@acms-subir/core 0.3.16 → 0.3.18

package/src/lib/sync/store.ts

@@ -0,0 +1,349 @@
+import type { SqlDriver, SqlStatement } from "../repo/sql";
+import type { MediaStore } from "../media/store";
+import { ApiError } from "../api";
+import {
+  canonical,
+  hash,
+  reference,
+  transform,
+  PROTOCOL,
+} from "./protocol.mjs";
+import {
+  rowData,
+  effective,
+  displayRef,
+  matchKey,
+  tables,
+  parseData,
+  type Data,
+  type Kind,
+} from "./catalog";
+
+export interface Entity {
+  key: string;
+  aliases: string[];
+  id: string;
+  kind: Kind;
+  ref: string;
+  match: string;
+  data: Data;
+  hash: string;
+  stateHash: string;
+  dependencies: string[];
+  live: Data;
+  draft: Data | null;
+  files?: { sourceKey: string; key: string; digest: string; size: number }[];
+}
+export interface Snapshot {
+  protocol: number;
+  siteId: string;
+  revision: number;
+  entities: Entity[];
+}
+export const MAX_OBJECT = 16 * 1024 * 1024;
+export async function objectBytes(
+  store: MediaStore,
+  key: string,
+): Promise<Uint8Array> {
+  const object = await store.get(key);
+  if (!object) throw new ApiError(409, `Missing media object: ${key}`);
+  if (object.size !== undefined && object.size > MAX_OBJECT)
+    throw new ApiError(413, "Sync media objects are limited to 16 MiB each.");
+  const reader = new Response(object.body).body!.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const r = await reader.read();
+      if (r.done) break;
+      size += r.value.byteLength;
+      if (size > MAX_OBJECT) {
+        await reader.cancel();
+        throw new ApiError(
+          413,
+          "Sync media objects are limited to 16 MiB each.",
+        );
+      }
+      chunks.push(r.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const out = new Uint8Array(size);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.length;
+  }
+  return out;
+}
+export class SyncStore {
+  constructor(private driver: () => Promise<SqlDriver>) {}
+  async state() {
+    const row = (
+      await (await this.driver()).all("SELECT * FROM sync_state WHERE id=1")
+    )[0];
+    return { siteId: String(row.site_id), revision: Number(row.revision) };
+  }
+  async rawSettings() {
+    return (
+      await (await this.driver()).all("SELECT * FROM settings WHERE id=1")
+    )[0] as Data;
+  }
+  async snapshot(media: MediaStore): Promise<Snapshot> {
+    const db = await this.driver(),
+      state = await this.state();
+    const aliases = await db.all("SELECT * FROM sync_aliases ORDER BY alias");
+    const authorRows = await db.all("SELECT * FROM post_authors ORDER BY ord");
+    const settings = await this.rawSettings();
+    const designDraft = settings.draft_design
+      ? JSON.parse(settings.draft_design)
+      : null;
+    const liveLayouts = JSON.parse(settings.section_pages || "{}"),
+      layouts = designDraft?.sectionPages ?? liveLayouts;
+    const entities: Entity[] = [];
+    const add = (kind: Kind, id: string, live: Data, draft: Data | null) => {
+      const own = `${state.siteId}:${kind}:${id}`;
+      const linked = aliases
+        .filter((a) => a.kind === kind && a.local_id === id)
+        .map((a) => String(a.alias));
+      const key = String(
+        aliases.find((a) => a.kind === kind && a.local_id === id && a.canonical)
+          ?.alias ?? own,
+      );
+      entities.push({
+        key,
+        aliases: [...new Set([key, own, ...linked])],
+        id,
+        kind,
+        live,
+        draft,
+        data: effective(kind, live, draft),
+        ref: "",
+        match: "",
+        hash: "",
+        stateHash: "",
+        dependencies: [],
+      });
+    };
+    for (const [kind, table] of Object.entries(tables) as [Kind, string][]) {
+      // Never read account credentials into the sync inventory.
+      const select = kind === "author" ? "id,name,slug" : "*";
+      const rows = await db.all(`SELECT ${select} FROM ${table} LIMIT 2001`);
+      if (rows.length > 2000 || entities.length + rows.length > 2000)
+        throw new ApiError(
+          413,
+          "Sync inventory exceeds 2,000 items; split this site before syncing.",
+        );
+      for (const row of rows) {
+        const live = rowData(kind, row);
+        if ((kind === "event" || kind === "resource") && !live.timezone)
+          live.timezone = settings.timezone || "UTC";
+        const draft = row.draft ? JSON.parse(String(row.draft)) : null;
+        if (kind === "post")
+          live.authorIds = authorRows
+            .filter((a) => a.post_id === row.id)
+            .map((a) => a.author_id);
+        if (kind === "page") live.layout = liveLayouts[String(row.id)] ?? null;
+        add(kind, String(row.id), live, draft);
+        if (kind === "page")
+          entities.at(-1)!.data = {
+            ...entities.at(-1)!.data,
+            layout: layouts[String(row.id)] ?? null,
+          };
+      }
+    }
+    add("design", "site", rowData("design", settings), designDraft);
+    add("settings", "site", rowData("settings", settings), null);
+    add(
+      "booking-settings",
+      "site",
+      JSON.parse(settings.calendar || "{}"),
+      null,
+    );
+    const substitutions = new Map<string, string>();
+    for (const entity of entities) {
+      if (entity.kind !== "media") {
+        if (entity.id !== "site")
+          substitutions.set(entity.id, reference(entity.key));
+        continue;
+      }
+      const data = entity.data,
+        files: NonNullable<Entity["files"]> = [];
+      for (const sourceKey of [
+        data.key,
+        ...(data.variants ?? []).map((v: Data) => v.key),
+      ]) {
+        const bytes = await objectBytes(media, sourceKey),
+          digest = await hash(bytes);
+        const ext =
+          /\.([a-zA-Z0-9]{1,8})$/.exec(sourceKey)?.[1].toLowerCase() ?? "bin";
+        const key = `sync/${digest}.${ext}`;
+        files.push({ sourceKey, key, digest, size: bytes.length });
+        substitutions.set(`/media/${sourceKey}`, `/media/${key}`);
+      }
+      entity.files = files;
+      const normalized = {
+        ...data,
+        key: files[0].key,
+        variants: (data.variants ?? []).map((v: Data, i: number) => ({
+          ...v,
+          key: files[i + 1].key,
+        })),
+        objects: files.map(({ key, digest, size }) => ({ key, digest, size })),
+      };
+      entity.live = normalized;
+      entity.data = normalized;
+    }
+    // Longest media path first; replace whole URL path tokens, not substrings.
+    const mediaPaths = [...substitutions]
+      .filter(([k]) => k.startsWith("/media/"))
+      .sort((a, b) => b[0].length - a[0].length);
+    const convert = (s: string) => {
+      if (substitutions.has(s)) return substitutions.get(s)!;
+      // JSON editor documents are strings. Decode before rewriting IDs/URLs.
+      if (/^\s*[\[{]/.test(s)) {
+        try {
+          return JSON.stringify(transform(JSON.parse(s), convert));
+        } catch {}
+      }
+      for (const [from, to] of mediaPaths) {
+        const escaped = from.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const boundary = "(?=$|[\\s\"'<>?#),\\]\\\\])";
+        if (settings.site_url) {
+          const origin = String(settings.site_url)
+            .replace(/\/$/, "")
+            .replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+          s = s.replace(new RegExp(origin + escaped + boundary, "g"), to);
+        }
+        s = s.replace(new RegExp(escaped + boundary, "g"), to);
+      }
+      return s;
+    };
+    const mediaByPath = new Map<string, string>(
+      entities
+        .filter((e) => e.kind === "media")
+        .flatMap((e) =>
+          (e.data.objects ?? []).map(
+            (o: Data) => [`/media/${o.key}`, e.key] as [string, string],
+          ),
+        ),
+    );
+    for (const entity of entities) {
+      entity.data = transform(parseData(entity.kind, entity.data), convert);
+      entity.live = transform(parseData(entity.kind, entity.live), convert);
+      entity.draft = entity.draft ? transform(entity.draft, convert) : null;
+      entity.ref = displayRef(entity.kind, entity.data);
+      entity.match = matchKey(entity.kind, entity.data);
+      entity.hash = await hash(entity.data);
+      entity.stateHash = await hash({
+        live: entity.live,
+        data: entity.data,
+        draft: entity.draft,
+      });
+      const text = canonical(entity.data);
+      const deps = entities
+        .filter((e) => e.key !== entity.key && text.includes(reference(e.key)))
+        .map((e) => e.key);
+      for (const [path, key] of mediaByPath)
+        if (entity.kind !== "media" && text.includes(path)) deps.push(key);
+      if (entity.kind === "post" || entity.kind === "event")
+        for (const tag of entities.filter(
+          (e) =>
+            e.kind === "tag" && (entity.data.tags ?? []).includes(e.data.name),
+        ))
+          deps.push(tag.key);
+      entity.dependencies = [...new Set(deps)];
+    }
+    if ((await this.state()).revision !== state.revision)
+      throw new ApiError(
+        409,
+        "Content changed while reading the inventory. Retry.",
+      );
+    const snapshot = { protocol: PROTOCOL, ...state, entities };
+    if (
+      new TextEncoder().encode(JSON.stringify(snapshot)).length >
+      8 * 1024 * 1024
+    )
+      throw new ApiError(413, "Sync inventory exceeds 8 MiB.");
+    return snapshot;
+  }
+  async plan(id: string) {
+    const r = (
+      await (
+        await this.driver()
+      ).all("SELECT * FROM sync_plans WHERE id=?", [id])
+    )[0];
+    return r
+      ? {
+          id: String(r.id),
+          digest: String(r.digest),
+          actor: String(r.actor),
+          body: JSON.parse(String(r.body)),
+          result: r.result ? JSON.parse(String(r.result)) : null,
+          createdAt: Number(r.created_at),
+        }
+      : null;
+  }
+  async savePlan(body: Data, actor: string) {
+    const id = crypto.randomUUID(),
+      digest = await hash(body);
+    await (
+      await this.driver()
+    ).run(
+      "INSERT INTO sync_plans(id,digest,actor,body,created_at) VALUES(?,?,?,?,?)",
+      [id, digest, actor, JSON.stringify(body), Date.now()],
+    );
+    return { id, digest, ...body };
+  }
+  async history() {
+    return (
+      await (
+        await this.driver()
+      ).all(
+        "SELECT id,created_at,result FROM sync_plans ORDER BY created_at DESC LIMIT 100",
+      )
+    ).map((r) => ({
+      id: r.id,
+      createdAt: r.created_at,
+      result: r.result ? JSON.parse(String(r.result)) : null,
+    }));
+  }
+  async commit(
+    planId: string,
+    expectedRevision: number,
+    statements: SqlStatement[],
+    result: Data,
+    versionKeys: string[],
+  ) {
+    const db = await this.driver();
+    try {
+      await db.batch([
+        {
+          sql: "INSERT INTO revision_checks(expected,actual) SELECT ?,revision FROM sync_state WHERE id=1",
+          args: [expectedRevision],
+        },
+        {
+          sql: "INSERT INTO revision_checks(expected,actual) SELECT 1,CASE WHEN result IS NULL THEN 1 ELSE 0 END FROM sync_plans WHERE id=?",
+          args: [planId],
+        },
+        ...statements,
+        {
+          sql: "UPDATE sync_plans SET result=json_set(?,'$.versions',json((SELECT json_group_object(entity,revision) FROM sync_versions WHERE entity IN (SELECT value FROM json_each(?))))) WHERE id=?",
+          args: [JSON.stringify(result), JSON.stringify(versionKeys), planId],
+        },
+        { sql: "DELETE FROM revision_checks" },
+      ]);
+    } catch (e) {
+      if (/CHECK constraint/i.test(String(e)))
+        throw new ApiError(
+          409,
+          "Destination changed after review. Generate a new plan.",
+        );
+      throw e;
+    }
+  }
+  async query(sql: string, args: unknown[] = []) {
+    return (await this.driver()).all(sql, args);
+  }
+}

package/src/pages/admin/calendar/settings.astro

@@ -1,8 +1,11 @@
 ---
 import Admin from '../../../layouts/Admin.astro';
+import CalendarFallbackImage from '../../../components/CalendarFallbackImage';
+import { env } from '../../../lib/env';
+import '../../../styles/editor.css';
 import Modal from '../../../components/Modal.astro';
 import { getRepo } from '../../../lib/repo';
-import { ApprovalRules, slugify, type ApprovalMode, type CalendarVisibility } from '../../../lib/schema';
+import { EventImageUrl, ApprovalRules, slugify, type ApprovalMode, type CalendarVisibility } from '../../../lib/schema';
 import { CALENDAR, bookingsEnabled, calendarFeedUrl, calendarPageUrl } from '../../../lib/calendar/config';
 import { safeColor } from '../../../lib/calendar/events';
 import { normalizeCalendarSrc } from '../../../lib/calendar/src';
@@ -54,6 +57,12 @@ if (Astro.request.method === 'POST') {
   const color = safeColor(String(form.get('color') || '#4f46e5'));
   const description = String(form.get('description') || '').slice(0, 1000);
 
+  if (op === 'event-images') {
+    const image = EventImageUrl.safeParse(form.get('eventFallbackImage'));
+    if (!image.success) return back(image.error.issues[0].message, '#event-images');
+    await repo.updateSettings({ calendar: { ...settings.calendar, eventFallbackImage: image.data } });
+    return back('Event fallback image saved.', '#event-images');
+  }
   if (op === 'defaults') {
     const defaultCalendarId = String(form.get('defaultCalendarId') || '');
     const ok = !defaultCalendarId || (await repo.getCalendar(defaultCalendarId))?.kind === 'native';
@@ -188,7 +197,7 @@ const I = {
   pin: 'M12 22s7-7 7-12a7 7 0 0 0-14 0c0 5 7 12 7 12zM12 12.5a2.5 2.5 0 1 0 0-5 2.5 2.5 0 0 0 0 5z',
 };
 const sections = [
-  ['calendars', 'Calendars'], ['places', 'Places'], ['subscribed', 'Subscribed calendars'], ['share', 'Share links'],
+  ['calendars', 'Calendars'], ['event-images', 'Event images'], ['places', 'Places'], ['subscribed', 'Subscribed calendars'], ['share', 'Share links'],
   ...(bookingsEnabled() ? [['bookings', 'Bookings']] : []), ['defaults', 'Defaults'],
 ] as const;
 ---
@@ -242,6 +251,16 @@ const sections = [
         ))}
       </section>
 
+      <section class="cs-sect" id="event-images">
+        <header><div><h2>Event images</h2><p>Choose a fallback for events without their own image. Used on event cards, event pages, and Upcoming events sections.</p></div></header>
+        <form method="post">
+          <input type="hidden" name="op" value="event-images" />
+          <CalendarFallbackImage client:load value={settings.calendar.eventFallbackImage} unsplashEnabled={Boolean(env('UNSPLASH_ACCESS_KEY'))} />
+          <p class="hint">An event’s own image takes priority. Upcoming events sections can choose a different fallback in Design → Pages. Removing the fallback restores date tiles on cards.</p>
+          <button class="btn primary" type="submit">Save event image</button>
+        </form>
+      </section>
+
       <!-- Places -->
       <section class="cs-sect" id="places">
         <header>

package/src/pages/admin/integrations.astro

@@ -6,6 +6,7 @@ import { API_SCOPES, WEBHOOK_EVENTS, type ApiScope } from '../../lib/schema';
 import { accessFor } from '../../lib/permissions/access';
 import { CALENDAR, bookingsEnabled } from '../../lib/calendar/config';
 import { issueApiKey } from '../../lib/api-keys';
+import { sessionRole } from '../../lib/api';
 import { attemptDelivery, generateWebhookSecret, validateWebhookUrl } from '../../lib/webhooks';
 import { resolveConfig } from '../../lib/email/config';
 import { env } from '../../lib/env';
@@ -32,6 +33,7 @@ if (Astro.request.method === 'POST') {
     if (op === 'key') {
       const scopes = form.getAll('scopes').map(String).filter((s): s is ApiScope => (API_SCOPES as readonly string[]).includes(s));
       if (!scopes.length) throw new Error('Pick at least one permission.');
+      if (scopes.some(s => s.startsWith('sync:')) && (await sessionRole(Astro.request, Astro.cookies, repo)).role !== 'owner') throw new Error('Only owners can issue environment sync keys.');
       const { key } = await issueApiKey(repo, String(form.get('name') || 'API key').slice(0, 80), scopes);
       newKey = key;
     } else if (op === 'revoke') {

package/src/pages/admin/links.astro

@@ -13,7 +13,7 @@ const unsplashEnabled = Boolean(env('UNSPLASH_ACCESS_KEY'));
 
 <Admin title="Links page" section="links">
   <div class="page-head">
-    <div><h1>Links page</h1><p class="sub">Your link-in-bio page at /links</p></div>
+    <div><h1>Links page</h1><p class="sub">Your link-in-bio page at /links. Save &amp; publish makes changes live immediately.</p></div>
     <a class="btn sm" href="/links" target="_blank" rel="noopener">View links page ↗</a>
   </div>
 

package/src/pages/api/agent/docs.ts

@@ -27,6 +27,8 @@ Connect a Streamable HTTP MCP client to ${url.origin}/api/mcp with the same Auth
 
 Themes define editable sections (hero, service times, upcoming events…) with typed fields. list_section_types returns the active theme's section types and field schemas; get_page_layout reads a page's layout; set_page_layout replaces it; update_section_data changes one section. The two write tools appear only when the owner turns on "Let the agent edit page sections". Field values: text/textarea/richtext/image/url/select/date (YYYY-MM-DD)/time (HH:MM) are strings, number is a number, toggle is a boolean, link is {"label","href"} (optionally "ref" like "page:<id>"), list is an array of row objects keyed by its sub-fields, source is {"calendar"|"collection"|"tag"|"resource", "limit"} and shows live content. All section writes stage into the design draft (review at the returned reviewUrl). update_section_data with publish:true publishes that one section when publishing is enabled.
 
+The library upcoming-events section supports cards/list variants and editable heading, intro, events (calendar and limit), more, empty, fallbackImage, showImages, imageRatio (landscape/square/portrait), imageFit (cover/contain), showLocation, and showSummary. Discover the active theme's schema first: copied or custom sections may expose different fields. Event images take priority over the section fallback, then the fallback chosen by the owner in Calendar settings → Event images. For a section override, call update_section_data with fallbackImage and the desired display fields; it follows the normal draft and publishing permissions.
+
 Updates replace only supplied fields; content replaces the body. Pages support title/content/seoTitle/seoDesc. Posts also support excerpt/tags. Create accepts slug and posts accept collection. Content length is limited to 100,000 characters; request size is limited to 300,000 bytes. List pagination defaults to 25 and allows up to 100.
 
 ## Tool schemas (publish_content requires permission)

package/src/pages/api/design/keys.ts

@@ -3,21 +3,25 @@ import { z } from 'zod';
 import { getRepo } from '../../../lib/repo';
 import { apiError, json, readJson, ApiError } from '../../../lib/api';
 import { DESIGN_SCOPES } from '../../../lib/design-service';
+import { SYNC_SCOPES } from '../../../lib/sync/auth';
+import { sessionRole } from '../../../lib/api';
+const TOOL_SCOPES=[...DESIGN_SCOPES,...SYNC_SCOPES] as const;
 import { generateAgentKey } from '../../../lib/ai-config';
 import { requirePermission } from '../../../lib/permissions/access';
 export const ALL:APIRoute=async({request,cookies,locals})=>{
   try {
     const repo=await getRepo(locals);await requirePermission(request, cookies, repo, 'integrations.manage');
-    if(request.method==='GET')return json({keys:(await repo.listApiKeys()).filter(k=>k.scopes.some(s=>DESIGN_SCOPES.includes(s as typeof DESIGN_SCOPES[number])))});
+    if(request.method==='GET')return json({keys:(await repo.listApiKeys()).filter(k=>k.scopes.some(s=>TOOL_SCOPES.includes(s as typeof TOOL_SCOPES[number])))});
     if(request.method==='POST') {
-      const input=z.object({name:z.string().min(1).max(100),scopes:z.array(z.enum(DESIGN_SCOPES)).min(1)}).strict().parse(await readJson(request,10000));
+      const input=z.object({name:z.string().min(1).max(100),scopes:z.array(z.enum(TOOL_SCOPES)).min(1)}).strict().parse(await readJson(request,10000));
+      if(input.scopes.some(s=>s.startsWith('sync:'))&&(await sessionRole(request,cookies,repo)).role!=='owner')throw new ApiError(403,'Only owners can issue environment sync keys.');
       const {token,keyHash,keyPrefix}=generateAgentKey();
       const key=await repo.createApiKey({name:input.name,scopes:input.scopes,keyHash,prefix:keyPrefix});return json({key,token},201);
     }
     if(request.method==='DELETE') {
       const {id}=z.object({id:z.string()}).strict().parse(await readJson(request,10000));
       const key=(await repo.listApiKeys()).find(k=>k.id===id);
-      if(!key||!key.scopes.some(s=>DESIGN_SCOPES.includes(s as typeof DESIGN_SCOPES[number])))throw new ApiError(404,'Design key not found.');
+      if(!key||!key.scopes.some(s=>TOOL_SCOPES.includes(s as typeof TOOL_SCOPES[number])))throw new ApiError(404,'Tool key not found.');
       await repo.deleteApiKey(id);return json({ok:true});
     }
     throw new ApiError(405,'Method not allowed.');

package/src/pages/api/sync/index.ts

@@ -0,0 +1,114 @@
+import type { APIRoute } from "astro";
+import { z } from "zod";
+import { getRepo } from "../../../lib/repo";
+import { getMediaStore } from "../../../lib/media/store";
+import { apiError, ApiError, json, readJson } from "../../../lib/api";
+import { syncIdentity } from "../../../lib/sync/auth";
+import { applyPlan, createPlan, followupPlan } from "../../../lib/sync/service";
+import { PROTOCOL, TYPES } from "../../../lib/sync/protocol.mjs";
+
+export const GET: APIRoute = async ({ request, locals }) => {
+  try {
+    const identity = await syncIdentity(request, await getRepo(locals), [
+      "sync:read",
+    ]);
+    return json({
+      protocol: PROTOCOL,
+      scopes: identity.scopes,
+      capabilities: {
+        sync: true,
+        types: Object.keys(TYPES),
+        maxItems: 200,
+        maxObjectBytes: 16 * 1024 * 1024,
+      },
+    });
+  } catch (e) {
+    return apiError(e);
+  }
+};
+const RequestBody = z.discriminatedUnion("op", [
+  z.object({ op: z.literal("snapshot") }).strict(),
+  z
+    .object({
+      op: z.literal("plan"),
+      input: z.unknown(),
+      validateOnly: z.boolean().default(false),
+    })
+    .strict(),
+  z
+    .object({
+      op: z.literal("apply"),
+      id: z.string().uuid(),
+      digest: z.string().regex(/^[a-f0-9]{64}$/),
+    })
+    .strict(),
+  z.object({ op: z.literal("show"), id: z.string().uuid() }).strict(),
+  z.object({ op: z.literal("history") }).strict(),
+  z
+    .object({
+      op: z.enum(["publish", "rollback"]),
+      id: z.string().uuid(),
+      validateOnly: z.boolean().default(false),
+    })
+    .strict(),
+]);
+export const POST: APIRoute = async ({ request, locals }) => {
+  try {
+    const repo = await getRepo(locals);
+    // Authenticate before parsing potentially large content.
+    const who = await syncIdentity(request, repo, ["sync:read"]);
+    const body = RequestBody.parse(await readJson(request, 8 * 1024 * 1024));
+    if (
+      ["plan", "apply", "publish", "rollback"].includes(body.op) &&
+      !who.scopes.includes("sync:write")
+    )
+      throw new ApiError(403, "Required scope: sync:write");
+    const media = getMediaStore(locals);
+    switch (body.op) {
+      case "snapshot":
+        return json(await repo.sync.snapshot(media));
+      case "plan":
+        return json(
+          await createPlan(
+            repo,
+            media,
+            body.input,
+            who.actor,
+            !body.validateOnly,
+          ),
+        );
+      case "apply":
+        return json(
+          await applyPlan(
+            repo,
+            media,
+            body.id,
+            body.digest,
+            who.actor,
+            who.scopes.includes("sync:publish"),
+          ),
+        );
+      case "show": {
+        const p = await repo.sync.plan(body.id);
+        if (!p) throw new ApiError(404, "Plan not found.");
+        return json(p);
+      }
+      case "history":
+        return json({ runs: await repo.sync.history() });
+      case "publish":
+      case "rollback":
+        return json(
+          await followupPlan(
+            repo,
+            media,
+            body.id,
+            body.op,
+            who.actor,
+            !body.validateOnly,
+          ),
+        );
+    }
+  } catch (e) {
+    return apiError(e);
+  }
+};

package/src/pages/api/sync/media.ts

@@ -0,0 +1,90 @@
+import type { APIRoute } from "astro";
+import { getRepo } from "../../../lib/repo";
+import { getMediaStore } from "../../../lib/media/store";
+import { apiError, ApiError, json } from "../../../lib/api";
+import { syncIdentity } from "../../../lib/sync/auth";
+import { objectBytes, MAX_OBJECT } from "../../../lib/sync/store";
+import { safeMediaKey } from "../../../lib/sync/catalog";
+import { hash } from "../../../lib/sync/protocol.mjs";
+
+export const ALL: APIRoute = async ({ request, locals }) => {
+  try {
+    const repo = await getRepo(locals),
+      write = request.method === "PUT";
+    await syncIdentity(
+      request,
+      repo,
+      write ? ["sync:read", "sync:write"] : ["sync:read"],
+    );
+    if (!["GET", "HEAD", "PUT"].includes(request.method))
+      throw new ApiError(405, "Method not allowed.");
+    const key = safeMediaKey(
+      new URL(request.url).searchParams.get("key") ?? "",
+    );
+    const media = getMediaStore(locals);
+    const digest = /^sync\/([a-f0-9]{64})\.[a-z0-9]{1,8}$/.exec(key)?.[1];
+    if (write) {
+      if (!request.body) throw new ApiError(400, "An upload body is required.");
+      if (!digest)
+        throw new ApiError(
+          400,
+          "Sync uploads require a content-addressed key.",
+        );
+      const bytes = await objectBytes(
+        {
+          get: async () => ({
+            body: request.body!,
+            contentType:
+              request.headers.get("content-type") ?? "application/octet-stream",
+            size: Number(request.headers.get("content-length")) || undefined,
+          }),
+          put: media.put.bind(media),
+          delete: media.delete.bind(media),
+        },
+        key,
+      );
+      if (bytes.length > MAX_OBJECT || (await hash(bytes)) !== digest)
+        throw new ApiError(400, "Media checksum mismatch.");
+      const existing = await media.get(key);
+      if (existing) {
+        if ((await hash(await objectBytes(media, key))) !== digest)
+          throw new ApiError(
+            409,
+            "Existing content-addressed object is damaged.",
+          );
+        return json({ ok: true, skipped: true });
+      }
+      await media.put(
+        key,
+        bytes.buffer as ArrayBuffer,
+        request.headers.get("content-type") ?? "application/octet-stream",
+      );
+      return json({ ok: true, skipped: false });
+    }
+    const rows = await repo.listMedia();
+    if (
+      !digest &&
+      !rows.some((m) => m.key === key || m.variants.some((v) => v.key === key))
+    )
+      throw new ApiError(404, "Media not found.");
+    const obj = await media.get(key);
+    if (!obj) throw new ApiError(404, "Media not found.");
+    if (request.method === "HEAD") {
+      const actual = await hash(await objectBytes(media, key));
+      if (digest && actual !== digest)
+        throw new ApiError(409, "Media checksum mismatch.");
+      return new Response(null, {
+        headers: { ETag: actual, "Cache-Control": "no-store" },
+      });
+    }
+    return new Response(obj.body, {
+      headers: {
+        "Content-Type": obj.contentType,
+        "Cache-Control": "no-store",
+        "Content-Disposition": "attachment",
+      },
+    });
+  } catch (e) {
+    return apiError(e);
+  }
+};