@acms-subir/core 0.3.2 → 0.3.3

package/src/lib/import/zipread.ts

@@ -0,0 +1,72 @@
+import { crc32 } from '../backup/zip';
+
+// Lazy ZIP reader for import sources: acms exports (stored) and archives made
+// by Finder, Windows or `zip` (deflated). Only the central directory is read
+// up front; entries inflate on demand through the platform's
+// DecompressionStream('deflate-raw'), available in browsers, Workers and
+// Node, so a large Ghost content folder never inflates all at once.
+
+export interface ZipIndex {
+  names: string[];
+  has(name: string): boolean;
+  read(name: string): Promise<Uint8Array<ArrayBuffer>>;
+}
+
+export function openZip(buf: ArrayBuffer): ZipIndex {
+  const bytes = new Uint8Array(buf);
+  const view = new DataView(buf);
+  let eocd = -1;
+  for (let i = bytes.length - 22; i >= Math.max(0, bytes.length - 22 - 65536); i--) {
+    if (view.getUint32(i, true) === 0x06054b50) { eocd = i; break; }
+  }
+  if (eocd < 0) throw new Error('Not a ZIP file.');
+  const count = view.getUint16(eocd + 10, true);
+  const dirSize = view.getUint32(eocd + 12, true);
+  let off = view.getUint32(eocd + 16, true);
+  if (count === 0xffff || off === 0xffffffff) throw new Error('ZIP64 archives are not supported. Split the folder into smaller ZIPs.');
+  if (off + dirSize > eocd) throw new Error('Corrupt ZIP directory.');
+
+  const entries = new Map<string, { method: number; crc: number; size: number; compSize: number; header: number }>();
+  for (let n = 0; n < count; n++) {
+    if (off + 46 > eocd || view.getUint32(off, true) !== 0x02014b50) throw new Error('Corrupt ZIP central directory.');
+    const flags = view.getUint16(off + 8, true);
+    const method = view.getUint16(off + 10, true);
+    const nameLen = view.getUint16(off + 28, true);
+    const extraLen = view.getUint16(off + 30, true);
+    const commentLen = view.getUint16(off + 32, true);
+    const name = new TextDecoder().decode(bytes.subarray(off + 46, off + 46 + nameLen));
+    if (!(flags & 1) && !name.endsWith('/') && !name.split('/').includes('..') && !name.startsWith('/')) {
+      entries.set(name, {
+        method,
+        crc: view.getUint32(off + 16, true),
+        compSize: view.getUint32(off + 20, true),
+        size: view.getUint32(off + 24, true),
+        header: view.getUint32(off + 42, true),
+      });
+    }
+    off += 46 + nameLen + extraLen + commentLen;
+  }
+
+  return {
+    names: [...entries.keys()],
+    has: (name) => entries.has(name),
+    async read(name) {
+      const e = entries.get(name);
+      if (!e) throw new Error(`${name} is not in the ZIP.`);
+      if (view.getUint32(e.header, true) !== 0x04034b50) throw new Error('Corrupt ZIP entry.');
+      const start = e.header + 30 + view.getUint16(e.header + 26, true) + view.getUint16(e.header + 28, true);
+      const raw = bytes.subarray(start, start + e.compSize);
+      let data: Uint8Array<ArrayBuffer>;
+      if (e.method === 0) data = raw;
+      else if (e.method === 8) data = await inflate(raw);
+      else throw new Error(`${name} uses an unsupported compression method.`);
+      if (data.length !== e.size || crc32(data) !== e.crc) throw new Error(`${name} is damaged (checksum mismatch).`);
+      return data;
+    },
+  };
+}
+
+async function inflate(raw: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>> {
+  const stream = new Blob([raw]).stream().pipeThrough(new DecompressionStream('deflate-raw'));
+  return new Uint8Array(await new Response(stream).arrayBuffer());
+}

package/src/lib/media/upload.ts

@@ -0,0 +1,83 @@
+import type { ContentRepository } from '../repo/types';
+import type { Media } from '../schema';
+import { ApiError } from '../api';
+import { getMediaStore } from './store';
+
+// Multipart upload shared by the admin (/api/media/upload) and editor apps
+// (/api/v1/admin/media). For images the client has already done the heavy
+// lifting (EXIF rotation, downscale, WebP re-encode, variant generation);
+// this stores the optimized file + variants and records the media row.
+// SVG/GIF arrive untouched. Documents (for the file/download card) are
+// stored as-is. Video/audio is deliberately rejected — embeds cover video
+// until a streaming upload + Range-serving pipeline exists.
+//
+// Fields: file (primary), width, height, alt?, variant_<w> (File, webp)…
+export const DOCUMENT_TYPES = new Set([
+  'application/pdf',
+  'application/zip',
+  'application/x-zip-compressed',
+  'application/json',
+  'text/plain',
+  'text/csv',
+  'text/markdown',
+  'application/msword',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  'application/vnd.ms-excel',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  'application/vnd.ms-powerpoint',
+  'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+  'application/epub+zip',
+]);
+export const MAX_IMAGE = 30 * 1024 * 1024;
+export const MAX_DOCUMENT = 25 * 1024 * 1024;
+/** a whole multipart body: the image plus its resized variants */
+export const MAX_UPLOAD_BODY = MAX_IMAGE * 2;
+
+export async function storeUpload(form: FormData, locals: unknown, repo: ContentRepository): Promise<Media> {
+  const file = form.get('file');
+  if (!(file instanceof File) || file.size === 0) throw new ApiError(400, 'Missing file');
+  const isImage = file.type.startsWith('image/');
+  const isDocument = DOCUMENT_TYPES.has(file.type);
+  if (!isImage && !isDocument) {
+    throw new ApiError(415, file.type.startsWith('video/') || file.type.startsWith('audio/')
+      ? 'Video and audio uploads aren’t supported yet — use an embed card instead.'
+      : 'Unsupported file type.');
+  }
+  const cap = isImage ? MAX_IMAGE : MAX_DOCUMENT;
+  if (file.size > cap) throw new ApiError(413, `File too large (max ${Math.round(cap / 1024 / 1024)} MB)`);
+
+  const variantFields = [...form.entries()].filter(([field, value]) => /^variant_\d+$/.test(field) && value instanceof File && value.size > 0);
+  if (variantFields.length > 8) throw new ApiError(400, 'Too many image sizes (max 8).');
+  for (const [field, value] of variantFields) {
+    const w = Number(field.slice(8));
+    if (!Number.isInteger(w) || w < 16 || w > 8192) throw new ApiError(400, 'Image sizes must be 16–8192 pixels wide.');
+    if ((value as File).size > MAX_IMAGE) throw new ApiError(413, `File too large (max ${Math.round(MAX_IMAGE / 1024 / 1024)} MB)`);
+  }
+
+  const id = crypto.randomUUID();
+  const ext = (file.name.split('.').pop() || 'bin').toLowerCase().replace(/[^a-z0-9]/g, '') || 'bin';
+  const key = `${id}/original.${ext}`;
+  const store = getMediaStore(locals);
+  await store.put(key, await file.arrayBuffer(), file.type);
+
+  const variants: { w: number; key: string }[] = [];
+  for (const [field, value] of variantFields) {
+    const w = Number(field.slice(8));
+    const vkey = `${id}/w${w}.webp`;
+    await store.put(vkey, await (value as File).arrayBuffer(), 'image/webp');
+    variants.push({ w, key: vkey });
+  }
+  variants.sort((a, b) => a.w - b.w);
+
+  return repo.createMedia({
+    id,
+    key,
+    filename: file.name,
+    mime: file.type,
+    width: Number(form.get('width') ?? 0),
+    height: Number(form.get('height') ?? 0),
+    size: file.size,
+    alt: String(form.get('alt') ?? ''),
+    variants,
+  });
+}

package/src/lib/mobile/associations.ts

@@ -0,0 +1,25 @@
+import type { APIRoute } from 'astro';
+import { userConfig } from 'virtual:acms-config';
+import { ApiError } from '../api';
+import { failure, publicResponse } from './http';
+
+export function association(platform: 'ios' | 'android', mobile = userConfig.mobile) {
+  if (platform === 'ios' && mobile?.ios) {
+    const { teamId, bundleId, paths } = mobile.ios;
+    return { applinks: { apps: [], details: [{ appID: `${teamId}.${bundleId}`, paths }] } };
+  }
+  if (platform === 'android' && mobile?.android) {
+    return [{ relation: ['delegate_permission/common.handle_all_urls'], target: {
+      namespace: 'android_app', package_name: mobile.android.package, sha256_cert_fingerprints: mobile.android.sha256CertFingerprints,
+    } }];
+  }
+  throw new ApiError(404, 'App association not configured.');
+}
+export function associationRoute(platform: 'ios' | 'android'): APIRoute {
+  return async ({ request }) => {
+    let res: Response;
+    try { res = await publicResponse(request, association(platform), true); }
+    catch (error) { res = failure(error); }
+    return request.method === 'HEAD' ? new Response(null, { status: res.status, headers: res.headers }) : res;
+  };
+}

package/src/lib/mobile/calendar.ts

@@ -5,10 +5,12 @@ import { CALENDAR, bookingsEnabled, resourceUrl, bookingLinkUrl } from '../calen
 import { calendarToJson, eventToJson } from '../calendar/api';
 import { eventIsListed, eventIsPublic, expandEvents } from '../calendar/events';
 import { availabilityContext } from '../booking/service';
-import { addDaysYmd, describeLink, linkLengths, slotsForDay, ymd } from '../booking/availability';
+import { addDaysYmd, describeLink, linkLengths, localMidnight, slotsForDay, ymd } from '../booking/availability';
 import { siteOrigin } from '../seo';
 import { safeUrl } from './content';
 import { pageQuery, isoDay, queryParams } from './http';
+import { localizeDoc } from '../translations';
+import { localeQuery, mobileLocale, localizedUrl } from './locale';
 
 export function requireCalendar(bookings = false) {
   if (!CALENDAR.enabled || (bookings && !bookingsEnabled())) throw new ApiError(404, 'This feature is disabled.');
@@ -19,31 +21,36 @@ export async function listCalendars(repo: ContentRepository, url: URL) {
   const origin = siteOrigin(await repo.getSettings(), url);
   return { calendars: (await repo.listCalendars()).filter(c => c.visibility === 'public').map(c => calendarToJson(c, origin)) };
 }
+export const eventsQuery = z.object({ ...pageQuery, locale: localeQuery, from: isoDay.optional(), to: isoDay.optional(), calendar: z.string().min(1).max(200).optional(), q: z.string().max(100).optional() }).strict();
 export async function listEvents(repo: ContentRepository, url: URL) {
   requireCalendar();
-  const q = z.object({ ...pageQuery, from: isoDay.optional(), to: isoDay.optional(), calendar: z.string().min(1).max(200).optional(), q: z.string().max(100).optional() }).strict().parse(queryParams(url));
-  const from = Date.parse(q.from ?? new Date().toISOString().slice(0, 10));
-  const to = q.to ? Date.parse(q.to) : from + 30 * 86400000;
-  if (to <= from || to - from > 90 * 86400000) throw new ApiError(400, 'Use an event window of 1 to 90 days.');
+  const q = eventsQuery.parse(queryParams(url));
+  const locale = mobileLocale(q.locale);
   const [settings, calendars, events] = await Promise.all([repo.getSettings(), repo.listCalendars(), repo.listPublishedEvents()]);
+  // days are the site's calendar days (a New York site's "today" starts at midnight there, not UTC)
+  const tz = settings.timezone || 'UTC';
+  const from = localMidnight(q.from ?? ymd(Date.now(), tz), tz);
+  const to = q.to ? localMidnight(q.to, tz) : localMidnight(addDaysYmd(q.from ?? ymd(Date.now(), tz), 30), tz);
+  if (to <= from || to - from > 90 * 86400000 + 3600000) throw new ApiError(400, 'Use an event window of 1 to 90 days.');
   const all = new Map(calendars.map(c => [c.id, c]));
   const cal = q.calendar ? calendars.find(c => c.slug === q.calendar && c.visibility !== 'private') : null;
   if (q.calendar && !cal) throw new ApiError(404, 'Calendar not found.');
   const publicCalendars = new Map(calendars.filter(c => c.visibility === 'public' || c.id === cal?.id).map(c => [c.id, c]));
-  const visible = events.filter(e => (cal ? e.calendarIds.includes(cal.id) && eventIsPublic(e, all) : eventIsListed(e, all))
+  const visible = events.map(e => localizeDoc(e, locale ?? undefined)).filter(e => (cal ? e.calendarIds.includes(cal.id) && eventIsPublic(e, all) : eventIsListed(e, all))
     && (!q.q || `${e.title} ${e.excerpt} ${e.location.name}`.toLowerCase().includes(q.q.toLowerCase())));
   const occurrences = expandEvents(visible, settings, { displayTz: settings.timezone || 'UTC', now: Date.now(), windowStartMs: from, windowEndMs: to });
   occurrences.sort((a, b) => a.start - b.start || (a.event.id < b.event.id ? -1 : a.event.id > b.event.id ? 1 : 0));
   const start = (q.page - 1) * q.limit;
   const origin = siteOrigin(settings, url);
   return {
-    timezone: settings.timezone || 'UTC', from: new Date(from).toISOString(), to: new Date(to).toISOString(),
+    locale, timezone: settings.timezone || 'UTC', from: new Date(from).toISOString(), to: new Date(to).toISOString(),
     occurrences: occurrences.slice(start, start + q.limit).map(o => {
       const event = eventToJson(o.event, origin, publicCalendars, settings.timezone);
+      event.url = localizedUrl(event.url, origin, locale);
       // Only configured public event fields; no undeclared imported metadata.
       event.fields = Object.fromEntries(CALENDAR.eventFields.filter(f => Object.hasOwn(o.event.fields, f.key)).map(f => [f.key, o.event.fields[f.key]]));
       event.image = safeUrl(o.event.cover, origin);
-      event.cta = { ...event.cta, href: safeUrl(event.cta.href, origin, true) };
+      event.cta = { ...event.cta, href: localizedUrl(safeUrl(event.cta.href, origin, true), origin, locale) };
       return { id: `${o.event.id}:${o.start}`, start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(), allDay: o.allDay, event };
     }),
     pagination: { page: q.page, limit: q.limit, nextPage: occurrences.length > start + q.limit ? q.page + 1 : null },
@@ -65,11 +72,12 @@ export async function listResources(repo: ContentRepository, url: URL) {
     })),
   })), pagination: { page: q.page, limit: q.limit, nextPage: visible.length > start + q.limit ? q.page + 1 : null } };
 }
+export const availabilityQuery = z.object({ resource: z.string().min(1).max(200), link: z.string().min(1).max(200), from: isoDay.optional(),
+  days: z.coerce.number().int().min(1).max(31).default(7), minutes: z.coerce.number().int().min(1).max(44640).optional(),
+}).strict();
 export async function getAvailability(repo: ContentRepository, url: URL) {
   requireCalendar(true);
-  const q = z.object({ resource: z.string().min(1).max(200), link: z.string().min(1).max(200), from: isoDay.optional(),
-    days: z.coerce.number().int().min(1).max(31).default(7), minutes: z.coerce.number().int().min(1).max(44640).optional(),
-  }).strict().parse(queryParams(url));
+  const q = availabilityQuery.parse(queryParams(url));
   const resource = await repo.getResourceBySlug(q.resource);
   const link = resource ? await repo.getBookingLinkBySlug(resource.id, q.link) : null;
   if (!resource || !link || !link.active) throw new ApiError(404, 'Resource or booking link not found.');

package/src/lib/mobile/config.mjs

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+
+export const MobileConfig = z.object({
+  ios: z.object({
+    teamId: z.string().regex(/^[A-Z0-9]{10}$/, 'Use a 10-character Apple team ID.'),
+    bundleId: z.string().regex(/^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/, 'Use a bundle ID such as com.example.app.'),
+    paths: z.array(z.string().min(1).max(2000).refine(p => /^(?:NOT )?(?:\*|\/[^\r\n]*)$/.test(p), 'Use an absolute path or *, optionally prefixed with NOT.')).max(100).default(['*']),
+  }).strict().optional(),
+  android: z.object({
+    package: z.string().regex(/^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/, 'Use an Android package such as com.example.app.'),
+    sha256CertFingerprints: z.array(z.string().regex(/^(?:[A-Fa-f0-9]{2}:){31}[A-Fa-f0-9]{2}$/, 'Use a colon-separated SHA-256 certificate fingerprint.').transform(s => s.toUpperCase())).min(1),
+  }).strict().optional(),
+  // Push notifications to the site's own Expo apps. Off unless configured:
+  // true, or { enabled, retentionDays } (devices not seen for that many days are removed).
+  push: z.union([z.boolean(), z.object({
+    enabled: z.boolean().default(true),
+    retentionDays: z.number().int().min(30).max(730).default(270),
+  }).strict()]).optional(),
+  // Editor apps (staff sign in through the browser, OAuth 2.0 + PKCE). Off
+  // unless redirect URIs are listed: only these exact URIs receive codes.
+  editor: z.object({
+    name: z.string().trim().min(1).max(80).optional(),
+    redirectUris: z.array(z.string().max(500).superRefine((uri, ctx) => {
+      const problem = redirectUriProblem(uri);
+      if (problem) ctx.addIssue({ code: z.ZodIssueCode.custom, message: problem });
+    })).min(1).max(20),
+    accessTokenMinutes: z.number().int().min(5).max(24 * 60).default(60),
+    refreshTokenDays: z.number().int().min(1).max(365).default(90),
+  }).strict().optional(),
+}).strict();
+
+const BLOCKED_SCHEMES = new Set(['javascript', 'data', 'vbscript', 'file', 'about', 'blob', 'filesystem', 'ftp', 'ws', 'wss', 'mailto', 'tel', 'sms', 'intent', 'chrome', 'view-source']);
+/** why a redirect URI can't be allowed, or '' (custom scheme, https, or http loopback per RFC 8252) */
+export function redirectUriProblem(uri) {
+  let url;
+  try { url = new URL(uri); } catch { return 'Use an absolute URI such as com.example.staff://auth or https://example.com/app/auth.'; }
+  const scheme = url.protocol.slice(0, -1).toLowerCase();
+  if (url.hash || uri.includes('#')) return 'Redirect URIs cannot contain a fragment.';
+  if (url.username || url.password) return 'Redirect URIs cannot contain credentials.';
+  if (BLOCKED_SCHEMES.has(scheme)) return `The ${scheme}: scheme cannot receive sign-in codes.`;
+  if (scheme === 'http') {
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    if (!['127.0.0.1', '::1', 'localhost'].includes(host)) return 'http:// is only allowed for loopback addresses (127.0.0.1, [::1], localhost); use https:// or an app scheme.';
+    return '';
+  }
+  if (scheme === 'https') return url.hostname ? '' : 'https:// redirect URIs need a host.';
+  if (!/^[a-z][a-z0-9+.-]*$/.test(scheme)) return 'Invalid URI scheme.';
+  return '';
+}
+
+export function resolveMobile(value) {
+  const result = MobileConfig.safeParse(value === undefined ? {} : value);
+  if (!result.success) throw new Error(`acms: ${result.error.issues.map(i => `mobile.${i.path.join('.')}: ${i.message}`).join('; ')}`);
+  const { push, editor, ...rest } = result.data;
+  const options = typeof push === 'object' ? push : { enabled: push === true, retentionDays: 270 };
+  return { ...rest, push: { enabled: options.enabled, retentionDays: options.retentionDays },
+    editor: editor ? { enabled: true, name: editor.name ?? '', redirectUris: [...new Set(editor.redirectUris)], accessTokenMinutes: editor.accessTokenMinutes, refreshTokenDays: editor.refreshTokenDays }
+      : { enabled: false, name: '', redirectUris: [], accessTokenMinutes: 60, refreshTokenDays: 90 } };
+}

package/src/lib/mobile/content.ts

@@ -10,10 +10,12 @@ import { renderMarkdown } from '../markdown';
 import { blocksToHtml } from '../blocksToHtml';
 import { ApiError } from '../api';
 import { pageQuery, queryParams } from './http';
+import { localizeDoc } from '../translations';
+import { localeQuery, mobileLocale, localizedUrl } from './locale';
 
 export const contentQuery = z.object({
   ...pageQuery, kind: z.enum(['post', 'page']).optional(),
-  collection: z.string().min(1).max(80).optional(), locale: z.string().min(1).max(35).optional(),
+  collection: z.string().min(1).max(80).optional(), locale: localeQuery,
 }).strict();
 export function safeUrl(value: string, origin: string, link = false): string {
   if (!value) return '';
@@ -22,7 +24,7 @@ export function safeUrl(value: string, origin: string, link = false): string {
     return (['http:', 'https:', ...(link ? ['mailto:', 'tel:'] : [])].includes(url.protocol) && !url.username && !url.password) ? url.href : '';
   } catch { return ''; }
 }
-export function mobileHtml(html: string, origin: string) {
+export function mobileHtml(html: string, origin: string, locale: string | null = null) {
   return sanitizeHtml(html, {
     allowedTags: [...sanitizeHtml.defaults.allowedTags, 'img'],
     allowedAttributes: { a: ['href', 'title'], img: ['src', 'alt', 'title', 'width', 'height'], th: ['colspan', 'rowspan'], td: ['colspan', 'rowspan'] },
@@ -30,20 +32,21 @@ export function mobileHtml(html: string, origin: string) {
     allowedSchemesByTag: { img: ['https', 'http'] },
     allowProtocolRelative: false,
     transformTags: {
-      a: (_tag, attrs) => ({ tagName: 'a', attribs: { ...attrs, href: safeUrl(attrs.href ?? '', origin, true) } }),
+      a: (_tag, attrs) => ({ tagName: 'a', attribs: { ...attrs, href: localizedUrl(safeUrl(attrs.href ?? '', origin, true), origin, locale) } }),
       img: (_tag, attrs) => ({ tagName: 'img', attribs: { ...attrs, src: safeUrl(attrs.src ?? '', origin) } }),
     },
   });
 }
 const iso = (n: number | null) => n === null ? null : new Date(n).toISOString();
-function dto(doc: Page | Post, kind: 'page' | 'post', origin: string, detail: boolean) {
+export function contentDto(raw: Page | Post, kind: 'page' | 'post', origin: string, detail: boolean, locale: string | null) {
+  const doc = localizeDoc(raw, locale ?? undefined);
   const post = kind === 'post' ? doc as Post : null;
   const page = kind === 'page' ? doc as Page : null;
   const result = {
     id: doc.id, kind, slug: doc.slug, title: doc.title,
     collection: post?.collection ?? null,
-    locale: page?.locale || I18N.defaultLocale || null,
-    url: safeUrl(post ? collectionUrl(post.collection, post.slug) : page!.isHome ? localeHomeUrl(page!.locale) : `/${page!.slug}`, origin),
+    locale,
+    url: localizedUrl(safeUrl(post ? collectionUrl(post.collection, post.slug) : page!.isHome ? localeHomeUrl(page!.locale) : `/${page!.slug}`, origin), origin, locale),
     excerpt: post?.excerpt ?? page!.seoDesc,
     tags: post ? publicTags(post.tags) : [],
     image: post ? safeUrl(post.cover, origin) : '', imageAlt: post?.coverAlt ?? '',
@@ -53,7 +56,7 @@ function dto(doc: Page | Post, kind: 'page' | 'post', origin: string, detail: bo
   if (!detail) return result;
   // An intentionally empty canonical editor body must not revive legacy text.
   const html = doc.bodyJson ? doc.bodyHtml : doc.bodyHtml || (post ? renderMarkdown(post.body) : blocksToHtml(page!.blocks));
-  return { ...result, content: { format: 'sanitized-html' as const, html: mobileHtml(html, result.url), dynamicWidgets: 'website-only' as const } };
+  return { ...result, content: { format: 'sanitized-html' as const, html: mobileHtml(html, result.url, locale), dynamicWidgets: 'website-only' as const } };
 }
 function visible(doc: Page | Post, kind: 'page' | 'post') {
   return doc.status === 'published' && (kind === 'page' || Object.hasOwn(CONTENT.collections, (doc as Post).collection));
@@ -62,17 +65,19 @@ export async function listContent(repo: ContentRepository, url: URL) {
   const q = contentQuery.parse(queryParams(url));
   if (q.collection && !Object.hasOwn(CONTENT.collections, q.collection)) throw new ApiError(400, 'Unknown collection.');
   if (q.collection && q.kind === 'page') throw new ApiError(400, 'Pages do not belong to post collections.');
-  if (q.locale && !I18N.locales.includes(q.locale)) throw new ApiError(400, 'Unknown locale.');
+  const locale = mobileLocale(q.locale);
   const origin = siteOrigin(await repo.getSettings(), url);
-  const rows = await repo.listPublicContent({ ...q, collections: Object.keys(CONTENT.collections), defaultLocale: I18N.defaultLocale });
+  const rows = await repo.listPublicContent({ ...q, locale: undefined, collections: Object.keys(CONTENT.collections), defaultLocale: I18N.defaultLocale });
   const items = await Promise.all(rows.slice(0, q.limit).map(async (r) => {
     const doc = r.kind === 'post' ? await repo.getPost(r.id) : await repo.getPage(r.id);
-    return doc && visible(doc, r.kind) ? dto(doc, r.kind, origin, false) : null;
+    return doc && visible(doc, r.kind) ? contentDto(doc, r.kind, origin, false, locale) : null;
   }));
-  return { items: items.filter((x) => x !== null), pagination: { page: q.page, limit: q.limit, nextPage: rows.length > q.limit ? q.page + 1 : null } };
+  return { locale, items: items.filter((x) => x !== null), pagination: { page: q.page, limit: q.limit, nextPage: rows.length > q.limit ? q.page + 1 : null } };
 }
+export const contentDetailQuery = z.object({ kind: z.enum(['post', 'page']).optional(), locale: localeQuery }).strict();
 export async function getContent(repo: ContentRepository, url: URL, id: string) {
-  const q = z.object({ kind: z.enum(['post', 'page']).optional() }).strict().parse(queryParams(url));
+  const q = contentDetailQuery.parse(queryParams(url));
+  const locale = mobileLocale(q.locale);
   // IDs are UUIDs, but restored databases may contain arbitrary legacy IDs.
   if (!id || id.length > 200) throw new ApiError(404, 'Content not found.');
   const post = q.kind === 'page' ? null : await repo.getPost(id);
@@ -81,5 +86,5 @@ export async function getContent(repo: ContentRepository, url: URL, id: string)
   const kind = post ? 'post' : 'page';
   const doc = post ?? page;
   if (!doc || !visible(doc, kind)) throw new ApiError(404, 'Content not found.');
-  return dto(doc, kind, siteOrigin(await repo.getSettings(), url), true);
+  return contentDto(doc, kind, siteOrigin(await repo.getSettings(), url), true, locale);
 }

package/src/lib/mobile/embed.ts

@@ -0,0 +1,83 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import { ApiError } from '../api';
+import { getTheme } from '../theme';
+import { wallNow } from '../sections';
+import { I18N } from '../i18n';
+import { localeQuery, mobileLocale } from './locale';
+import { queryParams } from './http';
+import { publishedPage, visibleSection } from './pages';
+
+// One published section as its own chrome-less document, for apps that have
+// no native component for it (GET /embed/section/<page|home>/<sectionId>).
+// The same visitor rules as the website and /api/v1/pages apply: a hidden,
+// off-schedule, invalid or unknown section is a 404, never a preview.
+
+export const embedQuery = z.object({ locale: localeQuery, scheme: z.enum(['light', 'dark']).optional() }).strict();
+
+export interface EmbedSection {
+  /** The page to hand to ThemeSections (the language's own home when it has one). */
+  page: NonNullable<Awaited<ReturnType<ContentRepository['getPage']>>>;
+  /** Settings whose layout for that page holds only the requested section. */
+  settings: Awaited<ReturnType<ContentRepository['getSettings']>>;
+  sectionId: string;
+  type: string;
+  /** Language to render in (the site default when none was asked for). */
+  locale: string;
+  scheme?: 'light' | 'dark';
+}
+
+export async function embedSection(repo: ContentRepository, url: URL, path: string, now = Date.now()): Promise<EmbedSection> {
+  const q = embedQuery.safeParse(queryParams(url));
+  if (!q.success) throw new ApiError(400, 'Invalid request parameters.');
+  const locale = mobileLocale(q.data.locale);
+  const parts = path.split('/').filter(Boolean);
+  const sectionId = parts.pop() ?? '';
+  const slug = parts.join('/');
+  if (!slug || !sectionId || path.length > 600) throw new ApiError(404, 'Section not found.');
+  const settings = await repo.getSettings();
+  const page = await publishedPage(repo, settings, slug, locale).catch(() => { throw new ApiError(404, 'Section not found.'); });
+  const layout = settings.sectionPages[page.id];
+  const stored = layout?.mode === 'sections' ? layout.sections.find((s) => s.id === sectionId) : undefined;
+  const section = stored && visibleSection(getTheme(settings.activeTheme), stored, wallNow(settings.timezone || 'UTC', now));
+  if (!layout || !stored || !section) throw new ApiError(404, 'Section not found.');
+  return {
+    page, sectionId, type: section.type, scheme: q.data.scheme,
+    locale: locale ?? I18N.defaultLocale ?? '',
+    settings: { ...settings, sectionPages: { ...settings.sectionPages, [page.id]: { ...layout, mode: 'sections', sections: [stored] } } },
+  };
+}
+
+/**
+ * Reports the section's height and hands link taps to the app instead of
+ * navigating: React Native WebView (window.ReactNativeWebView) or, on the
+ * web, the parent window of the iframe. Messages carry only public data.
+ */
+export function embedBridgeScript(sectionId: string): string {
+  return `(function () {
+  var id = ${JSON.stringify(sectionId).replace(/</g, '\\u003c')};
+  var post = function (msg) {
+    msg.acmsSection = id;
+    if (window.ReactNativeWebView) window.ReactNativeWebView.postMessage(JSON.stringify(msg));
+    else if (window.parent !== window) window.parent.postMessage(msg, '*');
+  };
+  var root = document.getElementById('acms-embed');
+  var last = 0;
+  var send = function () {
+    var h = Math.ceil(root.getBoundingClientRect().height);
+    if (h !== last) { last = h; post({ type: 'height', height: h }); }
+  };
+  document.addEventListener('click', function (e) {
+    var a = e.target && e.target.closest ? e.target.closest('a[href]') : null;
+    if (!a) return;
+    var raw = a.getAttribute('href') || '';
+    if (!raw || raw.charAt(0) === '#') return;
+    e.preventDefault();
+    post({ type: 'navigate', href: a.href });
+  }, true);
+  if (window.ResizeObserver) new ResizeObserver(send).observe(root);
+  window.addEventListener('load', send);
+  document.addEventListener('toggle', send, true);
+  send();
+})();`;
+}

package/src/lib/mobile/http.ts

@@ -6,8 +6,9 @@ import type { ContentRepository } from '../repo/types';
 
 const headers = {
   'Access-Control-Allow-Origin': '*',
-  'Access-Control-Allow-Methods': 'GET, HEAD, POST, OPTIONS',
-  'Access-Control-Allow-Headers': 'Content-Type, Idempotency-Key, If-None-Match',
+  'Access-Control-Allow-Methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
+  // Authorization carries editor-app bearer tokens; no route reads cookies
+  'Access-Control-Allow-Headers': 'Authorization, Content-Type, Idempotency-Key, If-None-Match',
   'Access-Control-Expose-Headers': 'ETag, Retry-After, Idempotency-Replayed',
   'X-Content-Type-Options': 'nosniff',
   'Cache-Control': 'no-store',
@@ -18,8 +19,8 @@ export const response = (data: unknown, status = 200, extra: HeadersInit = {}) =
   new Headers(extra).forEach((value, key) => h.set(key, value));
   return Response.json({ version: 1, data }, { status, headers: h });
 };
-export async function publicResponse(request: Request, data: unknown) {
-  const res = response(data);
+export async function publicResponse(request: Request, data: unknown, raw = false) {
+  const res = raw ? Response.json(data, { headers }) : response(data);
   const etag = `"${await sha256Hex(await res.clone().text())}"`;
   res.headers.set('ETag', etag);
   // Revalidate even fresh-looking content: unpublishing must take effect.
@@ -29,12 +30,13 @@ export async function publicResponse(request: Request, data: unknown) {
 }
 export function failure(error: unknown) {
   const status = error instanceof ApiError || error instanceof BookingError ? error.status : error instanceof z.ZodError ? 400 : 500;
-  const codes: Record<number, string> = { 400: 'invalid_request', 404: 'not_found', 405: 'method_not_allowed', 409: 'conflict', 410: 'gone', 413: 'payload_too_large', 415: 'unsupported_media_type', 429: 'rate_limited' };
+  const codes: Record<number, string> = { 400: 'invalid_request', 401: 'unauthorized', 403: 'forbidden', 404: 'not_found', 405: 'method_not_allowed', 409: 'conflict', 410: 'gone', 413: 'payload_too_large', 415: 'unsupported_media_type', 429: 'rate_limited', 502: 'upstream_error' };
   return Response.json({ version: 1, error: {
     code: codes[status] ?? 'internal_error',
     message: status === 500 ? 'Request failed. Please try again.' : error instanceof z.ZodError ? 'Invalid request parameters.' : (error as Error).message,
     ...(error instanceof z.ZodError ? { issues: error.issues.map(({ path, message }) => ({ path, message })) } : {}),
-  } }, { status, headers: { ...headers, ...(status === 429 ? { 'Retry-After': '60' } : {}) } });
+  } }, { status, headers: { ...headers, ...(status === 429 ? { 'Retry-After': '60' } : {}),
+    ...(status === 401 ? { 'WWW-Authenticate': 'Bearer realm="acms", error="invalid_token"' } : {}) } });
 }
 export async function limitRequest(repo: ContentRepository, address: string, write = false) {
   const key = `mobile:${write ? 'write' : 'read'}:${await sha256Hex(address)}`;

package/src/lib/mobile/locale.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+import { ApiError } from '../api';
+import { I18N, localePath } from '../i18n';
+
+export const localeQuery = z.string().min(1).max(35).optional();
+export function mobileLocale(value?: string) {
+  if (value && !I18N.locales.includes(value)) throw new ApiError(400, 'Unknown locale.');
+  return value ?? (I18N.defaultLocale || null);
+}
+export function localizedUrl(value: string, origin: string, locale: string | null) {
+  if (!value || !locale) return value;
+  try {
+    const url = new URL(value, origin);
+    if (url.origin !== new URL(origin).origin || /^\/(?:_|(?:media|api|admin|go)(?:\/|$))|\.[a-z0-9]+$/i.test(url.pathname)) return value;
+    url.pathname = localePath(url.pathname, locale);
+    return url.href;
+  } catch { return value; }
+}