all(`UPDATE email_jobs SET state='queued',error='',next_at=?,updated_at=? WHERE id=? AND state='failed' AND attempts < 8 AND created_at > ? AND (expires_at IS NULL OR expires_at > ?) RETURNING id`, [Date.now(),Date.now(),id,Date.now()-23*3600000,Date.now()]);
+    return rows.length > 0;
+  }
+  async suppressed(address: string): Promise<boolean> { return (await (await this.getDriver()).all('SELECT address FROM email_suppressions WHERE address=?', [address.toLowerCase()])).length > 0; }
+  async event(e: { id: string; provider: string; providerId: string; jobId?: string; recipient: string; state: 'delivered' | 'bounced' | 'complained'; at: number; configVersion: number }) {
+    const d = await this.getDriver();
+    await d.batch([
+      { sql: 'INSERT OR IGNORE INTO email_delivery_events (id,provider,provider_id,job_id,recipient,state,created_at,config_version) VALUES (?,?,?,?,?,?,?,?)', args: [e.id,e.provider,e.providerId,e.jobId || '',e.recipient.toLowerCase(),e.state,e.at,e.configVersion] },
+      ...(e.state !== 'delivered' && e.recipient ? [{ sql: 'INSERT OR IGNORE INTO email_suppressions (address,reason,created_at) VALUES (?,?,?)', args: [e.recipient.toLowerCase(),e.state,e.at] }] : []),
+    ]);
+    await this.reconcile();
+  }
+  async reconcile() {
+    const d = await this.getDriver();
+    // Event precedence is monotonic: complaint > bounce > delivery > accepted.
+    for (const state of ['delivered','bounced','complained']) {
+      await d.run(`UPDATE email_jobs SET state=?,payload=CASE WHEN kind='auth' THEN '' ELSE payload END WHERE state NOT IN (${state === 'delivered' ? "'bounced','complained','suppressed','cancelled'" : state === 'bounced' ? "'complained','suppressed','cancelled'" : "'suppressed','cancelled'"}) AND EXISTS (
+        SELECT 1 FROM email_delivery_events e WHERE e.state=? AND e.provider=email_jobs.provider AND e.config_version=email_jobs.config_version AND
+        ((e.provider_id=email_jobs.provider_id AND email_jobs.provider_id!='') OR e.job_id=email_jobs.id) AND (e.recipient='' OR e.recipient=email_jobs.recipient))`, [state,state]);
+    }
+  }
+  async rateLimit(key: string, max: number, windowMs: number): Promise<boolean> {
+    const now = Date.now(), d = await this.getDriver();
+    const rows = await d.all(`INSERT INTO email_rate_limits (key,count,expires_at) VALUES (?,1,?) ON CONFLICT(key) DO UPDATE SET
+      count=CASE WHEN expires_at <= ? THEN 1 ELSE count+1 END, expires_at=CASE WHEN expires_at <= ? THEN ? ELSE expires_at END RETURNING count`, [key,now+windowMs,now,now,now+windowMs]);
+    return Number(rows[0].count) <= max;
+  }
+  async recordScheduler(report: { startedAt: number; finishedAt: number; ok: boolean; jobs: Record<string, { ok: boolean; count?: number }> }) {
+    await (await this.getDriver()).run("INSERT INTO email_meta(key,value) VALUES ('scheduler-heartbeat',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value", [JSON.stringify(report)]);
+  }
+  async schedulerStatus(): Promise<{ startedAt: number; finishedAt: number; ok: boolean; jobs: Record<string, { ok: boolean; count?: number }> } | null> {
+    const rows = await (await this.getDriver()).all("SELECT value FROM email_meta WHERE key='scheduler-heartbeat'");
+    return rows[0] ? JSON.parse(String(rows[0].value)) : null;
+  }
+  async heartbeat(): Promise<number | null> { const r = await (await this.getDriver()).all("SELECT value FROM email_meta WHERE key='heartbeat'"); return r[0] ? Number(r[0].value) : null; }
+  async maintenance(now = Date.now()) {
+    const d = await this.getDriver();
+    await d.batch([
+      { sql: "INSERT INTO email_meta(key,value) VALUES ('heartbeat',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value", args:[String(now)] },
+      { sql: 'DELETE FROM email_rate_limits WHERE expires_at < ?', args:[now] },
+      { sql: "DELETE FROM email_jobs WHERE updated_at < ? AND state NOT IN ('queued','sending','retrying')",args:[now-30*86400000] },
+      { sql: 'DELETE FROM email_attempts WHERE created_at < ?',args:[now-30*86400000] },
+      { sql: 'DELETE FROM email_delivery_events WHERE created_at < ?',args:[now-30*86400000] },
+      { sql: "UPDATE email_tokens SET encrypted='' WHERE expires_at <= ? OR used_by != '' OR revoked=1", args:[now] },
+    ]);
+  }
+  async sessionVersion(id: string): Promise<number | null> { const r = await (await this.getDriver()).all('SELECT session_version FROM users WHERE id=?', [id]); return r[0] ? Number(r[0].session_version) : null; }
+  async invitations(): Promise<Invitation[]> {
+    return (await (await this.getDriver()).all("SELECT id,email,name,role,expires_at,created_at,CASE WHEN revoked=1 THEN 'revoked' WHEN used_by!='' THEN 'accepted' WHEN expires_at < ? THEN 'expired' ELSE 'pending' END state FROM email_tokens WHERE purpose='invite' ORDER BY created_at DESC LIMIT 100", [Date.now()])).map((r) => ({ id: String(r.id), email:String(r.email),name:String(r.name),role:r.role as Invitation['role'],expiresAt:Number(r.expires_at),createdAt:Number(r.created_at),state:String(r.state) }));
+  }
+  async token(id: string) { return (await (await this.getDriver()).all('SELECT * FROM email_tokens WHERE id=?', [id]))[0] || null; }
+  async tokenByHash(hash: string) { return (await (await this.getDriver()).all('SELECT * FROM email_tokens WHERE token_hash=? AND revoked=0 AND used_by=\'\' AND expires_at > ?', [hash,Date.now()]))[0] || null; }
+  async saveToken(t: { id:string; hash:string; encrypted:string; purpose:'invite'|'reset'; email:string; name:string; role:string; userId:string; expiresAt:number }, j: NewEmailJob) {
+    const d=await this.getDriver();
+    await d.batch([
+      {sql:"UPDATE email_tokens SET revoked=1,encrypted='' WHERE email=? AND purpose=? AND used_by=''",args:[t.email,t.purpose]},
+      {sql:"UPDATE email_jobs SET state='cancelled',payload='',rendered='' WHERE kind='auth' AND recipient=? AND json_extract(NULLIF(payload,''),'$.purpose')=? AND state IN ('queued','retrying','failed','unknown')",args:[t.email,t.purpose]},
+      {sql:'INSERT INTO email_tokens (id,token_hash,encrypted,purpose,email,name,role,user_id,expires_at,created_at) VALUES (?,?,?,?,?,?,?,?,?,?)',args:[t.id,t.hash,t.encrypted,t.purpose,t.email,t.name,t.role,t.userId,t.expiresAt,Date.now()]},
+      jobStatement(j),
+    ]);
+  }
+  async revoke(id:string) {
+    await (await this.getDriver()).batch([
+      {sql:"UPDATE email_tokens SET revoked=1,encrypted='' WHERE id=? AND used_by=''",args:[id]},
+      {sql:"UPDATE email_jobs SET state='cancelled',payload='',rendered='' WHERE kind='auth' AND json_extract(NULLIF(payload,''),'$.tokenId')=? AND state IN ('queued','retrying','failed','unknown')",args:[id]},
+    ]);
+  }
+  async consume(hash:string, passHash:string, userId:string, notice:NewEmailJob):Promise<boolean> {
+    const d=await this.getDriver(), nonce=crypto.randomUUID(),now=Date.now();
+    await d.batch([
+      {sql:`UPDATE email_tokens SET used_by=?,encrypted='' WHERE token_hash=? AND used_by='' AND revoked=0 AND expires_at>? AND
+        ((purpose='reset' AND EXISTS(SELECT 1 FROM users WHERE id=email_tokens.user_id AND email=email_tokens.email)) OR
+        (purpose='invite' AND NOT EXISTS(SELECT 1 FROM users WHERE email=email_tokens.email)))`,args:[nonce,hash,now]},
+      {sql:`INSERT INTO users (id,name,email,role,pass_hash,created_at) SELECT ?,name,email,role,?,? FROM email_tokens WHERE used_by=? AND purpose='invite'`,args:[userId,passHash,now,nonce]},
+      {sql:`UPDATE users SET pass_hash=?,session_version=session_version+1 WHERE id IN (SELECT user_id FROM email_tokens WHERE used_by=? AND purpose='reset')`,args:[passHash,nonce]},
+      jobStatement(notice,'EXISTS(SELECT 1 FROM email_tokens WHERE used_by=?)',[nonce]),
+    ]);
+    return (await d.all('SELECT id FROM email_tokens WHERE used_by=?',[nonce])).length>0;
+  }
+}

package/src/lib/email/templates.ts

@@ -0,0 +1,18 @@
+import type { Mail } from './types';
+export const escape = (s: string) => s.replace(/[&<>"']/g, (c) => ({ '&':'&amp;', '<':'&lt;', '>':'&gt;', '"':'&quot;', "'":'&#39;' }[c]!));
+export function accountMail(kind: 'invite'|'reset'|'welcome'|'password-changed'|'test', to: string, site: string, url = ''): Mail {
+  const copy = {
+    invite: ['You’re invited', `You’ve been invited to join ${site}. Choose your own password to accept.`, 'Accept invitation'],
+    reset: ['Reset your password', 'Use this single-use link within 30 minutes to choose a new password. If you did not request this, ignore this message.', 'Choose a new password'],
+    welcome: ['Welcome', `Your account at ${site} is ready.`, 'Sign in'],
+    'password-changed': ['Your password changed', 'Your password was changed and previous sessions were signed out. If this was not you, contact the site owner.', 'Sign in'],
+    test: ['Email connection test', `This is a transactional email test from ${site}.`, ''],
+  }[kind];
+  return { to, subject: `${copy[0]} · ${site}`, text: [copy[0], '', copy[1], ...(url ? ['',`${copy[2]}: ${url}`] : [])].join('\n'),
+    html: `<!doctype html><html><body style="margin:0;background:#f6f5f2;color:#24211c;font:16px/1.6 system-ui,sans-serif"><div style="max-width:520px;margin:auto;padding:32px 24px"><p style="color:#7d776e">${escape(site)}</p><h1 style="font-size:24px">${escape(copy[0])}</h1><p>${escape(copy[1])}</p>${url ? `<p><a style="display:inline-block;background:#ee5d20;color:#fff;padding:10px 18px;border-radius:8px;text-decoration:none" href="${escape(url)}">${escape(copy[2])}</a></p>` : ''}</div></body></html>` };
+}
+export function canonicalOrigin(value: string): string {
+  let url: URL; try { url = new URL(value); } catch { throw new Error('Set the canonical site URL in Settings before sending email links.'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash || url.pathname !== '/') throw new Error('The canonical site URL must be an HTTPS origin, without a path, credentials or query.');
+  return url.origin;
+}

package/src/lib/email/types.ts

@@ -0,0 +1,32 @@
+export type Provider = 'resend' | 'mailgun' | 'ses' | 'cloudflare';
+export type ProviderChoice = Provider | 'auto' | 'none';
+export interface Attachment { filename: string; type: string; content: string }
+export interface Mail { to: string | string[]; subject: string; html: string; text: string; attachments?: Attachment[]; replyTo?: string }
+export interface EmailConfig {
+  provider: ProviderChoice; source: 'env' | 'encrypted'; from: string; replyTo: string;
+  domain: string; region: string; configurationSet: string; snsTopicArn: string;
+  enabled: boolean; reminders: boolean; staffNotifications: boolean;
+}
+export interface Credentials { apiKey?: string; webhookSecret?: string; accessKeyId?: string; secretAccessKey?: string; sessionToken?: string }
+export interface ConfigRecord { version: number; config: EmailConfig; encrypted: string; createdAt: number }
+export interface ResolvedConfig { version: number; config: EmailConfig; provider: Provider | 'none'; credentials: Credentials; error?: string; fingerprint: string }
+export type DeliveryState = 'queued' | 'sending' | 'retrying' | 'accepted' | 'delivered' | 'failed' | 'unknown' | 'bounced' | 'complained' | 'suppressed' | 'cancelled';
+export interface EmailJob {
+  id: string; dedupe: string; kind: string; recipient: string; payload: string; configVersion: number;
+  state: DeliveryState; attempts: number; nextAt: number; expiresAt: number | null; createdAt: number;
+  lease: string; leaseUntil: number | null; provider: string; providerId: string; error: string;
+  acceptedAt: number | null; updatedAt: number; fingerprint: string;
+  rendered: string;
+}
+export interface NewEmailJob { id?: string; dedupe: string; kind: string; recipient: string; payload: string; configVersion: number; nextAt?: number; expiresAt?: number }
+export type SendResult = { state: 'accepted'; providerId: string } | { state: 'retrying' | 'failed' | 'unknown'; error: string; retryAfter?: number };
+export interface Invitation { id: string; email: string; name: string; role: 'owner' | 'editor'; state: string; expiresAt: number; createdAt: number }
+export interface PublicEmailSettings {
+  version: number; config: EmailConfig; provider: Provider | 'none'; configured: boolean; error: string;
+  encryptionAvailable: boolean; environmentLocked: boolean; credentialFields: string[];
+  activity: Omit<EmailJob, 'payload' | 'lease' | 'fingerprint' | 'rendered'>[]; heartbeat: number | null;
+}
+export const DEFAULT_EMAIL_CONFIG: EmailConfig = {
+  provider: 'auto', source: 'env', from: '', replyTo: '', domain: '', region: 'us-east-1', configurationSet: '', snsTopicArn: '',
+  enabled: true, reminders: true, staffNotifications: true,
+};

package/src/lib/email/webhooks.ts

@@ -0,0 +1,87 @@
+import { createHmac, timingSafeEqual, verify, X509Certificate } from 'node:crypto';
+import type { ContentRepository } from '../repo/types';
+import { resolveConfig } from './config';
+import type { ResolvedConfig } from './types';
+const equal=(a:Buffer,b:Buffer)=>a.length===b.length&&timingSafeEqual(a,b);
+const object=(v:unknown):Record<string,unknown>=>v&&typeof v==='object'&&!Array.isArray(v)?v as Record<string,unknown>:{};
+const string=(v:unknown)=>typeof v==='string'?v:'';
+const normalizeId=(s:string)=>s.replace(/^<|>$/g,'');
+async function rawBody(request:Request):Promise<string>{
+  const reader=request.body?.getReader();if(!reader)return '';
+  const parts:Uint8Array[]=[];let size=0;
+  try{while(true){const {value,done}=await reader.read();if(done)break;size+=value.length;if(size>262144){await reader.cancel();throw new Error('Too large');}parts.push(value);}}finally{reader.releaseLock();}
+  return Buffer.concat(parts).toString('utf8');
+}
+function fresh(timestamp:number,window=10*60000){return Number.isFinite(timestamp)&&Math.abs(Date.now()-timestamp)<window;}
+function resendValid(request:Request,raw:string,secret:string){
+  const id=request.headers.get('svix-id')||'',time=request.headers.get('svix-timestamp')||'',sig=request.headers.get('svix-signature')||'';
+  if(!id||!secret||!fresh(Number(time)*1000))return false;
+  const expected=createHmac('sha256',Buffer.from(secret.replace(/^whsec_/,''),'base64')).update(`${id}.${time}.${raw}`).digest();
+  return sig.split(' ').some(part=>part.startsWith('v1,')&&equal(expected,Buffer.from(part.slice(3),'base64')));
+}
+function mailgunValid(data:Record<string,unknown>,secret:string){
+  const sig=object(data.signature),time=string(sig.timestamp)||String(sig.timestamp||'');
+  if(!secret||!fresh(Number(time)*1000)||!string(sig.token)||!/^[a-f0-9]{64}$/i.test(string(sig.signature)))return false;
+  return equal(createHmac('sha256',secret).update(time+string(sig.token)).digest(),Buffer.from(string(sig.signature),'hex'));
+}
+function snsUrl(value:string,region:string,certificate=false):URL|null{
+  try{const u=new URL(value);return u.protocol==='https:'&&!u.username&&!u.password&&!u.port&&u.hostname===`sns.${region}.amazonaws.com`&&(!certificate||(/^\/SimpleNotificationService-[a-zA-Z0-9_-]+\.pem$/.test(u.pathname)&&!u.search))?u:null;}catch{return null;}
+}
+async function snsValid(data:Record<string,unknown>,c:ResolvedConfig){
+  if(!c.config.snsTopicArn||data.TopicArn!==c.config.snsTopicArn||!fresh(Date.parse(string(data.Timestamp)),86400000))return false;
+  const url=snsUrl(string(data.SigningCertURL),c.config.region,true);
+  if(!url||!['1','2'].includes(string(data.SignatureVersion)))return false;
+  const type=string(data.Type);
+  const fields=type==='Notification'?['Message','MessageId',...(data.Subject!==undefined?['Subject']:[]),'Timestamp','TopicArn','Type']:
+    type==='SubscriptionConfirmation'?['Message','MessageId','SubscribeURL','Timestamp','Token','TopicArn','Type']:[];
+  if(!fields.length||fields.some(k=>typeof data[k]!=='string'))return false;
+  const response=await fetch(url,{redirect:'error',signal:AbortSignal.timeout(5000)});
+  if(!response.ok)return false;
+  const certRaw=await rawBody(new Request('https://localhost',{method:'POST',body:response.body,duplex:'half'} as RequestInit));
+  const cert=new X509Certificate(certRaw);
+  if(Date.parse(cert.validFrom)>Date.now()||Date.parse(cert.validTo)<Date.now())return false;
+  const canonical=fields.map(k=>`${k}\n${data[k]}\n`).join('');
+  return verify(data.SignatureVersion==='2'?'RSA-SHA256':'RSA-SHA1',Buffer.from(canonical),cert.publicKey,Buffer.from(string(data.Signature),'base64'));
+}
+export async function receiveEmailWebhook(request:Request,provider:string,repo:ContentRepository,locals?:unknown):Promise<Response>{
+  try{
+    if(!['resend','mailgun','ses'].includes(provider))return new Response('Not found',{status:404});
+    const raw=await rawBody(request);const data=object(JSON.parse(raw));
+    const records=await repo.email.configs();
+    const candidates=[...records.map(r=>resolveConfig(r,locals)),resolveConfig(null,locals)].filter(c=>c.provider===provider);
+    let matched:ResolvedConfig|undefined;
+    for(const c of candidates){
+      if(provider==='resend'?resendValid(request,raw,c.credentials.webhookSecret||''):provider==='mailgun'?mailgunValid(data,c.credentials.webhookSecret||''):await snsValid(data,c)){matched=c;break;}
+    }
+    if(!matched)return new Response('Invalid signature',{status:401});
+    if(provider==='ses'&&data.Type==='SubscriptionConfirmation'){
+      const url=snsUrl(string(data.SubscribeURL),matched.config.region);
+      if(!url||url.searchParams.get('Action')!=='ConfirmSubscription'||url.searchParams.get('TopicArn')!==matched.config.snsTopicArn||url.searchParams.get('Token')!==data.Token)return new Response('Invalid subscription',{status:400});
+      const response=await fetch(url,{redirect:'error',signal:AbortSignal.timeout(5000)});
+      await response.body?.cancel();return new Response(response.ok?'Confirmed':'Confirmation failed',{status:response.ok?200:502});
+    }
+    let state:'delivered'|'bounced'|'complained'|undefined,recipients:string[]=[],providerId='',jobId='',eventId='';
+    if(provider==='resend'){
+      const d=object(data.data);state=({'email.delivered':'delivered','email.bounced':'bounced','email.complained':'complained'} as const)[string(data.type)];
+      recipients=Array.isArray(d.to)?d.to.filter(x=>typeof x==='string'):[];providerId=string(d.email_id);eventId=request.headers.get('svix-id')||'';
+      const tags=object(d.tags);jobId=string(tags.acms_id);
+    }else if(provider==='mailgun'){
+      const d=object(data['event-data']);state=string(d.event)==='delivered'?'delivered':string(d.event)==='complained'?'complained':string(d.event)==='failed'&&d.severity==='permanent'?'bounced':undefined;
+      recipients=[string(d.recipient)];providerId=normalizeId(string(object(object(d.message).headers)['message-id']));eventId=string(d.id);jobId=string(object(d['user-variables']).acms_id);
+    }else{
+      const d=object(JSON.parse(string(data.Message))),mail=object(d.mail);const kind=string(d.eventType)||string(d.notificationType);
+      state=kind==='Delivery'?'delivered':kind==='Bounce'?'bounced':kind==='Complaint'?'complained':undefined;
+      // Transient SES bounces do not permanently suppress an address.
+      if(kind==='Bounce'&&object(d.bounce).bounceType!=='Permanent')state=undefined;
+      recipients=kind==='Delivery'?(object(d.delivery).recipients as string[]||[]):((kind==='Bounce'?object(d.bounce).bouncedRecipients:object(d.complaint).complainedRecipients) as unknown[]||[]).map(r=>string(object(r).emailAddress));
+      providerId=string(mail.messageId);eventId=string(data.MessageId);const tag=object(mail.tags).acms_id;jobId=Array.isArray(tag)?string(tag[0]):'';
+    }
+    if(!state)return new Response('Ignored',{status:200});
+    if(!eventId||!providerId)return new Response('Invalid event',{status:400});
+    // A shared signing key can span configuration versions. Correlate only
+    // with jobs sent through one of the authenticated provider configs.
+    const authenticatedVersions=candidates.filter(c=>c.credentials.webhookSecret===matched!.credentials.webhookSecret&&c.config.snsTopicArn===matched!.config.snsTopicArn).map(c=>c.version);
+    for(const version of authenticatedVersions)for(const recipient of recipients.filter(Boolean))await repo.email.event({id:`${provider}:${version}:${eventId}:${recipient}`,provider,providerId,jobId,recipient,state,at:Date.now(),configVersion:version});
+    return new Response('OK');
+  }catch{return new Response('Invalid event',{status:400});}
+}

package/src/lib/email.ts

@@ -0,0 +1,15 @@
+// Compatibility facade. Durable application flows use email/service instead.
+import { resolveConfig } from './email/config';
+import { sendWithProvider } from './email/providers';
+export { parseFrom } from './email/config';
+export type { Mail, Attachment } from './email/types';
+import type { Mail, Provider } from './email/types';
+export type EmailProvider = Provider | 'none';
+export function emailProvider(locals?: unknown): EmailProvider {
+  const resolved = resolveConfig(null, locals);
+  return resolved.error ? 'none' : resolved.provider;
+}
+export async function sendMail(mail: Mail, locals?: unknown) {
+  const c = resolveConfig(null, locals), result = await sendWithProvider(mail, c, crypto.randomUUID(), locals);
+  return { sent: result.state === 'accepted', provider: c.provider, ...(result.state === 'accepted' ? { providerId: result.providerId } : { error: result.error }) };
+}

package/src/lib/env.ts

@@ -1,6 +1,6 @@
 /// <reference types="astro/client" />
 
 export function env(key: string, fallback = ''): string {
-  const v = (import.meta.env as Record<string, string | undefined>)[key] ?? process.env[key];
+  const v = process.env[key] ?? (import.meta.env as Record<string, string | undefined>)[key];
   return v ?? fallback;
 }

package/src/lib/legal/index.ts

@@ -0,0 +1,25 @@
+import { userConfig } from 'virtual:acms-config';
+import type { Settings } from '../schema';
+import { bookingsEnabled } from '../calendar/config';
+export const LEGAL = { enabled: true, operatorName: '', contactEmail: '', updatedAt: '', ...userConfig.legal };
+export function defaultPolicy(kind: 'privacy' | 'terms', settings: Settings) {
+  const operator = LEGAL.operatorName || settings.siteTitle;
+  const contact = LEGAL.contactEmail ? `Contact ${operator} at ${LEGAL.contactEmail}.` : 'Contact the site operator using the contact details published on this site.';
+  const sections = kind === 'privacy' ? [
+    { title: 'Who operates this site', text: `${operator} operates this site and decides how information collected here is used. ACMS supplies the website software; it does not automatically receive a copy of site content or visitor submissions. ${contact}` },
+    { title: 'Information used to run the site', text: 'The hosting and network providers may process IP addresses, request details and technical logs to deliver pages, protect the service and diagnose errors. The public API uses a hashed client address and short-lived counters to limit repeated requests. Administrators have account details and password hashes; sign-in uses a session cookie.' },
+    ...(bookingsEnabled() ? [{ title: 'Bookings and RSVPs', text: 'When you submit a booking or RSVP, the site stores your name, email address, any phone number or answers you provide, the requested time and the booking status. This information is used to manage the request, prevent duplicate submissions, and send confirmations or reminders when email is enabled. Authorized site staff can access it. Keep any booking-management link or token private.' }] : []),
+    { title: 'Cookies and browser storage', text: 'The admin session cookie keeps staff signed in and normally expires after seven days. Where enabled, the announcement banner stores its dismissed state in your browser. Optional integrations or embedded content may use additional cookies or storage; the operator is responsible for providing the notices and choices those features require.' },
+    { title: 'Service providers and optional features', text: 'The chosen host stores site data and uploaded files. If email is enabled, the selected email provider processes recipient details and message content. Themes may load fonts from Google Fonts, and embedded media may contact its provider. Optional analytics, session replay, custom scripts or AI tools are configured by the operator and may involve further providers. Additional processing must be described by the operator before those features are used.' },
+    { title: 'Retention and backups', text: 'Booking and content records are retained until the operator deletes them according to their retention policy. Hashed booking retry records are retained to prevent duplicate requests, including after a booking is deleted. Backups may retain copies of records and private booking-management tokens. The operator determines and must disclose the applicable retention periods, including hosting logs and backups.' },
+    { title: 'Questions and requests', text: `${contact} You may ask about your information or request access, correction or deletion. The operator may need to verify your identity and will handle requests in accordance with applicable law. This standard notice does not specify an operator’s jurisdiction, legal bases, international-transfer arrangements or additional data uses.` },
+  ] : [
+    { title: 'About this service', text: `${operator} provides this website and its enabled content, calendar and booking features. ${contact} These terms cover the standard site features; additional services may have separate terms presented by the operator.` },
+    { title: 'Using the site', text: 'Use the service lawfully. Do not attempt unauthorized access, disrupt availability, bypass request limits or submit malicious or misleading material. Keep account credentials and private booking-management links secure.' },
+    ...(bookingsEnabled() ? [{ title: 'Bookings and event information', text: 'Provide accurate contact and request details. Submitting a request does not guarantee acceptance: check whether its status is pending or confirmed. Availability can change before a booking is saved. Any event-specific fees, cancellation rules, eligibility or other conditions must be supplied by the operator; these standard terms do not create those conditions.' }] : []),
+    { title: 'Content and submissions', text: 'Respect the rights of content owners. Submit only information you are authorized to provide. Information submitted for a booking or support request is used to process that request as described in the privacy notice. The ACMS software license is separate from rights in the content published on this site.' },
+    { title: 'Availability and external services', text: 'The service may be interrupted for maintenance or technical reasons. Published information can change or contain errors; contact the operator to confirm information you rely on. External links and embedded services are operated by their respective providers and may have their own terms and privacy notices.' },
+    { title: 'Your rights and changes', text: 'Nothing in these terms excludes rights or liabilities that cannot be excluded under applicable law. The operator should explain material changes to these terms and provide any additional conditions needed for its services. No particular governing law, dispute forum, payment policy or contractual waiver is specified by this standard page.' },
+  ];
+  return { title: kind === 'privacy' ? 'Privacy notice' : 'Terms of service', sections, complete: Boolean(LEGAL.operatorName && LEGAL.contactEmail) };
+}