@acms-subir/core 0.3.10 → 0.3.12

package/src/pages/api/design/export.ts

@@ -0,0 +1,72 @@
+import type { APIRoute } from 'astro';
+import { userConfig } from 'virtual:acms-config';
+import { getRepo } from '../../../lib/repo';
+import { getMediaStore } from '../../../lib/media/store';
+import { apiError, ApiError } from '../../../lib/api';
+import { designIdentity } from '../../../lib/design-service';
+import { draftNavItems, mergeDesignDraft } from '../../../lib/drafts';
+import { sectionTargets } from '../../../lib/section-targets';
+import { getTheme, isProjectTheme } from '../../../lib/theme';
+import { buildDesignExport, mediaKeysIn, themeFileName, THEME_TRANSFER_FORMAT, type ThemeTransferManifest } from '../../../lib/theme-transfer';
+import { zipStream, type ZipEntry } from '../../../lib/backup/zip';
+import type { Media } from '../../../lib/schema';
+
+// Theme export (acms-theme v1): the design as the Design screen shows it
+// (draft over live) plus the images it uses, as one ZIP for Design → Import
+// theme on another site or machine. ?media=0 skips images, ?nav=1 adds menus.
+export const GET: APIRoute = async ({ request, cookies, locals }) => {
+  try {
+    const repo = await getRepo(locals);
+    const url = new URL(request.url);
+    const includeMedia = url.searchParams.get('media') !== '0', includeNav = url.searchParams.get('nav') === '1';
+    const who = await designIdentity(request, cookies, repo, 'design:read');
+    if ('role' in who && who.role === 'editor') throw new ApiError(403, 'Only an owner can export the theme.');
+    if (includeMedia && !who.scopes.includes('media:read')) throw new ApiError(403, 'Required scope: media:read (or export with media=0).');
+    const live = await repo.getSettings();
+    const settings = mergeDesignDraft(live);
+    const [pages, liveNav, targets] = await Promise.all([repo.listPages(), repo.listNavItems(), sectionTargets(repo, locals)]);
+    const design = buildDesignExport({
+      settings, navItems: draftNavItems(live.draftDesign) ?? liveNav, pages, links: targets.links, origin: url.origin, includeNav,
+    });
+    const now = Date.now();
+    const theme = getTheme(settings.activeTheme);
+    const media = includeMedia
+      ? (await Promise.all([...new Set(mediaKeysIn(design).map((k) => k.split('/')[0]))].map((id) => repo.getMedia(id)))).filter((m) => m !== null)
+      : [];
+    const manifest: ThemeTransferManifest = {
+      format: THEME_TRANSFER_FORMAT, version: 1, exportedAt: now,
+      coreVersion: String((userConfig as { coreVersion?: string }).coreVersion ?? ''),
+      source: { title: live.siteTitle, siteUrl: url.origin },
+      theme: { slug: theme.slug, name: theme.name, version: theme.version, project: isProjectTheme(theme.slug) },
+      includes: ['design', ...(media.length ? ['media' as const] : []), ...(includeNav ? ['nav' as const] : [])],
+    };
+    const store = getMediaStore(locals);
+    async function* entries(): AsyncGenerator<ZipEntry> {
+      const enc = new TextEncoder();
+      yield { name: 'manifest.json', data: enc.encode(JSON.stringify(manifest, null, 1)) };
+      yield { name: 'design.json', data: enc.encode(JSON.stringify(design, null, 1)) };
+      // a missing variant is skipped; the row still imports with what's left
+      const rows: Media[] = [];
+      for (const m of media) {
+        const variants: Media['variants'] = [];
+        let original = false;
+        for (const key of [m.key, ...m.variants.map((v) => v.key)]) {
+          const obj = await store.get(key);
+          if (!obj) continue;
+          if (key === m.key) original = true; else variants.push(m.variants.find((v) => v.key === key)!);
+          yield { name: `media/${key}`, data: new Uint8Array(await new Response(obj.body).arrayBuffer()) };
+        }
+        if (original) rows.push({ ...m, variants });
+      }
+      yield { name: 'media.json', data: enc.encode(JSON.stringify(rows, null, 1)) };
+    }
+    return new Response(zipStream(entries(), now), {
+      headers: {
+        'Content-Type': 'application/zip',
+        'Cache-Control': 'no-store',
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Disposition': `attachment; filename="${themeFileName(theme.slug, now)}"`,
+      },
+    });
+  } catch (e) { return apiError(e); }
+};

package/src/pages/api/design/import.ts

@@ -0,0 +1,41 @@
+import type { APIRoute } from 'astro';
+import { z } from 'zod';
+import { getRepo } from '../../../lib/repo';
+import { apiError, ApiError, json, readJson } from '../../../lib/api';
+import { DesignPatch, designIdentity, runDesignOperation } from '../../../lib/design-service';
+import { diffDesign } from '../../../lib/designDiff';
+import { sectionTargets } from '../../../lib/section-targets';
+import { getTheme, listThemes } from '../../../lib/theme';
+import { planDesignImport, ThemeDesignFile } from '../../../lib/theme-transfer';
+
+// Theme import: the design.json of an acms-theme ZIP becomes a staged draft
+// (never live). dryRun returns what would change; the browser uploads the
+// ZIP's images through /api/import/media before the real run.
+const Body = z.object({
+  revision: z.number().int().nonnegative(),
+  design: ThemeDesignFile,
+  nav: z.boolean().default(false),
+  dryRun: z.boolean().default(false),
+}).strict();
+
+export const POST: APIRoute = async ({ request, cookies, locals }) => {
+  try {
+    const repo = await getRepo(locals);
+    const input = Body.parse(await readJson(request, 2_000_000));
+    const who = await designIdentity(request, cookies, repo, 'design:write-draft');
+    if ('role' in who && who.role === 'editor') throw new ApiError(403, 'Only an owner can import a theme.');
+    const current = await repo.getSettings();
+    if (current.designRevision !== input.revision) throw new ApiError(409, 'Design changed. Reload and try again.');
+    const [pages, targets, liveNav] = await Promise.all([repo.listPages(), sectionTargets(repo, locals), repo.listNavItems()]);
+    const { patch, report } = planDesignImport({
+      file: input.design, pages, links: targets.links, installedThemes: listThemes().map((t) => t.slug),
+      stagedPages: (current.draftDesign?.sectionPages ?? current.sectionPages) as typeof current.sectionPages, includeNav: input.nav,
+    });
+    const parsed = DesignPatch.parse(patch);
+    const draft = { ...current.draftDesign, ...parsed };
+    const changes = diffDesign(current, liveNav, draft, (slug) => getTheme(slug).name);
+    if (input.dryRun) return json({ report, changes });
+    const result = await runDesignOperation(repo, who, { operation: 'stage', revision: input.revision, patch: parsed }, new URL(request.url).origin);
+    return json({ report, changes, revision: result.revision });
+  } catch (e) { return apiError(e); }
+};

package/src/pages/api/email/settings.ts

@@ -2,8 +2,10 @@ import type { APIRoute } from 'astro';
 import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
 import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
-import { validateSession, SESSION_COOKIE } from '../../../lib/auth';
+import { validateRequestSession } from '../../../lib/auth/request';
 import { reauthenticate } from '../../../lib/email/accounts';
+import { AUTH } from '../../../lib/auth/config';
+import { getRequestAuth } from '../../../lib/auth/request';
 import { decrypt, encrypt, encryptionAvailable, resolveConfig, runtimeValue } from '../../../lib/email/config';
 import { dispatchEmail } from '../../../lib/email/service';
 import { emailReadiness } from '../../../lib/email/readiness';
@@ -12,13 +14,13 @@ import type { Credentials, PublicEmailSettings } from '../../../lib/email/types'
 const Config = z.object({provider:z.enum(['auto','none','resend','mailgun','ses','cloudflare']),source:z.enum(['env','encrypted']),from:z.string().trim().max(320),replyTo:z.string().trim().max(320),domain:z.string().trim().max(253),region:z.string().trim().max(40),configurationSet:z.string().trim().max(200),snsTopicArn:z.string().trim().max(300),enabled:z.boolean(),reminders:z.boolean(),staffNotifications:z.boolean()}).strict();
 const Secrets = z.object({apiKey:z.string().max(4096).optional(),webhookSecret:z.string().max(4096).optional(),accessKeyId:z.string().max(256).optional(),secretAccessKey:z.string().max(4096).optional(),sessionToken:z.string().max(8192).optional()}).strict();
 const Input = z.discriminatedUnion('action',[
-  z.object({action:z.literal('save'),config:Config,credentials:Secrets.default({}),reauthPassword:z.string().max(1024)}).strict(),
+  z.object({action:z.literal('save'),config:Config,credentials:Secrets.default({}),reauthPassword:z.string().max(1024).default('')}).strict(),
   z.object({action:z.literal('test'),to:z.string().trim().email().max(254)}).strict(),
   z.object({action:z.literal('retry'),id:z.string().max(100)}).strict(),
 ]);
 export async function publicSettings(repo:ContentRepository,locals?:unknown):Promise<PublicEmailSettings> {
   const record=await repo.email.config(),c=resolveConfig(record,locals);
-  return {version:c.version,config:c.config,provider:c.provider,...emailReadiness(c,(await repo.getSettings()).siteUrl,locals),environmentLocked:!!runtimeValue('EMAIL_PROVIDER',locals),credentialFields:Object.entries(c.credentials).filter(([,v])=>!!v).map(([k])=>k),activity:(await repo.email.list()).map(({payload,lease,fingerprint,rendered,...safe})=>safe),heartbeat:await repo.email.heartbeat()};
+  return {authProvider:AUTH.provider,version:c.version,config:c.config,provider:c.provider,...emailReadiness(c,(await repo.getSettings()).siteUrl,locals),environmentLocked:!!runtimeValue('EMAIL_PROVIDER',locals),credentialFields:Object.entries(c.credentials).filter(([,v])=>!!v).map(([k])=>k),activity:(await repo.email.list()).map(({payload,lease,fingerprint,rendered,...safe})=>safe),heartbeat:await repo.email.heartbeat()};
 }
 export const GET:APIRoute=async({request,cookies,locals})=>{
   try{const repo=await getRepo(locals);await requireSession(request,cookies,repo,true);return json(await publicSettings(repo,locals));}catch(e){return apiError(e);}
@@ -26,11 +28,13 @@ export const GET:APIRoute=async({request,cookies,locals})=>{
 export const POST:APIRoute=async({request,cookies,locals})=>{
   try{
     const repo=await getRepo(locals);await requireSession(request,cookies,repo,true);
-    const userId=(await validateSession(cookies.get(SESSION_COOKIE)?.value,repo))!;
+    const userId=(await validateRequestSession(request, cookies, repo))!;
     const input=Input.parse(await readJson(request,20000));
     if(input.action==='save'){
       if(!await repo.email.rateLimit(`reauth:${userId}`,10,10*60000))throw new ApiError(429,'Too many attempts. Try again later.');
-      if(!await reauthenticate(repo,userId,input.reauthPassword))throw new ApiError(403,'Your current password is required to change email settings.');
+      if (AUTH.provider === 'clerk') {
+        if (!(await getRequestAuth(request,cookies,locals)).reverified) throw new ApiError(403,'Sign out and sign in again with Clerk before changing email settings. Recent verification is required.');
+      } else if(!await reauthenticate(repo,userId,input.reauthPassword))throw new ApiError(403,'Your current password is required to change email settings.');
       const current=await repo.email.config();
       if(runtimeValue('EMAIL_PROVIDER',locals)&&(input.config.provider!==runtimeValue('EMAIL_PROVIDER',locals)||input.config.source!=='env'))throw new ApiError(400,'Provider is managed by EMAIL_PROVIDER in the deployment environment.');
       let encrypted='';

package/src/pages/api/live/oauth/youtube/callback.ts

@@ -1,14 +1,15 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../../../lib/repo';
 import { ApiError } from '../../../../../lib/api';
-import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../../../../lib/auth';
+import { OWNER_ENV } from '../../../../../lib/auth';
+import { requestSessionBinding, validateRequestSession } from '../../../../../lib/auth/request';
 import { finishOAuth } from '../../../../../lib/live/service';
-export const GET:APIRoute=async({cookies,locals,url})=>{
+export const GET:APIRoute=async({request,cookies,locals,url})=>{
   const headers={'Cache-Control':'no-store','Referrer-Policy':'no-referrer'};
   try{
-    const repo=await getRepo(locals),session=cookies.get(SESSION_COOKIE)?.value;
+    const repo=await getRepo(locals),session=await requestSessionBinding(request,cookies,locals);
     // OAuth is intentionally a cross-site GET. Session-bound, one-use state provides CSRF protection.
-    const user=await validateSession(session,repo);
+    const user=await validateRequestSession(request,cookies,repo);
     if(!session||!user||user!==OWNER_ENV&&(await repo.getUser(user))?.role!=='owner')throw new ApiError(403,'Sign in as the site owner and start authorization again.');
     await finishOAuth(repo,session,url,locals);
     return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=connected'}});

package/src/pages/api/live/settings.ts

@@ -2,7 +2,7 @@ import type { APIRoute } from 'astro';
 import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
 import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
-import { SESSION_COOKIE } from '../../../lib/auth';
+import { requestSessionBinding } from '../../../lib/auth/request';
 import { Provider } from '../../../lib/live/types';
 import { adminState, beginOAuth, disconnect, saveConnection, syncConnection, validateConfig } from '../../../lib/live/service';
 const Input=z.discriminatedUnion('action',[
@@ -26,7 +26,7 @@ export const POST:APIRoute=async({request,cookies,locals,url})=>{
     switch(input.action){
       case 'saveConnection':await saveConnection(repo,input,locals);break;
       case 'test':await syncConnection(repo,input.provider,locals,true);break;
-      case 'authorize':return json({authorizationUrl:await beginOAuth(repo,cookies.get(SESSION_COOKIE)!.value,url,locals)});
+      case 'authorize':return json({authorizationUrl:await beginOAuth(repo,await requestSessionBinding(request,cookies,locals),url,locals)});
       case 'disconnect':await disconnect(repo,input.provider,locals);break;
       case 'saveConfig':await repo.updateSettings({live:validateConfig(input.config)});break;
       case 'selectChannel':{

package/src/pages/api/media/upload.ts

@@ -1,5 +1,5 @@
 import type { APIRoute } from 'astro';
-import { validateSession, SESSION_COOKIE } from '../../../lib/auth';
+import { validateRequestSession } from '../../../lib/auth/request';
 import { getRepo } from '../../../lib/repo';
 import { ApiError } from '../../../lib/api';
 import { storeUpload } from '../../../lib/media/upload';
@@ -7,7 +7,7 @@ import { storeUpload } from '../../../lib/media/upload';
 // Multipart upload from the admin; the rules live in lib/media/upload.ts
 // (shared with editor apps).
 export const POST: APIRoute = async ({ request, cookies, locals }) => {
-  if (!(await validateSession(cookies.get(SESSION_COOKIE)?.value, locals))) {
+  if (!(await validateRequestSession(request, cookies, locals))) {
     return Response.json({ error: 'Unauthorized' }, { status: 401 });
   }
   const form = await request.formData();

package/src/pages/api/push/admin.ts

@@ -1,7 +1,8 @@
 import type { APIRoute } from 'astro';
 import { getRepo } from '../../../lib/repo';
 import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
-import { OWNER_ENV, SESSION_COOKIE, validateSession } from '../../../lib/auth';
+import { OWNER_ENV } from '../../../lib/auth';
+import { validateRequestSession } from '../../../lib/auth/request';
 import { AdminPushInput, adminPushAction, adminPushState } from '../../../lib/push/api';
 
 // Admin → Mobile app (owner only; registered only when push is enabled).
@@ -19,7 +20,7 @@ export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
     // sending reaches every installed app: only from this site's admin
     if (request.headers.get('origin') !== url.origin) throw new ApiError(403, 'Send from this site’s admin.');
     const input = AdminPushInput.parse(await readJson(request, 20_000));
-    const id = await validateSession(cookies.get(SESSION_COOKIE)?.value, repo);
+    const id = await validateRequestSession(request, cookies, repo);
     const author = id === OWNER_ENV ? 'Owner' : (await repo.getUser(id ?? ''))?.name ?? '';
     const result = await adminPushAction(repo, input, { url, locals, author });
     return json({ ...result, state: input.action === 'count' ? undefined : await adminPushState(repo, url, locals) });

package/src/pages/api/restore.ts

@@ -1,12 +1,13 @@
 import type { APIRoute } from 'astro';
-import { validateSession, OWNER_ENV, SESSION_COOKIE } from '../../lib/auth';
+import { OWNER_ENV } from '../../lib/auth';
+import { getRequestAuth, validateRequestSession } from '../../lib/auth/request';
 import { getRepo } from '../../lib/repo';
 import { getMediaStore } from '../../lib/media/store';
 import { unzip } from '../../lib/backup/unzip';
 import { BackupContent } from '../../lib/backup/content';
 
 export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
-  const sessionUserId = (await validateSession(cookies.get(SESSION_COOKIE)?.value, locals));
+  const sessionUserId = (await validateRequestSession(request, cookies, locals));
   if (!sessionUserId) return Response.json({ error: 'Unauthorized' }, { status: 401 });
   const repo = await getRepo(locals);
   const sessionUser = sessionUserId !== OWNER_ENV ? await repo.getUser(sessionUserId) : null;
@@ -45,6 +46,8 @@ export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
     return Response.json({ error: 'content.json failed validation — is this from a newer acms?' }, { status: 400 });
   }
   const content = parsed.data;
+  const auth = await getRequestAuth(request, cookies, locals);
+  if (auth.clerk && (!auth.reverified || !content.users.some(u => u.id === sessionUserId && u.role === 'owner' && u.email === sessionUser?.email))) return Response.json({error:'A Clerk restore requires recent verification and a backup containing your current owner account. Sign in again and choose a matching backup.'}, {status:409});
   delete content.settings.ai;
   delete content.settings.agent;
 
@@ -86,7 +89,7 @@ export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
       await store.put(key, buf, m.mime);
     }
   }
-  await repo.restoreAll(content);
+  await repo.restoreAll(content, auth.clerk ? { issuer: auth.clerk.issuer, subject: auth.clerk.subject, userId: sessionUserId } : undefined);
 
   return Response.json({ ok: true, restored: { posts: content.posts.length, pages: content.pages.length, media: content.media.length, events: content.events.length, bookings: content.bookings.length, bookingRequests: content.bookingRequests?.length ?? 0 } }, { headers: { 'Cache-Control': 'no-store' } });
 };

package/src/pages/api/v1/calendars.ts

@@ -2,6 +2,6 @@ import { listCalendars } from '../../../lib/mobile/calendar';
 import { readRoute } from '../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../lib/mobile/http';
-export const GET = readRoute(listCalendars, true);
+export const GET = readRoute(listCalendars, true, false, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/links.ts

@@ -2,6 +2,6 @@ import { getLinks } from '../../../lib/mobile/links';
 import { readRoute } from '../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../lib/mobile/http';
-export const GET = readRoute(getLinks, true);
+export const GET = readRoute(getLinks, true, false, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/openapi.json.ts

@@ -2,6 +2,6 @@ import { getOpenApi } from '../../../lib/mobile/openapi';
 import { readRoute } from '../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../lib/mobile/http';
-export const GET = readRoute(getOpenApi, true, true);
+export const GET = readRoute(getOpenApi, true, true, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/push/topics.ts

@@ -2,6 +2,6 @@ import { listPushTopics } from '../../../../lib/push/api';
 import { readRoute } from '../../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../../lib/mobile/http';
-export const GET = readRoute(listPushTopics, true);
+export const GET = readRoute(listPushTopics, true, false, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/resources.ts

@@ -2,6 +2,6 @@ import { listResources } from '../../../lib/mobile/calendar';
 import { readRoute } from '../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../lib/mobile/http';
-export const GET = readRoute(listResources, true);
+export const GET = readRoute(listResources, true, false, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/theme.ts

@@ -2,6 +2,6 @@ import { getThemeTokens } from '../../../lib/mobile/site';
 import { readRoute } from '../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../lib/mobile/http';
-export const GET = readRoute(getThemeTokens);
+export const GET = readRoute(getThemeTokens, true, false, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/blog/[slug].astro

@@ -8,7 +8,7 @@ import { expandDynamicBlocks, extractToc } from '../../lib/dynamicBlocks';
 import TagLabel from '../../components/site/TagLabel.astro';
 import PostCard from '../../components/site/PostCard.astro';
 import { highlightCodeHtml } from '../../lib/highlightCode';
-import { validateSession, SESSION_COOKIE } from '../../lib/auth';
+import { validateRequestSession } from '../../lib/auth/request';
 import { slugify, authorSlug, publicTags } from '../../lib/schema';
 import { resolveDesign } from '../../lib/theme';
 import { effectiveSettings } from '../../lib/designPreview';
@@ -27,7 +27,7 @@ const locale = requestLocale(Astro.url, Astro.locals);
 const rawPost = slug ? await repo.getPostBySlug(slug, col.key) : null;
 const post = rawPost ? localizeDoc(rawPost, locale) : null;
 
-const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const isAdmin = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 if (!post || (post.status !== 'published' && !isAdmin)) {
   return new Response(null, { status: 404, statusText: 'Not found' });
 }
@@ -111,6 +111,7 @@ const shareLi = `https://www.linkedin.com/sharing/share-offsite/?url=${encodeURI
 ---
 
 <Site
+  staffPreview={!!isAdmin && post.status !== 'published'}
   title={post.seoTitle || post.title}
   exactTitle={Boolean(post.seoTitle)}
   description={post.seoDesc || post.excerpt || undefined}

package/src/pages/events/[slug].astro

@@ -12,7 +12,7 @@ import EventPage from '../../components/EventPage.astro';
 import { getRepo } from '../../lib/repo';
 import { expandDynamicBlocks } from '../../lib/dynamicBlocks';
 import { highlightCodeHtml } from '../../lib/highlightCode';
-import { validateSession, SESSION_COOKIE } from '../../lib/auth';
+import { validateRequestSession } from '../../lib/auth/request';
 import { effectiveSettings } from '../../lib/designPreview';
 import { resolveDesign } from '../../lib/theme';
 import { siteOrigin } from '../../lib/seo';
@@ -34,7 +34,7 @@ const rawEvent = await repo.getEventBySlug(Astro.params.slug ?? '');
 const event = rawEvent ? localizeDoc(rawEvent, locale) : null;
 const [rawSettings, allCalendars] = await Promise.all([repo.getSettings(), repo.listCalendars()]);
 const calMap = new Map(allCalendars.map((c) => [c.id, c]));
-const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const isAdmin = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 if (!event || (!eventIsPublic(event, calMap) && !isAdmin)) return new Response(null, { status: 404, statusText: 'Not found' });
 
 const baseSettings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
@@ -81,6 +81,7 @@ const props = { event, occurrence, settings, calendars, html, upcoming, origin,
 ---
 
 <Site
+  staffPreview={!!isAdmin && !eventIsPublic(event, calMap)}
   title={event.seoTitle || event.title}
   exactTitle={Boolean(event.seoTitle)}
   description={event.seoDesc || event.excerpt || undefined}

package/src/pages/preview/[type]/[id].astro

@@ -6,7 +6,7 @@ import { renderMarkdown } from '../../../lib/markdown';
 import { verifyPreviewToken } from '../../../lib/preview';
 import { expandDynamicBlocks } from '../../../lib/dynamicBlocks';
 import { highlightCodeHtml } from '../../../lib/highlightCode';
-import { validateSession, SESSION_COOKIE } from '../../../lib/auth';
+import { validateRequestSession } from '../../../lib/auth/request';
 import { mergeEventDraft, mergePageDraft, mergePostDraft } from '../../../lib/drafts';
 import EventPage from '../../../components/EventPage.astro';
 import { featuredOccurrence } from '../../../lib/calendar/events';
@@ -19,7 +19,7 @@ import { siteOrigin } from '../../../lib/seo';
 const { type, id } = Astro.params;
 if (type !== 'post' && type !== 'page' && type !== 'event') return new Response(null, { status: 404 });
 
-const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const isAdmin = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 const token = Astro.url.searchParams.get('token') ?? undefined;
 if (!isAdmin && !verifyPreviewToken(type, id!, token)) {
   return new Response(null, { status: 404 });
@@ -53,7 +53,7 @@ const fmt = (ts: number | null) =>
   ts ? new Date(ts).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' }) : '';
 ---
 
-<Site title={post?.title ?? event?.title ?? page?.seoTitle ?? page?.title}>
+<Site title={post?.title ?? event?.title ?? page?.seoTitle ?? page?.title} staffPreview={!!isAdmin}>
   {event && eventView?.occurrence && (
     <EventPage event={event} occurrence={eventView.occurrence} settings={eventView.settings} calendars={eventView.calendars} html={eventView.html} upcoming={[]} origin={eventView.origin} preview />
   )}

package/src/styles/admin.css

@@ -757,6 +757,25 @@ dialog.modal[open] { animation: modal-in 0.16s ease-out; }
 .btn.block { width: 100%; justify-content: center; min-height: 38px; }
 .login-note { margin-top: 14px; }
 .login-for-app { text-align: center; margin: -8px 0 14px; color: var(--muted); }
+.login-card.is-clerk { max-width: 420px; }
+.login-mount { min-height: 180px; }
+.login-mount[hidden] { display: none; }
+.login-loading { display: flex; align-items: center; justify-content: center; gap: 10px; min-height: 180px; margin: 0; color: var(--muted); font-size: 13px; }
+.login-spinner { width: 16px; height: 16px; border-radius: 50%; border: 2px solid var(--line-strong); border-top-color: var(--accent); animation: login-spin 0.8s linear infinite; }
+@keyframes login-spin { to { transform: rotate(360deg); } }
+@media (prefers-reduced-motion: reduce) { .login-spinner { animation-duration: 2.4s; } }
+.login-clerk [data-clerk-error] { display: flex; align-items: center; justify-content: space-between; gap: 10px; flex-wrap: wrap; }
+.login-clerk [data-clerk-error][hidden] { display: none; }
+.login-state { text-align: center; }
+.login-state h1 { font-size: 19px; letter-spacing: -0.02em; margin: 10px 0 6px; }
+.login-state p { color: var(--text-2); margin: 0 0 10px; overflow-wrap: anywhere; }
+.login-state .hint { margin-bottom: 18px; line-height: 1.5; }
+.login-state-icon { display: inline-grid; place-items: center; width: 40px; height: 40px; border-radius: var(--r-md); background: var(--sel); color: var(--text-2); }
+.login-state-icon svg { width: 20px; height: 20px; }
+.login-state-icon.is-warn { background: var(--amber-soft); color: var(--amber); }
+.login-state-icon.is-error { background: var(--red-soft); color: var(--red); }
+.login-actions { display: grid; gap: 8px; }
+[data-clerk-profile][hidden] { display: none; }
 
 /* editor-app sign-in (consent) — same paper card as login, a little wider */
 .consent-wrap { align-items: start; padding-top: max(8vh, 20px); }
@@ -1238,19 +1257,72 @@ input.mono { font-family: ui-monospace, 'SF Mono', monospace; font-size: 12.5px;
 .grow-text { flex: 1; min-width: 220px; }
 .grow-text .hint { margin-left: 6px; }
 .hint.tight { margin: 2px 0 0; }
-.user-form { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
-.user-form-row { display: flex; gap: 8px; flex-wrap: wrap; width: 100%; align-items: center; }
-.user-form .w-name { width: 150px; }
-.user-form .w-role { width: 100px; }
-.user-form .w-pass { width: 180px; }
-.user-form .w-slug { width: 140px; }
-.user-form .w-grow { flex: 1; min-width: 220px; }
-.user-form .w-full { width: 100%; }
-.user-email { min-width: 180px; }
 .td-actions { text-align: right; width: 80px; }
-@media (max-width: 767px) {
-  .user-form .w-name, .user-form .w-role, .user-form .w-pass, .user-form .w-slug, .user-form .w-grow { width: 100%; min-width: 0; flex: 1 1 100%; }
-}
+/* Users: sign-in strip, tabs, member table, profile drawer */
+.auth-strip { display: flex; align-items: center; gap: 12px; padding: 12px 16px; margin-bottom: 18px; }
+.auth-mark { flex: none; display: grid; place-items: center; width: 32px; height: 32px; border-radius: var(--r-md); background: var(--sel); color: var(--text-2); }
+.auth-mark svg { width: 17px; height: 17px; }
+.auth-main { flex: 1; min-width: 0; }
+.auth-main h2 { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; font-size: 13.5px; margin: 0 0 2px; }
+.auth-main .hint { margin: 0; line-height: 1.5; }
+.auth-where { flex: none; margin: 0; font-size: 12px; }
+.users-tabs { margin-bottom: 12px; }
+.users-tabs .count { font-size: 11px; font-weight: 600; color: var(--muted); background: var(--panel-2); border-radius: var(--r-full); padding: 0 6px; min-width: 18px; text-align: center; }
+.users-tabs [aria-selected='true'] .count { color: var(--text-2); background: var(--sel); }
+.users-panel[hidden] { display: none; }
+.users-panel.devices-card { margin-top: 0; }
+.users-panel-hint { margin: 0; padding: 14px 18px 4px; }
+.users-table tr[data-user-row] { cursor: pointer; }
+.users-table td { padding-top: 10px; padding-bottom: 10px; }
+.user-cell { display: flex; align-items: center; gap: 11px; min-width: 0; }
+.avatar.user-av { width: 32px; height: 32px; font-size: 11px; }
+.user-who { display: flex; flex-direction: column; min-width: 0; line-height: 1.35; }
+.user-who .t-title, .user-who .t-sub { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.user-you { margin-left: 7px; font-size: 10.5px; font-weight: 600; letter-spacing: 0.04em; text-transform: uppercase; color: var(--faint); }
+dialog.modal.drawer {
+  margin: 0 0 0 auto; width: min(440px, 100vw); height: 100dvh; max-height: 100dvh; max-width: 100vw;
+  border-radius: var(--r-lg) 0 0 var(--r-lg); border-left: 1px solid var(--line-strong);
+  flex-direction: column; overflow: hidden;
+}
+dialog.modal.drawer[open] { display: flex; animation: drawer-in 0.2s ease-out; }
+@keyframes drawer-in { from { opacity: 0.4; transform: translateX(28px); } }
+.drawer-head { display: flex; align-items: center; gap: 12px; padding: 18px 20px 16px; border-bottom: 1px solid var(--line); }
+.avatar.drawer-av { width: 46px; height: 46px; font-size: 15px; }
+.drawer-title { flex: 1; min-width: 0; }
+.drawer-title h2 { font-size: 16px; margin: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.drawer-title a { font-size: 12px; color: var(--muted); text-decoration: none; }
+.drawer-title a:hover { color: var(--accent-deep); }
+.drawer-body { flex: 1; overflow-y: auto; padding: 4px 20px 8px; }
+.drawer-body > .flash { margin: 14px 0 0; }
+.drawer-sec { padding: 16px 0 6px; border-bottom: 1px solid var(--line); }
+.drawer-sec:last-child { border-bottom: 0; }
+.drawer-sec h3 { margin: 0 0 10px; font-size: 11px; font-weight: 600; letter-spacing: 0.07em; text-transform: uppercase; color: var(--faint); }
+.drawer-kv { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-bottom: 12px; font-size: 13px; }
+.drawer-kv .k { color: var(--muted); flex: none; }
+.drawer-kv .v { display: flex; align-items: center; gap: 8px; min-width: 0; }
+.drawer-email { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.drawer-link { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 12px; }
+.drawer-link input { flex: 1; min-width: 0; font-family: ui-monospace, 'SF Mono', Menlo, Consolas, monospace; font-size: 12px; }
+.drawer-link .hint { flex-basis: 100%; margin: 0; }
+label.field > .slug-wrap { display: flex; margin: 0; font-size: inherit; font-weight: inherit; color: var(--text); }
+.drawer-sec .slug-wrap input { flex: 1; min-width: 0; }
+.drawer-foot { display: flex; align-items: center; gap: 8px; padding: 12px 20px; border-top: 1px solid var(--line); background: var(--panel-2); }
+.drawer-foot .spacer { flex: 1; }
+input.is-readonly { background: transparent; border-style: dashed; color: var(--text-2); }
+.callout { margin: 0 0 12px; padding: 10px 12px; border-radius: var(--r-md); background: var(--blue-soft); color: var(--blue); font-size: 12.5px; line-height: 1.5; }
+.callout.warn { background: var(--amber-soft); color: var(--amber); }
+@media (max-width: 640px) {
+  dialog.modal.drawer { width: 100vw; border-radius: 0; border-left: 0; }
+  .auth-strip { flex-wrap: wrap; }
+  .auth-where { flex-basis: 100%; margin-left: 44px; }
+  .users-table th:nth-child(3), .users-table td:nth-child(3) { display: none; }
+}
+/* Users: flash messages + Clerk re-verification */
+.users-flash { display: flex; align-items: center; justify-content: space-between; gap: 10px; flex-wrap: wrap; }
+.users-flash-actions { display: inline-flex; gap: 6px; flex-wrap: wrap; }
+.reverify-text { margin: 0 0 8px; font-size: 14px; line-height: 1.5; }
+.reverify-dialog .hint { margin: 0; }
+[data-acms-reverify][hidden] { display: none; }
 .sheet:focus, .sheet:focus-visible { outline: none; }
 
 /* ---- calendar module (events list, calendars) --------------------------- */
@@ -1511,10 +1583,6 @@ a.bk-row:hover, .bk-row.is-sel { background: var(--hover); }
   .dm-status-actions { margin-left: 0; width: 100%; }
 }
 
-/* role: marker + text (no badges) */
-.role-mark { display: inline-flex; align-items: center; gap: 6px; font-size: 12.5px; font-weight: 600; color: var(--text-2); }
-.role-mark i { width: 7px; height: 7px; border-radius: 2px; background: var(--blue); }
-.role-mark i.is-owner { background: var(--accent); }
 
 /* Users → Signed-in apps */
 .devices-card { margin-top: 20px; }
@@ -1656,3 +1724,22 @@ a.bk-row:hover, .bk-row.is-sel { background: var(--hover); }
   .mon-tile { padding: 10px 12px; }
   .mon-sub { font-size: 12px; }
 }
+
+/* Design → Export / Import theme (ThemeTransfer) */
+.tt-muted { color: var(--muted); }
+.tt-small { font-size: 12px; margin: 10px 0 0; }
+.check-row .tt-muted { font-size: 12px; margin-left: 2px; }
+.tt-note { font-size: 12.5px; color: var(--text-2); background: var(--panel-2); border-radius: var(--r-md); padding: 9px 11px; margin: 10px 0 0; }
+.tt-note.warn { background: var(--amber-soft); color: var(--amber); }
+.tt-drop { display: flex; align-items: center; justify-content: center; border: 1.5px dashed var(--line-strong); border-radius: var(--r-md); padding: 26px 12px; cursor: pointer; color: var(--text-2); }
+.tt-drop:hover { border-color: var(--accent); color: var(--text); }
+.tt-drop input { position: absolute; width: 1px; height: 1px; opacity: 0; }
+.tt-drop:focus-within { box-shadow: 0 0 0 3px var(--accent-ring); }
+.tt-pkg { border: 1px solid var(--line); border-radius: var(--r-md); background: var(--panel); padding: 10px 12px; margin-bottom: 12px; }
+.tt-pkg small { display: block; color: var(--muted); font-size: 12px; }
+.tt-list { list-style: none; margin: 0; padding: 0; }
+.tt-list li { padding: 9px 0; border-top: 1px solid var(--line); font-size: 13px; }
+.tt-list li:first-child { border-top: 0; }
+.tt-list small { display: block; color: var(--muted); font-size: 12px; }
+.tt-list .check-row { margin: 0; }
+.tt-list .imp-mark { font-size: 11px; font-weight: 600; color: var(--green); background: var(--green-soft); border-radius: 999px; padding: 1px 7px; margin-left: 4px; }

package/src/styles/email-settings.css

@@ -63,6 +63,12 @@
 .ems-note { background: var(--amber-soft); color: var(--text-2); border-radius: var(--r-md); padding: 9px 13px; margin: 0 0 12px; font-size: 13px; }
 .ems-pw { max-width: 340px; margin-top: 4px; }
 .ems-pw .hint { display: block; margin-top: 4px; }
+.ems-verify { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; margin-top: 4px; padding: 10px 12px; background: var(--panel-2); border: 1px solid var(--line); border-radius: var(--r-md); }
+.ems-verify p { flex: 1; min-width: 200px; margin: 0; font-size: 12.5px; color: var(--muted); line-height: 1.45; }
+.ems-verify p b { color: var(--text-2); font-weight: 600; }
+.ems-verify-mark { flex: none; display: grid; place-items: center; width: 28px; height: 28px; border-radius: var(--r-sm); background: var(--sel); color: var(--text-2); }
+.ems-verify-mark svg { width: 16px; height: 16px; }
+.ems-verify-actions { display: inline-flex; gap: 6px; }
 .ems-actions { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
 .ems-row { display: flex; gap: 8px; align-items: flex-end; flex-wrap: wrap; margin-bottom: 12px; }
 .ems-row .field { margin-bottom: 0; }

package/src/theme-sdk/calendar.ts

@@ -0,0 +1,48 @@
+import { CALENDAR } from '../lib/calendar/config';
+import type { Occurrence } from '../lib/calendar/events';
+
+export { eventUrl } from '../lib/calendar/config';
+
+export interface ThemeCalendarConfig {
+  enabled: boolean;
+  base: string;
+  eventsBase: string;
+}
+
+/** Public calendar routes configured by the site's integration. */
+export function calendarConfig(): ThemeCalendarConfig {
+  const { enabled, base, eventsBase } = CALENDAR;
+  return { enabled, base, eventsBase };
+}
+
+export interface UpcomingEventsOptions {
+  /** Maximum distinct events; defaults to 6. Zero returns an empty list. */
+  limit?: number;
+  /** Look-ahead window in days; defaults to 400. */
+  horizonDays?: number;
+}
+
+/** Occurrence start/end are Unix milliseconds; event retains its authored fields. */
+export type UpcomingEvent = Pick<Occurrence, 'event' | 'start' | 'end' | 'allDay' | 'days'>;
+
+/** Server-side helper for Astro templates and endpoints. No repository access needed. */
+export async function upcomingEvents(
+  context: { locals: unknown },
+  { limit = 6, horizonDays = 400 }: UpcomingEventsOptions = {},
+): Promise<UpcomingEvent[]> {
+  if (!Number.isSafeInteger(limit) || limit < 0) {
+    throw new RangeError('upcomingEvents limit must be a non-negative safe integer');
+  }
+  if (!Number.isFinite(horizonDays) || horizonDays <= 0) {
+    throw new RangeError('upcomingEvents horizonDays must be a positive finite number');
+  }
+  if (!CALENDAR.enabled || limit === 0) return [];
+
+  const [{ getRepo }, { upcomingEvents: loadUpcomingEvents }] = await Promise.all([
+    import('../lib/repo'),
+    import('../lib/calendar/cards'),
+  ]);
+  const repo = await getRepo(context.locals);
+  const settings = await repo.getSettings();
+  return loadUpcomingEvents(repo, settings, Date.now(), { limit, horizonDays });
+}