@acms-subir/core 0.3.10 → 0.3.11

package/src/lib/editor/token-route.ts

@@ -40,6 +40,7 @@ const address = (context: APIContext) => { try { return context.clientAddress ||
 function oauthFailure(error: unknown) {
   if (error instanceof OAuthError) return reply({ error: error.error, error_description: error.message }, error.status);
   if (error instanceof ApiError) {
+    if (error.status === 503) return reply({ error: 'temporarily_unavailable', error_description: error.message }, 503, { 'Retry-After': '10' });
     if (error.status === 429) return reply({ error: 'rate_limited', error_description: error.message }, 429, { 'Retry-After': '60' });
     if (error.status === 404) return reply({ error: 'not_found', error_description: error.message }, 404);
     return reply({ error: 'invalid_request', error_description: error.message }, error.status);
@@ -54,7 +55,7 @@ export async function tokenRoute(context: APIContext) {
     if (context.url.search) throw new OAuthError(400, 'invalid_request', 'Send parameters in the request body, not the URL.');
     const repo = await getRepo(context.locals);
     if (!await repo.email.rateLimit(`editor:token:${await sha256Hex(address(context))}`, 30, 60_000)) throw new ApiError(429, 'Too many requests. Try again in a minute.');
-    return reply(await tokenGrant(repo, await readForm(context.request)));
+    return reply(await tokenGrant(repo, await readForm(context.request), Date.now(), context.locals));
   } catch (error) { return oauthFailure(error); }
 }
 

package/src/lib/email/accounts.ts

@@ -1,3 +1,4 @@
+import { AUTH } from '../auth/config';
 import type { Role } from '../schema';
 import { randomBytes } from 'node:crypto';
 import type { ContentRepository } from '../repo/types';
@@ -23,12 +24,14 @@ export async function accountForm(request: Request): Promise<URLSearchParams> {
 }
 
 export async function reauthenticate(repo:ContentRepository, userId:string, password:string) {
+  if (AUTH.provider !== 'builtin') return false;
   if (!password || password.length>1024) return false;
   if (userId===OWNER_ENV) return checkPassword(password);
   const user=await repo.getUser(userId); if(!user)return false;
   const auth=await repo.getUserAuth(user.email);return !!auth && verifyPassword(password,auth.passHash);
 }
 export async function issueAccountToken(repo:ContentRepository, data:{purpose:'invite'|'reset';email:string;name?:string;role?:Role;expiresDays?:number}, locals?:unknown) {
+  if (AUTH.provider !== 'builtin') throw new Error('Account access is managed by Clerk.');
   const email=data.email.trim().toLowerCase();
   if(!validAddress(email))throw new Error('Enter a valid email address.');
   const auth=await repo.getUserAuth(email);
@@ -45,6 +48,7 @@ export async function issueAccountToken(repo:ContentRepository, data:{purpose:'i
   await repo.email.saveToken(token,job);
 }
 export async function redeemAccountToken(repo:ContentRepository,raw:string,password:string,purpose:'invite'|'reset'):Promise<boolean> {
+  if (AUTH.provider !== 'builtin') return false;
   if(!/^[a-zA-Z0-9_-]{43}$/.test(raw))return false;
   if(password.length<12||password.length>128)throw new Error('Use a password between 12 and 128 characters.');
   const token=await repo.email.tokenByHash(sha256(raw));

package/src/lib/email/service.ts

@@ -32,6 +32,7 @@ async function render(repo: ContentRepository, job: EmailJob, locals?: unknown,
     return accountMail(payload.purpose, job.recipient, settings.siteTitle, `${origin}/account/${payload.purpose}?token=${encodeURIComponent(raw)}`);
   }
   if (job.kind === 'welcome' || job.kind === 'password-changed') return accountMail(job.kind, job.recipient, settings.siteTitle, `${origin}/admin/login`);
+  if (job.kind === 'email-changed') return accountMail(job.kind, job.recipient, settings.siteTitle);
   return null;
 }
 export async function dispatchEmail(repo: ContentRepository, locals?: unknown, limit = 10): Promise<number> {

package/src/lib/email/templates.ts

@@ -1,11 +1,12 @@
 import type { Mail } from './types';
 export const escape = (s: string) => s.replace(/[&<>"']/g, (c) => ({ '&':'&amp;', '<':'&lt;', '>':'&gt;', '"':'&quot;', "'":'&#39;' }[c]!));
-export function accountMail(kind: 'invite'|'reset'|'welcome'|'password-changed'|'test', to: string, site: string, url = ''): Mail {
+export function accountMail(kind: 'invite'|'reset'|'welcome'|'password-changed'|'email-changed'|'test', to: string, site: string, url = ''): Mail {
   const copy = {
     invite: ['You’re invited', `You’ve been invited to join ${site}. Choose your own password to accept.`, 'Accept invitation'],
     reset: ['Reset your password', 'Use this single-use link within 30 minutes to choose a new password. If you did not request this, ignore this message.', 'Choose a new password'],
     welcome: ['Welcome', `Your account at ${site} is ready.`, 'Sign in'],
     'password-changed': ['Your password changed', 'Your password was changed and previous sessions were signed out. If this was not you, contact the site owner.', 'Sign in'],
+    'email-changed': ['Your sign-in email changed', `The email for your account at ${site} was changed to a new address, and previous sessions were signed out. If this was not expected, contact the site owner.`, ''],
     test: ['Email connection test', `This is a transactional email test from ${site}.`, ''],
   }[kind];
   return { to, subject: `${copy[0]} · ${site}`, text: [copy[0], '', copy[1], ...(url ? ['',`${copy[2]}: ${url}`] : [])].join('\n'),

package/src/lib/email/types.ts

@@ -23,6 +23,7 @@ export interface NewEmailJob { id?: string; dedupe: string; kind: string; recipi
 export type SendResult = { state: 'accepted'; providerId: string } | { state: 'retrying' | 'failed' | 'unknown'; error: string; retryAfter?: number };
 export interface Invitation { id: string; email: string; name: string; role: Role; state: string; expiresAt: number; createdAt: number }
 export interface PublicEmailSettings {
+  authProvider?: 'builtin' | 'clerk';
   version: number; config: EmailConfig; provider: Provider | 'none'; configured: boolean; error: string;
   encryptionAvailable: boolean; environmentLocked: boolean; credentialFields: string[];
   linksReady: boolean; linkError: string;

package/src/lib/mobile/http.ts

@@ -4,7 +4,7 @@ import { BookingError } from '../booking/service';
 import { sha256Hex } from '../api-keys';
 import type { ContentRepository } from '../repo/types';
 
-const headers = {
+export const headers = {
   'Access-Control-Allow-Origin': '*',
   'Access-Control-Allow-Methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
   // Authorization carries editor-app bearer tokens; no route reads cookies
@@ -25,9 +25,10 @@ export async function publicResponse(request: Request, data: unknown, raw = fals
   res.headers.set('ETag', etag);
   // Revalidate even fresh-looking content: unpublishing must take effect.
   res.headers.set('Cache-Control', 'public, max-age=0, must-revalidate');
-  const match = request.headers.get('if-none-match')?.split(',').some((s) => s.trim().replace(/^W\//, '') === etag || s.trim() === '*');
-  return match ? new Response(null, { status: 304, headers: res.headers }) : res;
+  return etagMatches(request, etag) ? new Response(null, { status: 304, headers: res.headers }) : res;
 }
+export const etagMatches = (request: Request, etag: string) =>
+  request.headers.get('if-none-match')?.split(',').some((s) => s.trim().replace(/^W\//, '') === etag || s.trim() === '*') ?? false;
 export function failure(error: unknown) {
   const status = error instanceof ApiError || error instanceof BookingError ? error.status : error instanceof z.ZodError ? 400 : 500;
   const codes: Record<number, string> = { 400: 'invalid_request', 401: 'unauthorized', 403: 'forbidden', 404: 'not_found', 405: 'method_not_allowed', 409: 'conflict', 410: 'gone', 413: 'payload_too_large', 415: 'unsupported_media_type', 429: 'rate_limited', 502: 'upstream_error' };

package/src/lib/mobile/route.ts

@@ -1,16 +1,28 @@
 import type { APIRoute } from 'astro';
 import type { ContentRepository } from '../repo/types';
 import { getRepo } from '../repo';
-import { limitRequest, failure, publicResponse, response } from './http';
-export function readRoute(load: (repo: ContentRepository, url: URL, id: string, locals: unknown) => Promise<unknown>, cache = true, raw = false): APIRoute {
+import { userConfig } from 'virtual:acms-config';
+import { limitRequest, failure, response, headers as baseHeaders, etagMatches } from './http';
+import { API_REVALIDATE } from '../cache/policy';
+import { CACHE } from '../cache/config';
+import { memoryGet, memorySet } from '../cache/memory';
+
+type Load = (repo: ContentRepository, url: URL, id: string, locals: unknown) => Promise<unknown>;
+/**
+ * A public, cacheable read. `timeless` routes depend only on stored content;
+ * the rest (upcoming events, dynamic page blocks, search) also change with
+ * the clock, so their ETag rolls over every cache.maxAge seconds too.
+ */
+export function readRoute(load: Load, cache = true, raw = false, opts: { timeless?: boolean } = {}): APIRoute {
   return async context => {
     try {
       const repo = await getRepo(context.locals);
       let address = 'unknown';
       try { address = context.clientAddress || address; } catch { /* adapters without a client address share a bucket */ }
       await limitRequest(repo, address);
-      const data = await load(repo, context.url, context.params.id ?? context.params.slug ?? '', context.locals);
-      const res = cache ? await publicResponse(context.request, data, raw) : response(data);
+      const id = context.params.id ?? context.params.slug ?? '';
+      const res = cache ? await versionedResponse(repo, context, () => load(repo, context.url, id, context.locals), raw, opts.timeless)
+        : response(await load(repo, context.url, id, context.locals));
       return context.request.method === 'HEAD' ? new Response(null, { status: res.status, headers: res.headers }) : res;
     } catch (error) {
       const res = failure(error);
@@ -19,6 +31,31 @@ export function readRoute(load: (repo: ContentRepository, url: URL, id: string,
   };
 }
 
+const CORE = String((userConfig as { coreVersion?: string }).coreVersion ?? '0');
+// The ETag comes from the content version (plus the framework version, and
+// a time window for clock-dependent routes), so a matching If-None-Match is
+// answered 304 before any content is loaded or serialized.
+async function versionedResponse(repo: ContentRepository, context: { request: Request; url: URL; locals: unknown }, build: () => Promise<unknown>, raw: boolean, timeless = false) {
+  const { version } = await repo.getCacheState();
+  const window = timeless ? '' : `.${Math.floor(Date.now() / (Math.max(CACHE.maxAge, 1) * 1000))}`;
+  const etag = `"c${version}${window}-${CORE}"`;
+  const h = new Headers(baseHeaders);
+  h.set('ETag', etag);
+  h.set('Cache-Control', API_REVALIDATE);
+  h.set('Content-Type', 'application/json');
+  if (etagMatches(context.request, etag)) return new Response(null, { status: 304, headers: h });
+  // Node only: Workers isolates are short-lived and many
+  const memory = CACHE.enabled && CACHE.memory && !(context.locals as { runtime?: unknown } | undefined)?.runtime;
+  const key = `${etag} ${context.url.href}`;
+  let body = memory ? memoryGet(key) : undefined;
+  if (body === undefined) {
+    const data = await build();
+    body = JSON.stringify(raw ? data : { version: 1, data });
+    if (memory) memorySet(key, body);
+  }
+  return new Response(body, { status: 200, headers: h });
+}
+
 export interface PublicContext { repo: ContentRepository; request: Request; url: URL; address: string; params: Record<string, string | undefined>; locals: unknown }
 /**
  * A private or write route on the public API: rate limited per client

package/src/lib/net.ts

@@ -1,20 +1,88 @@
 // SSRF guard shared by every server-side fetch of a user-supplied URL (the
 // bookmark card's metadata scrape, the calendar card's ICS feed): block
-// loopback, RFC1918, CGNAT, link-local and IPv6 ULA hosts so a pasted URL —
-// or a redirect hop — can never reach the Worker's own network.
-export function isPrivateHost(hostname: string): boolean {
-  const h = hostname.toLowerCase();
-  if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal')) return true;
-  const v4 = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+// loopback, RFC1918, CGNAT, link-local, multicast/reserved and IPv6 ULA hosts
+// so a pasted URL — or a redirect hop — can never reach the server's own network.
+
+function v4Private(a: number, b: number): boolean {
+  return (
+    a === 0 || a === 10 || a === 127 || a >= 224 || (a === 100 && b >= 64 && b <= 127) ||
+    (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) ||
+    (a === 198 && (b === 18 || b === 19))
+  );
+}
+
+// eight 16-bit groups, or null when not an IPv6 address (zone ids dropped)
+function v6Groups(ip: string): number[] | null {
+  let s = ip.split('%')[0];
+  const v4 = s.match(/:(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    const o = v4.slice(1).map(Number);
+    if (o.some((n) => n > 255)) return null;
+    s = `${s.slice(0, v4.index! + 1)}${((o[0] << 8) | o[1]).toString(16)}:${((o[2] << 8) | o[3]).toString(16)}`;
+  }
+  const parts = s.split('::');
+  if (parts.length > 2) return null;
+  const head = parts[0] ? parts[0].split(':') : [];
+  const tail = parts.length === 2 && parts[1] ? parts[1].split(':') : [];
+  const fill = 8 - head.length - tail.length;
+  if (parts.length === 1 ? fill !== 0 : fill < 1) return null;
+  const groups = [...head, ...Array(parts.length === 2 ? fill : 0).fill('0'), ...tail];
+  if (!groups.every((g) => /^[0-9a-f]{1,4}$/i.test(g))) return null;
+  return groups.map((g) => parseInt(g, 16));
+}
+
+/** true for any IP literal that isn't a public unicast address; non-IPs count as private */
+export function isPrivateAddress(ip: string): boolean {
+  const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
   if (v4) {
-    const [a, b] = [Number(v4[1]), Number(v4[2])];
-    return (
-      a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b <= 127) ||
-      (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168)
-    );
+    const o = v4.slice(1).map(Number);
+    return o.some((n) => n > 255) || v4Private(o[0], o[1]);
   }
-  if (h.includes(':')) return h === '::1' || h.startsWith('fe80') || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('[');
-  return false;
+  const g = v6Groups(ip.replace(/^\[|\]$/g, ''));
+  if (!g) return true;
+  // IPv4-mapped (::ffff:a.b.c.d), IPv4-compatible (::a.b.c.d) and NAT64 (64:ff9b::/96) carry an IPv4 address
+  const embedded = (g.slice(0, 5).every((n) => n === 0) && (g[5] === 0xffff || g[5] === 0))
+    || (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every((n) => n === 0));
+  if (embedded && (g[6] || g[7] || g[5] === 0xffff)) return v4Private(g[6] >> 8, g[6] & 0xff);
+  return (
+    g.every((n) => n === 0) || (g.slice(0, 7).every((n) => n === 0) && g[7] === 1) ||
+    (g[0] & 0xfe00) === 0xfc00 || (g[0] & 0xffc0) === 0xfe80 || (g[0] & 0xffc0) === 0xfec0 || (g[0] & 0xff00) === 0xff00
+  );
+}
+
+const isIp = (h: string) => /^\d{1,3}(\.\d{1,3}){3}$/.test(h) || h.includes(':');
+const bare = (hostname: string) => hostname.toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+
+/** literal check only: names that are private by convention, and private IP literals */
+export function isPrivateHost(hostname: string): boolean {
+  const h = bare(hostname);
+  if (!h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal')) return true;
+  return isIp(h) && isPrivateAddress(h);
+}
+
+type Lookup = (host: string, opts: { all: true; verbatim: true }) => Promise<{ address: string }[]>;
+let dnsLookup: Promise<Lookup | null> | undefined;
+// Workers have no usable node:dns, and their fetch can't reach private
+// networks anyway; there (or wherever the import fails) only the literal check runs
+const loadLookup = () => (dnsLookup ??= typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers'
+  ? Promise.resolve(null)
+  : import(/* @vite-ignore */ 'node:dns/promises').then((m) => m.lookup as unknown as Lookup, () => null));
+
+/**
+ * isPrivateHost, plus (on Node) true when the name resolves to ANY private
+ * address — a public name pointing at 127.0.0.1 or 169.254.169.254. fetch
+ * resolves again and can't be pinned to the checked IP, so a rebinding DNS
+ * server can still race this: it narrows the window, it doesn't close it. A
+ * failed lookup passes (fetch's own lookup will fail the same way).
+ */
+export async function resolvesToPrivate(hostname: string): Promise<boolean> {
+  if (isPrivateHost(hostname)) return true;
+  const h = bare(hostname);
+  if (isIp(h)) return false;
+  const lookup = await loadLookup();
+  if (!lookup) return false;
+  const addrs = await lookup(h, { all: true, verbatim: true }).catch((): { address: string }[] => []);
+  return addrs.some((a) => isPrivateAddress(a.address));
 }
 
 // Fetch that follows redirects manually so EVERY hop is re-checked against the
@@ -32,7 +100,7 @@ export async function fetchPublicUrl(
     } catch {
       return null;
     }
-    if (!/^https?:$/.test(u.protocol) || isPrivateHost(u.hostname)) return null;
+    if (!/^https?:$/.test(u.protocol) || await resolvesToPrivate(u.hostname)) return null;
     const res = await fetch(u.href, {
       redirect: 'manual',
       signal: AbortSignal.timeout(init.timeoutMs ?? 8000),

package/src/lib/repo/migrate-runner.ts

@@ -0,0 +1,96 @@
+import { MIGRATIONS, MIGRATIONS_TABLE } from './migrations';
+
+// Applies pending schema migrations under a database lock. Shared by the app
+// (first request after a deploy — the fallback) and `acms migrate` (Docker
+// entrypoint, before `wrangler deploy`), which runs a bundled copy of this
+// file (cli/migrations.generated.mjs), so the two can never disagree.
+
+export interface MigrationDriver {
+  all(sql: string, args?: unknown[]): Promise<Record<string, unknown>[]>;
+  run(sql: string, args?: unknown[]): Promise<void>;
+  batch(stmts: Array<{ sql: string; args?: unknown[] }>): Promise<void>;
+}
+
+export const MIGRATION_LOCK_TABLE = `CREATE TABLE IF NOT EXISTS migration_lock (
+  id INTEGER PRIMARY KEY CHECK (id = 1), owner TEXT NOT NULL, expires_at INTEGER NOT NULL
+)`;
+// a crashed migrator's lock expires; long enough for a big table rebuild
+const LOCK_TTL_MS = 10 * 60_000;
+
+export interface MigrationResult {
+  from: number; to: number; applied: number[];
+  /** set when a refused version is pending: nothing was applied, the site will migrate itself on start */
+  deferred?: number;
+}
+export interface MigrateOptions {
+  /** how long to wait for another migrator before giving up (ms) */
+  waitMs?: number;
+  /** versions this runner can't finish on an existing database (the CLI can't rebuild search for v21) */
+  refuse?: number[];
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+  log?: (message: string) => void;
+}
+
+export class MigrationLockTimeout extends Error {}
+
+async function appliedVersion(db: MigrationDriver): Promise<number> {
+  const r = (await db.all('SELECT MAX(version) AS v FROM migrations'))[0];
+  return Number(r?.v ?? 0);
+}
+
+export async function pendingMigrations(db: MigrationDriver) {
+  await db.run(MIGRATIONS_TABLE);
+  let applied = await appliedVersion(db);
+  // Pre-migrations DB: the baseline tables already exist, count v1 as applied
+  if (applied === 0 && (await db.all("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'pages'")).length) applied = 1;
+  return { applied, pending: MIGRATIONS.filter((m) => m.version > applied) };
+}
+
+export async function runMigrations(db: MigrationDriver, opts: MigrateOptions = {}): Promise<MigrationResult> {
+  const now = opts.now ?? Date.now;
+  const sleep = opts.sleep ?? ((ms: number) => new Promise((r) => setTimeout(r, ms)));
+  // the common case (nothing to do) takes no lock and writes nothing
+  const first = await pendingMigrations(db);
+  if (!first.pending.length) return { from: first.applied, to: first.applied, applied: [] };
+  // a brand-new database has nothing to rebuild, so only old ones are refused
+  const refused = first.applied > 0 && first.pending.find((m) => opts.refuse?.includes(m.version));
+  if (refused) return { from: first.applied, to: first.applied, applied: [], deferred: refused.version };
+
+  await db.run(MIGRATION_LOCK_TABLE);
+  const owner = crypto.randomUUID();
+  const deadline = now() + (opts.waitMs ?? 60_000);
+  let waited = false;
+  for (;;) {
+    const t = now();
+    await db.run(
+      `INSERT INTO migration_lock (id, owner, expires_at) VALUES (1, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET owner = excluded.owner, expires_at = excluded.expires_at WHERE migration_lock.expires_at < ?`,
+      [owner, t + LOCK_TTL_MS, t],
+    );
+    const holder = (await db.all('SELECT owner FROM migration_lock WHERE id = 1'))[0];
+    if (holder?.owner === owner) break;
+    if (t >= deadline) throw new MigrationLockTimeout('Another process is migrating this database. Try again when it finishes.');
+    if (!waited) { opts.log?.('Waiting for another migration to finish…'); waited = true; }
+    await sleep(500);
+  }
+  try {
+    // someone else may have finished while we waited
+    const { applied, pending } = await pendingMigrations(db);
+    if (applied === 1 && !(await appliedVersion(db))) {
+      await db.run('INSERT INTO migrations (version, applied_at) VALUES (1, ?)', [now()]);
+    }
+    for (const m of pending) {
+      opts.log?.(`Applying migration ${m.version}`);
+      await db.batch([
+        ...m.statements.map((sql) => ({ sql })),
+        { sql: 'INSERT INTO migrations (version, applied_at) VALUES (?, ?)', args: [m.version, now()] },
+      ]);
+    }
+    return { from: applied, to: pending.length ? pending[pending.length - 1].version : applied, applied: pending.map((m) => m.version) };
+  } finally {
+    await db.run('DELETE FROM migration_lock WHERE id = 1 AND owner = ?', [owner]).catch(() => {});
+  }
+}
+
+export { MIGRATIONS, LATEST_VERSION } from './migrations';

package/src/lib/repo/migrations.ts

@@ -19,6 +19,51 @@ export interface Migration {
   statements: string[];
 }
 
+// Columns whose change a visitor can see (v49 triggers bump content_version).
+// Left out on purpose: drafts and autosave bookkeeping (draft, updated_at,
+// revision counters), click counts, credentials, and staff-only settings.
+// Frozen with v49 — a later column joins by a new migration that recreates
+// that table's triggers (the cache test fails until every column is sorted).
+export const CONTENT_VERSION_COLUMNS: Record<string, string[]> = {
+  settings: ['site_title', 'tagline', 'links_name', 'links_bio', 'links_avatar', 'footer_text', 'active_theme', 'design_overrides', 'site_logo',
+    'site_url', 'site_favicon', 'site_cover', 'announcement', 'head_code', 'footer_code', 'timezone', 'locale', 'analytics', 'section_pages',
+    'live', 'push', 'calendar', 'site_logo_dark', 'mobile_access'],
+  pages: ['id', 'slug', 'title', 'status', 'is_home', 'blocks', 'seo_title', 'seo_desc', 'body_json', 'body_html', 'template', 'locale', 'translations'],
+  posts: ['id', 'slug', 'title', 'body', 'tags', 'cover', 'status', 'published_at', 'body_json', 'body_html', 'excerpt', 'cover_alt', 'seo_title',
+    'seo_desc', 'scheduled_at', 'author_id', 'featured', 'template', 'collection', 'translations'],
+  post_authors: ['post_id', 'author_id', 'ord'],
+  events: ['id', 'slug', 'title', 'body_json', 'body_html', 'excerpt', 'cover', 'cover_alt', 'seo_title', 'seo_desc', 'status', 'featured', 'tags',
+    'template', 'starts', 'ends', 'all_day', 'timezone', 'rrule', 'exdates', 'cancelled', 'location', 'cta', 'calendar_ids', 'fields', 'source_uid',
+    'start_at', 'end_at', 'published_at', 'scheduled_at', 'rsvp', 'translations', 'room_hold'],
+  calendars: ['id', 'slug', 'name', 'color', 'description', 'kind', 'feed_url', 'visibility', 'feed_token', 'ord'],
+  places: ['id', 'name', 'address', 'url', 'lat', 'lng', 'notes', 'is_default', 'map_image', 'map_image_dark', 'ord'],
+  resources: ['id', 'slug', 'name', 'kind', 'description', 'photo', 'capacity', 'amenities', 'timezone', 'hours', 'overrides', 'busy_feeds',
+    'visibility', 'show_on_calendar', 'feed_token', 'ord', 'place_id'],
+  booking_links: ['id', 'resource_id', 'slug', 'name', 'description', 'mode', 'duration', 'lengths', 'min_days', 'max_days', 'step', 'buffer_before',
+    'buffer_after', 'min_notice', 'max_advance', 'per_day_cap', 'hours', 'auto_confirm', 'visibility', 'ask_phone', 'questions', 'confirm_message',
+    'redirect_url', 'active', 'ord', 'approval', 'approval_rules', 'change_cutoff'],
+  links: ['id', 'label', 'url', 'icon', 'ord', 'kind', 'html', 'meta'],
+  nav_items: ['id', 'label', 'url', 'area', 'ord'],
+  tags: ['id', 'name', 'slug', 'description'],
+  media: ['id', 'key', 'filename', 'mime', 'width', 'height', 'size', 'alt', 'variants'],
+  redirects: ['id', 'from_path', 'to_path', 'code'],
+  users: ['id', 'name', 'email', 'role', 'bio', 'avatar', 'slug'],
+  forms: ['id', 'name', 'kind', 'purpose', 'status', 'definition'],
+};
+
+const BUMP_CONTENT_VERSION = 'UPDATE settings SET content_version = content_version + 1 WHERE id = 1;';
+function contentVersionTriggers(table: string, columns: string[]): string[] {
+  const changed = columns.map((c) => `OLD.${c} IS NOT NEW.${c}`).join(' OR ');
+  const update = `CREATE TRIGGER content_version_${table}_update AFTER UPDATE OF ${columns.join(', ')} ON ${table} WHEN ${changed} BEGIN ${BUMP_CONTENT_VERSION} END`;
+  // the settings row itself is created once and never deleted
+  if (table === 'settings') return [update];
+  return [
+    `CREATE TRIGGER content_version_${table}_insert AFTER INSERT ON ${table} BEGIN ${BUMP_CONTENT_VERSION} END`,
+    `CREATE TRIGGER content_version_${table}_delete AFTER DELETE ON ${table} BEGIN ${BUMP_CONTENT_VERSION} END`,
+    update,
+  ];
+}
+
 export const MIGRATIONS_TABLE = `CREATE TABLE IF NOT EXISTS migrations (
   version INTEGER PRIMARY KEY, applied_at INTEGER NOT NULL
 )`;
@@ -554,6 +599,37 @@ export const MIGRATIONS: Migration[] = [
   { version: 47, statements: [
     `ALTER TABLE settings ADD COLUMN monitoring TEXT NOT NULL DEFAULT '{}'`,
   ] },
+  { version: 48, statements: [
+    `CREATE TABLE auth_owner_checks (allowed INTEGER CONSTRAINT keep_clerk_owner CHECK(allowed=1))`,
+    `ALTER TABLE editor_codes ADD COLUMN auth_provider TEXT NOT NULL DEFAULT 'builtin'`,
+    `ALTER TABLE editor_devices ADD COLUMN auth_provider TEXT NOT NULL DEFAULT 'builtin'`,
+    `CREATE TABLE auth_identities (issuer TEXT NOT NULL, subject TEXT NOT NULL, user_id TEXT NOT NULL, disabled INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(issuer,subject), UNIQUE(issuer,user_id))`,
+    `CREATE TABLE auth_bootstrap (issuer TEXT PRIMARY KEY)`,
+    `CREATE TABLE auth_invitations (id TEXT PRIMARY KEY, issuer TEXT NOT NULL, email TEXT NOT NULL, name TEXT NOT NULL, role TEXT NOT NULL, state TEXT NOT NULL, remote_id TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL)`,
+    `CREATE UNIQUE INDEX auth_invitation_pending ON auth_invitations(issuer,email) WHERE state IN ('sending','pending')`,
+    `CREATE TABLE auth_mobile (kind TEXT NOT NULL, id TEXT NOT NULL, issuer TEXT NOT NULL, subject TEXT NOT NULL, session_id TEXT NOT NULL, PRIMARY KEY(kind,id))`,
+    `CREATE TRIGGER auth_user_deleted AFTER DELETE ON users BEGIN UPDATE auth_identities SET disabled=1 WHERE user_id=OLD.id; END`,
+    `CREATE TRIGGER auth_code_deleted AFTER DELETE ON editor_codes BEGIN DELETE FROM auth_mobile WHERE kind='code' AND id=OLD.hash; END`,
+    `CREATE TRIGGER auth_device_deleted AFTER DELETE ON editor_devices BEGIN DELETE FROM auth_mobile WHERE kind='device' AND id=OLD.id; END`,
+  ] },
+  // Public cache: content_version goes up on every change a visitor could
+  // see, from any write path (admin, editor API, scheduler, design publish,
+  // restore/import, raw SQL), because triggers do the bumping. Cached pages
+  // and app ETags are keyed by it; the purge loop records how far it got.
+  { version: 49, statements: [
+    `ALTER TABLE settings ADD COLUMN content_version INTEGER NOT NULL DEFAULT 0`,
+    `ALTER TABLE settings ADD COLUMN cache_purged_version INTEGER NOT NULL DEFAULT 0`,
+    // start at a random point so two databases (a reinstall, a test run)
+    // never hand out the same version, and an old ETag can't match by chance
+    `UPDATE settings SET content_version = abs(random() % 1000000000), cache_purged_version = content_version WHERE id = 1`,
+    ...Object.entries(CONTENT_VERSION_COLUMNS).flatMap(([table, columns]) => contentVersionTriggers(table, columns)),
+  ] },
+  // scheduled off-site backups (lib/backup/offsite.ts): last run + lease
+  { version: 50, statements: [
+    `CREATE TABLE backup_state (id INTEGER PRIMARY KEY CHECK (id = 1), last_at INTEGER NOT NULL DEFAULT 0, lease_until INTEGER NOT NULL DEFAULT 0,
+      last_key TEXT NOT NULL DEFAULT '', last_error TEXT NOT NULL DEFAULT '', failed_at INTEGER NOT NULL DEFAULT 0)`,
+    `INSERT INTO backup_state (id) VALUES (1)`,
+  ] },
 ];
 
 export const LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;