@acms-subir/core 0.3.29 → 0.3.31

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @acms-subir/core
 
+## 0.3.31
+
+### Patch Changes
+
+- 3eaa9a3: Cancelling one date of a repeating event now also cancels that date's RSVPs, the same way cancelling a whole event cancels all of them. Each person gets the "cancelled" email, and no 24-hour reminder goes out for that date. Before, those RSVPs stayed confirmed, nobody was told, and the reminder still went out. RSVPs for the event's other dates aren't touched. Restoring the date doesn't bring the RSVPs back, so people sign up again. RSVPs for a date cancelled before this release get cancelled, with the email, when their reminder would have been due.
+
+  The "Starting soon" push no longer goes out for a cancelled date of a repeating event. Only events cancelled as a whole were skipped before.
+
+  New repository method: `cancelOccurrenceRsvps(eventId, start)`.
+
+- 5d98d6a: The standard privacy notice and terms (`/privacy`, `/terms`) now describe what each site actually does, in English and Spanish, and the owner can complete them in a new **Settings → Legal** card. That's what Apple's 5.1.1, Google Play's User Data policy and Mexico's LFPDPPP expect, and the app stores need it before submission.
+
+  - **Built from the features that are on.** Always covered: site visits and rate limiting, sign-in (built-in or Clerk), forms (missing before), embedded content and Google Fonts, connected tools and backups, cookies with their lifetimes, service providers, retention, rights, children, Do Not Track, and how changes are announced. Covered when turned on: bookings and RSVPs (shown whenever the calendar is on, so RSVP-only sites are covered now), email sign-in in the app, the app and push notifications (token, platform, language and member-chosen topics, Expo → APNs/FCM, removal after the push retention period, how to turn them off), the email and maps providers by name, live video, Umami, and Meta/TikTok pixels. With a pixel on, the "no advertising" sentences are dropped and the Do Not Track answer changes.
+  - **Spanish.** `/es/privacy` and `/es/terms` are in Spanish (the site's language setting decides on single-language sites). Other languages show English, marked `lang="en"`.
+  - **Settings → Legal** (General settings permission):
+    - the legal name, contact email, address, country and who answers privacy requests. Country `MX` adds the ARCO wording, the 20-business-day answer and the data protection authority; any country makes the terms name its law;
+    - the owner's own sections for either page, up to 20, translatable into each site language, for retention, other services, sensitive data and consent;
+    - a summary of what the standard text covers, warnings for missing details, and **App store answers**: how to fill in App Store Connect → App Privacy and Google Play → Data safety for the enabled features, including the in-app deletion expected for email sign-in.
+    - `acms({ legal })` values (now with `address` and `country`) are the defaults for empty fields.
+  - **"Last updated" is automatic.** The date changes only when the wording changes; `legal.updatedAt` is the earliest date shown.
+  - A published `privacy` or `terms` page still replaces the standard text, and now uses its translations on `/es/…`.
+  - `/api/v1/site` adds `legal: { privacy, terms }` (absolute URLs, or null) so apps can link to them.
+
+  Migration 57 adds `settings.legal` (it clears the page cache when saved) and `settings.legal_stamps`. The text describes the framework's behavior; it isn't legal advice, and the pages stay marked as a standard notice, and noindex, until a name and contact email are set.
+
+## 0.3.30
+
+### Patch Changes
+
+- aeaed2c: YouTube **Authorize** (Integrations → Live video) now finishes on sites that use a Clerk development instance. Before, Google's redirect back to `/api/live/oauth/youtube/callback` was always signed out there: development instances set `__client_uat` as `SameSite=Strict`, so the browser drops it from the cross-site return, Clerk answers with a handshake, and the page showed "YouTube authorization didn't finish". The same thing could happen on production when the owner spent more than about a minute on Google's screens and the session token lapsed.
+
+  The callback no longer checks the sign-in. It attaches Google's code, encrypted, to its one-use pending state for up to two minutes. Only the first return counts. It then sends the owner to `/admin/live?live=finish`, where a lapsed sign-in renews like on any admin page. That page finishes with a same-origin request (the new `finishAuthorize` action on `/api/live/settings`, gated like every other owner action), and only the session that started authorization can finish it. The code never appears in a URL again, and nothing changes in Google's setup: the redirect URI is the same. No migration.
+
 ## 0.3.29
 
 ### Patch Changes

package/cli/migrations.generated.mjs

@@ -1065,11 +1065,19 @@ var MIGRATIONS = [
   { version: 56, statements: [
     `ALTER TABLE events ADD COLUMN host_ids TEXT NOT NULL DEFAULT '[]'`,
     `ALTER TABLE events ADD COLUMN request TEXT`
+  ] },
+  // Settings → Legal (Settings.legal): shown on /privacy and /terms, so it
+  // bumps the content version; the automatic "last updated" stamps don't
+  { version: 57, statements: [
+    `ALTER TABLE settings ADD COLUMN legal TEXT NOT NULL DEFAULT '{}'`,
+    `ALTER TABLE settings ADD COLUMN legal_stamps TEXT NOT NULL DEFAULT '{}'`,
+    `DROP TRIGGER content_version_settings_update`,
+    ...contentVersionTriggers("settings", [...CONTENT_VERSION_COLUMNS.settings, "links_verified", "links_avatar_shape", "links_avatar_fit", "links_avatar_scale", "legal"])
   ] }
 ];
 var CURRENT_CONTENT_VERSION_COLUMNS = {
   ...CONTENT_VERSION_COLUMNS,
-  settings: [...CONTENT_VERSION_COLUMNS.settings, "links_verified", "links_avatar_shape", "links_avatar_fit", "links_avatar_scale"],
+  settings: [...CONTENT_VERSION_COLUMNS.settings, "links_verified", "links_avatar_shape", "links_avatar_fit", "links_avatar_scale", "legal"],
   events: [...CONTENT_VERSION_COLUMNS.events, "cancelled_dates"]
 };
 var LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;

package/docs/live-video.md

@@ -28,7 +28,7 @@ ACMS obtains an app token with the client-credentials flow and checks Get Stream
 4. Save the Client ID and Client Secret in ACMS, then choose **Authorize YouTube**. Approve YouTube read-only access using the correct Google/Brand channel identity.
 5. Confirm the available channel, test, and turn the connection on. Selecting another channel requires a new test. A typed channel ID cannot override the authorized identity.
 
-The authorization-code flow uses session-bound, one-use state and PKCE. Access/refresh tokens stay encrypted on the server. ACMS lists active broadcasts, filters to the selected channel and public `live` broadcasts, and checks public video visibility/embedding permission. Private, unlisted and test broadcasts are excluded. Multiple current broadcasts use the latest actual start time with a stable ID tie-break. See [liveBroadcasts.list](https://developers.google.com/youtube/v3/live/docs/liveBroadcasts/list) and [server OAuth](https://developers.google.com/identity/protocols/oauth2/web-server).
+The authorization-code flow uses session-bound, one-use state and PKCE. Google's redirect back is a cross-site request that may arrive without a usable sign-in (a Clerk development instance withholds its `SameSite=Strict` cookie, and a session token can lapse while the owner is on Google's screens). It doesn't need one: it only attaches the code, encrypted, to its pending state for up to two minutes, then sends the owner to `/admin/live?live=finish`. That page finishes with a same-origin request from the signed-in session that began authorization; no other session can finish it, and the code never appears in a URL again. Access/refresh tokens stay encrypted on the server. ACMS lists active broadcasts, filters to the selected channel and public `live` broadcasts, and checks public video visibility/embedding permission. Private, unlisted and test broadcasts are excluded. Multiple current broadcasts use the latest actual start time with a stable ID tie-break. See [liveBroadcasts.list](https://developers.google.com/youtube/v3/live/docs/liveBroadcasts/list) and [server OAuth](https://developers.google.com/identity/protocols/oauth2/web-server).
 
 External OAuth apps left in **Testing** receive refresh tokens for YouTube scopes that expire after seven days. The UI's Testing/Production choice is owner-reported; ACMS cannot verify the app's publishing status. Follow Google's applicable publishing and verification requirements before relying on a long-running connection. A revoked or expired grant requires reauthorization. See [Google token expiration](https://developers.google.com/identity/protocols/oauth2#expiration).
 

package/docs/mobile.md

@@ -307,10 +307,14 @@ a pre-ticked choice doesn't count. So:
   fine once the person has allowed notifications from your explained prompt.
   List the topics they'll get on that screen.
 - Keep a Notifications screen with a switch per topic (`usePushTopics()`) and
-  an "Off" (`unregister()`). The app must work fully with notifications off.
-- Describe push notifications in the app's privacy policy (aviso de privacidad
-  in Mexico) and App Privacy answers. The site stores only the Expo token,
-  platform, language and topics, with no name or email.
+  an "Off" (`unregister()`). Off stays off across restarts (`turnedOff`); don't
+  invite people who turned it off. The app must work fully with notifications off.
+- The site's privacy notice (`/privacy`, `/es/privacy`) already describes push,
+  forms, bookings and email sign-in for the features that are on. The owner
+  completes it in **Settings → Legal**, which also lists the App Privacy and
+  Data safety answers. Link to it inside the app: `useSite().data.legal.privacy`
+  (and `.terms`). The site stores only the Expo token, platform, language and
+  topics, with no name or email.
 
 ## Editor apps (staff sign-in)
 
@@ -551,7 +555,8 @@ npx eas-cli submit --platform ios                    # and android
 Store checklist: real `ios.bundleIdentifier` / `android.package` (can't change
 after release; doctor warns on `com.example.*`); app name, `icon` (1024×1024)
 and splash in `app.json`; `version` and build numbers bumped; `.env` points at
-the **https** production site; privacy policy URL; screenshots for phone and
+the **https** production site; privacy policy URL (`site.legal.privacy`, also
+linked inside the app) and the store privacy answers from Settings → Legal; screenshots for phone and
 tablet; deep-link config deployed on the site; a production build tested on
 real devices; `acms mobile doctor` clean.
 

package/integration.mjs

@@ -73,6 +73,7 @@ const ROUTES = [
   ['/api/ops/status', 'api/ops/status.ts'],
   ['/api/health', 'api/health.ts'],
   ['/api/monitoring', 'api/monitoring.ts'],
+  ['/api/legal', 'api/legal.ts'],
   ['/admin/ai', 'admin/ai.astro'],
   ['/admin/import', 'admin/import.astro'],
   ['/admin/tags', 'admin/tags.astro'],
@@ -623,7 +624,7 @@ function acmsVitePlugin(userConfig) {
  *   the environment. Without a provider, MAPS_URL picks photon and
  *   MAPS_API_KEY picks geoapify; with neither, maps are off — saved places and
  *   pasted map links still work.
- * @param {false | {enabled?: boolean, operatorName?: string, contactEmail?: string, updatedAt?: string}} [options.legal]
+ * @param {false | {enabled?: boolean, operatorName?: string, contactEmail?: string, address?: string, country?: string, updatedAt?: string}} [options.legal]
  *   Default privacy/terms routes and footer links; published CMS pages at those slugs override the text.
  * @param {{provider?: 'builtin' | 'clerk'}} [options.auth] Staff authentication provider. Defaults to builtin.
  * @param {false | {maxAge?: number, staleWhileRevalidate?: number, memory?: boolean}} [options.cache]
@@ -676,8 +677,10 @@ export default function acms(options = {}) {
   const roles = resolveRoles(options.roles, members);
   const permissions = resolvePermissions(options.permissions, roles);
   const maps = resolveMaps(options.maps);
-  const legal = { enabled: true, operatorName: '', contactEmail: '', updatedAt: '', ...(options.legal === false ? { enabled: false } : options.legal ?? {}) };
-  if (typeof legal.enabled !== 'boolean' || ['operatorName','contactEmail','updatedAt'].some(k => typeof legal[k] !== 'string')) throw new Error('acms: invalid legal configuration');
+  const legal = { enabled: true, operatorName: '', contactEmail: '', address: '', country: '', updatedAt: '', ...(options.legal === false ? { enabled: false } : options.legal ?? {}) };
+  if (typeof legal.enabled !== 'boolean' || ['operatorName','contactEmail','address','country','updatedAt'].some(k => typeof legal[k] !== 'string')) throw new Error('acms: invalid legal configuration');
+  legal.country = legal.country.trim().toUpperCase();
+  if (legal.country && !/^[A-Z]{2}$/.test(legal.country)) throw new Error('acms: legal.country must be a two-letter country code such as MX or US');
   if (legal.contactEmail && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(legal.contactEmail)) throw new Error('acms: legal.contactEmail must be an email address');
   if (legal.updatedAt && (!/^\d{4}-\d{2}-\d{2}$/.test(legal.updatedAt) || !Number.isFinite(Date.parse(legal.updatedAt)) || new Date(legal.updatedAt).toISOString().slice(0,10) !== legal.updatedAt)) throw new Error('acms: legal.updatedAt must be a valid YYYY-MM-DD date');
   const auth = { provider: options.auth?.provider === undefined ? 'builtin' : options.auth.provider };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.29",
+  "version": "0.3.31",
   "publishConfig": {
     "access": "public"
   },

package/src/components/LegalPage.astro

@@ -2,26 +2,34 @@
 import Site from '../layouts/Site.astro';
 import WidgetRenderer from './WidgetRenderer.astro';
 import { getRepo } from '../lib/repo';
-import { defaultPolicy, LEGAL } from '../lib/legal';
+import { LEGAL, LEGAL_LANGUAGES, legalPolicy, policyLocale } from '../lib/legal';
 import { expandDynamicBlocks } from '../lib/dynamicBlocks';
+import { requestLocale } from '../lib/i18n';
+import { localizeDoc } from '../lib/translations';
 interface Props { policy: 'privacy' | 'terms' }
 const { policy } = Astro.props;
 const repo = await getRepo(Astro.locals);
 const [settings, page] = await Promise.all([repo.getSettings(), repo.getPageBySlug(policy)]);
-const custom = page?.status === 'published' ? page : null;
-const standard = defaultPolicy(policy, settings);
+const locale = policyLocale(requestLocale(Astro.url, Astro.locals), settings);
+// a published page with this slug replaces the standard text, in each language it's translated into
+const custom = page?.status === 'published' ? localizeDoc(page, requestLocale(Astro.url, Astro.locals)) : null;
+const standard = custom ? null : await legalPolicy(repo, policy, { locale, locals: Astro.locals });
 const html = custom?.bodyHtml ? await expandDynamicBlocks(custom.bodyHtml, repo) : '';
+const t = standard ? LEGAL_LANGUAGES[standard.lang] : null;
+const updated = standard?.updated ? new Intl.DateTimeFormat(locale, { dateStyle: 'long', timeZone: 'UTC' }).format(new Date(`${standard.updated}T12:00:00Z`)) : '';
+const contactEmail = settings.legal.contactEmail || LEGAL.contactEmail;
+const mailto = contactEmail ? `mailto:${contactEmail}` : '';
 ---
-<Site title={custom?.title || standard.title} noindex={!custom && !standard.complete}>
+<Site title={custom?.title || standard!.title} noindex={!custom && !standard!.complete}>
   {custom ? (
     html ? <article class="page-body" set:html={html} /> : <WidgetRenderer pageId={custom.id} blocks={custom.blocks} />
   ) : (
-    <article class="page-body">
-      <h1>{standard.title}</h1>
-      {LEGAL.updatedAt && <p>Last updated: <time datetime={LEGAL.updatedAt}>{LEGAL.updatedAt}</time></p>}
-      {!standard.complete && <p><strong>Standard notice:</strong> The site operator has not yet completed its identity and contact details. This page describes the standard site features and needs the operator’s site-specific information.</p>}
-      {standard.sections.map(section => <section><h2>{section.title}</h2><p>{section.text}</p></section>)}
-      {LEGAL.contactEmail && <p><a href={`mailto:${LEGAL.contactEmail}`}>Contact the site operator</a></p>}
+    <article class="page-body" lang={standard!.lang}>
+      <h1>{standard!.title}</h1>
+      {updated && <p>{t!.updated}: <time datetime={standard!.updated}>{updated}</time></p>}
+      {!standard!.complete && <p><strong>{t!.incomplete}</strong></p>}
+      {standard!.sections.map(section => <section><h2>{section.title}</h2>{section.text.map(p => <p>{p}</p>)}</section>)}
+      {mailto && <p><a href={mailto}>{t!.contact}</a></p>}
     </article>
   )}
 </Site>

package/src/components/LegalSettings.tsx

@@ -0,0 +1,152 @@
+import { useEffect, useState } from 'react';
+import type { LegalAdminState } from '../lib/legal/admin';
+import type { LegalSection, LegalSettings as Legal } from '../lib/legal/types';
+import '../styles/legal-settings.css';
+
+// Settings → Legal: who operates the site and the owner's own sections of the
+// privacy notice and terms (translatable), what the standard text already
+// covers, and the answers for the App Store and Google Play privacy forms.
+
+const ENDPOINT = '/api/legal';
+async function api(body?: Legal): Promise<LegalAdminState> {
+  const res = await fetch(ENDPOINT, {
+    method: body ? 'POST' : 'GET', credentials: 'same-origin',
+    headers: body ? { 'content-type': 'application/json', accept: 'application/json' } : { accept: 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  const data = await res.json().catch(() => null);
+  if (!res.ok) throw new Error(data?.issues?.[0]?.message || data?.error || `${res.status} ${res.statusText || 'Request failed'}`);
+  return data as LegalAdminState;
+}
+const errText = (e: unknown) => (e instanceof Error ? e.message : String(e));
+const newId = () => Math.random().toString(36).slice(2, 10);
+const longDate = (d: string) => new Date(`${d}T12:00:00Z`).toLocaleDateString(undefined, { dateStyle: 'long', timeZone: 'UTC' });
+
+function covered(c: LegalAdminState['covers']): string[] {
+  return [
+    'visits and rate limiting', c.auth === 'clerk' ? 'sign-in with Clerk' : 'staff sign-in', 'forms',
+    ...(c.calendar ? [c.bookings ? 'bookings and RSVPs' : 'event RSVPs'] : []),
+    ...(c.guestSignIn ? ['email-code sign-in in the app'] : []),
+    ...(c.push ? ['the app and push notifications'] : []),
+    ...(c.email ? [`email (${c.email})`] : []), ...(c.maps ? [`maps (${c.maps})`] : []),
+    ...(c.live ? ['live video'] : []),
+    ...(c.analytics.umami ? ['Umami statistics'] : []), ...(c.analytics.meta ? ['Meta Pixel'] : []), ...(c.analytics.tiktok ? ['TikTok Pixel'] : []),
+    ...(c.ai ? ['AI writing tools'] : []),
+    'embedded content and Google Fonts', 'cookies', 'service providers', 'retention', 'rights (including ARCO)', 'children',
+  ];
+}
+
+export default function LegalSettings() {
+  const [state, setState] = useState<LegalAdminState | null>(null);
+  const [form, setForm] = useState<Legal | null>(null);
+  const [error, setError] = useState('');
+  const [note, setNote] = useState('');
+  const [busy, setBusy] = useState(false);
+  useEffect(() => { api().then((s) => { setState(s); setForm(s.legal); }, (e) => setError(errText(e))); }, []);
+  if (!state || !form) return error ? <p className="flash error">{error}</p> : <div className="ma-skel" aria-busy="true" aria-label="Loading"><i /><i /></div>;
+
+  const dirty = JSON.stringify(form) !== JSON.stringify(state.legal);
+  const set = (patch: Partial<Legal>) => setForm({ ...form, ...patch });
+  const setSection = (i: number, patch: Partial<LegalSection>) => set({ sections: form.sections.map((s, j) => (j === i ? { ...s, ...patch } : s)) });
+  const setTranslation = (i: number, code: string, patch: { title?: string; body?: string }) => {
+    const s = form.sections[i];
+    const t = { title: s.translations[code]?.title ?? '', body: s.translations[code]?.body ?? '', ...patch };
+    setSection(i, { translations: { ...s.translations, [code]: t } });
+  };
+  const move = (i: number, by: number) => {
+    const next = [...form.sections];
+    const [s] = next.splice(i, 1);
+    next.splice(i + by, 0, s);
+    set({ sections: next });
+  };
+  const save = async () => {
+    setBusy(true); setError(''); setNote('');
+    try { const s = await api(form); setState(s); setForm(s.legal); setNote('Saved. The pages show it now.'); }
+    catch (e) { setError(errText(e)); } finally { setBusy(false); }
+  };
+
+  return (
+    <div className="lg">
+      {!state.enabled && <p className="flash">The standard pages are off (<code>legal: false</code>). Your site serves its own /privacy and /terms.</p>}
+      {state.warnings.length > 0 && <ul className="lg-warn">{state.warnings.map((w) => <li key={w}>{w}</li>)}</ul>}
+
+      <div className="lg-block">
+        <h3>Who operates this site</h3>
+        <div className="lg-grid">
+          <label className="field"><span>Legal name</span>
+            <input value={form.operatorName} maxLength={200} placeholder={state.defaults.operatorName} onChange={(e) => set({ operatorName: e.target.value })} />
+            <small className="hint">As it appears in your app’s store listing.</small></label>
+          <label className="field"><span>Contact email for privacy</span>
+            <input type="email" value={form.contactEmail} maxLength={200} placeholder={state.defaults.contactEmail || 'privacy@example.org'} onChange={(e) => set({ contactEmail: e.target.value })} /></label>
+          <label className="field lg-wide"><span>Address</span>
+            <textarea rows={2} value={form.address} maxLength={500} placeholder={state.defaults.address || 'Street, city, state, postal code, country'} onChange={(e) => set({ address: e.target.value })} /></label>
+          <label className="field"><span>Country</span>
+            <input value={form.country} maxLength={2} placeholder={state.defaults.country || 'MX, US…'} list="lg-countries" onChange={(e) => set({ country: e.target.value.toUpperCase() })} />
+            <datalist id="lg-countries">{['MX', 'US', 'CA', 'ES', 'CO', 'GT', 'SV', 'HN', 'PR', 'DO', 'AR', 'CL', 'PE'].map((c) => <option key={c} value={c} />)}</datalist>
+            <small className="hint">Two letters. MX adds the ARCO and authority wording.</small></label>
+          <label className="field"><span>Who answers privacy requests</span>
+            <input value={form.privacyContact} maxLength={200} placeholder="e.g. The church office" onChange={(e) => set({ privacyContact: e.target.value })} /></label>
+        </div>
+      </div>
+
+      <div className="lg-block">
+        <h3>Already covered</h3>
+        <p className="hint">The standard text describes what this site does, in English and Spanish, and updates itself when you turn features on or off: {covered(state.covers).join(', ')}.</p>
+        <p className="lg-links">
+          {state.links.privacy && <a href={state.links.privacy} target="_blank" rel="noopener">Privacy notice ↗</a>}
+          {state.links.terms && <a href={state.links.terms} target="_blank" rel="noopener">Terms ↗</a>}
+          {state.updated && <span className="hint">Last updated {longDate(state.updated.privacy)} (privacy) · {longDate(state.updated.terms)} (terms)</span>}
+        </p>
+      </div>
+
+      <div className="lg-block">
+        <h3>Your own sections</h3>
+        <p className="hint">For what the site can’t know: how long you keep records, how to reach you for privacy requests, other services you use, sensitive information you collect and how you ask for consent. Separate paragraphs with a blank line.</p>
+        {form.sections.map((s, i) => (
+          <fieldset key={s.id} className="lg-section">
+            <div className="lg-row">
+              <select value={s.policy} aria-label="Page" onChange={(e) => setSection(i, { policy: e.target.value as LegalSection['policy'] })}>
+                <option value="privacy">Privacy notice</option><option value="terms">Terms</option>
+              </select>
+              <input className="lg-title" value={s.title} maxLength={120} placeholder="Section title" aria-label="Section title" onChange={(e) => setSection(i, { title: e.target.value })} />
+              <button type="button" className="btn ghost" disabled={i === 0} onClick={() => move(i, -1)} aria-label="Move up">↑</button>
+              <button type="button" className="btn ghost" disabled={i === form.sections.length - 1} onClick={() => move(i, 1)} aria-label="Move down">↓</button>
+              <button type="button" className="btn ghost" onClick={() => set({ sections: form.sections.filter((_, j) => j !== i) })}>Remove</button>
+            </div>
+            <textarea rows={4} value={s.body} maxLength={6000} aria-label="Section text" onChange={(e) => setSection(i, { body: e.target.value })} />
+            {state.languages.extra.map((l) => (
+              <details key={l.code} className="lg-tr" open={!!(s.translations[l.code]?.title || s.translations[l.code]?.body)}>
+                <summary>{l.name}{!s.translations[l.code]?.body && s.body ? ' (missing: shows the main text)' : ''}</summary>
+                <input value={s.translations[l.code]?.title ?? ''} maxLength={120} placeholder={s.title} aria-label={`Title in ${l.name}`} onChange={(e) => setTranslation(i, l.code, { title: e.target.value })} />
+                <textarea rows={4} value={s.translations[l.code]?.body ?? ''} maxLength={6000} aria-label={`Text in ${l.name}`} onChange={(e) => setTranslation(i, l.code, { body: e.target.value })} />
+              </details>
+            ))}
+          </fieldset>
+        ))}
+        <button type="button" className="btn" disabled={form.sections.length >= 20} onClick={() => set({ sections: [...form.sections, { id: newId(), policy: 'privacy', title: '', body: '', translations: {} }] })}>Add a section</button>
+      </div>
+
+      {error && <p className="flash error" role="alert">{error}</p>}
+      <div className="form-actions">
+        <button type="button" className="btn primary" disabled={!dirty || busy} onClick={save}>{busy ? 'Saving…' : 'Save'}</button>
+        {dirty ? <button type="button" className="btn ghost" onClick={() => { setForm(state.legal); setError(''); }}>Discard</button> : note && <span className="hint" role="status">{note}</span>}
+      </div>
+
+      <div className="lg-block">
+        <h3>App store answers</h3>
+        <p className="hint">What an app built on this site collects, for App Store Connect → App Privacy and Google Play → Data safety. Review them, and add anything your app’s own code collects.</p>
+        <div className="lg-table" role="table" aria-label="App store answers">
+          <div role="row" className="lg-th"><span role="columnheader">Data</span><span role="columnheader">Apple</span><span role="columnheader">Google Play</span></div>
+          {state.answers.rows.map((r) => (
+            <div role="row" key={r.data}>
+              <span role="cell"><b>{r.data}</b><small className="hint">{r.when}</small></span>
+              <span role="cell">{r.apple}</span><span role="cell">{r.google}</span>
+            </div>
+          ))}
+        </div>
+        <p><b>Tracking:</b> {state.answers.tracking}</p>
+        <ul className="lg-notes">{state.answers.notes.map((n) => <li key={n}>{n}</li>)}</ul>
+      </div>
+    </div>
+  );
+}

package/src/components/LiveManager.tsx

@@ -167,11 +167,23 @@ export default function LiveManager() {
     }
   }
 
+  // Google sent the owner back (?live=finish): the callback parked the code; finish it with this
+  // signed-in session (a same-origin POST, so a lapsed sign-in renews on this page first)
+  async function finishAuthorize() {
+    try {
+      adopt(await api<LiveAdminState>({ action: 'finishAuthorize', provider: 'youtube' }));
+      setPageMsg({ ok: 'YouTube is authorized. Confirm your channel below, then test the connection.', err: '' });
+    } catch (e) {
+      setPageMsg({ ok: '', err: `YouTube authorization didn’t finish: ${errText(e)} Try Authorize again.` });
+      await load();
+    }
+  }
+
   useEffect(() => {
     const q = new URLSearchParams(location.search);
     const r = q.get('live');
-    if (r === 'connected') {
-      setPageMsg({ ok: 'YouTube is authorized. Confirm your channel below, then test the connection.', err: '' });
+    if (r === 'finish') {
+      setPageMsg({ ok: 'Finishing YouTube authorization…', err: '' });
     } else if (r === 'error') {
       setPageMsg({ ok: '', err: 'YouTube authorization didn’t finish. Check that the redirect URI in Google matches exactly, then try Authorize again.' });
     }
@@ -182,7 +194,7 @@ export default function LiveManager() {
       const qs = q.toString();
       history.replaceState(history.state, '', location.pathname + (qs ? `?${qs}` : '') + location.hash);
     }
-    void load();
+    void (r === 'finish' ? finishAuthorize() : load());
     const tick = setInterval(() => setNow(Date.now()), 30_000);
     return () => clearInterval(tick);
   }, []);

package/src/lib/booking/service.ts

@@ -335,12 +335,27 @@ export async function rescheduleBooking(repo: ContentRepository, b: Booking, sta
 export async function sendDueReminders(repo: ContentRepository, opts: FlowOptions): Promise<number> {
   const now = opts.now ?? Date.now();
   const due = await repo.listDueReminders(now + 60 * 60_000, now + 24 * 3600_000);
+  const events = new Map<string, CalEvent | null>();
+  let settings: Settings | undefined;
+  let queued = 0;
   for (const b of due) {
+    // an RSVP for a date cancelled before its RSVPs were cancelled with it
+    // (older versions): cancel it now (the person gets that email) instead of reminding
+    if (b.kind === 'rsvp' && b.eventId) {
+      if (!events.has(b.eventId)) events.set(b.eventId, await repo.getEvent(b.eventId));
+      const e = events.get(b.eventId);
+      settings ??= await repo.getSettings();
+      if (e?.cancelledDates?.length && e.cancelledDates.includes(occurrenceKey(e, b.start, settings))) {
+        await repo.cancelOccurrenceRsvps(e.id, b.start);
+        continue;
+      }
+    }
+    queued++;
     await repo.email.enqueue({dedupe:`${b.id}:${b.notificationVersion}:reminder:${b.email}`,kind:'booking',recipient:b.email,
       payload:JSON.stringify({bookingId:b.id,version:b.notificationVersion,kind:'reminder'}),configVersion:(await repo.email.config())?.version||0,expiresAt:b.start});
   }
   await kickEmail(repo,opts.locals,opts.waitUntil);
-  return due.length;
+  return queued;
 }
 
 // cron: pending bookings nobody answered within the link's deadline get the

package/src/lib/calendar/schedule.ts

@@ -15,6 +15,7 @@ import { addWallDays, findOccurrence, formatWall, parseWall } from './events';
 import { rruleMap, WEEKDAY_CODES, weekdayOf } from './rrule';
 import { eventDeleted } from './hooks';
 import { waitUntilFrom } from '../webhooks';
+import { kickEmail } from '../email/service';
 
 export async function uniqueSlug(repo: ContentRepository, title: string) {
   const base = slugify(title) || 'event';
@@ -167,7 +168,9 @@ export async function undoMove(repo: ContentRepository, undo: MoveUndo, hooks: S
 
 // ---- cancel one date ----------------------------------------------------------
 // The date stays on the calendar struck through ("Cancelled"), its room holds
-// are released, and feeds mark it STATUS:CANCELLED. These do no permission
+// are released, feeds mark it STATUS:CANCELLED, and its RSVPs are cancelled
+// (each person gets the "cancelled" email; no reminder). Restoring the date
+// leaves those RSVPs cancelled: people sign up again. These do no permission
 // checks: callers (admin actions, site code through @acms-subir/core/server)
 // decide who may do this.
 
@@ -182,6 +185,7 @@ async function setOccurrenceCancelled(repo: ContentRepository, id: string, key:
   const has = e.cancelledDates.includes(key);
   if (has === cancel) return e; // already so: nothing to change
   await repo.setEventCancelledDates(id, cancel ? [...e.cancelledDates, key].sort() : e.cancelledDates.filter((x) => x !== key));
+  if (cancel && await repo.cancelOccurrenceRsvps(id, o.start)) await kickEmail(repo, hooks.locals, waitUntilFrom(hooks.locals));
   const after = (await repo.getEvent(id))!;
   await eventSideEffects(repo, hooks, e, after);
   return after;

package/src/lib/legal/admin.ts

@@ -0,0 +1,60 @@
+import type { ContentRepository } from '../repo/types';
+import { I18N, localeName } from '../i18n';
+import { siteOrigin } from '../seo';
+import { LEGAL } from './config';
+import { legalFacts } from './facts';
+import { LEGAL_LANGUAGES, legalLanguage } from './text';
+import { policyUpdated } from './index';
+import { appPrivacyAnswers } from './app-privacy';
+import { LegalSettings } from './types';
+
+// Settings → Legal: the owner's details and sections for /privacy and /terms,
+// what the standard text covers, and the app store answers.
+
+export async function legalAdminState(repo: ContentRepository, url: URL, locals?: unknown) {
+  const [settings, pages] = await Promise.all([repo.getSettings(), repo.listPages()]);
+  const facts = await legalFacts(repo, settings, locals);
+  const origin = siteOrigin(settings, url);
+  const custom = { privacy: pages.some((p) => p.status === 'published' && p.slug === 'privacy'), terms: pages.some((p) => p.status === 'published' && p.slug === 'terms') };
+  const extra = I18N.enabled ? I18N.locales.filter((l) => l !== I18N.defaultLocale) : [];
+  const siteLanguages = I18N.enabled ? I18N.locales : [settings.locale || 'en'];
+  const pixels = facts.analytics.meta || facts.analytics.tiktok;
+  const warnings = [
+    ...(!facts.complete ? ['Add your legal name and a contact email. Until then the pages say they’re a standard notice and ask search engines not to list them.'] : []),
+    ...(!facts.operator.address ? ['Add your address. Mexico’s data protection law asks for the operator’s domicile, and app stores show the operator’s name.'] : []),
+    ...(facts.operator.country === 'MX' && !facts.operator.contact ? ['Name the person or department that answers privacy (ARCO) requests.'] : []),
+    ...(pixels ? ['Meta or TikTok ad pixels are on (Settings → Analytics). The notice says so, but you may also need visitors’ consent before they load, depending on where your visitors are.'] : []),
+    ...(siteLanguages.filter((l) => !LEGAL_LANGUAGES[legalLanguage(l)] || legalLanguage(l) !== l.split('-')[0].toLowerCase()).map((l) => `The standard text has no ${localeName(l)} version yet; ${localeName(l)} pages show it in English.`)),
+    ...(custom.privacy ? ['A published page at /privacy replaces the standard privacy notice. Unpublish it to use the text below.'] : []),
+    ...(custom.terms ? ['A published page at /terms replaces the standard terms. Unpublish it to use the text below.'] : []),
+  ];
+  const link = (slug: 'privacy' | 'terms') => (LEGAL.enabled || custom[slug] ? `${origin}/${slug}` : null);
+  return {
+    enabled: LEGAL.enabled,
+    legal: settings.legal,
+    // what each empty field falls back to (acms({ legal }) config, then the site title)
+    defaults: { operatorName: LEGAL.operatorName || settings.siteTitle, contactEmail: LEGAL.contactEmail, address: LEGAL.address, country: LEGAL.country },
+    languages: { main: I18N.enabled ? I18N.defaultLocale : (settings.locale || 'en'), extra: extra.map((code) => ({ code, name: localeName(code) })) },
+    links: { privacy: link('privacy'), terms: link('terms') },
+    custom,
+    updated: LEGAL.enabled ? { privacy: await policyUpdated(repo, 'privacy', facts, settings), terms: await policyUpdated(repo, 'terms', facts, settings) } : null,
+    covers: {
+      calendar: facts.calendar, bookings: facts.bookings, guestSignIn: facts.guestSignIn, push: facts.push.enabled, auth: facts.auth,
+      email: facts.email, maps: facts.maps, live: facts.live, analytics: facts.analytics, ai: facts.ai,
+    },
+    warnings,
+    answers: appPrivacyAnswers(facts, link('privacy') ?? `${origin}/privacy`),
+  };
+}
+export type LegalAdminState = Awaited<ReturnType<typeof legalAdminState>>;
+
+/** Saves Settings → Legal. Section ids must be unique; translations only for the site's other languages. */
+export async function saveLegal(repo: ContentRepository, raw: unknown) {
+  const input = LegalSettings.parse(raw);
+  const extra = new Set(I18N.enabled ? I18N.locales.filter((l) => l !== I18N.defaultLocale) : []);
+  const seen = new Set<string>();
+  const sections = input.sections.filter((s) => !seen.has(s.id) && !!seen.add(s.id)).map((s) => ({
+    ...s, translations: Object.fromEntries(Object.entries(s.translations).filter(([code, t]) => extra.has(code) && (t.title || t.body))),
+  }));
+  await repo.updateSettings({ legal: { ...input, sections } });
+}

package/src/lib/legal/app-privacy.ts

@@ -0,0 +1,49 @@
+import type { LegalFacts } from './facts';
+
+// Settings → Legal → App store answers: what an app built on this site's
+// public API collects, in the words of Apple's App Privacy form (App Store
+// Connect) and Google Play's Data safety form. Only the site's features; the
+// app's own SDKs (crash reporting, analytics) must be added by its developer.
+
+export interface StoreRow { data: string; when: string; apple: string; google: string }
+export interface AppPrivacyAnswers { rows: StoreRow[]; tracking: string; notes: string[] }
+
+export function appPrivacyAnswers(f: LegalFacts, privacyUrl: string): AppPrivacyAnswers {
+  const rows: StoreRow[] = [];
+  const contact = [...(f.bookings ? ['bookings'] : []), ...(f.appForms ? ['forms'] : [])];
+  if (contact.length) {
+    rows.push({
+      data: 'Name, email address, phone number', when: `When someone sends ${contact.join(' or ')} from the app`,
+      apple: 'Contact Info → Name, Email Address, Phone Number. Purpose: App Functionality. Linked to the user. Not used for tracking.',
+      google: 'Personal info → Name, Email address, Phone number. Collected, not shared. Purpose: App functionality. Optional (people choose to send it).',
+    });
+    rows.push({
+      data: 'Answers typed into a form or booking question', when: `When someone sends ${contact.join(' or ')} from the app`,
+      apple: 'User Content → Other User Content. Purpose: App Functionality. Linked to the user. Not used for tracking.',
+      google: 'App activity → Other user-generated content. Collected, not shared. Purpose: App functionality. Optional.',
+    });
+  }
+  if (f.guestSignIn) rows.push({
+    data: 'Email address (sign-in to see bookings)', when: 'When someone signs in with an emailed code',
+    apple: 'Contact Info → Email Address. Purpose: App Functionality. Linked to the user. Not used for tracking.',
+    google: 'Personal info → Email address. Collected, not shared. Purpose: App functionality, Account management. Optional.',
+  });
+  if (f.push.enabled) rows.push({
+    data: 'Push token, platform, language and chosen topics', when: 'When someone turns on notifications',
+    apple: 'Identifiers → Device ID. Purpose: App Functionality. Linked to the user. Not used for tracking.',
+    google: 'Device or other IDs. Collected, not shared (Expo, Apple and Google deliver on your behalf). Purpose: App functionality, Developer communications. Optional.',
+  });
+  rows.push({
+    data: 'IP address', when: 'Every request (rate limiting only)',
+    apple: 'Usually not declared: only a scrambled copy is kept, in counters that expire after about a minute. To be cautious, declare Other Data → Other Data Types, App Functionality, not linked.',
+    google: 'Usually not declared for the same reason. To be cautious: Device or other IDs, processed ephemerally, App functionality and Fraud prevention, security.',
+  });
+  const notes = [
+    'The site encrypts data in transit (HTTPS): answer “Yes” to “Is all of the user data collected by your app encrypted in transit?” in Google Play, once the site runs on https.',
+    `People can ask for their data to be deleted by writing to ${f.operator.email || 'your contact address (set it above)'}${f.push.enabled ? '; turning notifications off removes their device at once' : ''}. Use ${privacyUrl} as the privacy policy URL in both stores, and link to it inside the app too.`,
+    'Not used for tracking: the app doesn’t load the website’s analytics or ad pixels. If you add an SDK that tracks (ads, attribution), these answers change.',
+    'Add whatever the app itself collects: crash reporting, analytics or update SDKs (for example Sentry or Expo Updates) are not included here.',
+    ...(f.guestSignIn ? ['Signing in with an emailed code creates an account in the stores’ eyes. Apple (guideline 5.1.1(v)) and Google Play expect a way to delete it inside the app, plus a web link for Google. Offer “Sign out and delete my sign-in” (useGuest().signOut()) and say how to ask for bookings to be deleted.'] : []),
+  ];
+  return { rows, tracking: 'No: neither the site’s app API nor the packaged app components track people across other companies’ apps or websites.', notes };
+}

package/src/lib/legal/config.ts

@@ -0,0 +1,4 @@
+import { userConfig } from 'virtual:acms-config';
+
+// acms({ legal }) config: defaults for Settings → Legal. `legal: false` removes /privacy and /terms.
+export const LEGAL = { enabled: true, operatorName: '', contactEmail: '', updatedAt: '', address: '', country: '', ...userConfig.legal };