@acms-subir/core 0.2.0 → 0.3.1

package/src/lib/repo/sql.ts

@@ -1,10 +1,17 @@
-import type { ContentRepository, SearchResults, Stats } from './types';
-import { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, isInternalTag, normalizeRedirectPath, publicTags, slugify, type WidgetInstance } from '../schema';
-import { pickDesignDraft, pickPageDraft, pickPostDraft } from '../drafts';
+import { LiveStore } from '../live/store';
+import { LiveConfig } from '../live/types';
+import { ApiError } from '../api';
+import { EmailStore, bookingJobs } from '../email/store';
+import type { ContentRepository, DesignVersion, EventUpdate, SearchResults, Stats } from './types';
+import { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Calendar, CalEvent, ApiKey, Webhook, WebhookDelivery, Resource, BookingLink, Booking, isInternalTag, normalizeRedirectPath, publicTags, slugify, type WidgetInstance } from '../schema';
+import { designSnapshot, draftNavItems, pickDesignDraft, pickEventDraft, pickPageDraft, pickPostDraft } from '../drafts';
+import { eventInstants, eventTimeZone, normalizeEventTimes } from '../calendar/events';
+import { cleanRrule } from '../calendar/rrule';
 import { MIGRATIONS, MIGRATIONS_TABLE } from './migrations';
 import { htmlToPlaintext } from '../plaintext';
 import { SEED } from '../brand';
 import { CONTENT, postsIndexUrl } from '../content';
+import { webhookStatement } from '../webhook-sql';
 
 // Shared SQL implementation of ContentRepository. Cloudflare D1 and libSQL
 // are both SQLite, so every statement, mapper and behavior lives here once;
@@ -92,6 +99,99 @@ function rowToLink(r: Row): Link {
   });
 }
 
+const json = <T>(raw: unknown, fallback: T): T => {
+  try {
+    return raw === null || raw === undefined || raw === '' ? fallback : (JSON.parse(String(raw)) as T);
+  } catch {
+    return fallback;
+  }
+};
+function rowToCalendar(r: Row): Calendar {
+  return Calendar.parse({
+    id: r.id, slug: r.slug, name: r.name, color: r.color ?? '#4f46e5', description: r.description ?? '',
+    kind: r.kind ?? 'native', feedUrl: r.feed_url ?? '', visibility: r.visibility ?? 'public',
+    feedToken: r.feed_token ?? '', order: Number(r.ord ?? 0),
+    createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
+  });
+}
+function rowToEvent(r: Row): CalEvent {
+  return CalEvent.parse({
+    id: r.id, slug: r.slug, title: r.title, bodyJson: r.body_json ?? '', bodyHtml: r.body_html ?? '',
+    excerpt: r.excerpt ?? '', cover: r.cover ?? '', coverAlt: r.cover_alt ?? '',
+    seoTitle: r.seo_title ?? '', seoDesc: r.seo_desc ?? '', status: r.status,
+    featured: Boolean(r.featured), tags: json(r.tags, []), template: r.template ?? '',
+    start: r.starts, end: r.ends ?? '', allDay: Boolean(r.all_day), timezone: r.timezone ?? '',
+    rrule: r.rrule ?? '', exdates: json(r.exdates, []), cancelled: Boolean(r.cancelled),
+    location: json(r.location, {}), cta: json(r.cta, {}), calendarIds: json(r.calendar_ids, []),
+    fields: json(r.fields, {}), sourceUid: r.source_uid ?? '', rsvp: json(r.rsvp, {}),
+    startAt: Number(r.start_at), endAt: Number(r.end_at), draft: parseDraft(r.draft),
+    publishedAt: r.published_at === null || r.published_at === undefined ? null : Number(r.published_at),
+    scheduledAt: r.scheduled_at === null || r.scheduled_at === undefined ? null : Number(r.scheduled_at),
+    createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
+  });
+}
+function rowToResource(r: Row): Resource {
+  return Resource.parse({
+    id: r.id, slug: r.slug, name: r.name, kind: r.kind ?? 'Room', description: r.description ?? '', photo: r.photo ?? '',
+    capacity: r.capacity === null || r.capacity === undefined ? null : Number(r.capacity),
+    amenities: json(r.amenities, []), timezone: r.timezone ?? '', hours: json(r.hours, {}), overrides: json(r.overrides, []),
+    busyFeeds: json(r.busy_feeds, []), notifyEmails: json(r.notify_emails, []), visibility: r.visibility ?? 'public',
+    showOnCalendar: Boolean(r.show_on_calendar), feedToken: r.feed_token ?? '', order: Number(r.ord ?? 0),
+    createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
+  });
+}
+function rowToLink2(r: Row): BookingLink {
+  return BookingLink.parse({
+    id: r.id, resourceId: r.resource_id, slug: r.slug, name: r.name, description: r.description ?? '', mode: r.mode ?? 'slots',
+    duration: Number(r.duration), lengths: json(r.lengths, []), minDays: Number(r.min_days), maxDays: Number(r.max_days),
+    step: Number(r.step), bufferBefore: Number(r.buffer_before), bufferAfter: Number(r.buffer_after),
+    minNotice: Number(r.min_notice), maxAdvance: Number(r.max_advance), perDayCap: Number(r.per_day_cap),
+    hours: r.hours ? json(r.hours, null) : null, autoConfirm: Boolean(r.auto_confirm), visibility: r.visibility ?? 'public',
+    askPhone: Boolean(r.ask_phone), questions: json(r.questions, []), confirmMessage: r.confirm_message ?? '',
+    redirectUrl: r.redirect_url ?? '', active: Boolean(r.active), order: Number(r.ord ?? 0),
+    createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
+  });
+}
+function rowToBooking(r: Row): Booking {
+  return Booking.parse({
+    id: r.id, kind: r.kind ?? 'booking', resourceId: r.resource_id ?? '', linkId: r.link_id ?? '', eventId: r.event_id ?? '',
+    status: r.status, start: Number(r.start_at), end: Number(r.end_at), holdStart: Number(r.hold_start), holdEnd: Number(r.hold_end),
+    timezone: r.timezone ?? '', name: r.name ?? '', email: r.email ?? '', phone: r.phone ?? '', seats: Number(r.seats ?? 1),
+    answers: json(r.answers, {}), notes: r.notes ?? '', manageToken: r.manage_token ?? '', source: r.source ?? 'web',
+    notificationVersion: Number(r.notification_version ?? 0), reminderSentAt: r.reminder_sent_at === null || r.reminder_sent_at === undefined ? null : Number(r.reminder_sent_at),
+    createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
+  });
+}
+function rowToApiKey(r: Row): ApiKey {
+  return ApiKey.parse({
+    id: r.id, name: r.name, prefix: r.prefix, scopes: json(r.scopes, []),
+    lastUsedAt: r.last_used_at === null || r.last_used_at === undefined ? null : Number(r.last_used_at),
+    createdAt: Number(r.created_at),
+  });
+}
+function rowToWebhook(r: Row): Webhook {
+  return Webhook.parse({
+    id: r.id, url: r.url, secret: r.secret, events: json(r.events, []), active: Boolean(r.active),
+    lastStatus: r.last_status === null || r.last_status === undefined ? null : Number(r.last_status),
+    lastAt: r.last_at === null || r.last_at === undefined ? null : Number(r.last_at),
+    createdAt: Number(r.created_at),
+  });
+}
+function rowToDelivery(r: Row): WebhookDelivery {
+  const n = (v: unknown) => (v === null || v === undefined ? null : Number(v));
+  return WebhookDelivery.parse({
+    id: r.id, webhookId: r.webhook_id, event: r.event, payload: r.payload, status: r.status,
+    attempts: Number(r.attempts ?? 0), nextAt: n(r.next_at), responseCode: n(r.response_code),
+    createdAt: Number(r.created_at), deliveredAt: n(r.delivered_at),
+  });
+}
+
+// URL-safe secret for private calendar feeds
+function randomToken(): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(18));
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
 // FTS5 MATCH expression from user input: each whitespace token becomes a
 // quoted phrase (operators like AND / OR / - stay inert), the last one gets
 // a * for search-as-you-type prefix matching.
@@ -117,9 +217,13 @@ function safeSnippet(raw: unknown): string {
 export class SqlRepository implements ContentRepository {
   private driver!: SqlDriver;
   private ready: Promise<void>;
+  readonly email: EmailStore;
+  readonly live: LiveStore;
 
   constructor(driver: SqlDriver | (() => Promise<SqlDriver>)) {
     this.ready = this.init(driver);
+    this.live = new LiveStore(async () => { await this.ready; return this.driver; });
+    this.email = new EmailStore(async () => { await this.ready; return this.driver; });
   }
 
   private async init(driver: SqlDriver | (() => Promise<SqlDriver>)) {
@@ -215,6 +319,29 @@ export class SqlRepository implements ContentRepository {
     }
     return stmts;
   }
+  private eventIndexStatements(r: Row): SqlStatement[] {
+    const stmts: SqlStatement[] = [
+      { sql: "DELETE FROM search_index WHERE kind = 'event' AND ref_id = ?", args: [r.id] },
+    ];
+    if (r.status === 'published') {
+      const loc = json<{ name?: string; address?: string }>(r.location, {});
+      stmts.push({
+        sql: "INSERT INTO search_index (kind, ref_id, locale, title, excerpt, plaintext, tags) VALUES ('event', ?, '', ?, ?, ?, ?)",
+        args: [
+          r.id, r.title, r.excerpt ?? '',
+          [htmlToPlaintext(String(r.body_html ?? '')), loc.name ?? '', loc.address ?? ''].filter(Boolean).join(' '),
+          publicTags(json<string[]>(r.tags, [])).join(' '),
+        ],
+      });
+    }
+    return stmts;
+  }
+  private async syncEventIndex(id: string) {
+    const r = await this.first('SELECT id, status, title, excerpt, tags, body_html, location FROM events WHERE id = ?', [id]);
+    await this.driver.batch(
+      r ? this.eventIndexStatements(r) : [{ sql: "DELETE FROM search_index WHERE kind = 'event' AND ref_id = ?", args: [id] }]
+    );
+  }
   private async syncPostIndex(id: string) {
     const r = await this.first('SELECT id, status, title, excerpt, tags, body, body_html FROM posts WHERE id = ?', [id]);
     await this.driver.batch(
@@ -229,17 +356,55 @@ export class SqlRepository implements ContentRepository {
   }
   // full rebuild: the v21 backfill, restores, seeds
   private async reindexSearch() {
-    const [posts, pages] = await Promise.all([
+    const [posts, pages, events] = await Promise.all([
       this.driver.all("SELECT id, status, title, excerpt, tags, body, body_html FROM posts WHERE status = 'published'"),
       this.driver.all("SELECT id, status, locale, title, seo_desc, body_html FROM pages WHERE status = 'published'"),
+      this.driver.all("SELECT id, status, title, excerpt, tags, body_html, location FROM events WHERE status = 'published'"),
     ]);
     await this.driver.batch([
       { sql: 'DELETE FROM search_index' },
       ...posts.flatMap((r) => this.postIndexStatements(r)),
       ...pages.flatMap((r) => this.pageIndexStatements(r)),
+      ...events.flatMap((r) => this.eventIndexStatements(r)),
     ]);
   }
 
+  async listPublicContent(q: Parameters<ContentRepository['listPublicContent']>[0]) {
+    await this.ready;
+    const collections = q.collection ? [q.collection] : q.collections;
+    const rows = await this.driver.all(`SELECT id, kind FROM (
+      SELECT id, 'post' AS kind, COALESCE(published_at, created_at) AS sort_at FROM posts
+        WHERE status='published' AND collection IN (${collections.map(() => '?').join(',') || "''"})
+        AND ? != 'page' AND (? IS NULL OR ? = ?)
+      UNION ALL
+      SELECT id, 'page' AS kind, created_at AS sort_at FROM pages WHERE status='published'
+        AND ? != 'post' AND ? IS NULL AND (? IS NULL OR COALESCE(NULLIF(locale,''),?) = ?)
+      ) ORDER BY sort_at DESC, kind ASC, id ASC LIMIT ? OFFSET ?`,
+      [...collections, q.kind ?? '', q.locale ?? null, q.locale ?? null, q.defaultLocale,
+        q.kind ?? '', q.collection ?? null, q.locale ?? null, q.defaultLocale, q.locale ?? null,
+        q.limit + 1, (q.page - 1) * q.limit]);
+    return rows.map(r => ({ id: String(r.id), kind: r.kind === 'post' ? 'post' as const : 'page' as const }));
+  }
+
+  async exportBookingState() {
+    await this.ready;
+    // One SELECT snapshots bookings and their retry ledger together. No UI
+    // list limit; include tombstones for deleted bookings as well.
+    const columns = ['id','kind','resource_id','link_id','event_id','status','start_at','end_at','hold_start','hold_end','timezone','name','email','phone','seats','answers','notes','manage_token','source','reminder_sent_at','notification_version','created_at','updated_at'];
+    const rows = await this.driver.all(`SELECT 'booking' AS type, json_object(${columns.map(c => `'${c}',${c}`).join(',')}) AS data FROM bookings
+      UNION ALL SELECT 'request', json_object('keyHash',key_hash,'requestHash',request_hash,'bookingId',booking_id,'createdAt',created_at) FROM mobile_booking_requests`);
+    return {
+      bookings: rows.filter(r => r.type === 'booking').map(r => rowToBooking(JSON.parse(String(r.data)))),
+      bookingRequests: rows.filter(r => r.type === 'request').map(r => JSON.parse(String(r.data)) as import('../backup/content').BookingRequest),
+    };
+  }
+
+  async getBookingRequest(keyHash: string) {
+    await this.ready;
+    const r = await this.first('SELECT request_hash, booking_id FROM mobile_booking_requests WHERE key_hash=?', [keyHash]);
+    return r ? { requestHash: String(r.request_hash), bookingId: String(r.booking_id) } : null;
+  }
+
   // ---- pages ----
   async listPages() {
     await this.ready;
@@ -275,6 +440,8 @@ export class SqlRepository implements ContentRepository {
   }
   async updatePage(id: string, data: Parameters<ContentRepository['updatePage']>[1]) {
     await this.ready;
+    if (!(await this.getPage(id))) return;
+    const writes: SqlStatement[] = [];
     // a direct live write supersedes any staged edits (applyPageDraft routes
     // through here too, so applying clears the snapshot in the same UPDATE)
     const sets: string[] = ['updated_at = ?', 'draft = NULL'];
@@ -297,12 +464,13 @@ export class SqlRepository implements ContentRepository {
           data.locale !== undefined
             ? data.locale
             : String((await this.first('SELECT locale FROM pages WHERE id = ?', [id]))?.locale ?? '');
-        await this.driver.run('UPDATE pages SET is_home = 0 WHERE locale = ?', [locale]);
+        writes.push({ sql: 'UPDATE pages SET is_home = 0 WHERE locale = ? AND id != ? AND is_home = 1', args: [locale, id] });
       }
       sets.push('is_home = ?'); args.push(data.isHome ? 1 : 0);
     }
     args.push(id);
-    await this.driver.run(`UPDATE pages SET ${sets.join(', ')} WHERE id = ?`, args);
+    writes.push({ sql: `UPDATE pages SET ${sets.join(', ')} WHERE id = ?`, args });
+    await this.driver.batch(writes);
     await this.syncPageIndex(id);
   }
   // stage edits on a live page: only the `draft` JSON changes — live columns,
@@ -417,8 +585,7 @@ export class SqlRepository implements ContentRepository {
     if (data.featured !== undefined) { sets.push('featured = ?'); args.push(data.featured ? 1 : 0); }
     if (data.template !== undefined) { sets.push('template = ?'); args.push(data.template); }
     // authorIds is the source of truth; author_id mirrors the first entry.
-    // The join rows are written AFTER the main UPDATE succeeds, so a failed
-    // update (e.g. duplicate slug) can't leave the two out of sync.
+    // Main row, join rows and webhook notifications share one transaction.
     let authorJoin: string[] | null = null;
     if (data.authorIds !== undefined) {
       authorJoin = data.authorIds;
@@ -436,16 +603,28 @@ export class SqlRepository implements ContentRepository {
       }
     }
     args.push(id);
-    await this.driver.run(`UPDATE posts SET ${sets.join(', ')} WHERE id = ?`, args);
+    const writes: SqlStatement[] = [{ sql: `UPDATE posts SET ${sets.join(', ')} WHERE id = ?`, args }];
     if (authorJoin !== null) {
-      await this.driver.batch([
+      writes.push(
         { sql: 'DELETE FROM post_authors WHERE post_id = ?', args: [id] },
         ...authorJoin.map((aid, i) => ({
           sql: 'INSERT INTO post_authors (post_id, author_id, ord) VALUES (?, ?, ?)',
           args: [id, aid, i],
         })),
-      ]);
+      );
+      // The main-row trigger detects primary-author changes. Additional
+      // authors live in a join table, so emit once for an authors-only edit.
+      const authorsOnly = current.status === 'published'
+        && (authorJoin[0] ?? null) === current.authorId
+        && JSON.stringify(authorJoin) !== JSON.stringify(current.authorIds)
+        && Object.entries(data).every(([key, value]) => key === 'authorIds' || value === undefined
+          || JSON.stringify(value) === JSON.stringify(current[key as keyof Post]));
+      if (authorsOnly) {
+        const post = { id, slug: current.slug, title: current.title, status: current.status, collection: current.collection };
+        writes.push(webhookStatement('post.updated', { post, previous: post }));
+      }
     }
+    await this.driver.batch(writes);
     await this.syncPostIndex(id);
   }
   // stage edits on a live post: only the `draft` JSON changes — live columns,
@@ -485,15 +664,584 @@ export class SqlRepository implements ContentRepository {
       "SELECT id FROM posts WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
       [now]
     );
+    if (due.length) {
+      await this.driver.run(
+        "UPDATE posts SET status = 'published', published_at = COALESCE(published_at, scheduled_at), scheduled_at = NULL, updated_at = ? WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
+        [now, now]
+      );
+      for (const r of due) await this.syncPostIndex(String(r.id));
+    }
+    return due.length + (await this.publishDueEvents(now));
+  }
+  private async publishDueEvents(now: number) {
+    const due = await this.driver.all(
+      "SELECT id FROM events WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
+      [now]
+    );
     if (!due.length) return 0;
     await this.driver.run(
-      "UPDATE posts SET status = 'published', published_at = COALESCE(published_at, scheduled_at), scheduled_at = NULL, updated_at = ? WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
+      "UPDATE events SET status = 'published', published_at = COALESCE(published_at, scheduled_at), scheduled_at = NULL, updated_at = ? WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
       [now, now]
     );
-    for (const r of due) await this.syncPostIndex(String(r.id));
+    for (const r of due) await this.syncEventIndex(String(r.id));
     return due.length;
   }
 
+  // ---- calendars ----
+  async listCalendars() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM calendars ORDER BY ord ASC, name COLLATE NOCASE ASC');
+    return rows.map(rowToCalendar);
+  }
+  async getCalendar(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM calendars WHERE id = ?', [id]);
+    return r ? rowToCalendar(r) : null;
+  }
+  async getCalendarBySlug(slug: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM calendars WHERE slug = ?', [slug]);
+    return r ? rowToCalendar(r) : null;
+  }
+  async createCalendar(data: Parameters<ContentRepository['createCalendar']>[0]) {
+    await this.ready;
+    const now = Date.now();
+    const id = crypto.randomUUID();
+    const next = await this.first('SELECT COALESCE(MAX(ord), -1) + 1 AS n FROM calendars');
+    await this.driver.run(
+      'INSERT INTO calendars (id, slug, name, color, description, kind, feed_url, visibility, feed_token, ord, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+      [
+        id, data.slug, data.name, data.color ?? '#4f46e5', data.description ?? '', data.kind ?? 'native',
+        data.feedUrl ?? '', data.visibility ?? 'public', randomToken(), Number(next?.n ?? 0), now, now,
+      ]
+    );
+    return (await this.getCalendar(id))!;
+  }
+  async updateCalendar(id: string, data: Parameters<ContentRepository['updateCalendar']>[1]) {
+    await this.ready;
+    const sets: string[] = ['updated_at = ?'];
+    const args: unknown[] = [Date.now()];
+    const cols: Record<string, string> = {
+      name: 'name', slug: 'slug', color: 'color', description: 'description',
+      feedUrl: 'feed_url', visibility: 'visibility', feedToken: 'feed_token',
+    };
+    for (const [k, col] of Object.entries(cols)) {
+      const v = (data as Record<string, unknown>)[k];
+      if (v !== undefined) { sets.push(`${col} = ?`); args.push(v); }
+    }
+    args.push(id);
+    await this.driver.run(`UPDATE calendars SET ${sets.join(', ')} WHERE id = ?`, args);
+  }
+  async reorderCalendars(ids: string[]) {
+    await this.ready;
+    await this.driver.batch(ids.map((id, i) => ({ sql: 'UPDATE calendars SET ord = ? WHERE id = ?', args: [i, id] })));
+  }
+  async deleteCalendar(id: string) {
+    await this.ready;
+    const holders = await this.driver.all("SELECT id, calendar_ids FROM events WHERE calendar_ids LIKE ?", [`%${id}%`]);
+    await this.driver.batch([
+      { sql: 'DELETE FROM calendars WHERE id = ?', args: [id] },
+      ...holders.map((r) => ({
+        sql: 'UPDATE events SET calendar_ids = ? WHERE id = ?',
+        args: [JSON.stringify(json<string[]>(r.calendar_ids, []).filter((c) => c !== id)), r.id],
+      })),
+    ]);
+  }
+
+  // ---- events ----
+  async listEvents() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM events ORDER BY start_at ASC');
+    return rows.map(rowToEvent);
+  }
+  async listPublishedEvents() {
+    await this.ready;
+    const rows = await this.driver.all("SELECT * FROM events WHERE status = 'published' ORDER BY start_at ASC");
+    return rows.map(rowToEvent);
+  }
+  async getEvent(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM events WHERE id = ?', [id]);
+    return r ? rowToEvent(r) : null;
+  }
+  async getEventBySlug(slug: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM events WHERE slug = ?', [slug]);
+    return r ? rowToEvent(r) : null;
+  }
+  private async siteTimezone() {
+    const r = await this.first('SELECT timezone FROM settings WHERE id = 1');
+    return String(r?.timezone ?? '');
+  }
+  async createEvent(data: Parameters<ContentRepository['createEvent']>[0]) {
+    await this.ready;
+    const now = Date.now();
+    const id = crypto.randomUUID();
+    const allDay = data.allDay ?? false;
+    const times = normalizeEventTimes({ start: data.start, end: data.end, allDay });
+    const tz = eventTimeZone({ timezone: data.timezone ?? '' }, { timezone: await this.siteTimezone() });
+    const { startAt, endAt } = eventInstants({ ...times, allDay }, tz);
+    await this.driver.run(
+      `INSERT INTO events (id, slug, title, body_json, body_html, excerpt, cover, cover_alt, seo_title, seo_desc, status, featured, tags, template,
+        starts, ends, all_day, timezone, rrule, exdates, cancelled, location, cta, calendar_ids, fields, source_uid, start_at, end_at,
+        published_at, scheduled_at, created_at, updated_at, rsvp)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        id, data.slug, data.title, data.bodyJson ?? '', data.bodyHtml ?? '', data.excerpt ?? '', data.cover ?? '', data.coverAlt ?? '',
+        data.seoTitle ?? '', data.seoDesc ?? '', data.status ?? 'draft', data.featured ? 1 : 0, JSON.stringify(data.tags ?? []), data.template ?? '',
+        times.start, times.end, allDay ? 1 : 0, data.timezone ?? '', cleanRrule(data.rrule ?? ''), JSON.stringify(data.exdates ?? []),
+        data.cancelled ? 1 : 0, JSON.stringify(data.location ?? {}), JSON.stringify(data.cta ?? {}), JSON.stringify(data.calendarIds ?? []),
+        JSON.stringify(data.fields ?? {}), data.sourceUid ?? '', startAt, endAt,
+        data.publishedAt ?? (data.status === 'published' ? now : null), data.scheduledAt ?? null, now, now,
+        JSON.stringify(data.rsvp ?? {}),
+      ]
+    );
+    await this.syncEventIndex(id);
+    return (await this.getEvent(id))!;
+  }
+  async updateEvent(id: string, data: EventUpdate) {
+    await this.ready;
+    const current = await this.getEvent(id);
+    if (!current) return;
+    // a direct live write supersedes any staged edits (applyEventDraft routes
+    // through here too, so applying clears the snapshot in the same UPDATE)
+    const sets: string[] = ['updated_at = ?', 'draft = NULL'];
+    const args: unknown[] = [Date.now()];
+    const plain: Record<string, string> = {
+      title: 'title', slug: 'slug', bodyJson: 'body_json', bodyHtml: 'body_html', excerpt: 'excerpt',
+      cover: 'cover', coverAlt: 'cover_alt', seoTitle: 'seo_title', seoDesc: 'seo_desc', status: 'status',
+      template: 'template', timezone: 'timezone', sourceUid: 'source_uid',
+      publishedAt: 'published_at', scheduledAt: 'scheduled_at',
+    };
+    for (const [k, col] of Object.entries(plain)) {
+      const v = (data as Record<string, unknown>)[k];
+      if (v !== undefined) { sets.push(`${col} = ?`); args.push(v); }
+    }
+    const jsonCols: Record<string, string> = {
+      tags: 'tags', exdates: 'exdates', location: 'location', cta: 'cta', calendarIds: 'calendar_ids', fields: 'fields', rsvp: 'rsvp',
+    };
+    for (const [k, col] of Object.entries(jsonCols)) {
+      const v = (data as Record<string, unknown>)[k];
+      if (v !== undefined) { sets.push(`${col} = ?`); args.push(JSON.stringify(v)); }
+    }
+    if (data.featured !== undefined) { sets.push('featured = ?'); args.push(data.featured ? 1 : 0); }
+    if (data.cancelled !== undefined) { sets.push('cancelled = ?'); args.push(data.cancelled ? 1 : 0); }
+    if (data.rrule !== undefined) { sets.push('rrule = ?'); args.push(cleanRrule(data.rrule)); }
+    // first publish stamps published_at, like posts
+    if (data.status === 'published' && current.publishedAt === null && data.publishedAt === undefined) {
+      sets.push('published_at = ?'); args.push(Date.now());
+    }
+    // times: re-normalize the pair whenever any time field moves, then
+    // re-derive the UTC instants against the (possibly new) timezone
+    if (data.start !== undefined || data.end !== undefined || data.allDay !== undefined || data.timezone !== undefined) {
+      const allDay = data.allDay ?? current.allDay;
+      const times = normalizeEventTimes({ start: data.start ?? current.start, end: data.end ?? current.end, allDay });
+      const tz = eventTimeZone({ timezone: data.timezone ?? current.timezone }, { timezone: await this.siteTimezone() });
+      const { startAt, endAt } = eventInstants({ ...times, allDay }, tz);
+      sets.push('starts = ?', 'ends = ?', 'all_day = ?', 'start_at = ?', 'end_at = ?');
+      args.push(times.start, times.end, allDay ? 1 : 0, startAt, endAt);
+    }
+    args.push(id);
+    const changesCalendar = current.status === 'published' && ['title','start','end','allDay','timezone','location','cancelled','status'].some(k => k in data);
+    const cancelled = data.cancelled === true || (data.status !== undefined && data.status !== 'published');
+    const eventWrite = { sql:`UPDATE events SET ${sets.join(', ')} WHERE id = ?`, args };
+    if (changesCalendar) {
+      // One SQL INSERT...SELECT fans out recipient jobs without loading an
+      // unbounded attendee list. The update + jobs share the event batch.
+      const notifications = bookingJobs(id,cancelled?'cancelled':'updated').map(s=>({...s,sql:s.sql.replace('b.id = ?',`b.event_id = ? AND b.kind='rsvp' AND b.status IN (${cancelled ? "'cancelled'" : "'pending','confirmed'"})`)}));
+      const single = !current.rrule;
+      const siteTimezone = await this.siteTimezone();
+      await this.driver.batch([eventWrite,
+        {sql:`UPDATE bookings SET notification_version=notification_version+1,reminder_sent_at=NULL,
+          timezone=COALESCE(NULLIF((SELECT timezone FROM events WHERE id=?),''),?),
+          status=CASE WHEN ? THEN 'cancelled' ELSE status END,
+          start_at=CASE WHEN ? THEN (SELECT start_at FROM events WHERE id=?) ELSE start_at END,
+          end_at=CASE WHEN ? THEN (SELECT end_at FROM events WHERE id=?) ELSE end_at END
+          WHERE event_id=? AND kind='rsvp' AND status IN ('pending','confirmed')`,args:[id,siteTimezone,cancelled?1:0,single?1:0,id,single?1:0,id,id]},
+        ...notifications]);
+    } else await this.driver.batch([eventWrite]);
+    await this.syncEventIndex(id);
+  }
+  async saveEventDraft(id: string, data: Parameters<ContentRepository['saveEventDraft']>[1]) {
+    await this.ready;
+    const r = await this.first('SELECT draft FROM events WHERE id = ?', [id]);
+    if (!r) return;
+    const merged: Record<string, unknown> = parseDraft(r.draft) ?? {};
+    for (const [k, v] of Object.entries(data)) if (v !== undefined) merged[k] = v;
+    merged.savedAt = Date.now();
+    await this.driver.run('UPDATE events SET draft = ? WHERE id = ?', [JSON.stringify(merged), id]);
+  }
+  async applyEventDraft(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT draft FROM events WHERE id = ?', [id]);
+    const draft = parseDraft(r?.draft);
+    if (!draft) return;
+    await this.updateEvent(id, pickEventDraft(draft));
+  }
+  async discardEventDraft(id: string) {
+    await this.ready;
+    await this.driver.run('UPDATE events SET draft = NULL WHERE id = ?', [id]);
+  }
+  async deleteEvent(id: string) {
+    await this.ready;
+    const mutation = crypto.randomUUID();
+    const notifications = bookingJobs(id,'cancelled',undefined,false,mutation).map(s=>({...s,sql:s.sql.replace('b.id = ?',"b.event_id = ? AND b.kind='rsvp'")}));
+    await this.driver.batch([
+      {sql:"UPDATE bookings SET status='cancelled',notification_version=notification_version+1,email_mutation=?,reminder_sent_at=NULL WHERE event_id=? AND kind='rsvp' AND status IN ('pending','confirmed')",args:[mutation,id]},
+      ...notifications,
+      { sql: 'DELETE FROM events WHERE id = ?', args: [id] },
+      { sql: "DELETE FROM search_index WHERE kind = 'event' AND ref_id = ?", args: [id] },
+    ]);
+  }
+
+
+  // ---- resources + booking links ----
+  private resourceInsert(r: Resource): SqlStatement {
+    return {
+      sql: `INSERT INTO resources (id, slug, name, kind, description, photo, capacity, amenities, timezone, hours, overrides, busy_feeds,
+        notify_emails, visibility, show_on_calendar, feed_token, ord, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [r.id, r.slug, r.name, r.kind, r.description, r.photo, r.capacity, JSON.stringify(r.amenities), r.timezone, JSON.stringify(r.hours),
+        JSON.stringify(r.overrides), JSON.stringify(r.busyFeeds), JSON.stringify(r.notifyEmails), r.visibility, r.showOnCalendar ? 1 : 0,
+        r.feedToken || randomToken(), r.order, r.createdAt, r.updatedAt],
+    };
+  }
+  private linkInsert(l: BookingLink): SqlStatement {
+    return {
+      sql: `INSERT INTO booking_links (id, resource_id, slug, name, description, mode, duration, lengths, min_days, max_days, step, buffer_before,
+        buffer_after, min_notice, max_advance, per_day_cap, hours, auto_confirm, visibility, ask_phone, questions, confirm_message, redirect_url,
+        active, ord, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [l.id, l.resourceId, l.slug, l.name, l.description, l.mode, l.duration, JSON.stringify(l.lengths), l.minDays, l.maxDays, l.step,
+        l.bufferBefore, l.bufferAfter, l.minNotice, l.maxAdvance, l.perDayCap, l.hours ? JSON.stringify(l.hours) : null, l.autoConfirm ? 1 : 0,
+        l.visibility, l.askPhone ? 1 : 0, JSON.stringify(l.questions), l.confirmMessage, l.redirectUrl, l.active ? 1 : 0, l.order, l.createdAt, l.updatedAt],
+    };
+  }
+  private bookingInsert(b: Booking): SqlStatement {
+    return {
+      sql: `INSERT INTO bookings (id, kind, resource_id, link_id, event_id, status, start_at, end_at, hold_start, hold_end, timezone, name, email, phone,
+        seats, answers, notes, manage_token, source, reminder_sent_at, created_at, updated_at, notification_version) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [b.id, b.kind, b.resourceId, b.linkId, b.eventId, b.status, b.start, b.end, b.holdStart, b.holdEnd, b.timezone, b.name, b.email, b.phone,
+        b.seats, JSON.stringify(b.answers), b.notes, b.manageToken, b.source, b.reminderSentAt, b.createdAt, b.updatedAt, b.notificationVersion],
+    };
+  }
+  async listResources() {
+    await this.ready;
+    return (await this.driver.all('SELECT * FROM resources ORDER BY ord ASC, name COLLATE NOCASE ASC')).map(rowToResource);
+  }
+  async getResource(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM resources WHERE id = ?', [id]);
+    return r ? rowToResource(r) : null;
+  }
+  async getResourceBySlug(slug: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM resources WHERE slug = ?', [slug]);
+    return r ? rowToResource(r) : null;
+  }
+  async createResource(data: Parameters<ContentRepository['createResource']>[0]) {
+    await this.ready;
+    const now = Date.now();
+    const next = await this.first('SELECT COALESCE(MAX(ord), -1) + 1 AS n FROM resources');
+    const r = Resource.parse({ ...data, id: crypto.randomUUID(), feedToken: randomToken(), order: Number(next?.n ?? 0), createdAt: now, updatedAt: now });
+    await this.driver.run(this.resourceInsert(r).sql, this.resourceInsert(r).args);
+    return r;
+  }
+  async updateResource(id: string, data: Parameters<ContentRepository['updateResource']>[1]) {
+    await this.ready;
+    const cur = await this.getResource(id);
+    if (!cur) return;
+    const r = Resource.parse({ ...cur, ...data, id, updatedAt: Date.now() });
+    await this.driver.run(
+      `UPDATE resources SET slug = ?, name = ?, kind = ?, description = ?, photo = ?, capacity = ?, amenities = ?, timezone = ?, hours = ?,
+        overrides = ?, busy_feeds = ?, notify_emails = ?, visibility = ?, show_on_calendar = ?, feed_token = ?, updated_at = ? WHERE id = ?`,
+      [r.slug, r.name, r.kind, r.description, r.photo, r.capacity, JSON.stringify(r.amenities), r.timezone, JSON.stringify(r.hours),
+        JSON.stringify(r.overrides), JSON.stringify(r.busyFeeds), JSON.stringify(r.notifyEmails), r.visibility, r.showOnCalendar ? 1 : 0,
+        r.feedToken, r.updatedAt, id]
+    );
+  }
+  async reorderResources(ids: string[]) {
+    await this.ready;
+    await this.driver.batch(ids.map((id, i) => ({ sql: 'UPDATE resources SET ord = ? WHERE id = ?', args: [i, id] })));
+  }
+  async deleteResource(id: string) {
+    await this.ready;
+    await this.driver.batch([
+      { sql: 'DELETE FROM resources WHERE id = ?', args: [id] },
+      { sql: 'DELETE FROM booking_links WHERE resource_id = ?', args: [id] },
+    ]);
+  }
+  async listBookingLinks(resourceId?: string) {
+    await this.ready;
+    const rows = resourceId
+      ? await this.driver.all('SELECT * FROM booking_links WHERE resource_id = ? ORDER BY ord ASC, name COLLATE NOCASE ASC', [resourceId])
+      : await this.driver.all('SELECT * FROM booking_links ORDER BY ord ASC, name COLLATE NOCASE ASC');
+    return rows.map(rowToLink2);
+  }
+  async getBookingLink(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM booking_links WHERE id = ?', [id]);
+    return r ? rowToLink2(r) : null;
+  }
+  async getBookingLinkBySlug(resourceId: string, slug: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM booking_links WHERE resource_id = ? AND slug = ?', [resourceId, slug]);
+    return r ? rowToLink2(r) : null;
+  }
+  async createBookingLink(data: Parameters<ContentRepository['createBookingLink']>[0]) {
+    await this.ready;
+    const now = Date.now();
+    const next = await this.first('SELECT COALESCE(MAX(ord), -1) + 1 AS n FROM booking_links WHERE resource_id = ?', [data.resourceId]);
+    const l = BookingLink.parse({ ...data, id: crypto.randomUUID(), order: Number(next?.n ?? 0), createdAt: now, updatedAt: now });
+    const st = this.linkInsert(l);
+    await this.driver.run(st.sql, st.args);
+    return l;
+  }
+  async updateBookingLink(id: string, data: Parameters<ContentRepository['updateBookingLink']>[1]) {
+    await this.ready;
+    const cur = await this.getBookingLink(id);
+    if (!cur) return;
+    const l = BookingLink.parse({ ...cur, ...data, id, updatedAt: Date.now() });
+    await this.driver.run(
+      `UPDATE booking_links SET slug = ?, name = ?, description = ?, mode = ?, duration = ?, lengths = ?, min_days = ?, max_days = ?, step = ?,
+        buffer_before = ?, buffer_after = ?, min_notice = ?, max_advance = ?, per_day_cap = ?, hours = ?, auto_confirm = ?, visibility = ?,
+        ask_phone = ?, questions = ?, confirm_message = ?, redirect_url = ?, active = ?, ord = ?, updated_at = ? WHERE id = ?`,
+      [l.slug, l.name, l.description, l.mode, l.duration, JSON.stringify(l.lengths), l.minDays, l.maxDays, l.step, l.bufferBefore, l.bufferAfter,
+        l.minNotice, l.maxAdvance, l.perDayCap, l.hours ? JSON.stringify(l.hours) : null, l.autoConfirm ? 1 : 0, l.visibility, l.askPhone ? 1 : 0,
+        JSON.stringify(l.questions), l.confirmMessage, l.redirectUrl, l.active ? 1 : 0, l.order, l.updatedAt, id]
+    );
+  }
+  async deleteBookingLink(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM booking_links WHERE id = ?', [id]);
+  }
+
+  // ---- bookings ----
+  async listBookings(filter: Parameters<ContentRepository['listBookings']>[0] = {}) {
+    await this.ready;
+    const where: string[] = [];
+    const args: unknown[] = [];
+    if (filter.resourceId) { where.push('resource_id = ?'); args.push(filter.resourceId); }
+    if (filter.eventId) { where.push('event_id = ?'); args.push(filter.eventId); }
+    if (filter.from !== undefined) { where.push('end_at > ?'); args.push(filter.from); }
+    if (filter.to !== undefined) { where.push('start_at < ?'); args.push(filter.to); }
+    if (filter.statuses?.length) { where.push(`status IN (${filter.statuses.map(() => '?').join(', ')})`); args.push(...filter.statuses); }
+    if (filter.kinds?.length) { where.push(`kind IN (${filter.kinds.map(() => '?').join(', ')})`); args.push(...filter.kinds); }
+    const rows = await this.driver.all(`SELECT * FROM bookings${where.length ? ` WHERE ${where.join(' AND ')}` : ''} ORDER BY start_at ASC LIMIT 5000`, args);
+    return rows.map(rowToBooking);
+  }
+  async getBooking(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM bookings WHERE id = ?', [id]);
+    return r ? rowToBooking(r) : null;
+  }
+  async getBookingByToken(token: string) {
+    await this.ready;
+    if (!token) return null;
+    const r = await this.first('SELECT * FROM bookings WHERE manage_token = ?', [token]);
+    return r ? rowToBooking(r) : null;
+  }
+  // One INSERT … SELECT … WHERE NOT EXISTS: the overlap test and the write
+  // are a single statement, so two people racing for the same slot can't
+  // both win — the loser's insert simply affects no rows.
+  async createBooking(data: Parameters<ContentRepository['createBooking']>[0], guard: NonNullable<Parameters<ContentRepository['createBooking']>[1]> = {}) {
+    await this.ready;
+    const now = Date.now();
+    const b = Booking.parse({ ...data, id: crypto.randomUUID(), reminderSentAt: null, createdAt: now, updatedAt: now });
+    const ins = this.bookingInsert(b);
+    const cols = ins.sql.slice(ins.sql.indexOf('('), ins.sql.indexOf(')') + 1);
+    const holds = b.status === 'pending' || b.status === 'confirmed';
+    let write = { sql: `INSERT INTO bookings ${cols} SELECT ${ins.args!.map(() => '?').join(', ')} WHERE 1=1`, args: ins.args };
+    if (b.kind === 'rsvp') {
+      const cap = guard.capacity ?? 0;
+      write = { sql: `INSERT INTO bookings ${cols} SELECT ${ins.args!.map(() => '?').join(', ')}
+        WHERE (? = 0 OR (SELECT COALESCE(SUM(seats),0) FROM bookings WHERE kind='rsvp' AND event_id=? AND start_at=? AND status IN ('pending','confirmed')) + ? <= ?)`,
+        args: [...ins.args!,cap,b.eventId,b.start,b.seats,cap] };
+    } else if (holds && b.resourceId) {
+      write = { sql: `INSERT INTO bookings ${cols} SELECT ${ins.args!.map(() => '?').join(', ')} WHERE NOT EXISTS (
+        SELECT 1 FROM bookings WHERE resource_id=? AND kind IN ('booking','block') AND status IN ('pending','confirmed') AND hold_start < ? AND hold_end > ?)`,
+        args: [...ins.args!,b.resourceId,b.holdEnd,b.holdStart] };
+    }
+    const ledger: SqlStatement[] = [];
+    if (guard.idempotency) {
+      const { keyHash, requestHash } = guard.idempotency;
+      write = { sql: write.sql + ' AND NOT EXISTS (SELECT 1 FROM mobile_booking_requests WHERE key_hash=?)', args: [...write.args!, keyHash] };
+      ledger.push({ sql: `INSERT INTO mobile_booking_requests (key_hash,request_hash,booking_id,created_at)
+        SELECT ?,?,id,? FROM bookings WHERE id=?`, args: [keyHash, requestHash, now, b.id] });
+    }
+    // Booking, retry ledger and email outbox commit together on D1 and libSQL.
+    await this.driver.batch([write, ...ledger, ...bookingJobs(b.id, b.status === 'confirmed' ? 'confirmed' : 'received', 0, true)]);
+    return this.getBooking(b.id);
+  }
+  async moveBooking(id: string, t: { start: number; end: number; holdStart: number; holdEnd: number }) {
+    await this.ready;
+    const cur = await this.getBooking(id);
+    if (!cur) return false;
+    const nextVersion = cur.notificationVersion + 1;
+    const mutation = crypto.randomUUID();
+    await this.driver.batch([
+      { sql: `UPDATE bookings SET start_at=?,end_at=?,hold_start=?,hold_end=?,reminder_sent_at=NULL,updated_at=?,notification_version=notification_version+1,email_mutation=?
+        WHERE id=? AND notification_version=? AND status IN ('pending','confirmed') AND NOT EXISTS(SELECT 1 FROM bookings WHERE id!=? AND resource_id=? AND kind IN ('booking','block') AND status IN ('pending','confirmed') AND hold_start < ? AND hold_end > ?)`,
+        args:[t.start,t.end,t.holdStart,t.holdEnd,Date.now(),mutation,id,cur.notificationVersion,id,cur.resourceId,t.holdEnd,t.holdStart] },
+      ...bookingJobs(id,'rescheduled',nextVersion,false,mutation),
+    ]);
+    return !!await this.first('SELECT id FROM bookings WHERE id=? AND email_mutation=?',[id,mutation]);
+  }
+
+  async updateBooking(id: string, data: Parameters<ContentRepository['updateBooking']>[1]) {
+    await this.ready;
+    const current = await this.getBooking(id);
+    if (!current) return;
+    const changed = data.status !== undefined && data.status !== current.status;
+    const mutation = crypto.randomUUID();
+    const sets = ['updated_at = ?', 'email_mutation = ?'];
+    if (changed) sets.push('notification_version = notification_version + 1', 'reminder_sent_at = NULL');
+    const args: unknown[] = [Date.now(), mutation];
+    if (data.status !== undefined) { sets.push('status = ?'); args.push(data.status); }
+    if (data.notes !== undefined) { sets.push('notes = ?'); args.push(data.notes); }
+    if (data.name !== undefined) { sets.push('name = ?'); args.push(data.name); }
+    if (data.email !== undefined) { sets.push('email = ?'); args.push(data.email); }
+    if (data.phone !== undefined) { sets.push('phone = ?'); args.push(data.phone); }
+    if (data.answers !== undefined) { sets.push('answers = ?'); args.push(JSON.stringify(data.answers)); }
+    if (data.reminderSentAt !== undefined) { sets.push('reminder_sent_at = ?'); args.push(data.reminderSentAt); }
+    args.push(id);
+    const kind = data.status === 'confirmed' ? 'confirmed' : data.status === 'declined' ? 'declined' : data.status === 'pending' ? 'received' : 'cancelled';
+    await this.driver.batch([{sql:`UPDATE bookings SET ${sets.join(', ')} WHERE id = ? AND notification_version = ?`,args:[...args,current.notificationVersion]},
+      ...(changed ? bookingJobs(id,kind,current.notificationVersion+1,false,mutation,data.notificationMessage) : [])]);
+  }
+  async deleteBooking(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM bookings WHERE id = ?', [id]);
+  }
+  async listDueReminders(from: number, to: number) {
+    await this.ready;
+    const rows = await this.driver.all(
+      "SELECT * FROM bookings WHERE status = 'confirmed' AND kind IN ('booking', 'rsvp') AND reminder_sent_at IS NULL AND email != '' AND start_at >= ? AND start_at < ? LIMIT 100",
+      [from, to]
+    );
+    return rows.map(rowToBooking);
+  }
+
+  // ---- API keys ----
+  async listApiKeys() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM api_keys ORDER BY created_at DESC');
+    return rows.map(rowToApiKey);
+  }
+  async createApiKey(data: Parameters<ContentRepository['createApiKey']>[0]) {
+    await this.ready;
+    const id = crypto.randomUUID();
+    await this.driver.run(
+      'INSERT INTO api_keys (id, name, prefix, key_hash, scopes, created_at) VALUES (?, ?, ?, ?, ?, ?)',
+      [id, data.name, data.prefix, data.keyHash, JSON.stringify(data.scopes), Date.now()]
+    );
+    return rowToApiKey((await this.first('SELECT * FROM api_keys WHERE id = ?', [id]))!);
+  }
+  async findApiKeyByHash(keyHash: string) {
+    await this.ready;
+    const r = await this.first('SELECT * FROM api_keys WHERE key_hash = ?', [keyHash]);
+    if (!r) return null;
+    const now = Date.now();
+    // at most one write a minute per key: the stamp is informational
+    if (!r.last_used_at || now - Number(r.last_used_at) > 60_000) {
+      await this.driver.run('UPDATE api_keys SET last_used_at = ? WHERE id = ?', [now, r.id]);
+      r.last_used_at = now;
+    }
+    return rowToApiKey(r);
+  }
+  async deleteApiKey(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM api_keys WHERE id = ?', [id]);
+  }
+
+  // ---- webhooks ----
+  async listWebhooks() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM webhooks ORDER BY created_at ASC');
+    return rows.map(rowToWebhook);
+  }
+  async createWebhook(data: Parameters<ContentRepository['createWebhook']>[0]) {
+    await this.ready;
+    const id = crypto.randomUUID();
+    await this.driver.run(
+      'INSERT INTO webhooks (id, url, secret, events, active, created_at) VALUES (?, ?, ?, ?, 1, ?)',
+      [id, data.url, data.secret, JSON.stringify(data.events), Date.now()]
+    );
+    return rowToWebhook((await this.first('SELECT * FROM webhooks WHERE id = ?', [id]))!);
+  }
+  async updateWebhook(id: string, data: Parameters<ContentRepository['updateWebhook']>[1]) {
+    await this.ready;
+    const sets: string[] = [];
+    const args: unknown[] = [];
+    if (data.url !== undefined) { sets.push('url = ?'); args.push(data.url); }
+    if (data.secret !== undefined) { sets.push('secret = ?'); args.push(data.secret); }
+    if (data.events !== undefined) { sets.push('events = ?'); args.push(JSON.stringify(data.events)); }
+    if (data.active !== undefined) { sets.push('active = ?'); args.push(data.active ? 1 : 0); }
+    if (!sets.length) return;
+    args.push(id);
+    await this.driver.run(`UPDATE webhooks SET ${sets.join(', ')} WHERE id = ?`, args);
+  }
+  async deleteWebhook(id: string) {
+    await this.ready;
+    await this.driver.batch([
+      { sql: 'DELETE FROM webhooks WHERE id = ?', args: [id] },
+      { sql: 'DELETE FROM webhook_deliveries WHERE webhook_id = ?', args: [id] },
+    ]);
+  }
+  async createDeliveries(rows: Parameters<ContentRepository['createDeliveries']>[0]) {
+    await this.ready;
+    await this.driver.batch(
+      rows.map((d) => ({
+        sql: 'INSERT INTO webhook_deliveries (id, webhook_id, event, payload, status, attempts, next_at, created_at) VALUES (?, ?, ?, ?, ?, 0, ?, ?)',
+        args: [d.id, d.webhookId, d.event, d.payload, d.status, d.nextAt, d.createdAt],
+      }))
+    );
+  }
+  async listDueDeliveries(now: number, limit: number) {
+    await this.ready;
+    const rows = await this.driver.all(
+      "SELECT * FROM webhook_deliveries WHERE status = 'pending' AND (next_at IS NULL OR next_at <= ?) ORDER BY created_at ASC LIMIT ?",
+      [now, limit]
+    );
+    return rows.map(rowToDelivery);
+  }
+  async listDeliveries(webhookId: string, limit: number) {
+    await this.ready;
+    const rows = await this.driver.all(
+      'SELECT * FROM webhook_deliveries WHERE webhook_id = ? ORDER BY created_at DESC LIMIT ?',
+      [webhookId, limit]
+    );
+    return rows.map(rowToDelivery);
+  }
+  async claimDelivery(id: string, now: number) {
+    await this.ready;
+    // A lease outlasts the HTTP timeout. Competing request/cron flushes must
+    // not send the same pending delivery at the same time.
+    const r = await this.first(`UPDATE webhook_deliveries SET next_at = ?
+      WHERE id = ? AND status = 'pending' AND (next_at IS NULL OR next_at <= ?)
+      RETURNING *`, [now + 30_000, id, now]);
+    return r ? rowToDelivery(r) : null;
+  }
+  async recordDelivery(id: string, data: Parameters<ContentRepository['recordDelivery']>[1]) {
+    await this.ready;
+    const r = await this.first('SELECT webhook_id FROM webhook_deliveries WHERE id = ?', [id]);
+    await this.driver.batch([
+      {
+        sql: 'UPDATE webhook_deliveries SET status = ?, attempts = ?, next_at = ?, response_code = ?, delivered_at = ? WHERE id = ?',
+        args: [data.status, data.attempts, data.nextAt, data.responseCode, data.deliveredAt, id],
+      },
+      ...(r
+        ? [{ sql: 'UPDATE webhooks SET last_status = ?, last_at = ? WHERE id = ?', args: [data.responseCode ?? 0, Date.now(), r.webhook_id] }]
+        : []),
+    ]);
+    // keep the log bounded: the newest 50 deliveries per endpoint survive
+    if (r) {
+      await this.driver.run(
+        `DELETE FROM webhook_deliveries WHERE webhook_id = ? AND status != 'pending' AND id NOT IN (
+          SELECT id FROM webhook_deliveries WHERE webhook_id = ? ORDER BY created_at DESC LIMIT 50)`,
+        [r.webhook_id, r.webhook_id]
+      );
+    }
+  }
+
   // ---- media ----
   async listMedia() {
     await this.ready;
@@ -678,13 +1426,18 @@ export class SqlRepository implements ContentRepository {
     if (data.name !== undefined) { sets.push('name = ?'); args.push(data.name); }
     if (data.email !== undefined) { sets.push('email = ?'); args.push(data.email.toLowerCase()); }
     if (data.role !== undefined) { sets.push('role = ?'); args.push(data.role); }
-    if (data.passHash !== undefined) { sets.push('pass_hash = ?'); args.push(data.passHash); }
+    if (data.passHash !== undefined) { sets.push('pass_hash = ?', 'session_version = session_version + 1'); args.push(data.passHash); }
     if (data.bio !== undefined) { sets.push('bio = ?'); args.push(data.bio); }
     if (data.avatar !== undefined) { sets.push('avatar = ?'); args.push(data.avatar); }
     if (data.slug !== undefined) { sets.push('slug = ?'); args.push(data.slug); }
     if (!sets.length) return;
     args.push(id);
-    await this.driver.run(`UPDATE users SET ${sets.join(', ')} WHERE id = ?`, args);
+    await this.driver.batch([
+      {sql:`UPDATE users SET ${sets.join(', ')} WHERE id = ?`,args},
+      ...(data.passHash === undefined ? [] : [{sql:`INSERT INTO email_jobs(id,dedupe,kind,recipient,payload,config_version,next_at,created_at,updated_at)
+        SELECT ?,?,'password-changed',email,'{}',COALESCE((SELECT MAX(version) FROM email_configs),0),?,?,? FROM users WHERE id=?`,
+        args:[crypto.randomUUID(),crypto.randomUUID(),Date.now(),Date.now(),Date.now(),id]}]),
+    ]);
   }
   async deleteUser(id: string) {
     await this.ready;
@@ -693,7 +1446,7 @@ export class SqlRepository implements ContentRepository {
   async getUserAuth(email: string) {
     await this.ready;
     const r = await this.first('SELECT * FROM users WHERE email = ?', [email.toLowerCase()]);
-    return r ? { user: rowToUser(r), passHash: String(r.pass_hash) } : null;
+    return r ? { user: rowToUser(r), passHash: String(r.pass_hash), sessionVersion: Number(r.session_version) } : null;
   }
 
   // ---- navigation ----
@@ -737,12 +1490,13 @@ export class SqlRepository implements ContentRepository {
   async searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults> {
     await this.ready;
     const trimmed = query.trim();
-    if (!trimmed) return { posts: [], pages: [], tags: [], authors: [] };
+    if (!trimmed) return { posts: [], pages: [], events: [], tags: [], authors: [] };
     const locale = opts?.locale ?? '';
     let postRows: Row[];
     let pageRows: Row[];
+    let eventRows: Row[];
     try {
-      [postRows, pageRows] = await Promise.all([
+      [postRows, pageRows, eventRows] = await Promise.all([
         this.driver.all(
           `SELECT p.*, ${SNIPPET} AS snip FROM search_index JOIN posts p ON p.id = search_index.ref_id
            WHERE search_index MATCH ? AND search_index.kind = 'post' AND p.status = 'published'
@@ -757,11 +1511,17 @@ export class SqlRepository implements ContentRepository {
            ORDER BY (search_index.locale = ?) DESC, ${RANK} LIMIT 50`,
           [ftsQuery(trimmed), locale]
         ),
+        this.driver.all(
+          `SELECT e.*, ${SNIPPET} AS snip FROM search_index JOIN events e ON e.id = search_index.ref_id
+           WHERE search_index MATCH ? AND search_index.kind = 'event' AND e.status = 'published'
+           ORDER BY ${RANK} LIMIT 50`,
+          [ftsQuery(trimmed)]
+        ),
       ]);
     } catch {
       // FTS5 unavailable or a query form it rejects — degrade to the old
       // LIKE scan (recency-ordered, snippets fall back to excerpt/seo_desc)
-      [postRows, pageRows] = await this.likeSearch(trimmed, locale);
+      [postRows, pageRows, eventRows] = await this.likeSearch(trimmed, locale);
     }
     const like = `%${trimmed.replace(/[%_]/g, ' ').trim()}%`;
     const [authors, tagRows, userRows] = await Promise.all([
@@ -786,13 +1546,14 @@ export class SqlRepository implements ContentRepository {
         snippet: safeSnippet(r.snip ?? r.excerpt ?? ''),
       })),
       pages: pageRows.map((r) => ({ doc: rowToPage(r), snippet: safeSnippet(r.snip ?? r.seo_desc ?? '') })),
+      events: eventRows.map((r) => ({ doc: rowToEvent(r), snippet: safeSnippet(r.snip ?? r.excerpt ?? '') })),
       tags: tags.map((tag) => ({ tag, count: tagCounts.get(tag.name.toLowerCase()) ?? 0 })),
       authors: userRows.map(rowToUser),
     };
   }
-  private async likeSearch(query: string, locale: string): Promise<[Row[], Row[]]> {
+  private async likeSearch(query: string, locale: string): Promise<[Row[], Row[], Row[]]> {
     const q = `%${query.replace(/[%_]/g, ' ').trim()}%`;
-    if (q === '%%') return [[], []];
+    if (q === '%%') return [[], [], []];
     return Promise.all([
       this.driver.all(
         "SELECT * FROM posts WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ? OR body LIKE ?) ORDER BY published_at DESC LIMIT 50",
@@ -802,6 +1563,10 @@ export class SqlRepository implements ContentRepository {
         "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY (locale = ?) DESC, updated_at DESC LIMIT 50",
         [q, q, locale]
       ),
+      this.driver.all(
+        "SELECT * FROM events WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ?) ORDER BY start_at DESC LIMIT 50",
+        [q, q, q]
+      ),
     ]);
   }
 
@@ -809,9 +1574,33 @@ export class SqlRepository implements ContentRepository {
   async restoreAll(content: Parameters<ContentRepository['restoreAll']>[0]) {
     await this.ready;
     const stmts: SqlStatement[] = [
-      ...['posts', 'pages', 'media', 'links', 'tags', 'nav_items', 'users', 'post_authors', 'redirects'].map((t) => ({
+      // Suppression and re-enabling share the restore transaction. A failed
+      // restore cannot leave notifications disabled or emit phantom deletes.
+      { sql: 'UPDATE webhook_control SET suppressed=1 WHERE id=1' },
+      ...['email_jobs', 'email_attempts', 'email_delivery_events', 'email_tokens', 'posts', 'pages', 'media', 'links', 'tags', 'nav_items', 'users', 'post_authors', 'redirects', 'calendars', 'events', 'resources', 'booking_links', 'bookings', 'mobile_booking_requests'].map((t) => ({
         sql: `DELETE FROM ${t}`,
       })),
+      ...(content.calendars ?? []).map((c) => ({
+        sql: 'INSERT INTO calendars (id, slug, name, color, description, kind, feed_url, visibility, feed_token, ord, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [c.id, c.slug, c.name, c.color, c.description, c.kind, c.feedUrl, c.visibility, c.feedToken || randomToken(), c.order, c.createdAt, c.updatedAt],
+      })),
+      ...(content.events ?? []).map((e) => ({
+        sql: `INSERT INTO events (id, slug, title, body_json, body_html, excerpt, cover, cover_alt, seo_title, seo_desc, status, featured, tags, template,
+          starts, ends, all_day, timezone, rrule, exdates, cancelled, location, cta, calendar_ids, fields, source_uid, start_at, end_at,
+          draft, published_at, scheduled_at, created_at, updated_at, rsvp)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          e.id, e.slug, e.title, e.bodyJson, e.bodyHtml, e.excerpt, e.cover, e.coverAlt, e.seoTitle, e.seoDesc, e.status, e.featured ? 1 : 0,
+          JSON.stringify(e.tags), e.template, e.start, e.end, e.allDay ? 1 : 0, e.timezone, e.rrule, JSON.stringify(e.exdates),
+          e.cancelled ? 1 : 0, JSON.stringify(e.location), JSON.stringify(e.cta), JSON.stringify(e.calendarIds), JSON.stringify(e.fields),
+          e.sourceUid, e.startAt, e.endAt, e.draft ? JSON.stringify(e.draft) : null, e.publishedAt, e.scheduledAt, e.createdAt, e.updatedAt,
+          JSON.stringify(e.rsvp ?? {}),
+        ],
+      })),
+      ...(content.resources ?? []).map((r) => this.resourceInsert(r)),
+      ...(content.bookingLinks ?? []).map((l) => this.linkInsert(l)),
+      ...(content.bookings ?? []).map((b) => this.bookingInsert(b)),
+      ...(content.bookingRequests ?? []).map(r => ({ sql: 'INSERT INTO mobile_booking_requests (key_hash,request_hash,booking_id,created_at) VALUES (?,?,?,?)', args: [r.keyHash,r.requestHash,r.bookingId,r.createdAt] })),
       // p.locale defaults to '' via the zod schema, so pre-v20 backups
       // restore cleanly as default-locale pages
       ...content.pages.map((p) => ({
@@ -848,16 +1637,22 @@ export class SqlRepository implements ContentRepository {
       })),
       // accounts restore without hashes — sign in via ADMIN_PASSWORD and reset
       ...content.users.map((u) => ({
-        sql: 'INSERT INTO users (id, name, email, role, pass_hash, bio, avatar, slug, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)',
-        args: [u.id, u.name, u.email, u.role, '', u.bio, u.avatar, u.slug, u.createdAt],
+        sql: 'INSERT INTO users (id, name, email, role, pass_hash, bio, avatar, slug, created_at, session_version) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [u.id, u.name, u.email, u.role, '', u.bio, u.avatar, u.slug, u.createdAt, Date.now()],
       })),
       ...content.redirects.map((r) => ({
         sql: 'INSERT INTO redirects (id, from_path, to_path, code, created_at) VALUES (?, ?, ?, ?, ?)',
         args: [r.id, r.fromPath, r.toPath, r.code, r.createdAt],
       })),
     ];
+    const settingsWrite = this.settingsStatement({ ...content.settings, live: { ...LiveConfig.parse(content.settings.live ?? {}), mode: 'off', manual: { watchUrl: '', title: 'We’re live', until: 0 } } });
+    stmts.push({ sql: "UPDATE live_connections SET enabled=0,tested_at=0,revision=revision+1,lease='',lease_until=0,snapshot=NULL,upcoming=NULL,error='Restored content. Test this connection before enabling automatic checks.'" }, { sql: 'DELETE FROM live_oauth_states' });
+    if (settingsWrite) stmts.push(settingsWrite);
+    stmts.push(
+      { sql: 'UPDATE webhook_control SET suppressed=0 WHERE id=1' },
+      webhookStatement('site.restored', { counts: { posts: content.posts.length, pages: content.pages.length, media: content.media.length } }),
+    );
     await this.driver.batch(stmts);
-    await this.updateSettings(content.settings);
     await this.reindexSearch();
   }
 
@@ -900,12 +1695,16 @@ export class SqlRepository implements ContentRepository {
       siteTitle: r?.site_title ?? 'My Site', tagline: r?.tagline ?? '', footerText: r?.footer_text ?? '',
       linksName: r?.links_name ?? '', linksBio: r?.links_bio ?? '', linksAvatar: r?.links_avatar ?? '',
       activeTheme: r?.active_theme ?? '', designOverrides: JSON.parse(String(r?.design_overrides ?? '{}')),
+      sectionPages: JSON.parse(String(r?.section_pages ?? '{}')), designRevision: Number(r?.design_revision ?? 0),
       siteLogo: r?.site_logo ?? '',
       siteUrl: r?.site_url ?? '', siteFavicon: r?.site_favicon ?? '', siteCover: r?.site_cover ?? '',
       announcement: JSON.parse(String(r?.announcement ?? '{}')),
       analytics: JSON.parse(String(r?.analytics ?? '{}')),
       headCode: r?.head_code ?? '', footerCode: r?.footer_code ?? '',
       timezone: r?.timezone ?? '', locale: r?.locale ?? '',
+      ai: JSON.parse(String(r?.ai ?? '{}')),
+      live: JSON.parse(String(r?.live ?? '{}')),
+      agent: JSON.parse(String(r?.agent ?? '{}')),
       draftsApiKey: r?.drafts_api_key ?? '',
       draftsAllowedOrigins: JSON.parse(String(r?.drafts_allowed_origins ?? '[]')),
       draftDesign: parseDraft(r?.draft_design),
@@ -913,57 +1712,91 @@ export class SqlRepository implements ContentRepository {
   }
   async updateSettings(data: Partial<Settings>) {
     await this.ready;
-    const current = await this.getSettings();
-    // draft_design: undefined = leave the staged design alone (a settings
-    // save must not clobber it); null/value = explicit write (restore)
-    const draftDesign =
-      data.draftDesign === undefined ? current.draftDesign : data.draftDesign;
-    await this.driver.run(
-      'UPDATE settings SET site_title = ?, tagline = ?, footer_text = ?, links_name = ?, links_bio = ?, links_avatar = ?, active_theme = ?, design_overrides = ?, site_logo = ?, site_url = ?, site_favicon = ?, site_cover = ?, announcement = ?, analytics = ?, head_code = ?, footer_code = ?, timezone = ?, locale = ?, drafts_api_key = ?, drafts_allowed_origins = ?, draft_design = ? WHERE id = 1',
-      [
-        data.siteTitle ?? current.siteTitle, data.tagline ?? current.tagline,
-        data.footerText ?? current.footerText,
-        data.linksName ?? current.linksName, data.linksBio ?? current.linksBio,
-        data.linksAvatar ?? current.linksAvatar,
-        data.activeTheme ?? current.activeTheme,
-        JSON.stringify(data.designOverrides ?? current.designOverrides),
-        data.siteLogo ?? current.siteLogo,
-        data.siteUrl ?? current.siteUrl,
-        data.siteFavicon ?? current.siteFavicon,
-        data.siteCover ?? current.siteCover,
-        JSON.stringify(data.announcement ?? current.announcement),
-        JSON.stringify(data.analytics ?? current.analytics),
-        data.headCode ?? current.headCode,
-        data.footerCode ?? current.footerCode,
-        data.timezone ?? current.timezone,
-        data.locale ?? current.locale,
-        data.draftsApiKey ?? current.draftsApiKey,
-        JSON.stringify(data.draftsAllowedOrigins ?? current.draftsAllowedOrigins),
-        draftDesign ? JSON.stringify(draftDesign) : null,
-      ]
-    );
+    const statement = this.settingsStatement(data);
+    if (statement) await this.driver.run(statement.sql, statement.args);
+  }
+  private settingsStatement(data: Partial<Settings>): SqlStatement | undefined {
+    const columns: Record<string, string> = {
+      siteTitle:'site_title', tagline:'tagline', footerText:'footer_text', linksName:'links_name', linksBio:'links_bio', linksAvatar:'links_avatar',
+      activeTheme:'active_theme', designOverrides:'design_overrides', sectionPages:'section_pages', siteLogo:'site_logo', siteUrl:'site_url', siteFavicon:'site_favicon', siteCover:'site_cover',
+      announcement:'announcement', analytics:'analytics', headCode:'head_code', footerCode:'footer_code', timezone:'timezone', locale:'locale',
+      draftsApiKey:'drafts_api_key', draftsAllowedOrigins:'drafts_allowed_origins', draftDesign:'draft_design', ai:'ai', agent:'agent', live:'live',
+    };
+    const jsonKeys = new Set(['designOverrides','sectionPages','announcement','analytics','draftsAllowedOrigins','draftDesign','ai','agent','live']);
+    const entries = Object.entries(data).filter(([k,v]) => columns[k] && v !== undefined);
+    if (!entries.length) return;
+    const design = entries.some(([k]) => ['activeTheme','designOverrides','sectionPages','siteLogo','siteFavicon','siteCover','draftDesign'].includes(k));
+    return { sql: `UPDATE settings SET ${entries.map(([k]) => `${columns[k]} = ?`).join(', ')}${design ? ', design_revision = design_revision + 1' : ''} WHERE id = 1`,
+      args: entries.map(([k,v]) => jsonKeys.has(k) && v !== null ? JSON.stringify(v) : v) };
+  }
+  private async designWrite(expected: number, actor: string, action: string, statements: SqlStatement[]) {
+    try {
+      await this.driver.batch([
+        { sql: 'INSERT INTO design_audit (id,created_at,actor,action,expected_revision,actual_revision) SELECT ?,?,?,?,?,design_revision FROM settings WHERE id = 1', args: [crypto.randomUUID(), Date.now(), actor, action, expected] },
+        ...statements,
+        { sql: 'UPDATE settings SET design_revision = design_revision + 1 WHERE id = 1' },
+      ]);
+    } catch (e) {
+      if (/CHECK constraint|expected_revision/i.test(String(e))) throw new ApiError(409, 'Design changed. Pull the latest revision before saving.');
+      throw e;
+    }
+  }
+  async listDesignAudit() {
+    await this.ready;
+    return this.driver.all('SELECT id,created_at,actor,action,actual_revision FROM design_audit ORDER BY created_at DESC LIMIT 100');
   }
   // Design-screen staging: only the draft_design JSON changes on save — the
   // live design columns wait for applyDesignDraft ("Publish design").
   async saveDesignDraft(data: Parameters<ContentRepository['saveDesignDraft']>[0]) {
-    await this.ready;
-    const r = await this.first('SELECT draft_design FROM settings WHERE id = 1');
-    const merged: Record<string, unknown> = parseDraft(r?.draft_design) ?? {};
-    for (const [k, v] of Object.entries(data)) if (v !== undefined) merged[k] = v;
-    merged.savedAt = Date.now();
-    await this.driver.run('UPDATE settings SET draft_design = ? WHERE id = 1', [JSON.stringify(merged)]);
+    const current = await this.getSettings();
+    const merged = { ...current.draftDesign, ...data };
+    // Preserve a valid identity only while editing this same draft.
+    merged.shareEpoch = typeof current.draftDesign?.shareEpoch === 'string' ? current.draftDesign.shareEpoch : crypto.randomUUID();
+    if (data.shareEpoch) merged.shareEpoch = data.shareEpoch;
+    await this.setDesignDraft(merged, current.designRevision);
+  }
+  async setDesignDraft(draft: Record<string, unknown> | null, expectedRevision?: number, actor = 'admin') {
+    const current = await this.getSettings();
+    const value = draft ? { ...draft, shareEpoch: typeof draft.shareEpoch === 'string' ? draft.shareEpoch : crypto.randomUUID(), savedAt: Date.now() } : null;
+    await this.designWrite(expectedRevision ?? current.designRevision, actor, value ? 'stage' : 'discard', [
+      { sql: 'UPDATE settings SET draft_design = ? WHERE id = 1', args: [value ? JSON.stringify(value) : null] },
+    ]);
   }
-  async applyDesignDraft() {
+  async applyDesignDraft(opts: { author?: string; summary?: string; expectedRevision?: number } = {}) {
+    const current = await this.getSettings();
+    const draft = current.draftDesign;
+    if (!draft) {
+      if (opts.expectedRevision !== undefined && opts.expectedRevision !== current.designRevision) throw new ApiError(409, 'Design changed. Pull the latest revision.');
+      return;
+    }
+    const nav = draftNavItems(draft);
+    const liveNav = await this.listNavItems();
+    const design = { ...current, ...pickDesignDraft(draft) };
+    const statements: SqlStatement[] = [
+      { sql: 'INSERT INTO design_versions (id,created_at,author,summary,snapshot) VALUES (?,?,?,?,?)', args: [crypto.randomUUID(), Date.now(), opts.author ?? '', opts.summary ?? '', JSON.stringify(designSnapshot(current, liveNav))] },
+      { sql: 'DELETE FROM design_versions WHERE id NOT IN (SELECT id FROM design_versions ORDER BY created_at DESC LIMIT 20)' },
+      { sql: 'UPDATE settings SET active_theme=?,design_overrides=?,section_pages=?,site_logo=?,site_favicon=?,site_cover=?,draft_design=NULL WHERE id=1',
+        args: [design.activeTheme, JSON.stringify(design.designOverrides), JSON.stringify(design.sectionPages), design.siteLogo, design.siteFavicon, design.siteCover] },
+    ];
+    if (nav) statements.push({ sql: 'DELETE FROM nav_items' }, ...nav.map((n,i) => ({
+      sql: 'INSERT INTO nav_items (id,label,url,area,ord) VALUES (?,?,?,?,?)', args: [n.id.startsWith('tmp-') ? crypto.randomUUID() : n.id,n.label,n.url,n.area,i],
+    })));
+    statements.push(webhookStatement('design.published', { design: {
+      revision: current.designRevision + 1, activeTheme: design.activeTheme,
+      navigationChanged: nav !== null, sectionPageIds: Object.keys(design.sectionPages),
+    } }));
+    await this.designWrite(opts.expectedRevision ?? current.designRevision, opts.author ?? 'admin', 'publish', statements);
+  }
+  async discardDesignDraft() { await this.setDesignDraft(null); }
+  async listDesignVersions(limit = 20) {
     await this.ready;
-    const r = await this.first('SELECT draft_design FROM settings WHERE id = 1');
-    const draft = parseDraft(r?.draft_design);
-    if (!draft) return;
-    await this.updateSettings(pickDesignDraft(draft));
-    await this.discardDesignDraft();
+    const rows = await this.driver.all('SELECT * FROM design_versions ORDER BY created_at DESC LIMIT ?', [limit]);
+    return rows.map(designVersionRow);
   }
-  async discardDesignDraft() {
+  async getDesignVersion(id: string) {
     await this.ready;
-    await this.driver.run('UPDATE settings SET draft_design = NULL WHERE id = 1');
+    const r = await this.first('SELECT * FROM design_versions WHERE id = ?', [id]);
+    return r ? designVersionRow(r) : null;
   }
   async getStats(): Promise<Stats> {
     await this.ready;
@@ -980,3 +1813,9 @@ export class SqlRepository implements ContentRepository {
     };
   }
 }
+
+function designVersionRow(r: Row): DesignVersion {
+  let snapshot: Record<string, unknown> = {};
+  try { snapshot = JSON.parse(String(r.snapshot ?? '{}')); } catch { /* corrupt row: empty snapshot */ }
+  return { id: String(r.id), createdAt: Number(r.created_at), author: String(r.author ?? ''), summary: String(r.summary ?? ''), snapshot };
+}