@acms-subir/core 0.3.3-next.20260929113209 → 0.3.4

package/src/pages/api/media/upload.ts

@@ -1,89 +1,21 @@
 import type { APIRoute } from 'astro';
 import { validateSession, SESSION_COOKIE } from '../../../lib/auth';
 import { getRepo } from '../../../lib/repo';
-import { getMediaStore } from '../../../lib/media/store';
-
-// Multipart upload from the admin. For images the client has already done
-// the heavy lifting (EXIF rotation, downscale to max 1080px, WebP re-encode,
-// variant generation); this route just stores the optimized file + variants
-// and records the media row. SVG/GIF arrive untouched. Documents (for the
-// file/download card) are stored as-is. Video/audio is deliberately rejected
-// — embeds cover video until a streaming upload + Range-serving pipeline
-// exists.
-//
-// Fields: file (primary), width, height, alt?, variant_<w> (File, webp)…
-const DOCUMENT_TYPES = new Set([
-  'application/pdf',
-  'application/zip',
-  'application/x-zip-compressed',
-  'application/json',
-  'text/plain',
-  'text/csv',
-  'text/markdown',
-  'application/msword',
-  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
-  'application/vnd.ms-excel',
-  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
-  'application/vnd.ms-powerpoint',
-  'application/vnd.openxmlformats-officedocument.presentationml.presentation',
-  'application/epub+zip',
-]);
-const MAX_IMAGE = 30 * 1024 * 1024;
-const MAX_DOCUMENT = 25 * 1024 * 1024;
+import { ApiError } from '../../../lib/api';
+import { storeUpload } from '../../../lib/media/upload';
 
+// Multipart upload from the admin; the rules live in lib/media/upload.ts
+// (shared with editor apps).
 export const POST: APIRoute = async ({ request, cookies, locals }) => {
   if (!(await validateSession(cookies.get(SESSION_COOKIE)?.value, locals))) {
     return Response.json({ error: 'Unauthorized' }, { status: 401 });
   }
-
   const form = await request.formData();
-  const file = form.get('file');
-  if (!(file instanceof File) || file.size === 0) {
-    return Response.json({ error: 'Missing file' }, { status: 400 });
-  }
-  const isImage = file.type.startsWith('image/');
-  const isDocument = DOCUMENT_TYPES.has(file.type);
-  if (!isImage && !isDocument) {
-    const hint = file.type.startsWith('video/') || file.type.startsWith('audio/')
-      ? 'Video and audio uploads aren’t supported yet — use an embed card instead.'
-      : 'Unsupported file type.';
-    return Response.json({ error: hint }, { status: 415 });
+  try {
+    const media = await storeUpload(form, locals, await getRepo(locals));
+    return Response.json({ media });
+  } catch (error) {
+    if (error instanceof ApiError) return Response.json({ error: error.message }, { status: error.status });
+    throw error;
   }
-  const cap = isImage ? MAX_IMAGE : MAX_DOCUMENT;
-  if (file.size > cap) {
-    return Response.json({ error: `File too large (max ${Math.round(cap / 1024 / 1024)} MB)` }, { status: 413 });
-  }
-
-  const id = crypto.randomUUID();
-  const ext = (file.name.split('.').pop() || 'bin').toLowerCase().replace(/[^a-z0-9]/g, '') || 'bin';
-  const key = `${id}/original.${ext}`;
-  const store = getMediaStore(locals);
-  await store.put(key, await file.arrayBuffer(), file.type);
-
-  const variants: { w: number; key: string }[] = [];
-  for (const [field, value] of form.entries()) {
-    const m = field.match(/^variant_(\d+)$/);
-    if (m && value instanceof File && value.size > 0) {
-      const w = Number(m[1]);
-      const vkey = `${id}/w${w}.webp`;
-      await store.put(vkey, await value.arrayBuffer(), 'image/webp');
-      variants.push({ w, key: vkey });
-    }
-  }
-  variants.sort((a, b) => a.w - b.w);
-
-  const repo = await getRepo(locals);
-  const media = await repo.createMedia({
-    id,
-    key,
-    filename: file.name,
-    mime: file.type,
-    width: Number(form.get('width') ?? 0),
-    height: Number(form.get('height') ?? 0),
-    size: file.size,
-    alt: String(form.get('alt') ?? ''),
-    variants,
-  });
-
-  return Response.json({ media });
 };

package/src/pages/api/push/admin.ts

@@ -0,0 +1,27 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../lib/repo';
+import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
+import { OWNER_ENV, SESSION_COOKIE, validateSession } from '../../../lib/auth';
+import { AdminPushInput, adminPushAction, adminPushState } from '../../../lib/push/api';
+
+// Admin → Mobile app (owner only; registered only when push is enabled).
+export const GET: APIRoute = async ({ request, cookies, locals, url }) => {
+  try {
+    const repo = await getRepo(locals);
+    await requireSession(request, cookies, repo, true);
+    return json(await adminPushState(repo, url, locals));
+  } catch (e) { return apiError(e); }
+};
+export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
+  try {
+    const repo = await getRepo(locals);
+    await requireSession(request, cookies, repo, true);
+    // sending reaches every installed app: only from this site's admin
+    if (request.headers.get('origin') !== url.origin) throw new ApiError(403, 'Send from this site’s admin.');
+    const input = AdminPushInput.parse(await readJson(request, 20_000));
+    const id = await validateSession(cookies.get(SESSION_COOKIE)?.value, repo);
+    const author = id === OWNER_ENV ? 'Owner' : (await repo.getUser(id ?? ''))?.name ?? '';
+    const result = await adminPushAction(repo, input, { url, locals, author });
+    return json({ ...result, state: input.action === 'count' ? undefined : await adminPushState(repo, url, locals) });
+  } catch (e) { return apiError(e); }
+};

package/src/pages/api/v1/admin/bookings/[id]/[action].ts

@@ -0,0 +1,14 @@
+import { editorRoute, logWrite } from '../../../../../../lib/editor/http';
+import { BookingActionInput, bookingAction } from '../../../../../../lib/editor/bookings';
+import { methodNotAllowed } from '../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../../lib/mobile/http';
+// approve | decline | cancel — the guest is emailed, as from Admin → Bookings
+export const POST = editorRoute(async (c) => {
+  const { id, action } = c.context.params;
+  const body = c.context.request.headers.get('content-type') ? BookingActionInput.parse(await readJson(c.context.request, 5_000)) : {};
+  const result = await bookingAction(c.repo, id!, action!, body, { url: c.context.url, locals: c.context.locals });
+  await logWrite(c, `booking-${action}`, `booking:${id}`);
+  return result;
+}, { write: true });
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/admin/bookings/index.ts

@@ -0,0 +1,6 @@
+import { editorRoute } from '../../../../../lib/editor/http';
+import { InboxQuery, inbox } from '../../../../../lib/editor/bookings';
+import { methodNotAllowed, queryParams } from '../../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, context }) => inbox(repo, InboxQuery.parse(queryParams(context.url))));
+export const ALL = () => methodNotAllowed('GET, OPTIONS');

package/src/pages/api/v1/admin/documents/[kind]/[id]/[action].ts

@@ -0,0 +1,17 @@
+import { editorRoute, logWrite } from '../../../../../../../lib/editor/http';
+import { ActionInput, DocKindParam, docAction, docJson } from '../../../../../../../lib/editor/documents';
+import { methodNotAllowed } from '../../../../../../../lib/mobile/http';
+import { ApiError, readJson } from '../../../../../../../lib/api';
+import { invalidateRedirectCache } from '../../../../../../../middleware';
+export { preflight as OPTIONS } from '../../../../../../../lib/mobile/http';
+// publish | unpublish | schedule | discard
+export const POST = editorRoute(async (c) => {
+  const kind = DocKindParam.parse(c.context.params.kind);
+  const action = c.context.params.action!;
+  if (!['publish', 'unpublish', 'schedule', 'discard'].includes(action)) throw new ApiError(404, 'Unknown action.');
+  const body = ActionInput.parse(await readJson(c.context.request, 5_000));
+  const doc = await docAction(c.repo, kind, c.context.params.id!, action, body, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache });
+  await logWrite(c, action, `${kind}:${doc.id}`);
+  return docJson(kind, doc);
+}, { write: true });
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/admin/documents/[kind]/[id]/index.ts

@@ -0,0 +1,20 @@
+import { editorRoute, logWrite } from '../../../../../../../lib/editor/http';
+import { DocKindParam, SaveInput, docJson, loadDoc, saveDoc } from '../../../../../../../lib/editor/documents';
+import { methodNotAllowed, queryParams } from '../../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../../lib/api';
+import { invalidateRedirectCache } from '../../../../../../../middleware';
+import { z } from 'zod';
+export { preflight as OPTIONS } from '../../../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, context }) => {
+  z.object({}).strict().parse(queryParams(context.url));
+  const kind = DocKindParam.parse(context.params.kind);
+  return docJson(kind, await loadDoc(repo, kind, context.params.id!));
+});
+export const PUT = editorRoute(async (c) => {
+  const kind = DocKindParam.parse(c.context.params.kind);
+  const body = SaveInput.parse(await readJson(c.context.request, 2_500_000));
+  const doc = await saveDoc(c.repo, kind, c.context.params.id!, body, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache });
+  await logWrite(c, 'save', `${kind}:${doc.id}`);
+  return docJson(kind, doc);
+}, { write: true });
+export const ALL = () => methodNotAllowed('GET, PUT, OPTIONS');

package/src/pages/api/v1/admin/documents/[kind]/[id]/translations/[locale]/[action].ts

@@ -0,0 +1,26 @@
+import { editorRoute, logWrite } from '../../../../../../../../../lib/editor/http';
+import { DocKindParam } from '../../../../../../../../../lib/editor/documents';
+import { AiDocInput, ReviewDocInput, changeDocTranslation } from '../../../../../../../../../lib/editor/translations';
+import { failure, methodNotAllowed } from '../../../../../../../../../lib/mobile/http';
+import { ApiError, readJson } from '../../../../../../../../../lib/api';
+import { invalidateRedirectCache } from '../../../../../../../../../middleware';
+export { preflight as OPTIONS } from '../../../../../../../../../lib/mobile/http';
+// review: mark translated units reviewed · ai-draft: machine drafts for what's missing
+const handler = (ai: boolean) => editorRoute(async (c) => {
+  const { params } = c.context;
+  const kind = DocKindParam.parse(params.kind);
+  const hooks = { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache };
+  const raw = await readJson(c.context.request, 10_000);
+  const result = ai
+    ? await (async () => { const b = AiDocInput.parse(raw); return changeDocTranslation(c.repo, kind, params.id!, params.locale!, b.revision, { op: 'ai', paths: b.paths, includeReviewed: b.includeReviewed }, hooks); })()
+    : await (async () => { const b = ReviewDocInput.parse(raw); return changeDocTranslation(c.repo, kind, params.id!, params.locale!, b.revision, { op: 'review', paths: b.paths }, hooks); })();
+  await logWrite(c, ai ? 'translate-ai' : 'translate-review', `${kind}:${params.id}:${params.locale}`);
+  return result;
+}, { write: true, ...(ai ? { limit: 10 } : {}) });
+const review = handler(false), aiDraft = handler(true);
+export const POST: import('astro').APIRoute = (context) => {
+  if (context.params.action === 'review') return review(context);
+  if (context.params.action === 'ai-draft') return aiDraft(context);
+  return failure(new ApiError(404, 'Unknown action.'));
+};
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/admin/documents/[kind]/[id]/translations/[locale]/index.ts

@@ -0,0 +1,18 @@
+import { editorRoute, logWrite } from '../../../../../../../../../lib/editor/http';
+import { DocKindParam } from '../../../../../../../../../lib/editor/documents';
+import { SetDocInput, changeDocTranslation, getDocTranslation } from '../../../../../../../../../lib/editor/translations';
+import { methodNotAllowed } from '../../../../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../../../../lib/api';
+import { invalidateRedirectCache } from '../../../../../../../../../middleware';
+export { preflight as OPTIONS } from '../../../../../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, context: { params } }) => getDocTranslation(repo, DocKindParam.parse(params.kind), params.id!, params.locale!));
+// a person's words: stored as reviewed
+export const PUT = editorRoute(async (c) => {
+  const { params } = c.context;
+  const kind = DocKindParam.parse(params.kind);
+  const body = SetDocInput.parse(await readJson(c.context.request, 2_500_000));
+  const result = await changeDocTranslation(c.repo, kind, params.id!, params.locale!, body.revision, { op: 'set', values: body.values }, { url: c.context.url, locals: c.context.locals, onRedirect: invalidateRedirectCache });
+  await logWrite(c, 'translate', `${kind}:${params.id}:${params.locale}`);
+  return result;
+}, { write: true });
+export const ALL = () => methodNotAllowed('GET, PUT, OPTIONS');

package/src/pages/api/v1/admin/documents/index.ts

@@ -0,0 +1,13 @@
+import { editorRoute, logWrite } from '../../../../../lib/editor/http';
+import { CreateInput, createDoc, docJson, listDocs, listQuery } from '../../../../../lib/editor/documents';
+import { methodNotAllowed, queryParams } from '../../../../../lib/mobile/http';
+import { readJson } from '../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, context }) => listDocs(repo, listQuery.parse(queryParams(context.url))));
+export const POST = editorRoute(async (c) => {
+  const input = CreateInput.parse(await readJson(c.context.request, 20_000));
+  const doc = await createDoc(c.repo, input, c.who.user.id);
+  await logWrite(c, 'create', `${input.kind}:${doc.id}`);
+  return docJson(input.kind, doc);
+}, { write: true, status: 201 });
+export const ALL = () => methodNotAllowed('GET, POST, OPTIONS');

package/src/pages/api/v1/admin/me.ts

@@ -0,0 +1,6 @@
+import { editorRoute } from '../../../../lib/editor/http';
+import { me } from '../../../../lib/editor/me';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const GET = editorRoute(({ repo, who, context }) => me(repo, who, context.url, context.locals));
+export const ALL = () => methodNotAllowed('GET, OPTIONS');

package/src/pages/api/v1/admin/media/index.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+import { editorRoute, logWrite } from '../../../../../lib/editor/http';
+import { methodNotAllowed, pageQuery, queryParams } from '../../../../../lib/mobile/http';
+import { ApiError, readResponseBytes } from '../../../../../lib/api';
+import { MAX_UPLOAD_BODY, storeUpload } from '../../../../../lib/media/upload';
+import type { Media } from '../../../../../lib/schema';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+const view = (m: Media) => ({ id: m.id, url: `/media/${m.key}`, filename: m.filename, mime: m.mime, width: m.width, height: m.height, size: m.size, alt: m.alt,
+  variants: m.variants.map((v) => ({ width: v.w, url: `/media/${v.key}` })), createdAt: new Date(m.createdAt).toISOString() });
+const ListQuery = z.object({ q: z.string().max(200).optional(), type: z.enum(['image', 'document']).optional(), ...pageQuery }).strict();
+export const GET = editorRoute(async ({ repo, context }) => {
+  const q = ListQuery.parse(queryParams(context.url));
+  let list = await repo.listMedia();
+  if (q.type) list = list.filter((m) => (q.type === 'image') === m.mime.startsWith('image/'));
+  if (q.q) { const needle = q.q.toLowerCase(); list = list.filter((m) => `${m.filename} ${m.alt}`.toLowerCase().includes(needle)); }
+  list.sort((a, b) => b.createdAt - a.createdAt);
+  const start = (q.page - 1) * q.limit;
+  return { items: list.slice(start, start + q.limit).map(view), pagination: { page: q.page, limit: q.limit, nextPage: start + q.limit < list.length ? q.page + 1 : null } };
+});
+// same types, limits and storage as the admin uploader (images arrive pre-compressed)
+export const POST = editorRoute(async (c) => {
+  const type = c.context.request.headers.get('content-type') ?? '';
+  if (!type.toLowerCase().startsWith('multipart/form-data')) throw new ApiError(415, 'Use Content-Type: multipart/form-data with a "file" field.');
+  const bytes = await readResponseBytes(c.context.request, MAX_UPLOAD_BODY);
+  let form: FormData;
+  try { form = await new Response(bytes as BodyInit, { headers: { 'content-type': type } }).formData(); }
+  catch { throw new ApiError(400, 'The upload is not valid multipart form data.'); }
+  const media = await storeUpload(form, c.context.locals, c.repo);
+  await logWrite(c, 'upload', `media:${media.id}`);
+  return view(media);
+}, { write: true, status: 201, limit: 30 });
+export const ALL = () => methodNotAllowed('GET, POST, OPTIONS');

package/src/pages/api/v1/admin/sections/[pageId]/[sectionId]/index.ts

@@ -0,0 +1,14 @@
+import { editorRoute, logWrite } from '../../../../../../../lib/editor/http';
+import { SectionPatch, patchSection } from '../../../../../../../lib/editor/sections';
+import { methodNotAllowed } from '../../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../../../lib/mobile/http';
+// stage new field values for one section (content only for editors; locks apply)
+export const PATCH = editorRoute(async (c) => {
+  const { pageId, sectionId } = c.context.params;
+  const body = SectionPatch.parse(await readJson(c.context.request, 500_000));
+  const result = await patchSection(c.repo, c.who, pageId!, sectionId!, body, c.context.url.origin);
+  await logWrite(c, 'section', `${pageId}:${sectionId}`);
+  return result;
+}, { write: true });
+export const ALL = () => methodNotAllowed('PATCH, OPTIONS');

package/src/pages/api/v1/admin/sections/[pageId]/[sectionId]/publish.ts

@@ -0,0 +1,14 @@
+import { editorRoute, logWrite } from '../../../../../../../lib/editor/http';
+import { RevisionInput, publishSection } from '../../../../../../../lib/editor/sections';
+import { methodNotAllowed } from '../../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../../../lib/mobile/http';
+// publish just this section's staged copy (same rules as the Design screen)
+export const POST = editorRoute(async (c) => {
+  const { pageId, sectionId } = c.context.params;
+  const body = RevisionInput.parse(await readJson(c.context.request, 5_000));
+  const result = await publishSection(c.repo, c.who, pageId!, sectionId!, body.revision, c.context.url.origin);
+  await logWrite(c, 'section-publish', `${pageId}:${sectionId}`);
+  return result;
+}, { write: true });
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/admin/sections/[pageId]/[sectionId]/translations/[locale]/[action].ts

@@ -0,0 +1,22 @@
+import type { APIRoute } from 'astro';
+import { editorRoute, logWrite } from '../../../../../../../../../lib/editor/http';
+import { AiSectionInput, ReviewSectionInput, changeSectionTranslation } from '../../../../../../../../../lib/editor/translations';
+import { failure, methodNotAllowed } from '../../../../../../../../../lib/mobile/http';
+import { ApiError, readJson } from '../../../../../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../../../../../lib/mobile/http';
+const handler = (ai: boolean) => editorRoute(async (c) => {
+  const { params } = c.context;
+  const raw = await readJson(c.context.request, 10_000);
+  const mode = ai ? (() => { const b = AiSectionInput.parse(raw); return { revision: b.revision, mode: { op: 'ai' as const, paths: b.paths, includeReviewed: b.includeReviewed } }; })()
+    : (() => { const b = ReviewSectionInput.parse(raw); return { revision: b.revision, mode: { op: 'review' as const, paths: b.paths } }; })();
+  const result = await changeSectionTranslation(c.repo, c.who, params.pageId!, params.sectionId!, params.locale!, mode.revision, mode.mode, c.context.url.origin, c.context.locals);
+  await logWrite(c, ai ? 'translate-ai' : 'translate-review', `${params.pageId}:${params.sectionId}:${params.locale}`);
+  return result;
+}, { write: true, ...(ai ? { limit: 10 } : {}) });
+const review = handler(false), aiDraft = handler(true);
+export const POST: APIRoute = (context) => {
+  if (context.params.action === 'review') return review(context);
+  if (context.params.action === 'ai-draft') return aiDraft(context);
+  return failure(new ApiError(404, 'Unknown action.'));
+};
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/admin/sections/[pageId]/[sectionId]/translations/[locale]/index.ts

@@ -0,0 +1,14 @@
+import { editorRoute, logWrite } from '../../../../../../../../../lib/editor/http';
+import { SetSectionInput, changeSectionTranslation, getSectionTranslation } from '../../../../../../../../../lib/editor/translations';
+import { methodNotAllowed } from '../../../../../../../../../lib/mobile/http';
+import { readJson } from '../../../../../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, context: { params } }) => getSectionTranslation(repo, params.pageId!, params.sectionId!, params.locale!));
+export const PUT = editorRoute(async (c) => {
+  const { params } = c.context;
+  const body = SetSectionInput.parse(await readJson(c.context.request, 500_000));
+  const result = await changeSectionTranslation(c.repo, c.who, params.pageId!, params.sectionId!, params.locale!, body.revision, { op: 'set', values: body.values }, c.context.url.origin, c.context.locals);
+  await logWrite(c, 'translate', `${params.pageId}:${params.sectionId}:${params.locale}`);
+  return result;
+}, { write: true });
+export const ALL = () => methodNotAllowed('GET, PUT, OPTIONS');

package/src/pages/api/v1/admin/sections/index.ts

@@ -0,0 +1,6 @@
+import { editorRoute } from '../../../../../lib/editor/http';
+import { SectionsQuery, listSections } from '../../../../../lib/editor/sections';
+import { methodNotAllowed, queryParams } from '../../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const GET = editorRoute(async ({ repo, who, context }) => listSections(repo, SectionsQuery.parse(queryParams(context.url)), who));
+export const ALL = () => methodNotAllowed('GET, OPTIONS');

package/src/pages/api/v1/auth/revoke.ts

@@ -0,0 +1,5 @@
+import type { APIRoute } from 'astro';
+import { authPreflight, revokeRoute } from '../../../../lib/editor/token-route';
+// Editor apps: sign this device out (RFC 7009). Either token revokes the device.
+export const POST: APIRoute = (context) => revokeRoute(context);
+export const OPTIONS: APIRoute = () => authPreflight();

package/src/pages/api/v1/auth/token.ts

@@ -0,0 +1,5 @@
+import type { APIRoute } from 'astro';
+import { authPreflight, tokenRoute } from '../../../../lib/editor/token-route';
+// Editor apps: exchange a sign-in code (+ PKCE verifier) or a refresh token for device tokens.
+export const POST: APIRoute = (context) => tokenRoute(context);
+export const OPTIONS: APIRoute = () => authPreflight();

package/src/pages/api/v1/devices/[token].ts

@@ -0,0 +1,20 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../../lib/repo';
+import { unregisterDevice, updateDevice } from '../../../../lib/push/api';
+import { failure, limitRequest, methodNotAllowed, response } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+// PUT: change topics/locale. DELETE: opt out (idempotent).
+function handler(run: (repo: Awaited<ReturnType<typeof getRepo>>, request: Request, token: string) => Promise<unknown>): APIRoute {
+  return async context => {
+    try {
+      const repo = await getRepo(context.locals);
+      let address = 'unknown';
+      try { address = context.clientAddress || address; } catch { /* shared fallback bucket */ }
+      await limitRequest(repo, address, true);
+      return response(await run(repo, context.request, context.params.token ?? ''));
+    } catch (error) { return failure(error); }
+  };
+}
+export const PUT = handler((repo, request, token) => updateDevice(repo, request, token));
+export const DELETE = handler((repo, _request, token) => unregisterDevice(repo, token));
+export const ALL = () => methodNotAllowed('PUT, DELETE, OPTIONS');

package/src/pages/api/v1/devices/index.ts

@@ -0,0 +1,17 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../../lib/repo';
+import { registerDevice } from '../../../../lib/push/api';
+import { failure, limitRequest, methodNotAllowed, response } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+// Register or refresh this device's Expo push token (only when push is enabled).
+export const POST: APIRoute = async context => {
+  try {
+    const repo = await getRepo(context.locals);
+    let address = 'unknown';
+    try { address = context.clientAddress || address; } catch { /* shared fallback bucket */ }
+    await limitRequest(repo, address, true);
+    const result = await registerDevice(repo, context.request);
+    return response(result, result.created ? 201 : 200);
+  } catch (error) { return failure(error); }
+};
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/openapi.json.ts

@@ -0,0 +1,7 @@
+import { getOpenApi } from '../../../lib/mobile/openapi';
+import { readRoute } from '../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../lib/mobile/http';
+export const GET = readRoute(getOpenApi, true, true);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/pages/[...slug].ts

@@ -0,0 +1,7 @@
+import { getPage } from '../../../../lib/mobile/pages';
+import { readRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const GET = readRoute(getPage);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/pages/home.ts

@@ -0,0 +1,7 @@
+import { getPage } from '../../../../lib/mobile/pages';
+import { readRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const GET = readRoute((repo, url) => getPage(repo, url, 'home'));
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/push/topics.ts

@@ -0,0 +1,7 @@
+import { listPushTopics } from '../../../../lib/push/api';
+import { readRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const GET = readRoute(listPushTopics, true);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/site.ts

@@ -0,0 +1,7 @@
+import { getSite } from '../../../lib/mobile/site';
+import { readRoute } from '../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../lib/mobile/http';
+export const GET = readRoute(getSite);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/theme.ts

@@ -0,0 +1,7 @@
+import { getThemeTokens } from '../../../lib/mobile/site';
+import { readRoute } from '../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../lib/mobile/http';
+export const GET = readRoute(getThemeTokens);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/blog/[slug].astro

@@ -1,4 +1,6 @@
 ---
+import { requestLocale } from '../../lib/i18n';
+import { localizeDoc, isExtraLocale } from '../../lib/translations';
 import Site from '../../layouts/Site.astro';
 import { getRepo } from '../../lib/repo';
 import { renderMarkdown } from '../../lib/markdown';
@@ -20,7 +22,10 @@ if (!col) return new Response(null, { status: 404, statusText: 'Not found' });
 
 const { slug } = Astro.params;
 const repo = await getRepo(Astro.locals);
-const post = slug ? await repo.getPostBySlug(slug, col.key) : null;
+// another language (/es/…): translated words over the shared post
+const locale = requestLocale(Astro.url, Astro.locals);
+const rawPost = slug ? await repo.getPostBySlug(slug, col.key) : null;
+const post = rawPost ? localizeDoc(rawPost, locale) : null;
 
 const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
 if (!post || (post.status !== 'published' && !isAdmin)) {
@@ -35,7 +40,8 @@ const [tags, allUsers, allPosts, rawSettings, allMedia] = await Promise.all([
   post.cover.startsWith('/media/') ? repo.listMedia() : Promise.resolve([]),
 ]);
 // ?designPreview=1 (admin-only) renders the staged Design-screen changes
-const settings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+const baseSettings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+const settings = isExtraLocale(locale) ? { ...baseSettings, locale } : baseSettings;
 // ordered author objects; the first is the primary (gets the author card)
 const authors = authorIds
   .map((id) => allUsers.find((u) => u.id === id))

package/src/pages/blog/index.astro

@@ -8,6 +8,8 @@ import { formatDate } from '../../lib/dates';
 import { resolveDesign } from '../../lib/theme';
 import { effectiveSettings } from '../../lib/designPreview';
 import { collectionFromPath, collectionUrl, tagUrl } from '../../lib/content';
+import { requestLocale, localePath } from '../../lib/i18n';
+import { localizeDoc, isExtraLocale } from '../../lib/translations';
 
 // One file serves every collection's index — injectRoute can't pass props,
 // so the collection is resolved from the request path.
@@ -16,8 +18,13 @@ if (!col) return new Response(null, { status: 404, statusText: 'Not found' });
 
 const PAGE_SIZE = 12;
 const repo = await getRepo(Astro.locals);
-const [allPosts, tags, users, rawSettings] = await Promise.all([repo.listPublishedPosts(col.key), repo.listTags(), repo.listUsers(), repo.getSettings()]);
-const settings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+// another language (/es/blog): translated titles/excerpts, links stay in the language
+const locale = requestLocale(Astro.url, Astro.locals);
+const lp = (path: string) => (isExtraLocale(locale) ? localePath(path, locale) : path);
+const [rawPosts, tags, users, rawSettings] = await Promise.all([repo.listPublishedPosts(col.key), repo.listTags(), repo.listUsers(), repo.getSettings()]);
+const allPosts = rawPosts.map((p) => localizeDoc(p, locale));
+const baseSettings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+const settings = isExtraLocale(locale) ? { ...baseSettings, locale } : baseSettings;
 const design = resolveDesign(settings);
 
 // page 1 leads with the featured post (if any) as a big split card; it's
@@ -81,7 +88,7 @@ const iso = (ts: number | null) => (ts ? new Date(ts).toISOString() : undefined)
       <PostCard
         variant="feature"
         headingLevel={2}
-        href={collectionUrl(col.key, lead.slug)}
+        href={lp(collectionUrl(col.key, lead.slug))}
         title={lead.title}
         excerpt={lead.excerpt}
         cover={lead.cover}
@@ -99,7 +106,7 @@ const iso = (ts: number | null) => (ts ? new Date(ts).toISOString() : undefined)
         <PostCard
           variant={layout === 'cards' ? 'card' : 'row'}
           headingLevel={2}
-          href={collectionUrl(col.key, p.slug)}
+          href={lp(collectionUrl(col.key, p.slug))}
           title={p.title}
           excerpt={p.excerpt}
           cover={p.cover}

package/src/pages/book/[resource].ics.ts

@@ -4,8 +4,9 @@ import { getRepo } from '../../lib/repo';
 import { bookingsEnabled } from '../../lib/calendar/config';
 import { siteOrigin } from '../../lib/seo';
 import { escapeText, foldLine } from '../../lib/calendar/ics-write';
+import { eventHolds } from '../../lib/booking/holds';
 
-// Staff feed of a resource's bookings (names included), for Google/Apple/
+// Staff feed of a resource's bookings (names included) and event holds, for Google/Apple/
 // Outlook subscriptions: /book/<slug>.ics?t=<secret from the admin>.
 const same = (a: string, b: string) => a.length === b.length && a.length > 0 && timingSafeEqual(Buffer.from(a), Buffer.from(b));
 const utc = (ms: number) => new Date(ms).toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
@@ -31,6 +32,11 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
     lines.push('BEGIN:VEVENT', `UID:booking-${b.id}@${host}`, `DTSTAMP:${utc(Date.now())}`, `DTSTART:${utc(b.start)}`, `DTEND:${utc(b.end)}`,
       `SUMMARY:${escapeText(title)}`, `DESCRIPTION:${escapeText(desc)}`, `STATUS:${b.status === 'pending' ? 'TENTATIVE' : 'CONFIRMED'}`, 'END:VEVENT');
   }
+  // events holding this room (next year), so staff calendars show them too
+  for (const h of await eventHolds(repo, settings, Date.now() - 60 * 86_400_000, Date.now() + 366 * 86_400_000, resource.id)) {
+    lines.push('BEGIN:VEVENT', `UID:hold-${h.eventId}-${h.start}@${host}`, `DTSTAMP:${utc(Date.now())}`, `DTSTART:${utc(h.start)}`, `DTEND:${utc(h.end)}`,
+      `SUMMARY:${escapeText(`Held · ${h.title}`)}`, `DESCRIPTION:${escapeText(`${origin}/admin/calendar/events/${h.eventId}`)}`, 'STATUS:CONFIRMED', 'END:VEVENT');
+  }
   lines.push('END:VCALENDAR');
   return new Response(lines.map(foldLine).join('\r\n') + '\r\n', {
     headers: { 'Content-Type': 'text/calendar; charset=utf-8', 'Cache-Control': 'private, no-store' },