@acms-subir/core 0.3.10 → 0.3.11

package/src/lib/repo/sql.ts

@@ -1,8 +1,11 @@
+import { AUTH } from '../auth/config';
+import { AuthStore } from '../auth/store';
 import { FormStore, formInsert, submissionInsert } from '../forms/store';
 import { GuestStore } from '../mobile/guest-store';
 import { LiveStore } from '../live/store';
 import { PushStore } from '../push/store';
 import { EditorStore } from '../editor/store';
+import { BackupStore } from '../backup/store';
 import { LiveConfig } from '../live/types';
 import { ApiError } from '../api';
 import { EmailStore, bookingJobs } from '../email/store';
@@ -11,7 +14,7 @@ import { DocTranslations, Page, Post, Link, Media, NavItem, Redirect, Settings,
 import { designSnapshot, draftNavItems, pickDesignDraft, pickEventDraft, pickPageDraft, pickPostDraft } from '../drafts';
 import { eventInstants, eventTimeZone, normalizeEventTimes } from '../calendar/events';
 import { cleanRrule } from '../calendar/rrule';
-import { MIGRATIONS, MIGRATIONS_TABLE } from './migrations';
+import { runMigrations } from './migrate-runner';
 import { htmlToPlaintext } from '../plaintext';
 import { SEED } from '../brand';
 import { CONTENT, postsIndexUrl } from '../content';
@@ -258,12 +261,14 @@ function safeSnippet(raw: unknown): string {
 export class SqlRepository implements ContentRepository {
   private driver!: SqlDriver;
   private ready: Promise<void>;
+  readonly auth: AuthStore;
   readonly email: EmailStore;
   readonly forms: FormStore;
   readonly guests: GuestStore;
   readonly live: LiveStore;
   readonly push: PushStore;
   readonly editor: EditorStore;
+  readonly backups: BackupStore;
 
   constructor(driver: SqlDriver | (() => Promise<SqlDriver>)) {
     this.ready = this.init(driver);
@@ -272,6 +277,8 @@ export class SqlRepository implements ContentRepository {
     this.live = new LiveStore(async () => { await this.ready; return this.driver; });
     this.push = new PushStore(async () => { await this.ready; return this.driver; });
     this.editor = new EditorStore(async () => { await this.ready; return this.driver; });
+    this.backups = new BackupStore(async () => { await this.ready; return this.driver; });
+    this.auth = new AuthStore(async () => { await this.ready; return this.driver; });
     this.email = new EmailStore(async () => { await this.ready; return this.driver; });
   }
 
@@ -287,27 +294,11 @@ export class SqlRepository implements ContentRepository {
   }
 
   private async migrate() {
-    await this.driver.run(MIGRATIONS_TABLE);
-    const r = await this.first('SELECT MAX(version) AS v FROM migrations');
-    let applied = Number(r?.v ?? 0);
-    if (applied === 0) {
-      // Pre-migrations DB: the baseline tables already exist, mark v1 applied.
-      const baseline = await this.first("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'pages'");
-      if (baseline) {
-        await this.driver.run('INSERT INTO migrations (version, applied_at) VALUES (1, ?)', [Date.now()]);
-        applied = 1;
-      }
-    }
-    const pending = MIGRATIONS.filter((m) => m.version > applied);
-    for (const m of pending) {
-      await this.driver.batch([
-        ...m.statements.map((sql) => ({ sql })),
-        { sql: 'INSERT INTO migrations (version, applied_at) VALUES (?, ?)', args: [m.version, Date.now()] },
-      ]);
-    }
+    // under the shared migration lock (also used by `acms migrate`)
+    const { applied } = await runMigrations(this.driver);
     // v21 introduced the search index; plaintext can't be derived in SQL, so
     // the backfill runs here once, right after that version lands.
-    if (pending.some((m) => m.version === 21)) await this.reindexSearch();
+    if (applied.includes(21)) await this.reindexSearch();
   }
 
   private async seed() {
@@ -320,7 +311,8 @@ export class SqlRepository implements ContentRepository {
       { id: uuid(), type: 'text', config: { markdown: 'This home page was built in the **widget editor** — open `/admin` to change it.' } },
     ];
     await this.driver.batch([
-      { sql: 'INSERT INTO settings (id, site_title, tagline) VALUES (1, ?, ?)', args: [SEED.siteTitle, SEED.tagline] },
+      // random start: see migration 49
+      { sql: 'INSERT INTO settings (id, site_title, tagline, content_version) VALUES (1, ?, ?, abs(random() % 1000000000))', args: [SEED.siteTitle, SEED.tagline] },
       {
         sql: 'INSERT INTO pages (id, slug, title, status, is_home, blocks, created_at, updated_at) VALUES (?, ?, ?, ?, 1, ?, ?, ?)',
         args: [uuid(), 'home', 'Home', 'published', JSON.stringify(homeBlocks), now, now],
@@ -1559,6 +1551,23 @@ export class SqlRepository implements ContentRepository {
     await this.driver.run('DELETE FROM snippets WHERE id = ?', [id]);
   }
 
+  private ownerGuard(id: string): SqlStatement[] {
+    if (AUTH.provider !== 'clerk') return [];
+    // Execute in the same write transaction as demotion/deletion: concurrent
+    // owners cannot each remove the other and leave the site without one.
+    return [{ sql: `INSERT INTO auth_owner_checks(allowed) SELECT 0 FROM users target
+      WHERE target.id=? AND target.role='owner' AND EXISTS (
+        SELECT 1 FROM auth_identities a WHERE a.user_id=target.id AND a.disabled=0 AND NOT EXISTS (
+          SELECT 1 FROM users other JOIN auth_identities b ON b.user_id=other.id
+          WHERE other.id<>target.id AND other.role='owner' AND b.disabled=0 AND b.issuer=a.issuer))`, args: [id] }];
+  }
+  private async guardedUserWrite(statements: SqlStatement[]) {
+    try { await this.driver.batch(statements); }
+    catch (error) {
+      if (String(error).includes('keep_clerk_owner')) throw new Error('Keep at least one linked owner. Add another owner before removing or demoting this account.');
+      throw error;
+    }
+  }
   // ---- users ----
   async listUsers() {
     await this.ready;
@@ -1592,16 +1601,28 @@ export class SqlRepository implements ContentRepository {
     if (data.slug !== undefined) { sets.push('slug = ?'); args.push(data.slug); }
     if (!sets.length) return;
     args.push(id);
-    await this.driver.batch([
+    await this.guardedUserWrite([
+      ...(data.role !== undefined && data.role !== 'owner' ? this.ownerGuard(id) : []),
       {sql:`UPDATE users SET ${sets.join(', ')} WHERE id = ?`,args},
       ...(data.passHash === undefined ? [] : [{sql:`INSERT INTO email_jobs(id,dedupe,kind,recipient,payload,config_version,next_at,created_at,updated_at)
         SELECT ?,?,'password-changed',email,'{}',COALESCE((SELECT MAX(version) FROM email_configs),0),?,?,? FROM users WHERE id=?`,
         args:[crypto.randomUUID(),crypto.randomUUID(),Date.now(),Date.now(),Date.now(),id]}]),
     ]);
   }
+  async changeUserEmail(id: string, email: string, { signOut, notify }: { signOut: boolean; notify: boolean }) {
+    await this.ready;
+    const now = Date.now();
+    // the notice is queued before the update so it reads the previous address
+    await this.driver.batch([
+      ...(notify ? [{sql:`INSERT INTO email_jobs(id,dedupe,kind,recipient,payload,config_version,next_at,created_at,updated_at)
+        SELECT ?,?,'email-changed',email,'{}',COALESCE((SELECT MAX(version) FROM email_configs),0),?,?,? FROM users WHERE id=? AND email<>?`,
+        args:[crypto.randomUUID(),crypto.randomUUID(),now,now,now,id,email.toLowerCase()]}] : []),
+      {sql:`UPDATE users SET email = ?${signOut ? ', session_version = session_version + 1' : ''} WHERE id = ?`,args:[email.toLowerCase(),id]},
+    ]);
+  }
   async deleteUser(id: string) {
     await this.ready;
-    await this.driver.run('DELETE FROM users WHERE id = ?', [id]);
+    await this.guardedUserWrite([...this.ownerGuard(id), { sql: 'DELETE FROM users WHERE id = ?', args: [id] }]);
   }
   async getUserAuth(email: string) {
     await this.ready;
@@ -1735,12 +1756,13 @@ export class SqlRepository implements ContentRepository {
   }
 
   // ---- restore ----
-  async restoreAll(content: Parameters<ContentRepository['restoreAll']>[0]) {
+  async restoreAll(content: Parameters<ContentRepository['restoreAll']>[0], authRecovery?: { issuer: string; subject: string; userId: string }) {
     await this.ready;
     const stmts: SqlStatement[] = [
       // Suppression and re-enabling share the restore transaction. A failed
       // restore cannot leave notifications disabled or emit phantom deletes.
       { sql: 'UPDATE webhook_control SET suppressed=1 WHERE id=1' },
+      { sql: "UPDATE auth_invitations SET state='revoked' WHERE state<>'accepted'" },
       ...['email_jobs', 'email_attempts', 'email_delivery_events', 'email_tokens', 'posts', 'pages', 'media', 'links', 'tags', 'nav_items', 'users', 'post_authors', 'redirects', 'calendars', 'events', 'resources', 'booking_links', 'bookings', 'mobile_booking_requests', 'import_runs', 'import_records', 'places', 'forms', 'form_submissions'].map((t) => ({
         sql: `DELETE FROM ${t}`,
       })),
@@ -1816,6 +1838,7 @@ export class SqlRepository implements ContentRepository {
         args: [r.id, r.fromPath, r.toPath, r.code, r.createdAt],
       })),
     ];
+    if (authRecovery) stmts.push({ sql: `UPDATE auth_identities SET disabled=0 WHERE issuer=? AND subject=? AND user_id=? AND EXISTS(SELECT 1 FROM users WHERE id=? AND role='owner')`, args: [authRecovery.issuer, authRecovery.subject, authRecovery.userId, authRecovery.userId] });
     const settingsWrite = this.settingsStatement({ ...content.settings, live: { ...LiveConfig.parse(content.settings.live ?? {}), mode: 'off', manual: { watchUrl: '', title: 'We’re live', until: 0 } } });
     stmts.push({ sql: "UPDATE live_connections SET enabled=0,tested_at=0,revision=revision+1,lease='',lease_until=0,snapshot=NULL,upcoming=NULL,error='Restored content. Test this connection before enabling automatic checks.'" }, { sql: 'DELETE FROM live_oauth_states' });
     if (settingsWrite) stmts.push(settingsWrite);
@@ -1995,6 +2018,15 @@ export class SqlRepository implements ContentRepository {
     await this.ready;
     await this.driver.run('UPDATE settings SET mobile_access = json_patch(mobile_access, ?) WHERE id = 1', [JSON.stringify(patch)]);
   }
+  async getCacheState() {
+    await this.ready;
+    const r = await this.first('SELECT content_version, cache_purged_version FROM settings WHERE id = 1');
+    return { version: Number(r?.content_version ?? 0), purged: Number(r?.cache_purged_version ?? 0) };
+  }
+  async markCachePurged(version: number) {
+    await this.ready;
+    await this.driver.run('UPDATE settings SET cache_purged_version = MAX(cache_purged_version, ?) WHERE id = 1', [version]);
+  }
   private settingsStatement(data: Partial<Settings>): SqlStatement | undefined {
     const columns: Record<string, string> = {
       siteTitle:'site_title', tagline:'tagline', footerText:'footer_text', linksName:'links_name', linksBio:'links_bio', linksAvatar:'links_avatar',

package/src/lib/repo/sqlite.ts

@@ -39,7 +39,20 @@ export class SqliteRepository extends SqlRepository {
       }
       // remote libSQL (Turso, sqld) needs a token; local files don't
       const authToken = env('SQLITE_AUTH_TOKEN', '');
-      return new LibsqlDriver(createClient(authToken ? { url, authToken } : { url }));
+      const client = createClient(authToken ? { url, authToken } : { url });
+      if (url.startsWith('file:')) await tuneLocalFile(client);
+      return new LibsqlDriver(client);
     });
   }
 }
+
+// Local files only (remote libSQL/Turso manage their own journal): WAL lets
+// page reads continue while a write commits, busy_timeout waits out a
+// concurrent writer (the scheduler, a second process) instead of failing
+// with SQLITE_BUSY, and synchronous=NORMAL is the safe pairing for WAL.
+// File-copy backups must take acms.db, acms.db-wal and acms.db-shm together.
+export async function tuneLocalFile(client: Pick<Client, 'execute'>) {
+  await client.execute('PRAGMA journal_mode=WAL');
+  await client.execute('PRAGMA busy_timeout=5000');
+  await client.execute('PRAGMA synchronous=NORMAL');
+}

package/src/lib/repo/types.ts

@@ -1,4 +1,6 @@
+import { AuthStore } from '../auth/store';
 import type { FormStore } from '../forms/store';
+import type { BackupStore } from '../backup/store';
 import type { GuestStore } from '../mobile/guest-store';
 import type { SavedForm, FormSubmission } from '../forms/schema';
 import type { LiveStore } from '../live/store';
@@ -50,8 +52,10 @@ export type EventUpdate = Partial<
 // The single contract both backends implement. The app only ever imports
 // this — never a concrete adapter.
 export interface ContentRepository {
+  readonly auth: AuthStore;
   readonly email: EmailStore;
   readonly forms: FormStore;
+  readonly backups: BackupStore;
   readonly guests: GuestStore;
   readonly live: LiveStore;
   readonly push: PushStore;
@@ -258,6 +262,9 @@ export interface ContentRepository {
   getUser(id: string): Promise<User | null>;
   createUser(data: { name: string; email: string; role: Role; passHash: string }): Promise<User>;
   updateUser(id: string, data: { name?: string; email?: string; role?: Role; passHash?: string; bio?: string; avatar?: string; slug?: string }): Promise<void>;
+  /** Replace a user's email. `signOut` ends their sessions (the email is their
+   * login); `notify` queues an `email-changed` notice to the previous address. */
+  changeUserEmail(id: string, email: string, opts: { signOut: boolean; notify: boolean }): Promise<void>;
   deleteUser(id: string): Promise<void>;
   getUserAuth(email: string): Promise<{ user: User; passHash: string; sessionVersion: number } | null>;
 
@@ -300,7 +307,7 @@ export interface ContentRepository {
     places?: Place[];
     forms?: SavedForm[];
     formSubmissions?: FormSubmission[];
-  }): Promise<void>;
+  }, authRecovery?: { issuer: string; subject: string; userId: string }): Promise<void>;
 
   // imports (lib/import/apply.ts drives these). writeImported is the
   // id-preserving bulk write for imported posts/pages: original timestamps
@@ -327,6 +334,10 @@ export interface ContentRepository {
   updateSettings(data: Partial<Settings>): Promise<void>;
   /** merges just these App access fields in one statement, so concurrent saves don't undo each other */
   patchMobileAccess(patch: Partial<Settings['mobileAccess']>): Promise<void>;
+  /** public cache: version = bumped by triggers on every visible change; purged = last version cleared from caches */
+  getCacheState(): Promise<{ version: number; purged: number }>;
+  /** record that caches were cleared up to `version` (never moves backwards) */
+  markCachePurged(version: number): Promise<void>;
   // Design-screen staging: save stages into settings.draftDesign, apply
   // copies staged → live design fields and clears, discard just clears
   saveDesignDraft(data: Partial<Pick<Settings, 'activeTheme' | 'designOverrides' | 'siteLogo' | 'siteLogoDark' | 'siteFavicon' | 'siteCover' | 'sectionPages'>> & {

package/src/lib/scheduler.ts

@@ -6,6 +6,8 @@ import { decideOverdue, sendDueReminders } from './booking/service';
 import { runPushJobs } from './push/service';
 import { GUEST_IDLE_MS } from './mobile/guest-store';
 import { pushHeartbeat, pushUrlFor } from './monitoring';
+import { syncCachePurge } from './cache/purge';
+import { runOffsiteBackup } from './backup/offsite';
 
 // All work is awaited on both hosts. Traffic-triggered fallbacks do not mark
 // this heartbeat: monitoring must prove the independent scheduler ran.
@@ -24,6 +26,11 @@ export async function runScheduledTasks(repo: ContentRepository, locals?: unknow
     push: () => runPushJobs(repo, { locals, now: startedAt }),
     // expired guest sign-in codes and app sessions unused for 90 days
     guests: () => repo.guests.purge(GUEST_IDLE_MS, startedAt).then(() => 0),
+    // clear shared caches after scheduled publishes, and retry a purge that
+    // failed after an admin save (Cloudflare API down or rate limited)
+    cache: () => syncCachePurge(repo, locals, { force: true }),
+    // off-site backup ZIP when one is due (BACKUP_* settings / BACKUPS binding)
+    backup: () => runOffsiteBackup(repo, locals),
   };
   const results: Record<string, { ok: boolean; count?: number }> = {};
   for (const [name, run] of Object.entries(jobs)) {

package/src/lib/theme-transfer.ts

@@ -0,0 +1,163 @@
+import { z } from 'zod';
+import { SectionLayout, type SectionPages } from '../theme-sdk/contract.mjs';
+import type { NavItem, Page, Settings } from './schema';
+
+// Theme transfer (acms-theme v1): a theme as you see it on the Design screen,
+// moved between sites or machines as one ZIP:
+//   manifest.json   format, theme identity, core version, what's included
+//   design.json     the database half: overrides, brand images, section
+//                   layouts (keyed by page slug, not ID), optional navigation
+//   media/<key>     brand and section images, ids and keys verbatim
+// Theme code (src/themes/<slug>/) is compiled into the build, so it never
+// installs at runtime; an import that names a theme this site lacks stages
+// the rest and keeps the current theme.
+
+export const THEME_TRANSFER_FORMAT = 'acms-theme';
+
+export const ThemeTransferManifest = z.object({
+  format: z.literal(THEME_TRANSFER_FORMAT),
+  version: z.literal(1),
+  exportedAt: z.number().int().nonnegative(),
+  coreVersion: z.string().max(50).default(''),
+  source: z.object({ title: z.string().max(300).default(''), siteUrl: z.string().max(2000).default('') }).default({}),
+  theme: z.object({ slug: z.string().max(50), name: z.string().max(200).default(''), version: z.string().max(50).default(''), project: z.boolean().default(false) }),
+  includes: z.array(z.enum(['design', 'media', 'nav'])).max(10),
+}).passthrough();
+export type ThemeTransferManifest = z.infer<typeof ThemeTransferManifest>;
+
+const PageKey = z.object({ slug: z.string().max(300), locale: z.string().max(20).default(''), isHome: z.boolean().default(false), title: z.string().max(500).default('') });
+export const ThemeDesignFile = z.object({
+  activeTheme: z.string().max(50),
+  designOverrides: z.record(z.union([z.string().max(2000), z.number().finite()])).default({}),
+  siteLogo: z.string().max(2000).default(''),
+  siteLogoDark: z.string().max(2000).default(''),
+  siteFavicon: z.string().max(2000).default(''),
+  siteCover: z.string().max(2000).default(''),
+  layouts: z.array(z.object({ page: PageKey, layout: SectionLayout })).max(500).default([]),
+  // link refs (page:/post:/event:/booking:<id>) → the public URL they pointed
+  // at, so the importing site can find its own item at the same address
+  refs: z.record(z.string().max(200), z.string().max(2000)).default({}),
+  navItems: z.array(z.object({ label: z.string().max(200), url: z.string().max(2000), area: z.enum(['header', 'footer', 'social']) })).max(200).optional(),
+});
+export type ThemeDesignFile = z.infer<typeof ThemeDesignFile>;
+
+type Pages = z.infer<typeof SectionPages>;
+type PageRow = Pick<Page, 'id' | 'slug' | 'locale' | 'isHome' | 'title'>;
+export interface LinkRef { ref: string; url: string }
+
+const walk = (v: unknown, fn: (s: string) => string): unknown => {
+  if (typeof v === 'string') return fn(v);
+  if (Array.isArray(v)) return v.map((x) => walk(x, fn));
+  if (v && typeof v === 'object') return Object.fromEntries(Object.entries(v as Record<string, unknown>).map(([k, x]) => [k, walk(x, fn)]));
+  return v;
+};
+const collectRefs = (v: unknown, out: Set<string>) => {
+  if (Array.isArray(v)) v.forEach((x) => collectRefs(x, out));
+  else if (v && typeof v === 'object') {
+    for (const [k, x] of Object.entries(v as Record<string, unknown>)) {
+      if (k === 'ref' && typeof x === 'string') out.add(x); else collectRefs(x, out);
+    }
+  }
+};
+
+/** every uploaded-media key a value points at (/media/<id>/<file>) */
+export function mediaKeysIn(value: unknown): string[] {
+  const keys = new Set<string>();
+  walk(value, (s) => {
+    for (const m of s.matchAll(/\/media\/([\w-]+\/[\w.-]+)/g)) keys.add(m[1]);
+    return s;
+  });
+  return [...keys];
+}
+
+/**
+ * The database half of an export: the design as the Design screen shows it
+ * (draft merged over live). Same-origin absolute media URLs become
+ * site-relative so they resolve on the importing site.
+ */
+export function buildDesignExport(input: {
+  settings: Settings; navItems: Pick<NavItem, 'label' | 'url' | 'area'>[]; pages: PageRow[]; links: LinkRef[]; origin: string; includeNav: boolean;
+}): ThemeDesignFile {
+  const { settings: s, origin } = input;
+  const local = (v: string) => (origin && v.startsWith(`${origin}/media/`) ? v.slice(origin.length) : v);
+  const byId = new Map(input.pages.map((p) => [p.id, p]));
+  const layouts = Object.entries(s.sectionPages as Pages).flatMap(([id, layout]) => {
+    const p = byId.get(id);
+    return p ? [{ page: { slug: p.slug, locale: p.locale ?? '', isHome: Boolean(p.isHome), title: p.title ?? '' }, layout: walk(layout, local) as Pages[string] }] : [];
+  });
+  const used = new Set<string>();
+  collectRefs(layouts, used);
+  const urls = new Map(input.links.map((l) => [l.ref, l.url]));
+  const refs = Object.fromEntries([...used].flatMap((r) => (urls.has(r) ? [[r, urls.get(r)!]] : [])));
+  return {
+    activeTheme: s.activeTheme,
+    designOverrides: (s.designOverrides ?? {}) as Record<string, string | number>,
+    siteLogo: local(s.siteLogo ?? ''), siteLogoDark: local(s.siteLogoDark ?? ''), siteFavicon: local(s.siteFavicon ?? ''), siteCover: local(s.siteCover ?? ''),
+    layouts, refs,
+    ...(input.includeNav ? { navItems: input.navItems.map(({ label, url, area }) => ({ label, url: local(url), area })) } : {}),
+  };
+}
+
+export interface DesignImportReport {
+  theme: { slug: string; installed: boolean };
+  layouts: { matched: string[]; skipped: string[] };
+  links: { kept: number; dropped: number };
+  nav: number | null;
+}
+
+/**
+ * The stage patch for an imported design file, against this site's pages,
+ * link targets and installed themes. Layouts land on the page with the same
+ * slug (and locale, else the home page for the exported home), replacing any
+ * staged layout there; pages without a match are reported, never created.
+ * Link refs follow the item at the same URL, else fall back to their href.
+ */
+export function planDesignImport(input: {
+  file: ThemeDesignFile; pages: PageRow[]; links: LinkRef[]; installedThemes: string[];
+  stagedPages: Pages; includeNav: boolean;
+}): { patch: Record<string, unknown>; report: DesignImportReport } {
+  const { file } = input;
+  const installed = input.installedThemes.includes(file.activeTheme);
+  const refByUrl = new Map(input.links.map((l) => [l.url, l.ref]));
+  let kept = 0, dropped = 0;
+  const remap = (v: unknown): unknown => {
+    if (Array.isArray(v)) return v.map(remap);
+    if (!v || typeof v !== 'object') return v;
+    const o = Object.fromEntries(Object.entries(v as Record<string, unknown>).map(([k, x]) => [k, remap(x)]));
+    if (typeof o.ref === 'string') {
+      const url = file.refs[o.ref];
+      const to = url !== undefined ? refByUrl.get(url) : undefined;
+      if (to) { o.ref = to; kept++; } else { delete o.ref; dropped++; }
+    }
+    return o;
+  };
+  const find = (k: ThemeDesignFile['layouts'][number]['page']) =>
+    input.pages.find((p) => p.slug === k.slug && (p.locale ?? '') === k.locale)
+    ?? input.pages.find((p) => p.slug === k.slug)
+    ?? (k.isHome ? input.pages.find((p) => p.isHome && (p.locale ?? '') === k.locale) ?? input.pages.find((p) => p.isHome) : undefined);
+  const sectionPages: Pages = { ...input.stagedPages };
+  const matched: string[] = [], skipped: string[] = [];
+  for (const { page, layout } of file.layouts) {
+    const label = page.isHome ? 'Home' : `/${page.slug}`;
+    const target = find(page);
+    if (!target) { skipped.push(label); continue; }
+    sectionPages[target.id] = { ...layout, sections: layout.sections.map((s) => ({ ...s, data: remap(s.data) as typeof s.data })) };
+    matched.push(label);
+  }
+  const patch: Record<string, unknown> = {
+    designOverrides: file.designOverrides,
+    siteLogo: file.siteLogo, siteLogoDark: file.siteLogoDark, siteFavicon: file.siteFavicon, siteCover: file.siteCover,
+  };
+  if (installed) patch.activeTheme = file.activeTheme;
+  if (matched.length) patch.sectionPages = sectionPages;
+  // an empty list never wipes the receiving site's menus
+  const nav = input.includeNav && file.navItems?.length ? file.navItems : null;
+  if (nav) patch.navItems = nav.map((n) => ({ ...n, id: `tmp-${crypto.randomUUID()}` }));
+  return {
+    patch,
+    report: { theme: { slug: file.activeTheme, installed }, layouts: { matched, skipped }, links: { kept, dropped }, nav: nav ? nav.length : null },
+  };
+}
+
+export const themeFileName = (slug: string, now: number) =>
+  `${slug.replace(/[^a-z0-9-]/gi, '') || 'theme'}-${new Date(now).toISOString().slice(0, 10)}.acms-theme.zip`;

package/src/lib/theme.ts

@@ -194,6 +194,11 @@ export function listThemes(): Theme[] {
   return themes;
 }
 
+/** true for a theme from the project's src/themes/ (its code lives in the site repo) */
+export function isProjectTheme(slug: string): boolean {
+  return projectSlugs.has(slug);
+}
+
 export function getTheme(slug: string): Theme {
   return themes.find((t) => t.slug === slug) ?? themes.find((t) => t.slug === DEFAULT_THEME) ?? themes[0];
 }

package/src/lib/webhooks.ts

@@ -11,7 +11,7 @@
 // rejecting stale timestamps.
 import type { ContentRepository } from './repo/types';
 import type { Webhook, WebhookDelivery, WebhookEventType } from './schema';
-import { isPrivateHost } from './net';
+import { isPrivateHost, resolvesToPrivate } from './net';
 
 export const MAX_ATTEMPTS = 4;
 // minutes until attempt n+1 (after the first immediate try)
@@ -82,7 +82,12 @@ export async function attemptDelivery(repo: ContentRepository, d: WebhookDeliver
   const claimed = await repo.claimDelivery(d.id, now);
   if (!claimed) return false;
   d = claimed;
-  const fetcher: Fetcher = opts.fetcher ?? ((url, init) => fetch(url, init));
+  // the URL passed validateWebhookUrl when saved; re-check what its name
+  // resolves to now (dev allows local receivers, as validation does)
+  const fetcher: Fetcher = opts.fetcher ?? (async (url, init) => {
+    if (!import.meta.env?.DEV && await resolvesToPrivate(new URL(url).hostname)) throw new Error('private host');
+    return fetch(url, init);
+  });
   const ts = Math.floor(now / 1000);
   let code: number | null = null;
   try {

package/src/middleware.ts

@@ -1,6 +1,8 @@
 import { defineMiddleware } from 'astro:middleware';
+import type { APIContext, MiddlewareNext } from 'astro';
 import { I18N } from './lib/i18n';
-import { validateSession, SESSION_COOKIE } from './lib/auth';
+import { bindAuthEnvironment, getRequestAuth, shouldResolveClerk, validateRequestSession, withClerkHeaders } from './lib/auth/request';
+import { AUTH } from './lib/auth/config';
 import { getRepo } from './lib/repo';
 import { CONTENT } from './lib/content';
 import { processDueDeliveries, waitUntilFrom } from './lib/webhooks';
@@ -9,6 +11,8 @@ import { decideOverdue, sendDueReminders } from './lib/booking/service';
 import { PUSH } from './lib/push/config';
 import { processPushQueue, runPushJobs } from './lib/push/service';
 import { previewParamRedirect, hasPreviewCookie } from './lib/designPreview';
+import { applyCachePolicy } from './lib/cache/policy';
+import { bindExecutionContext, syncCachePurge } from './lib/cache/purge';
 
 // Legacy content-URL redirects, checked only on would-be 404s (below) so they
 // can never shadow real content. Tags moved from `${base}/tag/` to a
@@ -48,8 +52,16 @@ export function legacyContentRedirect(pathname: string): string | null {
 // Node target and local dev.
 let lastPublishCheck = 0;
 
-export const onRequest = defineMiddleware(async (context, next) => {
+// Every response, early redirects included, leaves through the cache policy
+// (lib/cache/policy.ts): public GET pages and the public app API get a
+// shared-cache header; everything personal or staff-only is private.
+export const onRequest = defineMiddleware(async (context, next) =>
+  applyCachePolicy(context.request, await handle(context, next), context.url.pathname));
+
+async function handle(context: APIContext, next: MiddlewareNext): Promise<Response> {
   const { pathname } = context.url;
+  bindAuthEnvironment(context.request, context.locals);
+  bindExecutionContext(context.request, context.locals);
 
   // one canonical URL per page: trailing-slash variants 301 to the bare path.
   // GET pages only — the astro:actions client POSTs to /_actions/<name>/ with
@@ -77,21 +89,31 @@ export const onRequest = defineMiddleware(async (context, next) => {
     }
   }
 
+  const auth = AUTH.provider === 'clerk' && shouldResolveClerk(context.request) ? await getRequestAuth(context.request, context.cookies, context.locals) : null;
+  if (auth?.headers.get('location') && context.request.method === 'GET' && !pathname.startsWith('/api/')) {
+    const headers = new Headers(auth.headers); headers.set('Cache-Control', 'no-store');
+    return new Response(null, { status: 307, headers });
+  }
+
+  if (pathname.startsWith('/api/') && (auth?.error === 'unavailable' || auth?.error === 'configuration')) {
+    return withClerkHeaders(Response.json({ error: 'Sign-in is temporarily unavailable. Please retry.' }, { status: 503 }), auth, context.request);
+  }
+
   // design preview links (?designPreview=1, ?designVersion=, ?preview=<token>,
   // ?preview=off) become a cookie, then the clean URL — so every link clicked
   // afterwards stays in preview mode
   const previewTo = await previewParamRedirect(context.url, context.request.method, context.cookies, async () =>
-    Boolean(await validateSession(context.cookies.get(SESSION_COOKIE)?.value, context.locals)));
-  if (previewTo) return context.redirect(previewTo, 302);
+    Boolean(await validateRequestSession(context.request, context.cookies, context.locals)));
+  if (previewTo) return withClerkHeaders(context.redirect(previewTo, 302), auth, context.request);
 
-  if (pathname.startsWith('/admin') && pathname !== '/admin/login') {
-    const token = context.cookies.get(SESSION_COOKIE)?.value;
-    if (!(await validateSession(token, context.locals))) {
+  if (pathname.startsWith('/admin') && pathname !== '/admin/login' && pathname !== '/admin/logout') {
+    if (auth?.error === 'configuration' || auth?.error === 'unavailable') return new Response('Sign-in is temporarily unavailable. Check the authentication configuration or try again later.', { status: 503, headers: { 'Cache-Control': 'no-store' } });
+    if (!(await validateRequestSession(context.request, context.cookies, context.locals))) {
       // editor-app sign-in comes back here after login (see login.astro's next)
       if (pathname === '/admin/app-auth' && context.request.method === 'GET') {
-        return context.redirect(`/admin/login?next=${encodeURIComponent(pathname + context.url.search)}`);
+        return withClerkHeaders(context.redirect(`/admin/login?next=${encodeURIComponent(pathname + context.url.search)}`), auth, context.request);
       }
-      return context.redirect('/admin/login');
+      return withClerkHeaders(context.redirect('/admin/login'), auth, context.request);
     }
   }
 
@@ -121,12 +143,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
       const push = runPushJobs(repo, { locals: context.locals, fallbackOrigin: context.url.origin, now })
         .catch((e) => console.error('acms push: scheduled jobs failed', e));
       if (wait) wait(push);
+      // a purge that failed or was throttled after an earlier write
+      // (Node: detached — the process outlives the request)
+      const purge = syncCachePurge(repo, context.locals).catch((e) => console.error('acms cache: purge failed', e));
+      if (wait) wait(purge);
     } catch {
       // never let the publish sweep break a request
     }
   }
 
-  const response = await next();
+  const response = withClerkHeaders(await next(), auth, context.request);
 
   // Database writes enqueue publication/media notifications atomically.
   // Flush after mutations (including Astro actions), once their transaction
@@ -142,6 +168,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
         .catch((e) => console.error('acms push: queue flush failed', e));
       if (wait) wait(push);
     }
+    // content changed → clear shared caches (the scheduler retries failures)
+    const purge = getRepo(context.locals).then(repo => syncCachePurge(repo, context.locals))
+      .catch((e) => console.error('acms cache: purge failed', e));
+    if (wait) wait(purge);
   }
 
   // a preview render must never be cached where a visitor could get it
@@ -169,7 +199,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
   }
 
   return response;
-});
+}
 
 let redirectCache: { at: number; map: Map<string, { toPath: string; code: 301 | 302 }> } | null = null;
 

package/src/pages/[...slug].astro

@@ -3,7 +3,7 @@ import ThemeSections from '../components/ThemeSections.astro';
 import Site from '../layouts/Site.astro';
 import WidgetRenderer from '../components/WidgetRenderer.astro';
 import { getRepo } from '../lib/repo';
-import { validateSession, SESSION_COOKIE } from '../lib/auth';
+import { validateRequestSession } from '../lib/auth/request';
 import { expandDynamicBlocks } from '../lib/dynamicBlocks';
 import { highlightCodeHtml } from '../lib/highlightCode';
 import { resolveDesign } from '../lib/theme';
@@ -18,7 +18,7 @@ const rawPage = slug ? await repo.getPageBySlug(slug) : null;
 const page = rawPage ? localizeDoc(rawPage, locale) : null;
 
 // Drafts are visible only to a logged-in admin (doubles as draft preview).
-const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const isAdmin = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 if (!page || (page.status !== 'published' && !isAdmin)) {
   return new Response(null, { status: 404, statusText: 'Not found' });
 }
@@ -37,6 +37,7 @@ const PageTemplate = (page.template && settings.sectionPages?.[page.id]?.mode !=
 ---
 
 <Site
+  staffPreview={!!isAdmin && page.status !== 'published'}
   title={page.seoTitle || page.title}
   exactTitle={Boolean(page.seoTitle)}
   description={page.seoDesc || undefined}

package/src/pages/account/[action].astro

@@ -5,10 +5,16 @@ import { sha256 } from '../../lib/email/config';
 import { dispatchEmail, kickEmail } from '../../lib/email/service';
 import { waitUntilFrom } from '../../lib/webhooks';
 import { SESSION_COOKIE } from '../../lib/auth';
+import { AUTH } from '../../lib/auth/config';
 import '../../styles/admin.css';
 const action=Astro.params.action||'';
 if(!['invite','reset','forgot'].includes(action))return new Response('Not found',{status:404});
 Astro.response.headers.set('Cache-Control','no-store');
+// Clerk handles invitations and recovery; local links are never redeemed.
+if(AUTH.provider==='clerk'){
+  if(Astro.request.method!=='GET'&&Astro.request.method!=='HEAD')return new Response('Account access is managed by the sign-in provider.',{status:403,headers:{'Cache-Control':'no-store'}});
+  return new Response(null,{status:303,headers:{Location:'/admin/login','Cache-Control':'no-store','Referrer-Policy':'no-referrer'}});
+}
 Astro.response.headers.set('Referrer-Policy','no-referrer');
 Astro.response.headers.set('X-Robots-Tag','noindex');
 const repo=await getRepo(Astro.locals);