@acms-subir/core 0.3.3-next.20260929113209 → 0.3.3

package/src/pages/api/v1/admin/documents/[kind]/[id]/translations/[locale]/index.ts

@@ -0,0 +1,18 @@
+import { editorRoute, logWrite } from '../../../../../../../../../lib/editor/http';
+import { DocKindParam } from '../../../../../../../../../lib/editor/documents';
+import { SetDocInput, changeDocTranslation, getDocTranslation } from '../../../../../../../../../lib/editor/translations';
+import { methodNotAllowed } from '../../../../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../../../../lib/api';
+import { invalidateRedirectCache } from '../../../../../../../../../middleware';
+export { preflight as OPTIONS } from '../../../../../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, context: { params } }) => getDocTranslation(repo, DocKindParam.parse(params.kind), params.id!, params.locale!));
+// a person's words: stored as reviewed
+export const PUT = editorRoute(async (c) => {
+  const { params } = c.context;
+  const kind = DocKindParam.parse(params.kind);
+  const body = SetDocInput.parse(await readJson(c.context.request, 2_500_000));
+  const result = await changeDocTranslation(c.repo, kind, params.id!, params.locale!, body.revision, { op: 'set', values: body.values }, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache });
+  await logWrite(c, 'translate', `${kind}:${params.id}:${params.locale}`);
+  return result;
+}, { write: true });
+export const ALL = () => methodNotAllowed('GET, PUT, OPTIONS');

package/src/pages/api/v1/admin/documents/index.ts

@@ -0,0 +1,13 @@
+import { editorRoute, logWrite } from '../../../../../lib/editor/http';
+import { CreateInput, createDoc, docJson, listDocs, listQuery } from '../../../../../lib/editor/documents';
+import { methodNotAllowed, queryParams } from '../../../../../lib/mobile/http';
+import { readJson } from '../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, context }) => listDocs(repo, listQuery.parse(queryParams(context.url))));
+export const POST = editorRoute(async (c) => {
+  const input = CreateInput.parse(await readJson(c.context.request, 20_000));
+  const doc = await createDoc(c.repo, input, c.who.user.id);
+  await logWrite(c, 'create', `${input.kind}:${doc.id}`);
+  return docJson(input.kind, doc);
+}, { write: true, status: 201 });
+export const ALL = () => methodNotAllowed('GET, POST, OPTIONS');

package/src/pages/api/v1/admin/me.ts

@@ -0,0 +1,6 @@
+import { editorRoute } from '../../../../lib/editor/http';
+import { me } from '../../../../lib/editor/me';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const GET = editorRoute(({ repo, who, context }) => me(repo, who, context.url, context.locals));
+export const ALL = () => methodNotAllowed('GET, OPTIONS');

package/src/pages/api/v1/admin/media/index.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+import { editorRoute, logWrite } from '../../../../../lib/editor/http';
+import { methodNotAllowed, pageQuery, queryParams } from '../../../../../lib/mobile/http';
+import { ApiError, readResponseBytes } from '../../../../../lib/api';
+import { MAX_UPLOAD_BODY, storeUpload } from '../../../../../lib/media/upload';
+import type { Media } from '../../../../../lib/schema';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+const view = (m: Media) => ({ id: m.id, url: `/media/${m.key}`, filename: m.filename, mime: m.mime, width: m.width, height: m.height, size: m.size, alt: m.alt,
+  variants: m.variants.map((v) => ({ width: v.w, url: `/media/${v.key}` })), createdAt: new Date(m.createdAt).toISOString() });
+const ListQuery = z.object({ q: z.string().max(200).optional(), type: z.enum(['image', 'document']).optional(), ...pageQuery }).strict();
+export const GET = editorRoute(async ({ repo, context }) => {
+  const q = ListQuery.parse(queryParams(context.url));
+  let list = await repo.listMedia();
+  if (q.type) list = list.filter((m) => (q.type === 'image') === m.mime.startsWith('image/'));
+  if (q.q) { const needle = q.q.toLowerCase(); list = list.filter((m) => `${m.filename} ${m.alt}`.toLowerCase().includes(needle)); }
+  list.sort((a, b) => b.createdAt - a.createdAt);
+  const start = (q.page - 1) * q.limit;
+  return { items: list.slice(start, start + q.limit).map(view), pagination: { page: q.page, limit: q.limit, nextPage: start + q.limit < list.length ? q.page + 1 : null } };
+});
+// same types, limits and storage as the admin uploader (images arrive pre-compressed)
+export const POST = editorRoute(async (c) => {
+  const type = c.context.request.headers.get('content-type') ?? '';
+  if (!type.toLowerCase().startsWith('multipart/form-data')) throw new ApiError(415, 'Use Content-Type: multipart/form-data with a "file" field.');
+  const bytes = await readResponseBytes(c.context.request, MAX_UPLOAD_BODY);
+  let form: FormData;
+  try { form = await new Response(bytes as BodyInit, { headers: { 'content-type': type } }).formData(); }
+  catch { throw new ApiError(400, 'The upload is not valid multipart form data.'); }
+  const media = await storeUpload(form, c.context.locals, c.repo);
+  await logWrite(c, 'upload', `media:${media.id}`);
+  return view(media);
+}, { write: true, status: 201, limit: 30 });
+export const ALL = () => methodNotAllowed('GET, POST, OPTIONS');

package/src/pages/api/v1/admin/sections/[pageId]/[sectionId]/index.ts

@@ -0,0 +1,14 @@
+import { editorRoute, logWrite } from '../../../../../../../lib/editor/http';
+import { SectionPatch, patchSection } from '../../../../../../../lib/editor/sections';
+import { methodNotAllowed } from '../../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../../../lib/mobile/http';
+// stage new field values for one section (content only for editors; locks apply)
+export const PATCH = editorRoute(async (c) => {
+  const { pageId, sectionId } = c.context.params;
+  const body = SectionPatch.parse(await readJson(c.context.request, 500_000));
+  const result = await patchSection(c.repo, c.who, pageId!, sectionId!, body, c.context.url.origin);
+  await logWrite(c, 'section', `${pageId}:${sectionId}`);
+  return result;
+}, { write: true });
+export const ALL = () => methodNotAllowed('PATCH, OPTIONS');

package/src/pages/api/v1/admin/sections/[pageId]/[sectionId]/publish.ts

@@ -0,0 +1,14 @@
+import { editorRoute, logWrite } from '../../../../../../../lib/editor/http';
+import { RevisionInput, publishSection } from '../../../../../../../lib/editor/sections';
+import { methodNotAllowed } from '../../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../../../lib/mobile/http';
+// publish just this section's staged copy (same rules as the Design screen)
+export const POST = editorRoute(async (c) => {
+  const { pageId, sectionId } = c.context.params;
+  const body = RevisionInput.parse(await readJson(c.context.request, 5_000));
+  const result = await publishSection(c.repo, c.who, pageId!, sectionId!, body.revision, c.context.url.origin);
+  await logWrite(c, 'section-publish', `${pageId}:${sectionId}`);
+  return result;
+}, { write: true });
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/admin/sections/[pageId]/[sectionId]/translations/[locale]/[action].ts

@@ -0,0 +1,22 @@
+import type { APIRoute } from 'astro';
+import { editorRoute, logWrite } from '../../../../../../../../../lib/editor/http';
+import { AiSectionInput, ReviewSectionInput, changeSectionTranslation } from '../../../../../../../../../lib/editor/translations';
+import { failure, methodNotAllowed } from '../../../../../../../../../lib/mobile/http';
+import { ApiError, readJson } from '../../../../../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../../../../../lib/mobile/http';
+const handler = (ai: boolean) => editorRoute(async (c) => {
+  const { params } = c.context;
+  const raw = await readJson(c.context.request, 10_000);
+  const mode = ai ? (() => { const b = AiSectionInput.parse(raw); return { revision: b.revision, mode: { op: 'ai' as const, paths: b.paths, includeReviewed: b.includeReviewed } }; })()
+    : (() => { const b = ReviewSectionInput.parse(raw); return { revision: b.revision, mode: { op: 'review' as const, paths: b.paths } }; })();
+  const result = await changeSectionTranslation(c.repo, c.who, params.pageId!, params.sectionId!, params.locale!, mode.revision, mode.mode, c.context.url.origin, c.context.locals);
+  await logWrite(c, ai ? 'translate-ai' : 'translate-review', `${params.pageId}:${params.sectionId}:${params.locale}`);
+  return result;
+}, { write: true, ...(ai ? { limit: 10 } : {}) });
+const review = handler(false), aiDraft = handler(true);
+export const POST: APIRoute = (context) => {
+  if (context.params.action === 'review') return review(context);
+  if (context.params.action === 'ai-draft') return aiDraft(context);
+  return failure(new ApiError(404, 'Unknown action.'));
+};
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/admin/sections/[pageId]/[sectionId]/translations/[locale]/index.ts

@@ -0,0 +1,14 @@
+import { editorRoute, logWrite } from '../../../../../../../../../lib/editor/http';
+import { SetSectionInput, changeSectionTranslation, getSectionTranslation } from '../../../../../../../../../lib/editor/translations';
+import { methodNotAllowed } from '../../../../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, context: { params } }) => getSectionTranslation(repo, params.pageId!, params.sectionId!, params.locale!));
+export const PUT = editorRoute(async (c) => {
+  const { params } = c.context;
+  const body = SetSectionInput.parse(await readJson(c.context.request, 500_000));
+  const result = await changeSectionTranslation(c.repo, c.who, params.pageId!, params.sectionId!, params.locale!, body.revision, { op: 'set', values: body.values }, c.context.url.origin, c.context.locals);
+  await logWrite(c, 'translate', `${params.pageId}:${params.sectionId}:${params.locale}`);
+  return result;
+}, { write: true });
+export const ALL = () => methodNotAllowed('GET, PUT, OPTIONS');

package/src/pages/api/v1/admin/sections/index.ts

@@ -0,0 +1,6 @@
+import { editorRoute } from '../../../../../lib/editor/http';
+import { SectionsQuery, listSections } from '../../../../../lib/editor/sections';
+import { methodNotAllowed, queryParams } from '../../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, who, context }) => listSections(repo, SectionsQuery.parse(queryParams(context.url)), who));
+export const ALL = () => methodNotAllowed('GET, OPTIONS');

package/src/pages/api/v1/auth/revoke.ts

@@ -0,0 +1,5 @@
+import type { APIRoute } from 'astro';
+import { authPreflight, revokeRoute } from '../../../../lib/editor/token-route';
+// Editor apps: sign this device out (RFC 7009). Either token revokes the device.
+export const POST: APIRoute = (context) => revokeRoute(context);
+export const OPTIONS: APIRoute = () => authPreflight();

package/src/pages/api/v1/auth/token.ts

@@ -0,0 +1,5 @@
+import type { APIRoute } from 'astro';
+import { authPreflight, tokenRoute } from '../../../../lib/editor/token-route';
+// Editor apps: exchange a sign-in code (+ PKCE verifier) or a refresh token for device tokens.
+export const POST: APIRoute = (context) => tokenRoute(context);
+export const OPTIONS: APIRoute = () => authPreflight();

package/src/pages/api/v1/devices/[token].ts

@@ -0,0 +1,20 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../../lib/repo';
+import { unregisterDevice, updateDevice } from '../../../../lib/push/api';
+import { failure, limitRequest, methodNotAllowed, response } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+// PUT: change topics/locale. DELETE: opt out (idempotent).
+function handler(run: (repo: Awaited<ReturnType<typeof getRepo>>, request: Request, token: string) => Promise<unknown>): APIRoute {
+  return async context => {
+    try {
+      const repo = await getRepo(context.locals);
+      let address = 'unknown';
+      try { address = context.clientAddress || address; } catch { /* shared fallback bucket */ }
+      await limitRequest(repo, address, true);
+      return response(await run(repo, context.request, context.params.token ?? ''));
+    } catch (error) { return failure(error); }
+  };
+}
+export const PUT = handler((repo, request, token) => updateDevice(repo, request, token));
+export const DELETE = handler((repo, _request, token) => unregisterDevice(repo, token));
+export const ALL = () => methodNotAllowed('PUT, DELETE, OPTIONS');

package/src/pages/api/v1/devices/index.ts

@@ -0,0 +1,17 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../../lib/repo';
+import { registerDevice } from '../../../../lib/push/api';
+import { failure, limitRequest, methodNotAllowed, response } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+// Register or refresh this device's Expo push token (only when push is enabled).
+export const POST: APIRoute = async context => {
+  try {
+    const repo = await getRepo(context.locals);
+    let address = 'unknown';
+    try { address = context.clientAddress || address; } catch { /* shared fallback bucket */ }
+    await limitRequest(repo, address, true);
+    const result = await registerDevice(repo, context.request);
+    return response(result, result.created ? 201 : 200);
+  } catch (error) { return failure(error); }
+};
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/openapi.json.ts

@@ -0,0 +1,7 @@
+import { getOpenApi } from '../../../lib/mobile/openapi';
+import { readRoute } from '../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../lib/mobile/http';
+export const GET = readRoute(getOpenApi, true, true);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/pages/[...slug].ts

@@ -0,0 +1,7 @@
+import { getPage } from '../../../../lib/mobile/pages';
+import { readRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const GET = readRoute(getPage);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/pages/home.ts

@@ -0,0 +1,7 @@
+import { getPage } from '../../../../lib/mobile/pages';
+import { readRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const GET = readRoute((repo, url) => getPage(repo, url, 'home'));
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/push/topics.ts

@@ -0,0 +1,7 @@
+import { listPushTopics } from '../../../../lib/push/api';
+import { readRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const GET = readRoute(listPushTopics, true);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/site.ts

@@ -0,0 +1,7 @@
+import { getSite } from '../../../lib/mobile/site';
+import { readRoute } from '../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../lib/mobile/http';
+export const GET = readRoute(getSite);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/theme.ts

@@ -0,0 +1,7 @@
+import { getThemeTokens } from '../../../lib/mobile/site';
+import { readRoute } from '../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../lib/mobile/http';
+export const GET = readRoute(getThemeTokens);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/blog/[slug].astro

@@ -1,4 +1,6 @@
 ---
+import { requestLocale } from '../../lib/i18n';
+import { localizeDoc, isExtraLocale } from '../../lib/translations';
 import Site from '../../layouts/Site.astro';
 import { getRepo } from '../../lib/repo';
 import { renderMarkdown } from '../../lib/markdown';
@@ -20,7 +22,10 @@ if (!col) return new Response(null, { status: 404, statusText: 'Not found' });
 
 const { slug } = Astro.params;
 const repo = await getRepo(Astro.locals);
-const post = slug ? await repo.getPostBySlug(slug, col.key) : null;
+// another language (/es/…): translated words over the shared post
+const locale = requestLocale(Astro.url, Astro.locals);
+const rawPost = slug ? await repo.getPostBySlug(slug, col.key) : null;
+const post = rawPost ? localizeDoc(rawPost, locale) : null;
 
 const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
 if (!post || (post.status !== 'published' && !isAdmin)) {
@@ -35,7 +40,8 @@ const [tags, allUsers, allPosts, rawSettings, allMedia] = await Promise.all([
   post.cover.startsWith('/media/') ? repo.listMedia() : Promise.resolve([]),
 ]);
 // ?designPreview=1 (admin-only) renders the staged Design-screen changes
-const settings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+const baseSettings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+const settings = isExtraLocale(locale) ? { ...baseSettings, locale } : baseSettings;
 // ordered author objects; the first is the primary (gets the author card)
 const authors = authorIds
   .map((id) => allUsers.find((u) => u.id === id))

package/src/pages/blog/index.astro

@@ -8,6 +8,8 @@ import { formatDate } from '../../lib/dates';
 import { resolveDesign } from '../../lib/theme';
 import { effectiveSettings } from '../../lib/designPreview';
 import { collectionFromPath, collectionUrl, tagUrl } from '../../lib/content';
+import { requestLocale, localePath } from '../../lib/i18n';
+import { localizeDoc, isExtraLocale } from '../../lib/translations';
 
 // One file serves every collection's index — injectRoute can't pass props,
 // so the collection is resolved from the request path.
@@ -16,8 +18,13 @@ if (!col) return new Response(null, { status: 404, statusText: 'Not found' });
 
 const PAGE_SIZE = 12;
 const repo = await getRepo(Astro.locals);
-const [allPosts, tags, users, rawSettings] = await Promise.all([repo.listPublishedPosts(col.key), repo.listTags(), repo.listUsers(), repo.getSettings()]);
-const settings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+// another language (/es/blog): translated titles/excerpts, links stay in the language
+const locale = requestLocale(Astro.url, Astro.locals);
+const lp = (path: string) => (isExtraLocale(locale) ? localePath(path, locale) : path);
+const [rawPosts, tags, users, rawSettings] = await Promise.all([repo.listPublishedPosts(col.key), repo.listTags(), repo.listUsers(), repo.getSettings()]);
+const allPosts = rawPosts.map((p) => localizeDoc(p, locale));
+const baseSettings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+const settings = isExtraLocale(locale) ? { ...baseSettings, locale } : baseSettings;
 const design = resolveDesign(settings);
 
 // page 1 leads with the featured post (if any) as a big split card; it's
@@ -81,7 +88,7 @@ const iso = (ts: number | null) => (ts ? new Date(ts).toISOString() : undefined)
       <PostCard
         variant="feature"
         headingLevel={2}
-        href={collectionUrl(col.key, lead.slug)}
+        href={lp(collectionUrl(col.key, lead.slug))}
         title={lead.title}
         excerpt={lead.excerpt}
         cover={lead.cover}
@@ -99,7 +106,7 @@ const iso = (ts: number | null) => (ts ? new Date(ts).toISOString() : undefined)
         <PostCard
           variant={layout === 'cards' ? 'card' : 'row'}
           headingLevel={2}
-          href={collectionUrl(col.key, p.slug)}
+          href={lp(collectionUrl(col.key, p.slug))}
           title={p.title}
           excerpt={p.excerpt}
           cover={p.cover}

package/src/pages/embed/section/[...path].astro

@@ -0,0 +1,42 @@
+---
+import Site from '../../../layouts/Site.astro';
+import ThemeSections from '../../../components/ThemeSections.astro';
+import { getRepo } from '../../../lib/repo';
+import { ApiError } from '../../../lib/api';
+import { I18N } from '../../../lib/i18n';
+import { embedSection, embedBridgeScript } from '../../../lib/mobile/embed';
+
+// One published section, chrome-less, for mobile apps without a native
+// component for it: GET /embed/section/<page slug|home>/<section id>
+//   ?locale=es       the language to render (default: the site's)
+//   ?scheme=dark     light/dark for themes that follow the device
+// The document posts its height and link taps to the app (see
+// lib/mobile/embed.ts); it never navigates itself.
+const repo = await getRepo(Astro.locals);
+let embed;
+try {
+  embed = await embedSection(repo, Astro.url, Astro.params.path ?? '');
+} catch (error) {
+  const status = error instanceof ApiError ? error.status : 500;
+  return new Response((status === 400 ? 'Bad request' : status === 404 ? 'Not found' : 'Error'), { status, headers: { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store', 'X-Robots-Tag': 'noindex' } });
+}
+if (I18N.enabled && embed.locale && embed.locale !== I18N.defaultLocale) (Astro.locals as { acmsLocale?: string }).acmsLocale = embed.locale;
+Astro.response.headers.set('Content-Security-Policy', 'frame-ancestors *');
+Astro.response.headers.set('Cache-Control', 'public, max-age=0, must-revalidate');
+Astro.response.headers.set('X-Robots-Tag', 'noindex');
+---
+
+<Site title="Section" bare noindex>
+  <div id="acms-embed" data-section={embed.sectionId} data-scheme={embed.scheme}>
+    <ThemeSections page={embed.page} settings={embed.settings} locale={embed.locale} editable={false} />
+  </div>
+  <style is:global>
+    html, body { background: var(--bg); }
+    main.site-main { max-width: none; margin: 0; padding: 0; }
+    #acms-embed { display: flow-root; }
+    #acms-embed .acms-sections { margin: 0; }
+    #acms-embed .acms-section { padding: 0; }
+    astro-dev-toolbar { display: none !important; }
+  </style>
+  <script is:inline set:html={embedBridgeScript(embed.sectionId)} />
+</Site>

package/src/pages/events/[slug].astro

@@ -1,4 +1,6 @@
 ---
+import { requestLocale } from '../../lib/i18n';
+import { localizeDoc, isExtraLocale } from '../../lib/translations';
 import Site from '../../layouts/Site.astro';
 import EventPage from '../../components/EventPage.astro';
 import { getRepo } from '../../lib/repo';
@@ -21,13 +23,16 @@ import { waitUntilFrom } from '../../lib/webhooks';
 // repeating event — the calendar grid links carry it.
 if (!CALENDAR.enabled) return new Response(null, { status: 404, statusText: 'Not found' });
 const repo = await getRepo(Astro.locals);
-const event = await repo.getEventBySlug(Astro.params.slug ?? '');
+const locale = requestLocale(Astro.url, Astro.locals);
+const rawEvent = await repo.getEventBySlug(Astro.params.slug ?? '');
+const event = rawEvent ? localizeDoc(rawEvent, locale) : null;
 const [rawSettings, allCalendars] = await Promise.all([repo.getSettings(), repo.listCalendars()]);
 const calMap = new Map(allCalendars.map((c) => [c.id, c]));
 const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
 if (!event || (!eventIsPublic(event, calMap) && !isAdmin)) return new Response(null, { status: 404, statusText: 'Not found' });
 
-const settings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+const baseSettings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+const settings = isExtraLocale(locale) ? { ...baseSettings, locale } : baseSettings;
 const now = Date.now();
 const on = Astro.url.searchParams.get('on') ?? undefined;
 const occurrence = featuredOccurrence(event, settings, now, on && /^\d{4}-\d{2}-\d{2}$/.test(on) ? on : undefined);

package/src/pages/index.astro

@@ -14,14 +14,20 @@ const repo = await getRepo(Astro.locals);
 const locale = I18N.enabled ? localeFromPath(Astro.url.pathname) : I18N.defaultLocale;
 const wantsLocaleHome = I18N.enabled && locale !== I18N.defaultLocale;
 let [home, rawSettings] = await Promise.all([
-  repo.getHomePage(wantsLocaleHome ? locale : undefined),
+  repo.getHomePage(),
   repo.getSettings(),
 ]);
 // ?designPreview=1 (admin-only) renders the staged Design-screen changes
 const settings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
-// a locale home that isn't authored yet falls back to the default home —
-// /es must never 404 mid-setup
-if (wantsLocaleHome && !home) home = await repo.getHomePage();
+// Another language: the default home page's section layout with that
+// language's translated words, once it has any. A separately authored home
+// page for the language (the older setup) keeps serving until then, and /es
+// never 404s mid-setup.
+if (wantsLocaleHome) {
+  const translated = Boolean(home && settings.sectionPages?.[home.id]?.sections.some((s) => s.translations?.[locale]));
+  const separate = translated ? null : await repo.getHomePage(locale);
+  if (separate) home = separate;
+}
 
 // Live state must not survive in a cached page after its snapshot expires.
 if (settings.live.mode !== 'off' || home?.blocks.some(block => block.type === 'live') ||
@@ -46,7 +52,7 @@ const homeForTemplate = home ? { ...home, bodyHtml: homeHtml } : null;
 
 <Site title={home?.seoTitle || undefined} description={home?.seoDesc || undefined}>
   {home && settings.sectionPages?.[home.id]?.mode === 'sections' ? (
-    <ThemeSections page={home} settings={settings} />
+    <ThemeSections page={home} settings={settings} locale={locale} />
   ) : HomeTemplate ? (
     <HomeTemplate settings={settings} page={homeForTemplate} posts={posts} tags={tags} />
   ) : home ? (

package/src/pages/sitemap.xml.ts

@@ -5,6 +5,8 @@ import { siteOrigin, xmlEscape } from '../lib/seo';
 import { CONTENT, collectionUrl, tagUrl } from '../lib/content';
 import { CALENDAR, eventUrl, bookingsEnabled, resourceUrl } from '../lib/calendar/config';
 import { eventIsPublic } from '../lib/calendar/events';
+import { extraLocales, localePath } from '../lib/i18n';
+import { hasTranslation } from '../lib/translations';
 
 // DB-backed sitemap: content lives in D1/libSQL, so this is generated per
 // request instead of at build time. Draft/scheduled content never appears.
@@ -49,6 +51,12 @@ export const GET: APIRoute = async ({ locals, url }) => {
           ...publicEvents.map((e) => ({ loc: eventUrl(e.slug), lastmod: e.updatedAt })),
         ]
       : []),
+    // translated documents also live at /<locale>/… (acms({ i18n }))
+    ...extraLocales().flatMap((l) => [
+      ...pages.filter((p) => p.status === 'published' && !p.isHome && hasTranslation(p, l)).map((p) => ({ loc: localePath(`/${p.slug}`, l), lastmod: p.updatedAt })),
+      ...posts.filter((p) => hasTranslation(p, l)).map((p) => ({ loc: localePath(collectionUrl(p.collection, p.slug), l), lastmod: p.updatedAt })),
+      ...publicEvents.filter((e) => hasTranslation(e, l)).map((e) => ({ loc: localePath(eventUrl(e.slug), l), lastmod: e.updatedAt })),
+    ]),
     ...(bookingsEnabled()
       ? [{ loc: CALENDAR.bookBase }, ...(await repo.listResources()).filter((r) => r.visibility === 'public').map((r) => ({ loc: resourceUrl(r.slug), lastmod: r.updatedAt }))]
       : []),

package/src/styles/admin.css

@@ -756,6 +756,43 @@ dialog.modal[open] { animation: modal-in 0.16s ease-out; }
 .login-wrap { background: var(--bg); }
 .btn.block { width: 100%; justify-content: center; min-height: 38px; }
 .login-note { margin-top: 14px; }
+.login-for-app { text-align: center; margin: -8px 0 14px; color: var(--muted); }
+
+/* editor-app sign-in (consent) — same paper card as login, a little wider */
+.consent-wrap { align-items: start; padding-top: max(8vh, 20px); }
+.consent-card { width: 100%; max-width: 440px; padding: 0; overflow: hidden; }
+.consent-site { display: flex; align-items: center; gap: 8px; padding: 14px 22px; border-bottom: 1px solid var(--line); color: var(--text-2); font-weight: 600; font-size: 13px; min-width: 0; }
+.consent-site span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.consent-body { padding: 22px 22px 18px; }
+.consent-body h1 { font-size: 20px; line-height: 1.3; letter-spacing: -0.02em; margin: 0 0 6px; overflow-wrap: anywhere; }
+.consent-app { color: var(--text); }
+.consent-lead { color: var(--muted); margin: 0 0 18px; }
+.consent-lead b { color: var(--text-2); font-weight: 600; }
+.consent-who { display: flex; align-items: center; gap: 12px; padding: 12px; background: var(--panel-2); border: 1px solid var(--line); border-radius: var(--r-md); margin-bottom: 18px; min-width: 0; }
+.consent-initial { flex: none; width: 36px; height: 36px; border-radius: var(--r-md); display: grid; place-items: center; background: var(--accent-soft); color: var(--accent-deep); font-weight: 700; font-size: 15px; }
+.consent-id { display: flex; flex-direction: column; min-width: 0; flex: 1; }
+.consent-id b { font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.consent-id span { color: var(--muted); font-size: 12.5px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.consent-role { flex: none; display: inline-flex; align-items: center; gap: 6px; font-size: 12px; font-weight: 600; color: var(--text-2); }
+.consent-role i { width: 7px; height: 7px; border-radius: 2px; background: var(--blue); }
+.consent-role i.is-owner { background: var(--accent); }
+.consent-label { font-size: 12px; font-weight: 600; color: var(--muted); margin: 0 0 6px; }
+.consent-can { list-style: none; margin: 0 0 18px; padding: 0; display: grid; gap: 6px; }
+.consent-can li { position: relative; padding-left: 20px; color: var(--text-2); }
+.consent-can li::before { content: ''; position: absolute; left: 3px; top: 0.45em; width: 8px; height: 5px; border-left: 2px solid var(--green); border-bottom: 2px solid var(--green); transform: rotate(-45deg); }
+.consent-device { margin-bottom: 16px; }
+.consent-actions { display: grid; grid-template-columns: 1fr 1fr; gap: 10px; }
+.consent-actions .btn { justify-content: center; min-height: 40px; }
+.consent-meta { margin: 18px 0 0; padding-top: 14px; border-top: 1px solid var(--line); display: grid; gap: 6px; font-size: 12px; }
+.consent-meta div { display: flex; gap: 10px; min-width: 0; }
+.consent-meta dt { color: var(--faint); flex: 0 0 76px; }
+.consent-meta dd { margin: 0; min-width: 0; overflow-wrap: anywhere; color: var(--text-2); }
+.consent-meta code { font-family: ui-monospace, 'SF Mono', Menlo, Consolas, monospace; font-size: 11.5px; }
+.consent-foot { margin: 12px 0 0; }
+@media (max-width: 480px) {
+  .consent-wrap { padding: 0; align-items: stretch; }
+  .consent-card { max-width: none; border-radius: 0; border: 0; min-height: 100vh; box-shadow: none; }
+}
 
 /* recent list on dashboard */
 .recent { list-style: none; margin: 0; padding: 0; }
@@ -1473,3 +1510,35 @@ a.bk-row:hover, .bk-row.is-sel { background: var(--hover); }
   .dm-hist li { flex-direction: column; align-items: flex-start; }
   .dm-status-actions { margin-left: 0; width: 100%; }
 }
+
+/* role: marker + text (no badges) */
+.role-mark { display: inline-flex; align-items: center; gap: 6px; font-size: 12.5px; font-weight: 600; color: var(--text-2); }
+.role-mark i { width: 7px; height: 7px; border-radius: 2px; background: var(--blue); }
+.role-mark i.is-owner { background: var(--accent); }
+
+/* Users → Signed-in apps */
+.devices-card { margin-top: 20px; }
+.devices-head { padding: 16px 20px 12px; border-bottom: 1px solid var(--line); }
+.devices-head h2 { font-size: 15px; margin: 0 0 2px; letter-spacing: -0.01em; }
+.devices-head .hint { margin: 0; }
+.devices-empty { color: var(--muted); padding: 18px 20px 20px; margin: 0; }
+.devices-group + .devices-group { border-top: 1px solid var(--line); }
+.devices-person { display: flex; align-items: center; justify-content: space-between; gap: 10px; padding: 12px 20px 2px; min-width: 0; }
+.devices-person > span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.devices-person .t-sub { color: var(--faint); font-size: 12px; }
+.devices-list { list-style: none; margin: 0; padding: 4px 8px 8px; }
+.device-row { display: grid; grid-template-columns: 32px minmax(0, 1.2fr) minmax(0, 1fr) auto; align-items: center; gap: 12px; padding: 10px 12px; border-radius: var(--r-md); }
+.device-row:hover { background: var(--hover); }
+.device-icon { width: 32px; height: 32px; border-radius: var(--r-sm); display: grid; place-items: center; background: var(--panel-2); border: 1px solid var(--line); color: var(--muted); }
+.device-main { display: flex; flex-direction: column; min-width: 0; }
+.device-main b { font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.device-main .t-sub { color: var(--faint); font-size: 12px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-family: ui-monospace, 'SF Mono', Menlo, Consolas, monospace; font-size: 11.5px; }
+.device-when { display: flex; flex-wrap: wrap; column-gap: 16px; row-gap: 2px; color: var(--text-2); font-size: 12.5px; font-variant-numeric: tabular-nums; }
+.device-when > span { white-space: nowrap; }
+.device-k { color: var(--faint); margin-right: 3px; }
+@media (max-width: 640px) {
+  .device-row { grid-template-columns: 32px minmax(0, 1fr) auto; row-gap: 4px; }
+  .device-when { grid-column: 2 / 4; grid-row: 2; }
+  .device-action { grid-column: 3; grid-row: 1; }
+  .devices-head, .devices-person { padding-left: 16px; padding-right: 16px; }
+}

package/src/styles/editor.css

@@ -1024,3 +1024,24 @@
 .pe-evcard-one small { display: block; font-size: 11.5px; font-weight: 700; letter-spacing: 0.04em; text-transform: uppercase; color: var(--accent-deep); }
 .pe-evcard-one b { display: block; font-size: 15px; color: var(--text); margin-top: 2px; }
 .pe-evcard-one em { display: block; font-style: normal; font-size: 12px; color: var(--amber); margin-top: 3px; }
+
+/* ---- translations: language switch + panel ---- */
+.pe-langs button { position: relative; padding: 4px 10px; font-weight: 600; letter-spacing: .02em; }
+.pe-lang-dot { position: absolute; top: 3px; right: 3px; width: 6px; height: 6px; border-radius: 2px; background: var(--amber, #93660c); }
+.pe-trpanel { margin: 0 0 18px; padding: 14px 16px; border-radius: var(--r-md); background: var(--panel-2); font-size: 13px; color: var(--text-2); }
+.pe-tr-head { display: flex; flex-wrap: wrap; align-items: baseline; gap: 6px 14px; }
+.pe-tr-head b { font-size: 14px; color: var(--text); }
+.pe-tr-states { display: flex; flex-wrap: wrap; gap: 4px 12px; font-size: 12px; }
+.pe-tr-states .is-missing { color: var(--red); }
+.pe-tr-states .is-outdated { color: var(--amber, #93660c); }
+.pe-tr-states .is-ai { color: var(--blue, #2f5fb3); }
+.pe-tr-states .is-reviewed { color: var(--green, #127442); }
+.pe-tr-note { margin: 6px 0 10px; color: var(--muted); font-size: 12.5px; }
+.pe-tr-fields { display: grid; grid-template-columns: repeat(auto-fit, minmax(min(100%, 240px), 1fr)); gap: 10px; }
+.pe-tr-fields label { display: flex; flex-direction: column; gap: 4px; font-size: 12px; font-weight: 500; color: var(--muted); }
+.pe-tr-fields input, .pe-tr-fields textarea { font: inherit; font-size: 13.5px; color: var(--text); padding: 7px 10px; border: 1px solid var(--line-strong); border-radius: var(--r-sm); background: var(--bg); resize: vertical; }
+.pe-tr-actions { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin-top: 12px; }
+.pe-tr-msg { font-size: 12.5px; color: var(--muted); }
+@media (max-width: 767px) { .pe-langs { order: 3; } .pe-tr-fields input, .pe-tr-fields textarea { font-size: 16px; } }
+.pe-seg button[aria-checked='true'] { background: var(--bg); color: var(--text); box-shadow: var(--shadow-sm); }
+:root[data-theme='dark'] .pe-seg button[aria-checked='true'] { background: #3a3632; }