@acms-subir/core 0.3.3-next.20260929113209 → 0.3.3

package/src/lib/editor/me.ts

@@ -0,0 +1,30 @@
+import type { ContentRepository } from '../repo/types';
+import { CONTENT } from '../content';
+import { CALENDAR, bookingsEnabled } from '../calendar/config';
+import { I18N, extraLocales, localeName } from '../i18n';
+import { translationEngine } from '../translate';
+import { siteOrigin } from '../seo';
+import type { EditorPrincipal } from './auth';
+
+/** who is signed in on this device, and what this site lets them do */
+export async function me(repo: ContentRepository, who: EditorPrincipal, url: URL, locals: unknown) {
+  const settings = await repo.getSettings();
+  const owner = who.user.role === 'owner';
+  return {
+    user: who.user,
+    device: { id: who.device.id, name: who.device.name, clientId: who.device.clientId },
+    site: { name: settings.siteTitle, url: siteOrigin(settings, url) },
+    features: {
+      collections: Object.entries(CONTENT.collections).map(([key, c]) => ({ key, singular: c.singular, plural: c.plural })),
+      calendar: CALENDAR.enabled, bookings: bookingsEnabled(),
+      languages: { default: I18N.enabled ? I18N.defaultLocale : null, extra: extraLocales().map((code) => ({ code, name: localeName(code, true) })) },
+      aiTranslation: translationEngine(settings.ai, locals) !== null,
+    },
+    // Non-owner roles retain the existing editor capabilities.
+    permissions: {
+      documents: { edit: true, publish: true },
+      sections: { editContent: true, editLocked: owner, publishSection: true, changeLayout: false },
+      bookings: bookingsEnabled(),
+    },
+  };
+}

package/src/lib/editor/migration.ts

@@ -0,0 +1,57 @@
+// v38: editor apps (staff sign in on their phone through the browser, OAuth
+// 2.0 authorization code + PKCE). Every secret is stored as a SHA-256 hash.
+//
+// editor_devices  one row per signed-in app install; revoking it kills every
+//                 token. session_version pins the user's password generation.
+// editor_tokens   access (short) and refresh (rotating) tokens. Rotated refresh
+//                 tokens keep their row with used_at set: presenting one again
+//                 is token theft, and revokes the whole device.
+// editor_codes    one-time authorization codes (about two minutes, single use)
+// editor_activity what each device changed (actor + device), for the audit trail
+//
+// Triggers make every path that deletes a user or changes their password
+// (Users page, password reset email, restore) sign their devices out.
+const now = "CAST((julianday('now') - 2440587.5) * 86400000 AS INTEGER)";
+const revoke = (reason: string) => `UPDATE editor_devices SET revoked_at=${now}, revoked_reason='${reason}' WHERE user_id=OLD.id AND revoked_at IS NULL;
+    DELETE FROM editor_tokens WHERE device_id IN (SELECT id FROM editor_devices WHERE user_id=OLD.id);`;
+
+export const EDITOR_MIGRATION = { version: 38, statements: [
+  `CREATE TABLE editor_devices (
+    id TEXT PRIMARY KEY, user_id TEXT NOT NULL, name TEXT NOT NULL, client_id TEXT NOT NULL,
+    session_version INTEGER NOT NULL, created_at INTEGER NOT NULL, last_used_at INTEGER NOT NULL,
+    revoked_at INTEGER, revoked_reason TEXT NOT NULL DEFAULT ''
+  )`,
+  `CREATE INDEX editor_devices_user ON editor_devices (user_id, revoked_at)`,
+  `CREATE TABLE editor_tokens (
+    hash TEXT PRIMARY KEY, device_id TEXT NOT NULL, kind TEXT NOT NULL CHECK (kind IN ('access','refresh')),
+    created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, used_at INTEGER
+  )`,
+  `CREATE INDEX editor_tokens_device ON editor_tokens (device_id)`,
+  `CREATE TABLE editor_codes (
+    hash TEXT PRIMARY KEY, user_id TEXT NOT NULL, client_id TEXT NOT NULL, redirect_uri TEXT NOT NULL,
+    challenge TEXT NOT NULL, device_name TEXT NOT NULL, session_version INTEGER NOT NULL,
+    created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, used_at INTEGER, device_id TEXT
+  )`,
+  `CREATE TABLE editor_activity (
+    id TEXT PRIMARY KEY, created_at INTEGER NOT NULL, user_id TEXT NOT NULL, device_id TEXT NOT NULL,
+    action TEXT NOT NULL, target TEXT NOT NULL DEFAULT ''
+  )`,
+  `CREATE INDEX editor_activity_device ON editor_activity (device_id, created_at)`,
+  `CREATE TRIGGER editor_user_delete AFTER DELETE ON users BEGIN ${revoke('user removed')} END`,
+  `CREATE TRIGGER editor_user_password AFTER UPDATE OF session_version ON users
+    WHEN NEW.session_version IS NOT OLD.session_version BEGIN ${revoke('password changed')} END`,
+] };
+
+// v39: a refresh-token grace window and atomic document saves.
+// editor_tokens.parent  the refresh token this pair replaced, so a retried
+//                       refresh (the app lost the response) can be told apart
+//                       from a stolen, replayed one.
+// editor_tokens.used_at on access tokens: set on first use (proves the app
+//                       received that pair).
+// editor_claims         a per-document lock held while a save checks the
+//                       revision and writes, so two saves can't both win.
+export const EDITOR_GRACE_MIGRATION = { version: 39, statements: [
+  `ALTER TABLE editor_tokens ADD COLUMN parent TEXT`,
+  `CREATE INDEX editor_tokens_parent ON editor_tokens (parent)`,
+  `CREATE TABLE editor_claims (key TEXT PRIMARY KEY, created_at INTEGER NOT NULL)`,
+] };

package/src/lib/editor/next.ts

@@ -0,0 +1,11 @@
+/**
+ * A post-login destination: only the editor-app sign-in page on this origin
+ * (with its query), so ?next= can never become an open redirect.
+ */
+export function safeNext(next: string | null | undefined, base: URL): string | null {
+  if (!next || !next.startsWith('/') || next.startsWith('//') || next.includes('\\') || /[\u0000-\u001f]/.test(next)) return null;
+  let url: URL;
+  try { url = new URL(next, base.origin); } catch { return null; }
+  if (url.origin !== base.origin || url.pathname !== '/admin/app-auth' || url.hash) return null;
+  return url.pathname + url.search;
+}

package/src/lib/editor/openapi.ts

@@ -0,0 +1,124 @@
+import { z } from 'zod';
+import * as schemas from './schemas';
+import { ActionInput, CreateInput, EventFields, PageFields, PostFields, listQuery } from './documents';
+import { SectionPatch, SectionsQuery, RevisionInput } from './sections';
+import { AiDocInput, AiSectionInput, ReviewDocInput, ReviewSectionInput, SetDocInput, SetSectionInput } from './translations';
+import { BookingActionInput, InboxQuery } from './bookings';
+import { pageQuery } from '../mobile/http';
+
+// OpenAPI for editor apps: device sign-in (/api/v1/auth/*) and the bearer-only
+// admin API (/api/v1/admin/*). Present in the document for every site; the
+// routes exist only when acms({ mobile: { editor } }) is configured (404 otherwise).
+
+type Json = (schema: z.ZodTypeAny) => unknown;
+const ref = (name: string) => ({ $ref: `#/components/schemas/${name}` });
+const media = (schema: unknown) => ({ 'application/json': { schema } });
+const envelope = (schema: unknown) => ({ type: 'object', required: ['version', 'data'], properties: { version: { const: 1 }, data: schema } });
+const noStore = { 'Cache-Control': { schema: { type: 'string', const: 'no-store' } } };
+const tags = ['Editor'];
+const security = [{ deviceToken: [] }];
+const preflight = { summary: 'CORS preflight', tags, responses: { 204: { description: 'No body.' } } };
+
+export const editorSchemas = schemas;
+
+export function editorPaths(jsonSchema: Json) {
+  const error = (description: string) => ({ description, content: media(ref('Error')) });
+  const errors = {
+    400: error('Invalid request.'), 401: { ...error('Missing, expired or signed-out access token: refresh once, then sign in again.'), headers: { 'WWW-Authenticate': { schema: { type: 'string' } } } },
+    403: error('The signed-in role may not do this (same rules as the web admin).'), 404: error('Not found, or the feature is off.'),
+    429: { ...error('Rate limited per device (600 reads, 60 writes a minute; AI drafts 10, uploads 30).'), headers: { 'Retry-After': { schema: { type: 'string' } } } },
+    500: error('Request failed.'),
+  };
+  const writeErrors = { ...errors, 409: error('Revision conflict or a state that forbids it: reload and try again.'), 413: error('Payload too large.'), 415: error('Unsupported media type.') };
+  const params = (query: z.AnyZodObject) => Object.entries(query.shape).map(([name, s]) => ({ name, in: 'query', required: !(s as z.ZodTypeAny).isOptional(), schema: jsonSchema(s as z.ZodTypeAny) }));
+  const pathParams = (path: string) => [...path.matchAll(/\{(\w+)\}/g)].map((m) => ({
+    name: m[1], in: 'path', required: true,
+    schema: m[1] === 'kind' ? { type: 'string', enum: ['post', 'page', 'event'] } : { type: 'string' },
+  }));
+  const op = (path: string, summary: string, response: string, opts: { query?: z.AnyZodObject; body?: z.ZodTypeAny; write?: boolean; status?: number; description?: string; form?: boolean } = {}) => ({
+    summary, tags, security, ...(opts.description ? { description: opts.description } : {}),
+    parameters: [...pathParams(path), ...(opts.query ? params(opts.query) : [])],
+    ...(opts.body ? { requestBody: { required: true, content: opts.form ? { 'multipart/form-data': { schema: jsonSchema(opts.body) } } : media(jsonSchema(opts.body)) } } : {}),
+    responses: { ...(opts.write ? writeErrors : errors), [opts.status ?? 200]: { description: 'Success.', headers: noStore, content: media(envelope(ref(response))) } },
+  });
+  const P = '/api/v1/admin';
+  const doc = `${P}/documents/{kind}/{id}`, docTr = `${doc}/translations/{locale}`;
+  const sec = `${P}/sections/{pageId}/{sectionId}`, secTr = `${sec}/translations/{locale}`;
+  const SaveBody = z.object({ revision: z.string().max(60), fields: z.union([PostFields, PageFields, EventFields]) }).strict();
+  const Upload = z.object({ file: z.string().describe('The file (binary). Images should be compressed on the device first.'), width: z.string().optional(), height: z.string().optional(), alt: z.string().optional() });
+  const oauth = (summary: string, description: string, body: z.ZodTypeAny, ok: string) => ({
+    summary, description, tags, security: [],
+    requestBody: { required: true, content: { 'application/x-www-form-urlencoded': { schema: jsonSchema(body) }, 'application/json': { schema: jsonSchema(body) } } },
+    responses: {
+      200: { description: 'Success (OAuth shape, no v1 envelope).', headers: noStore, content: media(ref(ok)) },
+      ...Object.fromEntries([400, 404, 415, 429].map((code) => [code, { description: code === 429 ? 'Rate limited (30/minute/client address).' : 'OAuth error (error, error_description).', content: media(ref('EditorOAuthError')) }])),
+    },
+  });
+  const paths: Record<string, unknown> = {
+    '/api/v1/auth/token': {
+      post: oauth('Exchange a sign-in code (+ PKCE verifier) or a refresh token for device tokens',
+        'authorization_code: the one-time code from /admin/app-auth (single use, about two minutes) with the PKCE code_verifier, the same redirect_uri and client_id. refresh_token: rotates — the response carries a new refresh token and the old one stops working; presenting a used refresh token signs the whole device out.',
+        schemas.EditorTokenRequest, 'EditorToken'),
+      options: preflight,
+    },
+    '/api/v1/auth/revoke': {
+      post: oauth('Sign this device out (RFC 7009)', 'Either token revokes the device. Unknown tokens also succeed.', schemas.EditorRevokeRequest, 'EditorRevoked'),
+      options: preflight,
+    },
+    [`${P}/me`]: { get: op(`${P}/me`, 'The signed-in person, device, site features and permissions', 'EditorMe'), options: preflight },
+    [`${P}/documents`]: {
+      get: op(`${P}/documents`, 'Posts, pages or events (staged edits merged), newest change first', 'EditorDocumentList', { query: listQuery }),
+      post: op(`${P}/documents`, 'Start a draft post, page or event', 'EditorDocument', { body: CreateInput, write: true, status: 201 }),
+      options: preflight,
+    },
+    [doc]: {
+      get: op(doc, 'One document as the editor shows it (staged edits merged)', 'EditorDocument'),
+      put: op(doc, 'Save fields (live documents stage them until publish)', 'EditorDocument', { body: SaveBody, write: true,
+        description: 'Same validation as the admin editor. Fields per kind: post, page or event. bodyHtml replaces the body. Status changes use the publish/unpublish/schedule actions.' }),
+      options: preflight,
+    },
+    ...Object.fromEntries(([['publish', 'Publish, or put staged edits live'], ['unpublish', 'Unpublish (back to draft, keeping staged edits)'], ['schedule', 'Schedule publishing (posts and events; body.at)'], ['discard', 'Discard staged edits']] as const)
+      .map(([action, summary]) => [`${doc}/${action}`, { post: op(`${doc}/${action}`, summary, 'EditorDocument', { body: ActionInput, write: true }), options: preflight }])),
+    [docTr]: {
+      get: op(docTr, 'Translation units and review state for one extra language', 'EditorDocumentTranslation'),
+      put: op(docTr, 'Set translated texts (a person’s words are stored as reviewed)', 'EditorDocumentTranslation', { body: SetDocInput, write: true }),
+      options: preflight,
+    },
+    [`${docTr}/review`]: { post: op(`${docTr}/review`, 'Mark translated units reviewed', 'EditorDocumentTranslation', { body: ReviewDocInput, write: true }), options: preflight },
+    [`${docTr}/ai-draft`]: { post: op(`${docTr}/ai-draft`, 'AI drafts for missing (or changed) units; 409 when AI is off', 'EditorDocumentTranslation', { body: AiDocInput, write: true }), options: preflight },
+    [`${P}/sections`]: { get: op(`${P}/sections`, 'Section layouts (staged or live) and the theme’s section definitions', 'EditorSections', { query: SectionsQuery }), options: preflight },
+    [sec]: {
+      patch: op(sec, 'Stage new field values for one section', 'EditorSectionResult', { body: SectionPatch, write: true,
+        description: 'Editors change content only: locked sections and locked fields are owner-only (403). Uses the design revision (409 when stale).' }),
+      options: preflight,
+    },
+    [`${sec}/publish`]: { post: op(`${sec}/publish`, 'Publish just this section’s staged copy', 'EditorRevision', { body: RevisionInput, write: true }), options: preflight },
+    [secTr]: {
+      get: op(secTr, 'Section translation units and review state', 'EditorSectionTranslation'),
+      put: op(secTr, 'Set translated section texts (stored as reviewed)', 'EditorSectionTranslation', { body: SetSectionInput, write: true }),
+      options: preflight,
+    },
+    [`${secTr}/review`]: { post: op(`${secTr}/review`, 'Mark section translation units reviewed', 'EditorSectionTranslation', { body: ReviewSectionInput, write: true }), options: preflight },
+    [`${secTr}/ai-draft`]: { post: op(`${secTr}/ai-draft`, 'AI drafts for a section’s missing units', 'EditorSectionTranslation', { body: AiSectionInput, write: true }), options: preflight },
+    [`${P}/media`]: {
+      get: op(`${P}/media`, 'Media library, newest first', 'EditorMediaList', { query: z.object({ q: z.string().max(200).optional(), type: z.enum(['image', 'document']).optional(), ...pageQuery }).strict() }),
+      post: op(`${P}/media`, 'Upload an image or document (multipart, same types and limits as the admin)', 'EditorMedia', { body: Upload, form: true, write: true, status: 201,
+        description: 'Images up to 30 MB, documents up to 25 MB; optional variant_<width> WebP fields (max 8). Compress images on the device first.' }),
+      options: preflight,
+    },
+    [`${P}/bookings`]: { get: op(`${P}/bookings`, 'Bookings inbox (pending first); requires bookings', 'EditorBookingList', { query: InboxQuery }), options: preflight },
+    ...Object.fromEntries((['approve', 'decline', 'cancel'] as const).map((action) => [`${P}/bookings/{id}/${action}`, {
+      post: op(`${P}/bookings/{id}/${action}`, `${action[0].toUpperCase()}${action.slice(1)} a booking (the guest is emailed)`, 'EditorBooking', { body: BookingActionInput, write: true }),
+      options: preflight,
+    }])),
+  };
+  return paths;
+}
+
+export const editorSecuritySchemes = {
+  deviceToken: { type: 'http', scheme: 'bearer', bearerFormat: 'acms_dev_a_…', description: 'Device access token from POST /api/v1/auth/token. Cookies never authenticate the admin API.' },
+  editorSignIn: {
+    type: 'oauth2', description: 'Browser sign-in for editor apps: authorization code + PKCE (S256). The page is /admin/app-auth; redirect_uri must be listed in acms({ mobile: { editor: { redirectUris } } }).',
+    flows: { authorizationCode: { authorizationUrl: '/admin/app-auth', tokenUrl: '/api/v1/auth/token', refreshUrl: '/api/v1/auth/token', scopes: {} } },
+  },
+};

package/src/lib/editor/schemas.ts

@@ -0,0 +1,91 @@
+import { z } from 'zod';
+import { Booking } from '../schema';
+
+// Response shapes of the editor-app API (OpenAPI components, client types).
+const str = z.string(), bool = z.boolean(), num = z.number(), date = str.datetime();
+const role = z.enum(['contributor', 'author', 'editor', 'administrator', 'owner']);
+const Pagination = z.object({ page: num.int(), limit: num.int(), nextPage: num.int().nullable() });
+const User = z.object({ id: str, name: str, email: str, role });
+
+export const EditorToken = z.object({
+  access_token: str, token_type: z.literal('Bearer'), expires_in: num.int(), refresh_token: str, refresh_token_expires_in: num.int(),
+  user: User, device: z.object({ id: str, name: str }),
+});
+export const EditorOAuthError = z.object({ error: str, error_description: str });
+export const EditorRevoked = z.object({ revoked: z.literal(true) });
+
+export const EditorMe = z.object({
+  user: User, device: z.object({ id: str, name: str, clientId: str }), site: z.object({ name: str, url: str }),
+  features: z.object({
+    collections: z.array(z.object({ key: str, singular: str, plural: str })), calendar: bool, bookings: bool,
+    languages: z.object({ default: str.nullable(), extra: z.array(z.object({ code: str, name: str })) }), aiTranslation: bool,
+  }),
+  permissions: z.object({
+    documents: z.object({ edit: bool, publish: bool }),
+    sections: z.object({ editContent: bool, editLocked: bool, publishSection: bool, changeLayout: bool }),
+    bookings: bool,
+  }),
+});
+
+const kind = z.enum(['post', 'page', 'event']);
+const status = z.enum(['draft', 'scheduled', 'published', 'archived']);
+export const EditorDocumentSummary = z.object({
+  id: str, kind, collection: str.nullable(), title: str, slug: str, status, hasChanges: bool, url: str, image: str, updatedAt: date,
+  /** send back unchanged with every write; 409 when the document changed meanwhile */
+  revision: str,
+});
+export const EditorDocumentList = z.object({ items: z.array(EditorDocumentSummary), total: num.int(), pagination: Pagination });
+export const EditorDocument = EditorDocumentSummary.extend({
+  excerpt: str, bodyHtml: str, tags: z.array(str), cover: str, coverAlt: str, seoTitle: str, seoDesc: str, featured: bool, template: str,
+  authorIds: z.array(str), locale: str.nullable(), isHome: bool, publishedAt: date.nullable(), scheduledAt: date.nullable(), createdAt: date,
+  event: z.object({
+    start: str, end: str, allDay: bool, timezone: str, rrule: str, exdates: z.array(str), cancelled: bool,
+    location: z.object({ name: str, address: str, url: str }), cta: z.object({ label: str, href: str, style: z.enum(['primary', 'outline']) }),
+    calendarIds: z.array(str), fields: z.record(str), rsvp: z.object({ enabled: bool, capacity: num, autoConfirm: bool, maxSeats: num }),
+  }).nullable(),
+  languages: z.array(str),
+});
+
+const SectionTranslation = z.object({ data: z.record(z.unknown()), meta: z.record(z.object({ state: z.enum(['ai', 'reviewed']), src: str })) });
+const SectionInstance = z.object({
+  id: str, type: str, version: num.int(), variant: str, hidden: bool, locked: bool.optional(), showFrom: str.optional(), showUntil: str.optional(),
+  translations: z.record(SectionTranslation).optional(), data: z.record(z.unknown()),
+});
+export const EditorSections = z.object({
+  revision: num.int(), stage: z.enum(['draft', 'live']), hasDraft: bool, role, theme: z.object({ slug: str, name: str }),
+  definitions: z.record(z.object({ name: str, version: num.int(), category: str.nullable(), description: str, variants: z.array(str), fields: z.record(z.unknown()) })),
+  pages: z.array(z.object({
+    pageId: str, title: str, slug: str, isHome: bool, locale: str.nullable(), mode: z.enum(['content', 'sections']),
+    sections: z.array(z.object({
+      id: str, type: str, version: num.int(), variant: str, hidden: bool, locked: bool, showFrom: str.nullable(), showUntil: str.nullable(),
+      data: z.record(z.unknown()), translations: z.record(SectionTranslation), name: str, isNew: bool, changed: bool, editable: bool,
+    })),
+  })),
+});
+export const EditorSectionResult = z.object({ revision: num.int(), section: SectionInstance });
+export const EditorRevision = z.object({ revision: num.int() });
+
+const Unit = z.object({
+  path: str, label: str, kind: z.enum(['text', 'textarea', 'richtext', 'link', 'select']), source: str, value: str,
+  status: z.enum(['missing', 'ai', 'reviewed', 'outdated']),
+});
+const Summary = z.object({ total: num.int(), missing: num.int(), ai: num.int(), reviewed: num.int(), outdated: num.int() });
+export const EditorDocumentTranslation = z.object({ locale: str, revision: str, units: z.array(Unit), summary: Summary, changed: num.int().optional() });
+export const EditorSectionTranslation = z.object({ locale: str, revision: num.int(), units: z.array(Unit), summary: Summary, changed: num.int().optional() });
+
+export const EditorMedia = z.object({
+  id: str, url: str, filename: str, mime: str, width: num, height: num, size: num, alt: str,
+  variants: z.array(z.object({ width: num, url: str })), createdAt: date,
+});
+export const EditorMediaList = z.object({ items: z.array(EditorMedia), pagination: Pagination });
+
+export const EditorBooking = Booking.pick({ id: true, kind: true, status: true, name: true, email: true, phone: true, seats: true, answers: true, source: true, notes: true })
+  .extend({ start: date, end: date, resourceId: str.nullable(), linkId: str.nullable(), eventId: str.nullable(), createdAt: date, updatedAt: date, title: str });
+export const EditorBookingList = z.object({ pending: num.int(), items: z.array(EditorBooking), pagination: Pagination });
+
+/** documented request body for POST /api/v1/auth/token (form-encoded or JSON) */
+export const EditorTokenRequest = z.discriminatedUnion('grant_type', [
+  z.object({ grant_type: z.literal('authorization_code'), code: str, code_verifier: str, redirect_uri: str, client_id: str }).strict(),
+  z.object({ grant_type: z.literal('refresh_token'), refresh_token: str, client_id: str.optional() }).strict(),
+]);
+export const EditorRevokeRequest = z.object({ token: str }).strict();

package/src/lib/editor/sections.ts

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import type { Settings } from '../schema';
+import { ApiError } from '../api';
+import { DesignRequest, runDesignOperation } from '../design-service';
+import type { EditorPrincipal } from './auth';
+
+// Section layouts for editor apps. Every write is a design operation run by
+// the same code as the Design screen (lib/design-service runDesignOperation)
+// with the person's live role: editors change content only (assertContentOnly
+// — no structure, style, visibility or lock changes, nothing locked) and may
+// publish single sections; owners may also edit locked sections. The design
+// revision guards every write (409 when someone else saved first).
+
+type Pages = Settings['sectionPages'];
+type Instance = Pages[string]['sections'][number];
+
+export const SectionsQuery = z.object({ stage: z.enum(['draft', 'live']).default('draft'), pageId: z.string().max(100).optional() }).strict();
+export const SectionPatch = z.object({
+  revision: z.number().int().nonnegative(),
+  /** top-level field values to replace; other fields keep their values */
+  data: z.record(z.string().max(100), z.unknown()),
+}).strict();
+export const RevisionInput = z.object({ revision: z.number().int().nonnegative() }).strict();
+
+export const stagedPages = (s: Settings) => (s.draftDesign?.sectionPages ?? s.sectionPages) as Pages;
+// lazy: the theme registry pulls in Astro templates (keeps the OpenAPI/schema imports light)
+const getTheme = async (slug: string) => (await import('../theme')).getTheme(slug);
+export const stagedTheme = (s: Settings) => getTheme(String(s.draftDesign?.activeTheme ?? s.activeTheme));
+export const designIdentityFor = (who: EditorPrincipal) => ({ actor: who.actor, role: who.user.role === 'owner' ? 'owner' as const : 'editor' as const });
+
+export async function listSections(repo: ContentRepository, query: z.infer<typeof SectionsQuery>, who: EditorPrincipal) {
+  const [settings, pages] = await Promise.all([repo.getSettings(), repo.listPages()]);
+  const draft = query.stage === 'draft';
+  const layouts = draft ? stagedPages(settings) : settings.sectionPages;
+  const theme = draft ? await stagedTheme(settings) : await getTheme(settings.activeTheme);
+  const byId = new Map(pages.map((p) => [p.id, p]));
+  const out = Object.entries(layouts)
+    .filter(([id, layout]) => layout && byId.has(id) && (!query.pageId || query.pageId === id))
+    .map(([id, layout]) => {
+      const p = byId.get(id)!;
+      const liveLayout = settings.sectionPages[id];
+      return {
+        pageId: id, title: p.title, slug: p.slug, isHome: p.isHome, locale: p.locale || null, mode: layout.mode,
+        sections: layout.sections.map((s) => ({
+          id: s.id, type: s.type, version: s.version, variant: s.variant, hidden: s.hidden, locked: Boolean(s.locked),
+          showFrom: s.showFrom ?? null, showUntil: s.showUntil ?? null, data: s.data, translations: s.translations ?? {},
+          name: theme.sections[s.type]?.name ?? s.type,
+          /** new on the page (not live yet): only a full design publish adds it */
+          isNew: !liveLayout?.sections.some((x) => x.id === s.id),
+          changed: draft && JSON.stringify(liveLayout?.sections.find((x) => x.id === s.id) ?? null) !== JSON.stringify(s),
+          editable: who.user.role === 'owner' || !s.locked,
+        })),
+      };
+    });
+  if (query.pageId && !out.length) throw new ApiError(404, 'That page has no section layout.');
+  return {
+    revision: settings.designRevision, stage: query.stage, hasDraft: Boolean(settings.draftDesign?.sectionPages),
+    role: who.user.role, theme: { slug: theme.slug, name: theme.name },
+    definitions: Object.fromEntries(Object.entries(theme.sections).map(([type, d]) => [type, {
+      name: d.name, version: d.version, category: d.category ?? null, description: d.description ?? '', variants: d.variants, fields: d.fields,
+    }])),
+    pages: out,
+  };
+}
+
+export function findSection(pages: Pages, pageId: string, sectionId: string): Instance {
+  const section = pages[pageId]?.sections.find((s) => s.id === sectionId);
+  if (!section) throw new ApiError(404, 'Section not found.');
+  return section;
+}
+
+/** stage one section's changed copy through the shared design rules */
+export async function stageSection(repo: ContentRepository, who: EditorPrincipal, revision: number, pageId: string, sectionId: string, change: (s: Instance) => Instance, origin: string) {
+  const settings = await repo.getSettings();
+  if (settings.designRevision !== revision) throw new ApiError(409, 'Design changed. Pull the latest revision before saving.');
+  const pages = structuredClone(stagedPages(settings));
+  const layout = pages[pageId];
+  const index = layout?.sections.findIndex((s) => s.id === sectionId) ?? -1;
+  if (!layout || index < 0) throw new ApiError(404, 'Section not found.');
+  layout.sections[index] = change(layout.sections[index]);
+  const input = DesignRequest.parse({ operation: 'stage', revision, patch: { sectionPages: pages } });
+  const result = await runDesignOperation(repo, designIdentityFor(who), input, origin);
+  return { revision: result.revision, section: layout.sections[index] };
+}
+
+export async function patchSection(repo: ContentRepository, who: EditorPrincipal, pageId: string, sectionId: string, body: z.infer<typeof SectionPatch>, origin: string) {
+  if (!Object.keys(body.data).length) throw new ApiError(400, 'Send at least one field in data.');
+  return stageSection(repo, who, body.revision, pageId, sectionId, (s) => ({ ...s, data: { ...s.data, ...body.data } as Instance['data'] }), origin);
+}
+
+export async function publishSection(repo: ContentRepository, who: EditorPrincipal, pageId: string, sectionId: string, revision: number, origin: string) {
+  const input = DesignRequest.parse({ operation: 'publishSection', revision, pageId, sectionId });
+  const result = await runDesignOperation(repo, designIdentityFor(who), input, origin);
+  return { revision: result.revision };
+}

package/src/lib/editor/store.ts

@@ -0,0 +1,184 @@
+import { Role } from '../schema';
+import type { SqlDriver } from '../repo/sql';
+
+type Row = Record<string, unknown>;
+
+export interface EditorDevice {
+  id: string; userId: string; name: string; clientId: string; sessionVersion: number;
+  createdAt: number; lastUsedAt: number; revokedAt: number | null; revokedReason: string;
+}
+export interface EditorCode {
+  hash: string; userId: string; clientId: string; redirectUri: string; challenge: string;
+  deviceName: string; sessionVersion: number; createdAt: number; expiresAt: number; usedAt: number | null; deviceId: string | null;
+}
+/** an access token joined with its device and the user's live row */
+export interface EditorAccess {
+  device: EditorDevice;
+  user: { id: string; name: string; email: string; role: Role; sessionVersion: number };
+}
+export interface EditorActivity { id: string; createdAt: number; userId: string; deviceId: string; action: string; target: string }
+
+function device(r: Row): EditorDevice {
+  return { id: String(r.id), userId: String(r.user_id), name: String(r.name), clientId: String(r.client_id), sessionVersion: Number(r.session_version),
+    createdAt: Number(r.created_at), lastUsedAt: Number(r.last_used_at), revokedAt: r.revoked_at == null ? null : Number(r.revoked_at), revokedReason: String(r.revoked_reason ?? '') };
+}
+function code(r: Row): EditorCode {
+  return { hash: String(r.hash), userId: String(r.user_id), clientId: String(r.client_id), redirectUri: String(r.redirect_uri), challenge: String(r.challenge),
+    deviceName: String(r.device_name), sessionVersion: Number(r.session_version), createdAt: Number(r.created_at), expiresAt: Number(r.expires_at),
+    usedAt: r.used_at == null ? null : Number(r.used_at), deviceId: r.device_id == null ? null : String(r.device_id) };
+}
+
+// Storage for editor-app devices, tokens, one-time codes and the activity log.
+// Shared by the D1 and libSQL adapters (plain SQLite). Callers pass hashes
+// only; plaintext secrets never reach this layer.
+export class EditorStore {
+  constructor(private driver: () => Promise<SqlDriver>) {}
+  private async all(sql: string, args: unknown[] = []) { return (await this.driver()).all(sql, args); }
+  private async run(sql: string, args: unknown[] = []) { return (await this.driver()).run(sql, args); }
+
+  // ---- authorization codes ----
+  async createCode(c: Omit<EditorCode, 'usedAt' | 'deviceId' | 'createdAt'>, now: number) {
+    await this.run(`INSERT INTO editor_codes (hash,user_id,client_id,redirect_uri,challenge,device_name,session_version,created_at,expires_at,used_at,device_id)
+      VALUES (?,?,?,?,?,?,?,?,?,NULL,NULL)`, [c.hash, c.userId, c.clientId, c.redirectUri, c.challenge, c.deviceName, c.sessionVersion, now, c.expiresAt]);
+  }
+  /**
+   * Burn a code (single use, even when the rest of the exchange fails).
+   * `reused` = it was already spent: the caller revokes whatever it produced.
+   */
+  async consumeCode(hash: string, now: number): Promise<{ code: EditorCode; reused: boolean } | null> {
+    const rows = await this.all('UPDATE editor_codes SET used_at=? WHERE hash=? AND used_at IS NULL RETURNING *', [now, hash]);
+    if (rows[0]) return { code: code(rows[0]), reused: false };
+    const spent = await this.all('SELECT * FROM editor_codes WHERE hash=?', [hash]);
+    return spent[0] ? { code: code(spent[0]), reused: true } : null;
+  }
+  async bindCode(hash: string, deviceId: string) { await this.run('UPDATE editor_codes SET device_id=? WHERE hash=?', [deviceId, hash]); }
+
+  // ---- devices + tokens ----
+  /** a new device and its first token pair, atomically */
+  async createDevice(d: Pick<EditorDevice, 'id' | 'userId' | 'name' | 'clientId' | 'sessionVersion'>, tokens: { access: string; accessExpires: number; refresh: string; refreshExpires: number }, now: number) {
+    await (await this.driver()).batch([
+      { sql: `INSERT INTO editor_devices (id,user_id,name,client_id,session_version,created_at,last_used_at,revoked_at,revoked_reason) VALUES (?,?,?,?,?,?,?,NULL,'')`,
+        args: [d.id, d.userId, d.name, d.clientId, d.sessionVersion, now, now] },
+      ...this.tokenRows(d.id, tokens, now),
+    ]);
+  }
+  private tokenRows(deviceId: string, t: { access: string; accessExpires: number; refresh: string; refreshExpires: number }, now: number, parent: string | null = null) {
+    return [
+      { sql: `INSERT INTO editor_tokens (hash,device_id,kind,created_at,expires_at,used_at,parent) VALUES (?,?,'access',?,?,NULL,?)`, args: [t.access, deviceId, now, t.accessExpires, parent] },
+      { sql: `INSERT INTO editor_tokens (hash,device_id,kind,created_at,expires_at,used_at,parent) VALUES (?,?,'refresh',?,?,NULL,?)`, args: [t.refresh, deviceId, now, t.refreshExpires, parent] },
+    ];
+  }
+  /**
+   * Spend a refresh token. `reused` = presented after it was rotated (or two
+   * requests raced for it): the caller revokes the device, unless `retry`
+   * says it's the app retrying a refresh whose response it lost.
+   */
+  async spendRefresh(hash: string, now: number): Promise<{ deviceId: string; reused: boolean; expired: boolean; usedAt?: number } | null> {
+    const rows = await this.all(`UPDATE editor_tokens SET used_at=? WHERE hash=? AND kind='refresh' AND used_at IS NULL RETURNING device_id, expires_at`, [now, hash]);
+    if (rows[0]) return { deviceId: String(rows[0].device_id), reused: false, expired: Number(rows[0].expires_at) <= now };
+    const spent = await this.all(`SELECT device_id, used_at, expires_at FROM editor_tokens WHERE hash=? AND kind='refresh'`, [hash]);
+    return spent[0] ? { deviceId: String(spent[0].device_id), reused: true, expired: Number(spent[0].expires_at) <= now, usedAt: Number(spent[0].used_at) } : null;
+  }
+  /**
+   * Grace for a lost response: `hash` was rotated at most `graceMs` ago and
+   * the pair it produced was never used (its refresh token unspent, its
+   * access token never presented), so the app most likely never received
+   * it. Atomically retire that pair: the refresh token is marked spent (if
+   * it ever shows up later, that is reuse and signs the device out) and the
+   * access token is deleted. True when the caller may issue a new pair.
+   */
+  async retireUnusedSuccessor(hash: string, usedAt: number, now: number, graceMs: number): Promise<boolean> {
+    if (!(usedAt > 0) || now - usedAt > graceMs) return false;
+    const usedAccess = await this.all(`SELECT 1 FROM editor_tokens WHERE parent=? AND kind='access' AND used_at IS NOT NULL LIMIT 1`, [hash]);
+    if (usedAccess.length) return false;
+    const claimed = await this.all(`UPDATE editor_tokens SET used_at=? WHERE parent=? AND kind='refresh' AND used_at IS NULL RETURNING hash`, [now, hash]);
+    if (!claimed.length) return false;
+    await this.run(`DELETE FROM editor_tokens WHERE parent=? AND kind='access'`, [hash]);
+    return true;
+  }
+  /** rotation: a fresh pair for the device; earlier access tokens stop working */
+  async rotate(deviceId: string, tokens: { access: string; accessExpires: number; refresh: string; refreshExpires: number }, now: number, parent: string | null = null) {
+    await (await this.driver()).batch([
+      { sql: `DELETE FROM editor_tokens WHERE device_id=? AND kind='access'`, args: [deviceId] },
+      ...this.tokenRows(deviceId, tokens, now, parent),
+      { sql: 'UPDATE editor_devices SET last_used_at=? WHERE id=?', args: [now, deviceId] },
+    ]);
+  }
+  async access(hash: string, now: number): Promise<EditorAccess | null> {
+    const rows = await this.all(`SELECT d.*, t.used_at AS t_used, u.name AS u_name, u.email AS u_email, u.role AS u_role, u.session_version AS u_sv
+      FROM editor_tokens t JOIN editor_devices d ON d.id=t.device_id JOIN users u ON u.id=d.user_id
+      WHERE t.hash=? AND t.kind='access' AND t.expires_at>? AND d.revoked_at IS NULL`, [hash, now]);
+    const r = rows[0];
+    if (!r) return null;
+    // first use proves the app received this pair (ends the refresh grace)
+    if (r.t_used == null) await this.run('UPDATE editor_tokens SET used_at=? WHERE hash=? AND used_at IS NULL', [now, hash]);
+    return { device: device(r), user: { id: String(r.user_id), name: String(r.u_name), email: String(r.u_email), role: Role.parse(r.u_role), sessionVersion: Number(r.u_sv) } };
+  }
+  /** the device a token (access or refresh) belongs to, for revocation */
+  async deviceForToken(hash: string): Promise<string | null> {
+    const rows = await this.all('SELECT device_id FROM editor_tokens WHERE hash=?', [hash]);
+    return rows[0] ? String(rows[0].device_id) : null;
+  }
+  async getDevice(id: string): Promise<EditorDevice | null> {
+    const rows = await this.all('SELECT * FROM editor_devices WHERE id=?', [id]);
+    return rows[0] ? device(rows[0]) : null;
+  }
+  /** signed-in (not revoked) devices, newest use first; one user or everyone */
+  async listDevices(userId?: string): Promise<EditorDevice[]> {
+    const rows = userId
+      ? await this.all('SELECT * FROM editor_devices WHERE user_id=? AND revoked_at IS NULL ORDER BY last_used_at DESC', [userId])
+      : await this.all('SELECT * FROM editor_devices WHERE revoked_at IS NULL ORDER BY last_used_at DESC');
+    return rows.map(device);
+  }
+  async revokeDevice(id: string, reason: string, now: number) {
+    await (await this.driver()).batch([
+      { sql: 'UPDATE editor_devices SET revoked_at=?, revoked_reason=? WHERE id=? AND revoked_at IS NULL', args: [now, reason.slice(0, 100), id] },
+      { sql: 'DELETE FROM editor_tokens WHERE device_id=?', args: [id] },
+    ]);
+  }
+  async revokeUserDevices(userId: string, reason: string, now: number) {
+    await (await this.driver()).batch([
+      { sql: 'UPDATE editor_devices SET revoked_at=?, revoked_reason=? WHERE user_id=? AND revoked_at IS NULL', args: [now, reason.slice(0, 100), userId] },
+      { sql: 'DELETE FROM editor_tokens WHERE device_id IN (SELECT id FROM editor_devices WHERE user_id=?)', args: [userId] },
+    ]);
+  }
+  /** last-used bookkeeping, at most once a minute per device */
+  async touch(id: string, now: number) {
+    await this.run('UPDATE editor_devices SET last_used_at=? WHERE id=? AND last_used_at<?', [now, id, now - 60_000]);
+  }
+
+  // ---- save locks ----
+  /**
+   * A short per-document lock so "check the revision, then write" is atomic:
+   * a second save of the same document while one is in flight gets false
+   * (the caller answers 409). Held only during the save; a lock left by a
+   * crashed request expires after `ttlMs`.
+   */
+  async claim(key: string, now: number, ttlMs = 30_000): Promise<boolean> {
+    const rows = await this.all(`INSERT INTO editor_claims (key, created_at) VALUES (?, ?)
+      ON CONFLICT(key) DO UPDATE SET created_at=excluded.created_at WHERE editor_claims.created_at < ? RETURNING key`, [key.slice(0, 300), now, now - ttlMs]);
+    return rows.length > 0;
+  }
+  async release(key: string) { await this.run('DELETE FROM editor_claims WHERE key=?', [key.slice(0, 300)]); }
+
+  // ---- activity ----
+  async log(a: Omit<EditorActivity, 'id' | 'createdAt'>, now: number) {
+    await this.run('INSERT INTO editor_activity (id,created_at,user_id,device_id,action,target) VALUES (?,?,?,?,?,?)',
+      [crypto.randomUUID(), now, a.userId, a.deviceId, a.action.slice(0, 60), a.target.slice(0, 300)]);
+  }
+  async activity(deviceId: string, limit = 20): Promise<EditorActivity[]> {
+    const rows = await this.all('SELECT * FROM editor_activity WHERE device_id=? ORDER BY created_at DESC LIMIT ?', [deviceId, limit]);
+    return rows.map((r) => ({ id: String(r.id), createdAt: Number(r.created_at), userId: String(r.user_id), deviceId: String(r.device_id), action: String(r.action), target: String(r.target) }));
+  }
+
+  /** expired codes and tokens go; revoked devices are kept 30 days for the record */
+  async prune(now: number) {
+    await (await this.driver()).batch([
+      { sql: 'DELETE FROM editor_codes WHERE expires_at < ?', args: [now - 86_400_000] },
+      { sql: `DELETE FROM editor_tokens WHERE expires_at < ? OR (used_at IS NOT NULL AND used_at < ?)`, args: [now, now - 30 * 86_400_000] },
+      { sql: 'DELETE FROM editor_devices WHERE revoked_at IS NOT NULL AND revoked_at < ?', args: [now - 30 * 86_400_000] },
+      { sql: 'DELETE FROM editor_activity WHERE created_at < ?', args: [now - 365 * 86_400_000] },
+      { sql: 'DELETE FROM editor_claims WHERE created_at < ?', args: [now - 86_400_000] },
+    ]);
+  }
+}