@acms-subir/core 0.1.0 → 0.3.0

package/src/actions/index.ts

@@ -1,9 +1,12 @@
+import { pickDesignDraft } from '../lib/drafts';
+import { ApiError } from '../lib/api';
+import { validateSectionDesign } from '../lib/design-service';
 import { defineAction, ActionError } from 'astro:actions';
 import { z } from 'astro:schema';
 import type { ActionAPIContext } from 'astro:actions';
 import { getRepo } from '../lib/repo';
 import { getMediaStore } from '../lib/media/store';
-import { verifySessionToken, SESSION_COOKIE } from '../lib/auth';
+import { validateSession, SESSION_COOKIE } from '../lib/auth';
 import { parseConfig, slugify, widgetTypes, type WidgetType } from '../lib/schema';
 import { env } from '../lib/env';
 import { CONTENT, collectionUrl } from '../lib/content';
@@ -12,12 +15,32 @@ import { isPrivateHost } from '../lib/net';
 import { normalizeCalendarSrc } from '../lib/calendar/src';
 import { getCalendarEvents } from '../lib/calendar/ics';
 import { siteLocale } from '../lib/dates';
-import { normalizePageLocale } from '../lib/i18n';
+import { normalizePageLocale, localeHomeUrl } from '../lib/i18n';
+import { CALENDAR } from '../lib/calendar/config';
+import { eventTimeZone, featuredOccurrence, formatOccurrence, isValidTimeZone, normalizeEventTimes, safeColor } from '../lib/calendar/events';
+import { eventsFromCsv, eventsFromIcs, eventsFromVEvents } from '../lib/calendar/import';
+import { loadFeed } from '../lib/calendar/ics';
+import { NATIVE_ALL } from '../lib/calendar/render';
+import { collectViewEvents } from '../lib/calendar/data';
+import { waitUntilFrom } from '../lib/webhooks';
+import { eventChanged, eventDeleted } from '../lib/calendar/hooks';
+import { siteOrigin } from '../lib/seo';
+import type { CalEvent } from '../lib/schema';
+import { diffDesign, revertDesignChange, summarizeChanges } from '../lib/designDiff';
+import { shareEpoch } from '../lib/drafts';
+import { createDesignToken } from '../lib/preview';
+import { getTheme } from '../lib/theme';
+
+// "What changes" for the Design screen: the staged draft vs the live design
+async function designChanges(repo: Awaited<ReturnType<typeof getRepo>>) {
+  const [settings, nav] = await Promise.all([repo.getSettings(), repo.listNavItems()]);
+  return diffDesign(settings, nav, settings.draftDesign, (slug) => getTheme(slug).name);
+}
 
 // All admin mutations live here. The middleware only guards /admin pages,
 // so every action re-checks the session itself.
-function requireAdmin(ctx: ActionAPIContext) {
-  if (!verifySessionToken(ctx.cookies.get(SESSION_COOKIE)?.value)) {
+async function requireAdmin(ctx: ActionAPIContext) {
+  if (!(await validateSession(ctx.cookies.get(SESSION_COOKIE)?.value, ctx.locals))) {
     throw new ActionError({ code: 'UNAUTHORIZED', message: 'Not signed in.' });
   }
 }
@@ -39,6 +62,105 @@ const BlockInput = z.object({
   config: z.record(z.any()),
 });
 
+
+// ---- calendar helpers ------------------------------------------------------
+
+type EventSaveInput = Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt' | 'sourceUid' | 'publishedAt'>>;
+
+// Validate + normalize an event save. Times are checked as a PAIR against the
+// merged (staged) state so a half-edited range can't slip through.
+async function cleanEventInput(repo: Awaited<ReturnType<typeof getRepo>>, data: EventSaveInput, before: CalEvent): Promise<EventSaveInput> {
+  const out: EventSaveInput = { ...data };
+  if (out.slug !== undefined) {
+    const base = slugify(out.slug || out.title || before.title);
+    let slug = base;
+    for (let n = 2; ; n++) {
+      const clash = await repo.getEventBySlug(slug);
+      if (!clash || clash.id === before.id) break;
+      slug = `${base}-${n}`;
+    }
+    out.slug = slug;
+  }
+  if (out.timezone !== undefined && out.timezone !== '' && !isValidTimeZone(out.timezone)) {
+    throw new ActionError({ code: 'BAD_REQUEST', message: `“${out.timezone}” isn’t a timezone we recognize.` });
+  }
+  if (out.start !== undefined || out.end !== undefined || out.allDay !== undefined) {
+    const merged = before.draft ? { ...before, ...(before.draft as Partial<CalEvent>) } : before;
+    try {
+      const t = normalizeEventTimes({ start: out.start ?? merged.start, end: out.end ?? merged.end, allDay: out.allDay ?? merged.allDay });
+      out.start = t.start;
+      out.end = t.end;
+    } catch (err) {
+      throw new ActionError({ code: 'BAD_REQUEST', message: err instanceof Error ? err.message : 'Invalid time.' });
+    }
+  }
+  if (out.calendarIds !== undefined) {
+    const known = new Set((await repo.listCalendars()).filter((c) => c.kind === 'native').map((c) => c.id));
+    out.calendarIds = [...new Set(out.calendarIds.filter((c) => known.has(c)))];
+  }
+  if (out.fields !== undefined) {
+    const allowed = new Map(CALENDAR.eventFields.map((f) => [f.key, f]));
+    out.fields = Object.fromEntries(
+      Object.entries(out.fields)
+        .filter(([k, v]) => allowed.has(k) && v !== '')
+        .filter(([k, v]) => allowed.get(k)!.type !== 'select' || allowed.get(k)!.options.includes(v))
+    );
+  }
+  if (out.cta !== undefined) {
+    const href = out.cta.href.trim();
+    if (href && !/^(https?:\/\/|\/(?!\/)|mailto:|tel:|#)/i.test(href)) {
+      throw new ActionError({ code: 'BAD_REQUEST', message: 'The button link must start with https://, /, mailto:, or tel:.' });
+    }
+    out.cta = { ...out.cta, href };
+  }
+  if (out.location?.url) {
+    if (!/^https?:\/\//i.test(out.location.url.trim())) {
+      throw new ActionError({ code: 'BAD_REQUEST', message: 'The map or meeting link must start with https://.' });
+    }
+  }
+  if (out.tags !== undefined) out.tags = [...new Set(out.tags.map((t) => t.trim()).filter(Boolean))];
+  if (out.status === 'scheduled' && !(out.scheduledAt && out.scheduledAt > Date.now())) {
+    throw new ActionError({ code: 'BAD_REQUEST', message: 'Pick a future publish time to schedule.' });
+  }
+  if (out.status === 'published') out.scheduledAt = null;
+  return out;
+}
+
+async function eventSideEffects(
+  repo: Awaited<ReturnType<typeof getRepo>>,
+  ctx: ActionAPIContext,
+  before: CalEvent,
+  after: CalEvent,
+  applied = false
+) {
+  const settings = await repo.getSettings();
+  await eventChanged(repo, before, after, {
+    origin: siteOrigin(settings, ctx.url), waitUntil: waitUntilFrom(ctx.locals), applied, onRedirect: invalidateRedirectCache,
+  });
+}
+
+async function importEvents(
+  repo: Awaited<ReturnType<typeof getRepo>>,
+  parsed: { events: ReturnType<typeof eventsFromIcs>['events']; skipped: number },
+  calendarId?: string
+) {
+  // re-importing the same feed updates nothing and duplicates nothing: known
+  // source UIDs are skipped
+  const existing = new Set((await repo.listEvents()).map((e) => e.sourceUid).filter(Boolean));
+  let created = 0;
+  let duplicates = 0;
+  for (const e of parsed.events) {
+    if (e.sourceUid && existing.has(e.sourceUid)) { duplicates++; continue; }
+    const base = slugify(e.title);
+    let slug = base;
+    for (let n = 2; await repo.getEventBySlug(slug); n++) slug = `${base}-${n}`;
+    await repo.createEvent({ ...e, slug, status: 'draft', calendarIds: calendarId ? [calendarId] : [] });
+    if (e.sourceUid) existing.add(e.sourceUid);
+    created++;
+  }
+  return { created, duplicates, skipped: parsed.skipped };
+}
+
 export const server = {
   posts: {
     save: defineAction({
@@ -65,14 +187,23 @@ export const server = {
         scheduledAt: nullableTs.optional(),
       }),
       handler: async ({ id, ...data }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         if (data.slug !== undefined) data.slug = slugify(data.slug);
         if (data.collection !== undefined && !CONTENT.collections[data.collection]) {
           throw new ActionError({ code: 'BAD_REQUEST', message: `Unknown collection "${data.collection}".` });
         }
-        const movesUrl = data.slug !== undefined || data.collection !== undefined;
-        const before = movesUrl ? await repo.getPost(id) : null;
+        const before = await repo.getPost(id);
+        if (!before) throw new ActionError({ code: 'NOT_FOUND', message: 'Post not found.' });
+        // A live (published/scheduled) post never takes content edits
+        // directly: they stage into the pending draft until the user hits
+        // Update. Status transitions stay deliberate, immediate writes.
+        const transitions = data.status !== undefined && data.status !== before.status;
+        if ((before.status === 'published' || before.status === 'scheduled') && !transitions) {
+          const { status: _status, scheduledAt: _scheduledAt, authorId: _authorId, ...staged } = data;
+          await repo.savePostDraft(id, staged);
+          return { post: (await repo.getPost(id))! };
+        }
         await repo.updatePost(id, data);
         // any new tag names become registry entries with slugs for archives
         if (data.tags !== undefined) await repo.ensureTags(data.tags);
@@ -80,7 +211,32 @@ export const server = {
         if (!post) throw new ActionError({ code: 'NOT_FOUND', message: 'Post not found.' });
         // a published post whose slug or collection changed leaves a 301
         // behind so old links keep working
-        if (before && before.status === 'published' && (before.slug !== post.slug || before.collection !== post.collection)) {
+        if (before.status === 'published' && (before.slug !== post.slug || before.collection !== post.collection)) {
+          await repo
+            .createRedirect({
+              fromPath: collectionUrl(before.collection, before.slug),
+              toPath: collectionUrl(post.collection, post.slug),
+            })
+            .catch(() => {});
+          invalidateRedirectCache();
+        }
+        return { post };
+      },
+    }),
+    // Update button: copy the pending draft onto the live columns. The
+    // deferred side-effects (tag registry, slug-change 301) happen here —
+    // the moment the change actually goes live.
+    applyUpdate: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const before = await repo.getPost(id);
+        if (!before) throw new ActionError({ code: 'NOT_FOUND', message: 'Post not found.' });
+        await repo.applyPostDraft(id);
+        const post = (await repo.getPost(id))!;
+        if (post.tags.length) await repo.ensureTags(post.tags);
+        if (before.status === 'published' && (before.slug !== post.slug || before.collection !== post.collection)) {
           await repo
             .createRedirect({
               fromPath: collectionUrl(before.collection, before.slug),
@@ -92,10 +248,21 @@ export const server = {
         return { post };
       },
     }),
+    discardChanges: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.discardPostDraft(id);
+        const post = await repo.getPost(id);
+        if (!post) throw new ActionError({ code: 'NOT_FOUND', message: 'Post not found.' });
+        return { post };
+      },
+    }),
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.deletePost(id);
         return { ok: true };
@@ -120,33 +287,68 @@ export const server = {
         blocks: z.array(BlockInput).optional(),
       }),
       handler: async ({ id, blocks, ...data }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         if (data.slug !== undefined) data.slug = slugify(data.slug);
         // default locale stores as '', unknown codes fall back to it
         if (data.locale !== undefined) data.locale = normalizePageLocale(data.locale);
-        const before = data.slug !== undefined ? await repo.getPage(id) : null;
+        const before = await repo.getPage(id);
+        if (!before) throw new ActionError({ code: 'NOT_FOUND', message: 'Page not found.' });
         const cleanBlocks =
           blocks === undefined
             ? undefined
             : blocks
                 .filter((b) => widgetTypes.includes(b.type as WidgetType))
                 .map((b) => ({ ...b, type: b.type as WidgetType, config: parseConfig(b.type as WidgetType, b.config) as Record<string, unknown> }));
+        // live pages stage their edits until Update, same as posts
+        const transitions = data.status !== undefined && data.status !== before.status;
+        if ((before.status === 'published' || before.status === 'scheduled') && !transitions) {
+          const { status: _status, ...staged } = data;
+          await repo.savePageDraft(id, { ...staged, blocks: cleanBlocks });
+          return { page: (await repo.getPage(id))! };
+        }
         await repo.updatePage(id, { ...data, blocks: cleanBlocks });
         const page = await repo.getPage(id);
         if (!page) throw new ActionError({ code: 'NOT_FOUND', message: 'Page not found.' });
         // renaming a published slug leaves a 301 behind so old links keep working
-        if (before && before.status === 'published' && before.slug !== page.slug && !page.isHome) {
+        if (before.status === 'published' && before.slug !== page.slug && !page.isHome) {
+          await repo.createRedirect({ fromPath: `/${before.slug}`, toPath: `/${page.slug}` }).catch(() => {});
+          invalidateRedirectCache();
+        }
+        return { page };
+      },
+    }),
+    applyUpdate: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const before = await repo.getPage(id);
+        if (!before) throw new ActionError({ code: 'NOT_FOUND', message: 'Page not found.' });
+        await repo.applyPageDraft(id);
+        const page = (await repo.getPage(id))!;
+        if (before.status === 'published' && before.slug !== page.slug && !page.isHome) {
           await repo.createRedirect({ fromPath: `/${before.slug}`, toPath: `/${page.slug}` }).catch(() => {});
           invalidateRedirectCache();
         }
         return { page };
       },
     }),
+    discardChanges: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.discardPageDraft(id);
+        const page = await repo.getPage(id);
+        if (!page) throw new ActionError({ code: 'NOT_FOUND', message: 'Page not found.' });
+        return { page };
+      },
+    }),
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.deletePage(id);
         return { ok: true };
@@ -158,7 +360,7 @@ export const server = {
     list: defineAction({
       input: z.object({}),
       handler: async (_input, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         return { media: await repo.listMedia() };
       },
@@ -166,7 +368,7 @@ export const server = {
     updateAlt: defineAction({
       input: z.object({ id: z.string(), alt: z.string() }),
       handler: async ({ id, alt }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.updateMedia(id, { alt });
         return { ok: true };
@@ -175,7 +377,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         const media = await repo.getMedia(id);
         if (media) {
@@ -199,7 +401,7 @@ export const server = {
         meta: z.record(z.any()).default({}),
       }),
       handler: async (data, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         return { link: await repo.createLink(data) };
       },
@@ -214,7 +416,7 @@ export const server = {
         meta: z.record(z.any()).optional(),
       }),
       handler: async ({ id, ...data }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.updateLink(id, data);
         return { ok: true };
@@ -223,7 +425,7 @@ export const server = {
     reorder: defineAction({
       input: z.object({ ids: z.array(z.string()) }),
       handler: async ({ ids }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.reorderLinks(ids);
         return { ok: true };
@@ -232,7 +434,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.deleteLink(id);
         return { ok: true };
@@ -241,6 +443,26 @@ export const server = {
   },
 
   nav: {
+    // Navigation stages with the design: the full ordered list goes into the
+    // design draft and reaches the live menus on "Publish design".
+    saveDraft: defineAction({
+      input: z.object({
+        items: z.array(z.object({
+          id: z.string(),
+          label: z.string(),
+          url: z.string(),
+          area: z.enum(['header', 'footer', 'social']),
+        })),
+      }),
+      handler: async ({ items }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.saveDesignDraft({ navItems: items });
+        const changes = await designChanges(repo);
+        if (!changes.length) await repo.discardDesignDraft();
+        return { ok: true, changes };
+      },
+    }),
     create: defineAction({
       input: z.object({
         label: z.string().default('New link'),
@@ -248,7 +470,7 @@ export const server = {
         area: z.enum(['header', 'footer', 'social']).default('header'),
       }),
       handler: async (data, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         return { item: await repo.createNavItem(data) };
       },
@@ -261,7 +483,7 @@ export const server = {
         area: z.enum(['header', 'footer', 'social']).optional(),
       }),
       handler: async ({ id, ...data }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.updateNavItem(id, data);
         return { ok: true };
@@ -270,7 +492,7 @@ export const server = {
     reorder: defineAction({
       input: z.object({ ids: z.array(z.string()) }),
       handler: async ({ ids }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.reorderNavItems(ids);
         return { ok: true };
@@ -279,7 +501,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.deleteNavItem(id);
         return { ok: true };
@@ -303,36 +525,279 @@ export const server = {
         siteCover: z.string().optional(),
       }),
       handler: async (data, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         await repo.updateSettings(data);
         return { ok: true };
       },
     }),
+    // Design-screen staging: edits stage in settings.draftDesign (seen in
+    // preview mode) until "Publish design" applies them live. Every mutation
+    // returns the refreshed change list.
+    saveDesignDraft: defineAction({
+      input: z.object({
+        activeTheme: z.string().optional(),
+        designOverrides: z.record(z.any()).optional(),
+        siteLogo: z.string().optional(),
+        siteFavicon: z.string().optional(),
+        siteCover: z.string().optional(),
+      }),
+      handler: async (data, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.saveDesignDraft(data);
+        // edits that land back on the live design leave nothing to publish
+        const changes = await designChanges(repo);
+        if (!changes.length) await repo.discardDesignDraft();
+        return { ok: true, changes };
+      },
+    }),
+    designStatus: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        await requireAdmin(ctx);
+        return { changes: await designChanges(await getRepo(ctx.locals)) };
+      },
+    }),
+    // undo one row of the change list (back to the live value)
+    revertDesignChange: defineAction({
+      input: z.object({ key: z.string() }),
+      handler: async ({ key }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const [settings, nav] = await Promise.all([repo.getSettings(), repo.listNavItems()]);
+        if (settings.draftDesign) await repo.setDesignDraft(revertDesignChange(settings, nav, settings.draftDesign, key));
+        const after = await repo.getSettings();
+        return { changes: await designChanges(repo), draft: after.draftDesign };
+      },
+    }),
+    applyDesign: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        const userId = await validateSession(ctx.cookies.get(SESSION_COOKIE)?.value, ctx.locals);
+        if (!userId) throw new ActionError({ code: 'UNAUTHORIZED', message: 'Not signed in.' });
+        const repo = await getRepo(ctx.locals);
+        const changes = await designChanges(repo);
+        const author = (await repo.listUsers()).find((u) => u.id === userId)?.name ?? 'Admin';
+        const settings = await repo.getSettings();
+        const effective = { ...settings, ...pickDesignDraft(settings.draftDesign ?? {}) };
+        try {
+          validateSectionDesign(effective, getTheme(effective.activeTheme));
+          await repo.applyDesignDraft({ author, summary: summarizeChanges(changes), expectedRevision: settings.designRevision });
+        } catch (error) {
+          if (error instanceof ApiError) throw new ActionError({ code: 'BAD_REQUEST', message: error.message });
+          throw error;
+        }
+        return { ok: true };
+      },
+    }),
+    discardDesign: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.discardDesignDraft();
+        return { ok: true };
+      },
+    }),
+    // design history (snapshots taken on every publish)
+    listDesignVersions: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const versions = await repo.listDesignVersions(20);
+        return {
+          versions: versions.map((v) => ({
+            id: v.id, createdAt: v.createdAt, author: v.author, summary: v.summary,
+            theme: getTheme(String(v.snapshot.activeTheme || 'ink')).name,
+          })),
+        };
+      },
+    }),
+    // a restore never goes live directly: the snapshot becomes the draft
+    restoreDesignVersion: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const v = await repo.getDesignVersion(id);
+        if (!v) throw new ActionError({ code: 'NOT_FOUND', message: 'That version no longer exists.' });
+        const current = await repo.getSettings();
+        await repo.setDesignDraft({ ...v.snapshot, shareEpoch: crypto.randomUUID() });
+        const changes = await designChanges(repo);
+        if (!changes.length) await repo.discardDesignDraft();
+        return { changes };
+      },
+    }),
+    // share links: signed ?preview=<token> URLs, tied to the draft's epoch
+    createShareLink: defineAction({
+      input: z.object({ days: z.number().int().min(1).max(30).default(7) }),
+      handler: async ({ days }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const settings = await repo.getSettings();
+        if (!settings.draftDesign) throw new ActionError({ code: 'BAD_REQUEST', message: 'There are no draft changes to share.' });
+        if (shareEpoch(settings.draftDesign) === 'legacy-disabled') {
+          await repo.saveDesignDraft({ shareEpoch: crypto.randomUUID() });
+          settings.draftDesign = (await repo.getSettings()).draftDesign;
+        }
+        const { token, expiresAt } = createDesignToken(shareEpoch(settings.draftDesign), days * 86_400_000);
+        return { url: `${siteOrigin(settings, ctx.url)}/?preview=${token}`, expiresAt };
+      },
+    }),
+    revokeShareLinks: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const settings = await repo.getSettings();
+        if (settings.draftDesign) await repo.saveDesignDraft({ shareEpoch: crypto.randomUUID() });
+        return { ok: true };
+      },
+    }),
+  },
+
+  admin: {
+    // ⌘K palette index: every page, collection entry and tag, small enough to
+    // fetch once per palette session and filter client-side
+    index: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const [pages, posts, tags, events] = await Promise.all([
+          repo.listPages(), repo.listPosts(), repo.listTags(), CALENDAR.enabled ? repo.listEvents() : Promise.resolve([] as CalEvent[]),
+        ]);
+        return {
+          items: [
+            ...events.map((e) => ({
+              kind: 'Event',
+              title: e.title || 'Untitled event',
+              sub: `${CALENDAR.eventsBase}/${e.slug}`,
+              href: `/admin/calendar/events/${e.id}`,
+              status: e.status as string,
+              image: e.cover || '',
+              at: e.updatedAt,
+            })),
+            ...posts.map((p) => ({
+              kind: (CONTENT.collections[p.collection] ?? CONTENT.posts).singular,
+              title: p.title || 'Untitled',
+              sub: collectionUrl(p.collection, p.slug),
+              href: `/admin/c/${p.collection}/${p.id}`,
+              status: p.status as string,
+              image: p.cover || '',
+              at: p.updatedAt,
+            })),
+            ...pages.map((p) => ({
+              kind: 'Page',
+              title: p.title || 'Untitled',
+              sub: p.isHome ? '/' : `/${p.slug}`,
+              href: `/admin/pages/${p.id}`,
+              status: p.status as string,
+              image: '',
+              at: p.updatedAt,
+            })),
+            ...tags.map((t) => ({
+              kind: 'Tag',
+              title: t.name,
+              sub: `${CONTENT.tags.base}/${t.slug}`,
+              href: '/admin/tags',
+              status: '',
+              image: '',
+              at: 0,
+            })),
+          ],
+        };
+      },
+    }),
   },
 
   tags: {
     list: defineAction({
       input: z.object({}),
       handler: async (_input, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         return { tags: await repo.listTags() };
       },
     }),
   },
 
+  snippets: {
+    list: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        return { snippets: await repo.listSnippets() };
+      },
+    }),
+    create: defineAction({
+      input: z.object({ name: z.string().min(1).max(80), contentJson: z.string().min(2) }),
+      handler: async ({ name, contentJson }, ctx) => {
+        await requireAdmin(ctx);
+        // must be a JSON array of ProseMirror nodes — reject anything else
+        // before it can break the editor on re-insert
+        let parsed: unknown;
+        try { parsed = JSON.parse(contentJson); } catch { parsed = null; }
+        if (!Array.isArray(parsed) || !parsed.length) {
+          throw new ActionError({ code: 'BAD_REQUEST', message: 'Select some content first.' });
+        }
+        const repo = await getRepo(ctx.locals);
+        return { snippet: await repo.createSnippet({ name, contentJson }) };
+      },
+    }),
+    delete: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.deleteSnippet(id);
+        return { ok: true };
+      },
+    }),
+  },
+
   users: {
     list: defineAction({
       input: z.object({}),
       handler: async (_input, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
         return { users: await repo.listUsers() };
       },
     }),
   },
 
+  linkTargets: {
+    // ⌘K internal link search: published posts + pages matched by title or
+    // URL. Drafts are excluded on purpose — linking to one would 404 until
+    // it's published.
+    search: defineAction({
+      input: z.object({ query: z.string().min(1) }),
+      handler: async ({ query }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const q = query.toLowerCase();
+        const [posts, pages] = await Promise.all([repo.listPosts(), repo.listPages()]);
+        const targets = [
+          ...pages
+            .filter((p) => p.status === 'published')
+            .map((p) => ({ kind: 'Page', title: p.title, url: p.isHome ? localeHomeUrl(p.locale) : `/${p.slug}` })),
+          ...posts
+            .filter((p) => p.status === 'published')
+            .map((p) => ({
+              kind: (CONTENT.collections[p.collection] ?? CONTENT.posts).singular,
+              title: p.title,
+              url: collectionUrl(p.collection, p.slug),
+            })),
+        ].filter((t) => t.title.toLowerCase().includes(q) || t.url.toLowerCase().includes(q));
+        return { targets: targets.slice(0, 8) };
+      },
+    }),
+  },
+
   bookmark: {
     // Server-side link-metadata fetch for the bookmark card (no CORS in the
     // browser). Fetches the page, scrapes OG/meta tags, returns a compact
@@ -340,7 +805,7 @@ export const server = {
     fetch: defineAction({
       input: z.object({ url: z.string().url() }),
       handler: async ({ url }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         // redirects are followed manually so EVERY hop is re-checked against
         // the private-host guard (a public URL 302ing to 127.0.0.1 or a cloud
         // metadata IP must not slip through)
@@ -408,9 +873,20 @@ export const server = {
     preview: defineAction({
       input: z.object({ sources: z.array(z.string()).min(1).max(6) }),
       handler: async ({ sources }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const normalized: string[] = [];
+        const repo0 = await getRepo(ctx.locals);
+        const siteCalendars = await repo0.listCalendars();
         for (const raw of sources) {
+          // site calendars: 'acms:all' or 'acms:cal:<slug>'
+          if (raw === NATIVE_ALL || raw.startsWith('acms:cal:')) {
+            const slug = raw.slice('acms:cal:'.length);
+            if (raw !== NATIVE_ALL && !siteCalendars.some((c) => c.slug === slug && c.visibility !== 'private')) {
+              throw new ActionError({ code: 'BAD_REQUEST', message: 'That calendar doesn’t exist or is private.' });
+            }
+            if (!normalized.includes(raw)) normalized.push(raw);
+            continue;
+          }
           const url = normalizeCalendarSrc(raw);
           if (!url) {
             throw new ActionError({
@@ -424,12 +900,18 @@ export const server = {
         const settings = await repo.getSettings();
         const tz = settings.timezone || 'UTC';
         const now = Date.now();
-        const { events, errors } = await getCalendarEvents(normalized, {
-          displayTz: tz, now,
-          windowStartMs: now - 86_400_000,
-          windowEndMs: now + 120 * 86_400_000,
-        });
-        if (!events.length && errors.length) throw new ActionError({ code: 'BAD_GATEWAY', message: errors[0] });
+        const win = { displayTz: tz, now, windowStartMs: now - 86_400_000, windowEndMs: now + 120 * 86_400_000 };
+        const feedUrls = normalized.filter((s) => s.startsWith('http'));
+        const natives = normalized.filter((s) => !s.startsWith('http'));
+        const { events: feedEvents, errors } = feedUrls.length ? await getCalendarEvents(feedUrls, win) : { events: [], errors: [] as string[] };
+        let events = feedEvents;
+        if (natives.length) {
+          const all = natives.includes(NATIVE_ALL);
+          const ids = siteCalendars.filter((c) => natives.includes(`acms:cal:${c.slug}`)).map((c) => c.id);
+          const got = await collectViewEvents(repo, settings, win, { audience: 'public', ...(all ? {} : { calendarIds: ids }) });
+          events = [...events, ...got.events.map((e) => ({ ...e, cal: e.cal + feedUrls.length }))].sort((x, y) => x.start - y.start);
+        }
+        if (!events.length && errors.length && !natives.length) throw new ActionError({ code: 'BAD_GATEWAY', message: errors[0] });
         const locale = siteLocale(settings);
         const dayFmt = new Intl.DateTimeFormat(locale, { weekday: 'short', month: 'short', day: 'numeric', timeZone: tz });
         const timeFmt = new Intl.DateTimeFormat(locale, { hour: 'numeric', minute: '2-digit', timeZone: tz });
@@ -441,7 +923,231 @@ export const server = {
             title: e.title,
             cal: e.cal,
           }));
-        return { sources: normalized, upcoming, total: events.length };
+        const labels = Object.fromEntries(
+          natives.map((n) => [n, n === NATIVE_ALL ? 'All site events' : siteCalendars.find((c) => `acms:cal:${c.slug}` === n)?.name ?? n])
+        );
+        return { sources: normalized, upcoming, total: events.length, labels };
+      },
+    }),
+  },
+
+  events: {
+    save: defineAction({
+      input: z.object({
+        id: z.string(),
+        title: z.string().max(300).optional(),
+        slug: z.string().optional(),
+        bodyJson: z.string().optional(),
+        bodyHtml: z.string().optional(),
+        excerpt: z.string().max(1000).optional(),
+        tags: z.array(z.string()).optional(),
+        cover: z.string().optional(),
+        coverAlt: z.string().optional(),
+        seoTitle: z.string().optional(),
+        seoDesc: z.string().optional(),
+        status: StatusInput.optional(),
+        featured: z.boolean().optional(),
+        template: z.string().optional(),
+        start: z.string().optional(),
+        end: z.string().optional(),
+        allDay: z.boolean().optional(),
+        timezone: z.string().optional(),
+        rrule: z.string().max(500).optional(),
+        exdates: z.array(z.string()).max(500).optional(),
+        cancelled: z.boolean().optional(),
+        location: z.object({ name: z.string().max(300), address: z.string().max(500), url: z.string().max(1000) }).optional(),
+        cta: z.object({ label: z.string().max(120), href: z.string().max(1000), style: z.enum(['primary', 'outline']) }).optional(),
+        calendarIds: z.array(z.string()).max(50).optional(),
+        fields: z.record(z.string().max(2000)).optional(),
+        rsvp: z.object({ enabled: z.boolean(), capacity: z.number().int().min(0).max(100000), autoConfirm: z.boolean(), maxSeats: z.number().int().min(1).max(50) }).optional(),
+        scheduledAt: nullableTs.optional(),
+      }),
+      handler: async ({ id, ...data }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const before = await repo.getEvent(id);
+        if (!before) throw new ActionError({ code: 'NOT_FOUND', message: 'Event not found.' });
+        const clean = await cleanEventInput(repo, data, before);
+        // live events stage edits until Update, exactly like posts
+        const transitions = clean.status !== undefined && clean.status !== before.status;
+        if ((before.status === 'published' || before.status === 'scheduled') && !transitions) {
+          const { status: _s, scheduledAt: _sa, ...staged } = clean;
+          await repo.saveEventDraft(id, staged);
+          return { event: (await repo.getEvent(id))! };
+        }
+        await repo.updateEvent(id, clean);
+        if (clean.tags !== undefined) await repo.ensureTags(clean.tags);
+        const event = (await repo.getEvent(id))!;
+        await eventSideEffects(repo, ctx, before, event);
+        return { event };
+      },
+    }),
+    applyUpdate: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const before = await repo.getEvent(id);
+        if (!before) throw new ActionError({ code: 'NOT_FOUND', message: 'Event not found.' });
+        await repo.applyEventDraft(id);
+        const event = (await repo.getEvent(id))!;
+        if (event.tags.length) await repo.ensureTags(event.tags);
+        await eventSideEffects(repo, ctx, before, event, true);
+        return { event };
+      },
+    }),
+    discardChanges: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        await repo.discardEventDraft(id);
+        return { event: await repo.getEvent(id) };
+      },
+    }),
+    delete: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const before = await repo.getEvent(id);
+        await repo.deleteEvent(id);
+        await eventDeleted(repo, before, { waitUntil: waitUntilFrom(ctx.locals) });
+        return { ok: true };
+      },
+    }),
+    // editor pickers (event card): every event with its next date
+    list: defineAction({
+      input: z.object({ publishedOnly: z.boolean().default(false) }),
+      handler: async ({ publishedOnly }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const [events, settings] = await Promise.all([publishedOnly ? repo.listPublishedEvents() : repo.listEvents(), repo.getSettings()]);
+        const now = Date.now();
+        return {
+          events: events.map((e) => {
+            const o = featuredOccurrence(e, settings, now);
+            return {
+              id: e.id, title: e.title || 'Untitled event', slug: e.slug, status: e.status, cover: e.cover,
+              when: o ? formatOccurrence(o, settings.timezone || 'UTC', siteLocale(settings)).range : '',
+              at: o?.start ?? e.startAt,
+            };
+          }).sort((a, b) => a.at - b.at),
+        };
+      },
+    }),
+    // one-time import: an ICS file/URL or a CSV becomes DRAFT events
+    import: defineAction({
+      input: z.object({
+        format: z.enum(['ics', 'csv']),
+        text: z.string().max(3_000_000).optional(),
+        url: z.string().max(2000).optional(),
+        calendarId: z.string().optional(),
+      }),
+      handler: async ({ format, text, url, calendarId }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const settings = await repo.getSettings();
+        if (calendarId && !(await repo.getCalendar(calendarId))) throw new ActionError({ code: 'BAD_REQUEST', message: 'Unknown calendar.' });
+        let body = text ?? '';
+        if (format === 'ics' && url) {
+          const feedUrl = normalizeCalendarSrc(url);
+          if (!feedUrl) throw new ActionError({ code: 'BAD_REQUEST', message: 'Paste a Google Calendar link, a calendar ID, or an .ics feed URL.' });
+          try {
+            const feed = await loadFeed(feedUrl, Date.now());
+            return await importEvents(repo, eventsFromVEvents(feed.vevents, feed.calTz, settings.timezone), calendarId);
+          } catch (err) {
+            throw new ActionError({ code: 'BAD_GATEWAY', message: err instanceof Error ? err.message : 'Couldn’t load that feed.' });
+          }
+        }
+        if (!body.trim()) throw new ActionError({ code: 'BAD_REQUEST', message: 'Choose a file or paste a feed URL.' });
+        if (format === 'ics') {
+          if (!body.includes('BEGIN:VCALENDAR')) throw new ActionError({ code: 'BAD_REQUEST', message: 'That file isn’t an .ics calendar.' });
+          return importEvents(repo, eventsFromIcs(body, settings.timezone), calendarId);
+        }
+        const parsed = eventsFromCsv(body);
+        if (parsed.error) throw new ActionError({ code: 'BAD_REQUEST', message: parsed.error });
+        return importEvents(repo, parsed, calendarId);
+      },
+    }),
+  },
+
+  calendars: {
+    list: defineAction({
+      input: z.object({}),
+      handler: async (_input, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        return { calendars: await repo.listCalendars() };
+      },
+    }),
+    save: defineAction({
+      input: z.object({
+        id: z.string().optional(),
+        name: z.string().trim().min(1).max(120),
+        slug: z.string().optional(),
+        color: z.string().optional(),
+        description: z.string().max(1000).optional(),
+        kind: z.enum(['native', 'feed']).optional(),
+        feedUrl: z.string().max(2000).optional(),
+        visibility: z.enum(['public', 'unlisted', 'private']).optional(),
+      }),
+      handler: async ({ id, ...data }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const existing = id ? await repo.getCalendar(id) : null;
+        if (id && !existing) throw new ActionError({ code: 'NOT_FOUND', message: 'Calendar not found.' });
+        const kind = existing?.kind ?? data.kind ?? 'native';
+        let feedUrl = existing?.feedUrl ?? '';
+        if (kind === 'feed' && (data.feedUrl !== undefined || !existing)) {
+          const normalized = normalizeCalendarSrc(data.feedUrl ?? '');
+          if (!normalized) throw new ActionError({ code: 'BAD_REQUEST', message: 'Paste a Google Calendar link, a calendar ID, or an .ics feed URL.' });
+          feedUrl = normalized;
+        }
+        const base = slugify(data.slug || data.name);
+        let slug = base;
+        for (let n = 2; ; n++) {
+          const clash = await repo.getCalendarBySlug(slug);
+          if (!clash || clash.id === id) break;
+          slug = `${base}-${n}`;
+        }
+        const fields = {
+          name: data.name, slug, color: safeColor(data.color ?? existing?.color ?? '#4f46e5'),
+          description: data.description ?? existing?.description ?? '', feedUrl,
+          visibility: data.visibility ?? existing?.visibility ?? 'public',
+        };
+        if (existing) {
+          await repo.updateCalendar(existing.id, fields);
+          return { calendar: (await repo.getCalendar(existing.id))! };
+        }
+        return { calendar: await repo.createCalendar({ ...fields, kind }) };
+      },
+    }),
+    reorder: defineAction({
+      input: z.object({ ids: z.array(z.string()) }),
+      handler: async ({ ids }, ctx) => {
+        await requireAdmin(ctx);
+        await (await getRepo(ctx.locals)).reorderCalendars(ids);
+        return { ok: true };
+      },
+    }),
+    rotateToken: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const bytes = crypto.getRandomValues(new Uint8Array(18));
+        const token = btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+        await repo.updateCalendar(id, { feedToken: token });
+        return { calendar: await repo.getCalendar(id) };
+      },
+    }),
+    delete: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        await (await getRepo(ctx.locals)).deleteCalendar(id);
+        return { ok: true };
       },
     }),
   },
@@ -450,7 +1156,7 @@ export const server = {
     search: defineAction({
       input: z.object({ query: z.string().min(1), page: z.number().int().min(1).default(1) }),
       handler: async ({ query, page }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const key = env('UNSPLASH_ACCESS_KEY');
         if (!key) throw new ActionError({ code: 'PRECONDITION_FAILED', message: 'Unsplash is not configured.' });
         const res = await fetch(
@@ -491,7 +1197,7 @@ export const server = {
     track: defineAction({
       input: z.object({ downloadLocation: z.string().url() }),
       handler: async ({ downloadLocation }, ctx) => {
-        requireAdmin(ctx);
+        await requireAdmin(ctx);
         const key = env('UNSPLASH_ACCESS_KEY');
         if (!key || !downloadLocation.startsWith('https://api.unsplash.com/')) return { ok: false };
         await fetch(downloadLocation, { headers: { Authorization: `Client-ID ${key}` } }).catch(() => {});