@acms-subir/core 0.3.3-next.20260929113209 → 0.3.4

package/src/lib/translations.ts

@@ -0,0 +1,39 @@
+import type { DocTranslation, DocTranslations } from './schema';
+import { I18N } from './i18n';
+
+// Posts, pages and events in another language: the translated words laid
+// over the document; anything not translated yet stays in the main language.
+// Facts (dates, covers, tags, places' addresses…) are never translated.
+
+type Doc = { title: string; bodyHtml: string; seoTitle: string; seoDesc: string; excerpt?: string; translations?: DocTranslations; location?: { name: string }; cta?: { label: string } };
+
+export const isExtraLocale = (locale: string | undefined | null): locale is string =>
+  Boolean(locale) && I18N.enabled && locale !== I18N.defaultLocale && I18N.locales.includes(locale as string);
+
+export function translationFor(doc: { translations?: DocTranslations }, locale: string): DocTranslation | null {
+  if (!isExtraLocale(locale)) return null;
+  return doc.translations?.[locale] ?? null;
+}
+
+/** does this document have any words in the language? */
+export const hasTranslation = (doc: { translations?: DocTranslations }, locale: string) => {
+  const t = translationFor(doc, locale);
+  return Boolean(t && (t.title.trim() || t.bodyHtml.trim()));
+};
+
+export function localizeDoc<T extends Doc>(doc: T, locale: string | undefined): T {
+  const t = locale ? translationFor(doc, locale) : null;
+  if (!t) return doc;
+  const pick = (v: string, fallback: string) => (v && v.trim() ? v : fallback);
+  const out: T = {
+    ...doc,
+    title: pick(t.title, doc.title),
+    bodyHtml: pick(t.bodyHtml, doc.bodyHtml),
+    seoTitle: pick(t.seoTitle, doc.seoTitle),
+    seoDesc: pick(t.seoDesc, doc.seoDesc),
+  };
+  if (doc.excerpt !== undefined) (out as Doc).excerpt = pick(t.excerpt, doc.excerpt);
+  if (doc.location) (out as Doc).location = { ...doc.location, name: pick(t.locationName, doc.location.name) };
+  if (doc.cta) (out as Doc).cta = { ...doc.cta, label: pick(t.ctaLabel, doc.cta.label) };
+  return out;
+}

package/src/middleware.ts

@@ -1,10 +1,13 @@
 import { defineMiddleware } from 'astro:middleware';
+import { I18N } from './lib/i18n';
 import { validateSession, SESSION_COOKIE } from './lib/auth';
 import { getRepo } from './lib/repo';
 import { CONTENT } from './lib/content';
 import { processDueDeliveries, waitUntilFrom } from './lib/webhooks';
 import { dispatchEmail } from './lib/email/service';
-import { sendDueReminders } from './lib/booking/service';
+import { decideOverdue, sendDueReminders } from './lib/booking/service';
+import { PUSH } from './lib/push/config';
+import { processPushQueue, runPushJobs } from './lib/push/service';
 import { previewParamRedirect, hasPreviewCookie } from './lib/designPreview';
 
 // Legacy content-URL redirects, checked only on would-be 404s (below) so they
@@ -60,6 +63,20 @@ export const onRequest = defineMiddleware(async (context, next) => {
     return context.redirect(pathname.replace(/\/+$/, '') + context.url.search, 301);
   }
 
+  // another language: /es/events/x renders /events/x with the request marked
+  // Spanish (pages lay translated words over the shared content). The URL the
+  // visitor sees stays /es/…; /es itself is the injected home route.
+  if (I18N.enabled && context.request.method !== 'OPTIONS') {
+    for (const l of I18N.locales) {
+      if (l === I18N.defaultLocale || !pathname.startsWith(`/${l}/`)) continue;
+      const bare = pathname.slice(l.length + 1);
+      if (/^\/(admin|api|_|media|embed|go)(\/|$)/.test(bare)) break;
+      (context.locals as { acmsLocale?: string; acmsPath?: string }).acmsLocale = l;
+      (context.locals as { acmsLocale?: string; acmsPath?: string }).acmsPath = pathname;
+      return context.rewrite(new URL(bare + context.url.search, context.url));
+    }
+  }
+
   // design preview links (?designPreview=1, ?designVersion=, ?preview=<token>,
   // ?preview=off) become a cookie, then the clean URL — so every link clicked
   // afterwards stays in preview mode
@@ -70,6 +87,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
   if (pathname.startsWith('/admin') && pathname !== '/admin/login') {
     const token = context.cookies.get(SESSION_COOKIE)?.value;
     if (!(await validateSession(token, context.locals))) {
+      // editor-app sign-in comes back here after login (see login.astro's next)
+      if (pathname === '/admin/app-auth' && context.request.method === 'GET') {
+        return context.redirect(`/admin/login?next=${encodeURIComponent(pathname + context.url.search)}`);
+      }
       return context.redirect('/admin/login');
     }
   }
@@ -89,9 +110,17 @@ export const onRequest = defineMiddleware(async (context, next) => {
       if (wait) wait(retries); else await retries;
       // booking reminders (Node has no cron): site URL, else this request's origin
       const reminders = repo.getSettings()
-        .then((s) => sendDueReminders(repo, { origin: s.siteUrl.replace(/\/+$/, '') || context.url.origin, locals: context.locals, now }))
+        .then(async (s) => {
+          const flow = { origin: s.siteUrl.replace(/\/+$/, '') || context.url.origin, locals: context.locals, now };
+          await sendDueReminders(repo, flow);
+          await decideOverdue(repo, flow);
+        })
         .catch(() => {});
       if (wait) wait(reminders); else await reminders;
+      // push jobs (Node has no cron): never awaited here, errors are logged
+      const push = runPushJobs(repo, { locals: context.locals, fallbackOrigin: context.url.origin, now })
+        .catch((e) => console.error('acms push: scheduled jobs failed', e));
+      if (wait) wait(push);
     } catch {
       // never let the publish sweep break a request
     }
@@ -106,6 +135,13 @@ export const onRequest = defineMiddleware(async (context, next) => {
     const deliveries = getRepo(context.locals).then(repo => processDueDeliveries(repo, { limit: 5 })).catch(() => 0);
     const wait = waitUntilFrom(context.locals);
     if (wait) wait(deliveries); else await deliveries;
+    // first-publish push notices: background only, never delaying the response
+    if (PUSH.enabled) {
+      const push = getRepo(context.locals)
+        .then(repo => processPushQueue(repo, { locals: context.locals, fallbackOrigin: context.url.origin }))
+        .catch((e) => console.error('acms push: queue flush failed', e));
+      if (wait) wait(push);
+    }
   }
 
   // a preview render must never be cached where a visitor could get it

package/src/pages/.well-known/apple-app-site-association.ts

@@ -0,0 +1,6 @@
+import { associationRoute } from '../../lib/mobile/associations';
+import { methodNotAllowed } from '../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../lib/mobile/http';
+export const GET = associationRoute('ios');
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/.well-known/assetlinks.json.ts

@@ -0,0 +1,6 @@
+import { associationRoute } from '../../lib/mobile/associations';
+import { methodNotAllowed } from '../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../lib/mobile/http';
+export const GET = associationRoute('android');
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/[...slug].astro

@@ -8,10 +8,14 @@ import { expandDynamicBlocks } from '../lib/dynamicBlocks';
 import { highlightCodeHtml } from '../lib/highlightCode';
 import { resolveDesign } from '../lib/theme';
 import { effectiveSettings } from '../lib/designPreview';
+import { requestLocale } from '../lib/i18n';
+import { localizeDoc, isExtraLocale } from '../lib/translations';
 
 const { slug } = Astro.params;
 const repo = await getRepo(Astro.locals);
-const page = slug ? await repo.getPageBySlug(slug) : null;
+const locale = requestLocale(Astro.url, Astro.locals);
+const rawPage = slug ? await repo.getPageBySlug(slug) : null;
+const page = rawPage ? localizeDoc(rawPage, locale) : null;
 
 // Drafts are visible only to a logged-in admin (doubles as draft preview).
 const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
@@ -20,7 +24,8 @@ if (!page || (page.status !== 'published' && !isAdmin)) {
 }
 const bodyHtml = page.bodyHtml ? highlightCodeHtml(await expandDynamicBlocks(page.bodyHtml, repo)) : '';
 // ?designPreview=1 (admin-only) renders the staged Design-screen changes
-const settings = await effectiveSettings(await repo.getSettings(), Astro.url, Astro.cookies, Astro.locals);
+const baseSettings = await effectiveSettings(await repo.getSettings(), Astro.url, Astro.cookies, Astro.locals);
+const settings = isExtraLocale(locale) ? { ...baseSettings, locale } : baseSettings;
 // Live state must not survive in a cached page after its snapshot expires.
 if (settings.live.mode !== 'off' || page?.blocks.some(block => block.type === 'live') ||
     (page && settings.sectionPages?.[page.id]?.sections.some(section => section.type === 'live'))) {
@@ -43,7 +48,7 @@ const PageTemplate = (page.template && settings.sectionPages?.[page.id]?.mode !=
     </p>
   )}
   {settings.sectionPages?.[page.id]?.mode === 'sections' ? (
-    <ThemeSections page={page} settings={settings} />
+    <ThemeSections page={page} settings={settings} locale={locale} />
   ) : PageTemplate ? (
     <PageTemplate page={page} html={bodyHtml} settings={settings} />
   ) : page.bodyHtml ? (

package/src/pages/admin/app-auth.astro

@@ -0,0 +1,159 @@
+---
+import { roleLabels } from '../../lib/roles';
+// Editor-app sign-in (OAuth 2.0 authorization code + PKCE, RFC 8252). The
+// app opens this page in the system browser; the middleware has already sent
+// signed-out visitors to /admin/login?next=… and back. Approving issues a
+// one-time code (two minutes, single use) bound to this person, the app, its
+// return address and the PKCE challenge, then returns to the app.
+import { getRepo } from '../../lib/repo';
+import { BRAND } from '../../lib/brand';
+import { validateSession, OWNER_ENV, SESSION_COOKIE } from '../../lib/auth';
+import { EDITOR } from '../../lib/editor/config';
+import { checkAuthorize, checkConsentTicket, consentTicket, issueCode, redirectWith } from '../../lib/editor/auth';
+import { bookingsEnabled } from '../../lib/calendar/config';
+import { I18N } from '../../lib/i18n';
+import ThemeScript from '../../components/ThemeScript.astro';
+import '../../styles/admin.css';
+
+// never framed (clickjacking the Approve button), never cached; the query
+// (challenge, state) never leaks as a referrer. Not "no-referrer": that
+// makes browsers send Origin: null on the form POST, failing the CSRF check.
+Astro.response.headers.set('X-Frame-Options', 'DENY');
+Astro.response.headers.set('Content-Security-Policy', "frame-ancestors 'none'");
+Astro.response.headers.set('Cache-Control', 'no-store');
+Astro.response.headers.set('Referrer-Policy', 'same-origin');
+if (!EDITOR.enabled) return new Response(null, { status: 404 });
+
+const leave = (to: string) => new Response(null, { status: 303, headers: { Location: to, 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer' } });
+const repo = await getRepo(Astro.locals);
+const session = Astro.cookies.get(SESSION_COOKIE)?.value ?? '';
+const userId = await validateSession(session, Astro.locals);
+if (!userId) return Astro.redirect(`/admin/login?next=${encodeURIComponent(Astro.url.pathname + Astro.url.search)}`);
+
+const check = checkAuthorize(Astro.url.searchParams);
+const iss = Astro.url.origin;
+// untrustworthy return address/app: show the problem here, never redirect
+if (!check.ok && check.redirect) {
+  return leave(redirectWith(check.redirectUri, { error: check.error, error_description: check.message, ...(check.state ? { state: check.state } : {}), iss }));
+}
+const params = check.ok ? check.params : null;
+const envOwner = userId === OWNER_ENV;
+const user = envOwner ? null : await repo.getUser(userId);
+const settings = await repo.getSettings();
+const appName = EDITOR.name || params?.clientId || 'An app';
+const switchUrl = `/admin/logout?next=${encodeURIComponent(Astro.url.pathname + Astro.url.search)}`;
+
+let error = '';
+if (Astro.request.method === 'POST' && params && user) {
+  const form = await Astro.request.formData();
+  const origin = Astro.request.headers.get('origin');
+  if (origin !== Astro.url.origin || Astro.request.headers.get('sec-fetch-site') === 'cross-site') error = 'This request didn’t come from this page. Try again.';
+  else if (!checkConsentTicket(String(form.get('ticket') ?? ''), session, params)) error = 'This sign-in page expired. Start again from the app.';
+  else if (form.get('op') === 'cancel') return leave(redirectWith(params.redirectUri, { error: 'access_denied', error_description: 'Sign-in was cancelled.', state: params.state, iss }));
+  else if (form.get('op') === 'approve') {
+    if (!await repo.email.rateLimit(`editor:approve:${user.id}`, 10, 60_000)) error = 'Too many sign-ins in a minute. Wait a moment and try again.';
+    else {
+      const version = await repo.email.sessionVersion(user.id);
+      if (version === null) error = 'Your account changed. Sign in again.';
+      else {
+        const code = await issueCode(repo, { id: user.id, sessionVersion: version }, params, String(form.get('device_name') ?? ''));
+        return leave(redirectWith(params.redirectUri, { code, state: params.state, iss }));
+      }
+    }
+  }
+}
+const ticket = params && user ? consentTicket(session, params) : '';
+const deviceName = params?.deviceName || 'Phone';
+const returnTo = (() => { if (!params) return ''; try { const u = new URL(params.redirectUri); return u.protocol === 'https:' || u.protocol === 'http:' ? u.host : `${u.protocol}//`; } catch { return ''; } })();
+const owner = user?.role === 'owner';
+const can = [
+  'Edit, publish and unpublish posts, pages and events',
+  owner ? 'Change section content, including locked sections' : 'Change section text and images (not the layout)',
+  'Upload images and files',
+  ...(I18N.enabled ? ['Write and review translations'] : []),
+  ...(bookingsEnabled() ? ['Confirm, decline and cancel bookings'] : []),
+];
+---
+
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+    <ThemeScript />
+    <meta name="robots" content="noindex" />
+    <title>Sign in to {appName} · {settings.siteTitle}</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet" />
+  </head>
+  <body>
+    <main class="login-wrap consent-wrap">
+      <div class="card consent-card">
+        <div class="consent-site">
+          <svg width="20" height="20" viewBox="0 0 24 24" aria-hidden="true">
+            <rect x="1" y="3" width="22" height="4.4" rx="1.9" fill="currentColor" opacity="0.85" />
+            <rect x="1" y="10" width="12.5" height="4.4" rx="1.9" fill="var(--accent)" />
+            <rect x="1" y="17" width="17.5" height="4.4" rx="1.9" fill="currentColor" opacity="0.35" />
+          </svg>
+          <span>{settings.siteTitle || BRAND.name}</span>
+        </div>
+
+        {!params && (
+          <div class="consent-body">
+            <h1>This app can’t sign in here</h1>
+            <p class="consent-lead">{!check.ok && check.message}</p>
+            <p class="hint">Close this page and return to the app. If you run this site, check the editor app settings.</p>
+          </div>
+        )}
+
+        {params && envOwner && (
+          <div class="consent-body">
+            <h1>Use your own account</h1>
+            <p class="consent-lead"><b>{appName}</b> signs in as a person, so each phone can be signed out on its own. You’re signed in with the owner password, which has no account to connect.</p>
+            <a class="btn primary block" href={switchUrl}>Sign in with an account</a>
+            <p class="hint consent-foot">Owners create accounts in Users.</p>
+          </div>
+        )}
+
+        {params && user && (
+          <form method="post" class="consent-body">
+            <h1><span class="consent-app">{appName}</span> wants to sign in</h1>
+            <p class="consent-lead">It will use <b>{settings.siteTitle || 'this site'}</b> as you, with your role. You can sign this phone out any time.</p>
+
+            <div class="consent-who">
+              <span class="consent-initial" aria-hidden="true">{(user.name || user.email).trim().charAt(0).toUpperCase()}</span>
+              <span class="consent-id">
+                <b>{user.name}</b>
+                <span>{user.email}</span>
+              </span>
+              <span class="consent-role"><i class={owner ? 'is-owner' : ''} aria-hidden="true"></i>{user ? roleLabels[user.role] : 'Owner'}</span>
+            </div>
+
+            <p class="consent-label">The app will be able to</p>
+            <ul class="consent-can">
+              {can.map((line) => <li>{line}</li>)}
+            </ul>
+
+            <label class="field consent-device">
+              <span>Name this device</span>
+              <input type="text" name="device_name" value={deviceName} maxlength="60" autocomplete="off" required />
+            </label>
+
+            {error && <div class="flash error" role="alert">{error}</div>}
+            <input type="hidden" name="ticket" value={ticket} />
+            <div class="consent-actions">
+              <button class="btn" type="submit" name="op" value="cancel" formnovalidate>Cancel</button>
+              <button class="btn primary" type="submit" name="op" value="approve">Approve</button>
+            </div>
+
+            <dl class="consent-meta">
+              <div><dt>Returns to</dt><dd><code>{returnTo}</code></dd></div>
+              <div><dt>App ID</dt><dd><code>{params.clientId}</code></dd></div>
+            </dl>
+            <p class="hint consent-foot">Not you? <a href={switchUrl}>Switch account</a></p>
+          </form>
+        )}
+      </div>
+    </main>
+  </body>
+</html>

package/src/pages/admin/c/[collection]/[id].astro

@@ -1,4 +1,6 @@
 ---
+import { I18N, extraLocales, localeName } from '../../../../lib/i18n';
+import { translationEngine } from '../../../../lib/translate';
 import { getRepo } from '../../../../lib/repo';
 import { renderMarkdown } from '../../../../lib/markdown';
 import { createPreviewToken } from '../../../../lib/preview';
@@ -37,6 +39,10 @@ const sharePath = `${previewPath}?token=${createPreviewToken('post', post.id)}`;
 const unsplashEnabled = Boolean(env('UNSPLASH_ACCESS_KEY'));
 const settings = await repo.getSettings();
 const templates = Object.keys(resolveDesign(settings).theme.postTemplates);
+// other languages this document can be written in (acms({ i18n }))
+const trLanguages = extraLocales().map((code) => ({ code, name: localeName(code, true) }));
+const trMain = { code: I18N.defaultLocale, name: localeName(I18N.defaultLocale || 'en', true) };
+const trDrafts = trLanguages.length > 0 && translationEngine((await repo.getSettings()).ai, Astro.locals) !== null;
 ---
 
 <!doctype html>
@@ -54,6 +60,9 @@ const templates = Object.keys(resolveDesign(settings).theme.postTemplates);
     <PostEditor
       client:only="react"
       post={editable}
+      languages={trLanguages}
+      mainLanguage={trMain}
+      translationDrafts={trDrafts}
       initialHTML={initialHTML}
       unsplashEnabled={unsplashEnabled}
       previewPath={previewPath}

package/src/pages/admin/calendar/bookings.astro

@@ -1,5 +1,7 @@
 ---
 import Admin from '../../../layouts/Admin.astro';
+import BookingsHead from '../../../components/calendar/BookingsHead.astro';
+import { eventHolds } from '../../../lib/booking/holds';
 import Modal from '../../../components/Modal.astro';
 import { getRepo } from '../../../lib/repo';
 import type { Booking, BookingStatus } from '../../../lib/schema';
@@ -73,7 +75,7 @@ if (Astro.request.method === 'POST') {
       const allDay = Boolean(form.get('allDay'));
       const start = allDay ? localMidnight(date, tz) : toMs(date, String(form.get('start')));
       const end = allDay ? localMidnight(addDaysYmd(date, 1), tz) : toMs(date, String(form.get('end')));
-      if (!r || Number.isNaN(start) || Number.isNaN(end)) throw new BookingError(400, 'Choose a resource, date and times.');
+      if (!r || Number.isNaN(start) || Number.isNaN(end)) throw new BookingError(400, 'Choose a room or person, a date and times.');
       const b = await createBlock(repo, r, start, end, String(form.get('note') || ''));
       if (!b) throw new BookingError(409, 'That time already has a booking — cancel or move it first.');
       return Astro.redirect(keep({ notice: `${r.name} is blocked.` }));
@@ -85,6 +87,9 @@ if (Astro.request.method === 'POST') {
       const start = toMs(String(form.get('date')), String(form.get('time')));
       if (Number.isNaN(start)) throw new BookingError(400, 'Pick a date and time.');
       const len = link.mode === 'range' && link.lengths.length ? Number(form.get('len')) || link.lengths[0] : link.mode === 'day' ? 1440 : link.duration;
+      // staff may book over an event's hold, but only on purpose
+      const held = (await eventHolds(repo, settings, start, start + len * 60_000, r.id))[0];
+      if (held && !form.has('overHold')) throw new BookingError(409, `${r.name} is held for “${held.title}” then. Tick “Book anyway” to add it regardless.`);
       const b = await createResourceBooking(repo, {
         resource: r, link, start, end: start + len * 60_000, source: 'admin', status: 'confirmed',
         booker: { name: String(form.get('name') || ''), email: String(form.get('email') || ''), phone: String(form.get('phone') || '') },
@@ -155,6 +160,8 @@ const dayCols = resources.filter((r) => !resFilter || r.id === resFilter).map((r
   r, items: all.filter((b) => b.resourceId === r.id && active(b) && b.start < dayEnd && b.end > dayStart),
 }));
 const H0 = 7, H1 = 22;
+// rooms held by events that day (lib/booking/holds.ts), drawn under bookings
+const dayHolds = view === 'day' ? await eventHolds(repo, settings, dayStart, dayEnd) : [];
 const pos = (b: Booking) => {
   const s = Math.max(b.start, dayStart), e = Math.min(b.end, dayEnd);
   const top = ((s - dayStart) / 3_600_000 - H0) / (H1 - H0) * 100;
@@ -164,7 +171,7 @@ const pos = (b: Booking) => {
 
 const selected = Astro.url.searchParams.get('b') ? await repo.getBooking(Astro.url.searchParams.get('b')!) : null;
 const provider = emailProvider(Astro.locals);
-const TABS = [['upcoming', 'Upcoming'], ['unconfirmed', 'Unconfirmed'], ['past', 'Past'], ['cancelled', 'Cancelled']] as const;
+const TABS = [['upcoming', 'Upcoming'], ['unconfirmed', 'Needs approval'], ['past', 'Past'], ['cancelled', 'Cancelled']] as const;
 const statusLabel = (b: Booking) => (b.kind === 'block' ? 'Blocked' : b.status[0].toUpperCase() + b.status.slice(1));
 const whenOf = (b: Booking) => (b.end - b.start >= 86_400_000 - 3_600_000 && ymd(b.start, tz) !== ymd(b.end - 1, tz)
   ? `${f.day.format(b.start)} – ${f.day.format(b.end - 1)}`
@@ -174,21 +181,14 @@ const activeLinks = links.filter((l) => l.active && resById.has(l.resourceId));
 ---
 
 <Admin title="Bookings" section="calendar:bookings" wide={view === 'day'}>
-  <div class="page-head">
-    <div>
-      <h1>Bookings</h1>
-      <p class="sub">{counts.unconfirmed ? `${counts.unconfirmed} waiting for approval · ` : ''}{week} in the next 7 days</p>
-    </div>
-    <div class="page-actions">
-      <nav class="seg" aria-label="View">
-        <a class={view === 'agenda' ? 'on' : ''} href={keep({ view: null })}>Agenda</a>
-        <a class={view === 'day' ? 'on' : ''} href={keep({ view: 'day' })}>Day</a>
-      </nav>
-      <a class="btn" href={keep({ format: 'csv', b: null, notice: null })}>Export</a>
-      <button class="btn" type="button" data-modal="bk-block" disabled={!resources.length}>Block time</button>
-      <button class="btn primary" type="button" data-modal="bk-add" disabled={!activeLinks.length}>Add booking</button>
-    </div>
-  </div>
+  <BookingsHead active="requests" inPlace pending={counts.unconfirmed} rooms={resources.length}
+    sub={`${counts.unconfirmed ? `${counts.unconfirmed} ${counts.unconfirmed === 1 ? 'needs' : 'need'} approval · ` : ''}${week} in the next 7 days`}>
+    <nav class="seg" aria-label="View">
+      <a class={view === 'agenda' ? 'on' : ''} href={keep({ view: null })}>Agenda</a>
+      <a class={view === 'day' ? 'on' : ''} href={keep({ view: 'day' })}>Day</a>
+    </nav>
+    <a class="btn" href={keep({ format: 'csv', b: null, notice: null })}>Export</a>
+  </BookingsHead>
   {notice && <p class="notice" role="status">{notice}</p>}
   {error && <p class="notice warn" role="alert">{error}</p>}
   {provider === 'none' && <p class="notice"><span>Emails are off — set <code>EMAIL_FROM</code> plus <code>RESEND_API_KEY</code> (or a Cloudflare <code>send_email</code> binding named EMAIL) so guests get confirmations and reminders.</span></p>}
@@ -196,13 +196,13 @@ const activeLinks = links.filter((l) => l.active && resById.has(l.resourceId));
   {resources.length === 0 && !all.length ? (
     <div class="empty-state">
       <b>No bookings yet</b>
-      <p>Add a room or a person under Resources, share its booking link, and bookings land here.</p>
-      <a class="btn primary" href="/admin/calendar/resources?new=1">New resource</a>
+      <p>Bookings are times people reserve with a room or person. Add one, share its booking link, and requests land here.</p>
+      <a class="btn primary" href="/admin/calendar/resources?new=1">Add a room or person</a>
     </div>
   ) : (
   <>
     <div class="bk-kpis kpis">
-      <div class="kpi"><small>Waiting for approval</small><b>{counts.unconfirmed}</b></div>
+      <div class="kpi"><small>Needs approval</small><b>{counts.unconfirmed}</b></div>
       <div class="kpi"><small>Next 7 days</small><b>{week}</b></div>
       <div class="kpi"><small>Today</small><b>{all.filter((b) => active(b) && ymd(b.start, tz) === today).length}</b></div>
       <div class="kpi"><small>Cancelled · 30 days</small><b>{cancelled30}</b></div>
@@ -229,9 +229,9 @@ const activeLinks = links.filter((l) => l.active && resById.has(l.resourceId));
       </div>
       {resources.length > 1 && (
         <details class={`fmenu ${resFilter ? 'is-set' : ''}`}>
-          <summary>{resFilter ? resById.get(resFilter)?.name : 'All resources'} <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M6 9l6 6 6-6" /></svg></summary>
+          <summary>{resFilter ? resById.get(resFilter)?.name : 'All rooms & people'} <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M6 9l6 6 6-6" /></svg></summary>
           <div class="fmenu-pop">
-            <a class={!resFilter ? 'on' : ''} href={keep({ r: null })}>All resources</a>
+            <a class={!resFilter ? 'on' : ''} href={keep({ r: null })}>All rooms &amp; people</a>
             {resources.map((r) => <a class={resFilter === r.id ? 'on' : ''} href={keep({ r: r.id })}>{r.name}</a>)}
           </div>
         </details>
@@ -247,6 +247,11 @@ const activeLinks = links.filter((l) => l.active && resById.has(l.resourceId));
               <div class="bk-day-hours">{Array.from({ length: H1 - H0 }, (_, i) => <span>{f.time.format(dayStart + (H0 + i) * 3_600_000).replace(':00', '')}</span>)}</div>
               {dayCols.map((c) => (
                 <div class="bk-day-col">
+                  {dayHolds.filter((h) => h.resourceId === c.r.id).map((h) => (
+                    <a class="bk-blk is-hold" style={pos({ start: h.start, end: h.end } as Booking)} href={`/admin/calendar/events/${h.eventId}`} title={`Held for ${h.title}`}>
+                      <b>Held · {h.title}</b><small>{f.time.format(h.eventStart)} – {f.time.format(h.eventEnd)}{h.start < h.eventStart || h.end > h.eventEnd ? ' · incl. setup/cleanup' : ''}</small>
+                    </a>
+                  ))}
                   {c.items.map((b) => (
                     <a class={`bk-blk is-${b.kind === 'block' ? 'block' : b.status}`} style={pos(b)} href={keep({ b: b.id })}>
                       <b>{titleOf(b)}</b><small>{whenOf(b)}</small>
@@ -260,7 +265,7 @@ const activeLinks = links.filter((l) => l.active && resById.has(l.resourceId));
           <>
             {pending.length > 0 && (
               <section class="card bk-group">
-                <div class="bk-dayh"><b>Needs a decision</b><span>{pending.length}</span></div>
+                <div class="bk-dayh"><b>Needs approval</b><span>{pending.length}</span></div>
                 {pending.map((b) => (
                   <div class={`bk-row${selected?.id === b.id ? ' is-sel' : ''}`}>
                     <a class="bk-when" href={keep({ b: b.id })}>{f.day.format(b.start)}<small>{whenOf(b)}</small></a>
@@ -354,10 +359,10 @@ const activeLinks = links.filter((l) => l.active && resById.has(l.resourceId));
   </>
   )}
 
-  <Modal id="bk-block" title="Block time">
+  <Modal id="bk-block" title="Block time" open={Astro.url.searchParams.has('block') && resources.length > 0}>
     <form method="post">
       <input type="hidden" name="op" value="block" />
-      <label class="field"><span>Resource</span><select name="resourceId">{resources.map((r) => <option value={r.id} selected={r.id === resFilter}>{r.name}</option>)}</select></label>
+      <label class="field"><span>Room or person</span><select name="resourceId">{resources.map((r) => <option value={r.id} selected={r.id === resFilter}>{r.name}</option>)}</select></label>
       <div class="field-row three">
         <label class="field"><span>Date</span><input type="date" name="date" value={day} required /></label>
         <label class="field"><span>From</span><input type="time" name="start" value="09:00" /></label>
@@ -369,7 +374,7 @@ const activeLinks = links.filter((l) => l.active && resById.has(l.resourceId));
     </form>
   </Modal>
 
-  <Modal id="bk-add" title="Add booking">
+  <Modal id="bk-add" title="Add booking" open={Astro.url.searchParams.has('add') && activeLinks.length > 0}>
     <form method="post">
       <input type="hidden" name="op" value="add" />
       <label class="field"><span>Booking link</span><select name="linkId">{activeLinks.map((l) => <option value={l.id}>{resById.get(l.resourceId)?.name} · {l.name}</option>)}</select></label>
@@ -383,6 +388,7 @@ const activeLinks = links.filter((l) => l.active && resById.has(l.resourceId));
         <label class="field"><span>Email</span><input type="email" name="email" required /></label>
       </div>
       <label class="field"><span>Phone <em class="hint">optional</em></span><input type="tel" name="phone" /></label>
+      <label class="check-row"><input type="checkbox" name="overHold" /> Book anyway if an event is holding the room</label>
       <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Add and confirm</button></div>
       <p class="hint modal-note">Staff bookings skip notice windows but can never overlap another booking.</p>
     </form>