@acms-subir/core 0.3.9 → 0.3.10

package/src/lib/editor/schedule.ts

@@ -0,0 +1,340 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import type { Booking, BookingLink, Resource, Settings } from '../schema';
+import { ApiError } from '../api';
+import { ApprovalMode, ApprovalRules, BookingMode, DateOverride, QUESTION_TYPES, TimeRange, WeeklyHours, slugify } from '../schema';
+import { CALENDAR, bookingsEnabled } from '../calendar/config';
+import { collectViewEvents } from '../calendar/data';
+import { isValidTimeZone, safeColor } from '../calendar/events';
+import { describeRepeat } from '../calendar/rrule';
+import { zonedToUtc } from '../calendar/ics';
+import { normalizeCalendarSrc } from '../calendar/src';
+import { saveCalendar } from '../calendar/admin';
+import { availabilityContext, bookingJson, createBlock, createResourceBooking, rescheduleBooking } from '../booking/service';
+import { isBookable } from '../booking/availability';
+import { siteOrigin } from '../seo';
+import { waitUntilFrom } from '../webhooks';
+import { isoDay } from '../mobile/http';
+import type { EditorContext } from './http';
+import { requireBookings } from './bookings';
+import { requireAdmin, requireScheduleRole, canManageSchedule } from './roles';
+
+// The schedule from editor apps: one-request week/month view, booking on
+// someone's behalf, moving bookings, blocked time, and setup (rooms, booking
+// types, hours, calendars). Setup writes need the schedule role (Admin →
+// Mobile app; administrators + owners by default). Every write goes through
+// the same services as the web admin and lands in the audit log.
+
+const DAY = 86_400_000;
+const iso = (n: number) => new Date(n).toISOString();
+const flow = (c: EditorContext, settings: Settings) => ({ origin: siteOrigin(settings, c.context.url), locals: c.context.locals, waitUntil: waitUntilFrom(c.context.locals) });
+function requireCalendarModule() { if (!CALENDAR.enabled) throw new ApiError(404, 'The calendar is turned off on this site.'); }
+
+// ---- schedule view -----------------------------------------------------------
+
+export const ScheduleQuery = z.object({ from: isoDay, to: isoDay, resource: z.string().max(200).optional() }).strict()
+  .refine((q) => q.to >= q.from && Date.parse(q.to) - Date.parse(q.from) <= 62 * DAY, 'Use a range of 1 to 63 days.');
+
+export async function schedule(c: EditorContext, q: z.infer<typeof ScheduleQuery>) {
+  requireCalendarModule();
+  const settings = await c.repo.getSettings();
+  const tz = settings.timezone || 'UTC';
+  const at = (d: string) => zonedToUtc(+d.slice(0, 4), +d.slice(5, 7), +d.slice(8, 10), 0, 0, 0, tz);
+  // site-local midnights: from the start of `from` to the end of `to`
+  const startMs = at(q.from), endMs = at(new Date(Date.parse(q.to) + DAY).toISOString().slice(0, 10));
+  const win = { displayTz: tz, now: Date.now(), windowStartMs: startMs, windowEndMs: endMs };
+  const resources = bookingsEnabled() ? await c.repo.listResources() : [];
+  const resource = q.resource ? resources.find((r) => r.id === q.resource || r.slug === q.resource) : null;
+  if (q.resource && !resource) throw new ApiError(404, 'Room or service not found.');
+  const [{ events, calendars, errors }, bookings] = await Promise.all([
+    collectViewEvents(c.repo, settings, win, { audience: 'admin', includeFeeds: true, includeBookings: false }),
+    bookingsEnabled() ? c.repo.listBookings({ from: startMs, to: win.windowEndMs, resourceId: resource?.id, statuses: ['pending', 'confirmed'], kinds: ['booking', 'block'] }) : Promise.resolve([] as Booking[]),
+  ]);
+  const calById = new Map(calendars.map((cal) => [cal.id, cal]));
+  const items = [
+    ...events.filter((v) => !resource || v.event?.roomHold.resourceIds.includes(resource.id)).map((v) => {
+      const e = v.event;
+      const cal = e ? e.calendarIds.map((id) => calById.get(id)).find(Boolean) : calendars.find((x) => x.name === v.calendarName && x.kind === 'feed');
+      return {
+        kind: e ? 'event' as const : 'feed' as const, id: e?.id ?? '', title: v.title,
+        start: iso(v.start), end: iso(v.end), allDay: v.allDay, status: e ? e.status : 'feed',
+        calendarId: cal?.id ?? '', color: v.color ?? (cal ? safeColor(cal.color) : '#8a8378'),
+        location: v.location, cancelled: Boolean(v.cancelled), repeat: e?.rrule ? describeRepeat(e.rrule, e.start) : '',
+        resourceIds: e?.roomHold.resourceIds ?? [],
+      };
+    }),
+    ...bookings.map((b) => ({
+      kind: b.kind as 'booking' | 'block', id: b.id, title: b.kind === 'block' ? b.notes || 'Blocked' : b.name,
+      start: iso(b.start), end: iso(b.end), allDay: false, status: b.status, resourceId: b.resourceId, linkId: b.linkId || null,
+      name: b.name, email: b.email, phone: b.phone, notes: b.notes,
+    })),
+  ].sort((a, b) => a.start.localeCompare(b.start));
+  return {
+    timezone: tz, from: q.from, to: q.to,
+    resources: resources.map((r) => ({ id: r.id, slug: r.slug, name: r.name, kind: r.kind })),
+    calendars: calendars.map((cal) => ({ id: cal.id, name: cal.name, color: safeColor(cal.color), kind: cal.kind, visibility: cal.visibility })),
+    items, errors,
+  };
+}
+
+// ---- bookings: on someone's behalf, moving ----------------------------------
+
+async function resourceAndLink(repo: ContentRepository, resourceRef: string, linkRef: string) {
+  const resource = await repo.getResource(resourceRef) ?? await repo.getResourceBySlug(resourceRef);
+  const link = resource ? (await repo.listBookingLinks(resource.id)).find((l) => l.id === linkRef || l.slug === linkRef) ?? null : null;
+  if (!resource || !link) throw new ApiError(404, 'Room or booking type not found.');
+  return { resource, link };
+}
+
+export const StaffBookingInput = z.object({
+  resource: z.string().min(1).max(200), link: z.string().min(1).max(200),
+  start: z.string().datetime({ offset: true }), minutes: z.number().int().min(1).max(44640).optional(),
+  name: z.string().trim().min(1).max(120), email: z.string().trim().email().max(200), phone: z.string().trim().max(40).default(''),
+  // question id → answer, as on the public form
+  answers: z.record(z.string().max(2000)).default({}),
+  status: z.enum(['confirmed', 'pending']).default('confirmed'),
+  // book outside hours/notice (never over another booking); administrators and owners only
+  ignoreRules: z.boolean().default(false),
+}).strict();
+
+export async function staffBook(c: EditorContext, body: z.infer<typeof StaffBookingInput>) {
+  requireBookings();
+  if (body.ignoreRules) requireAdmin(c.who, 'book outside the normal rules');
+  const settings = await c.repo.getSettings();
+  const { resource, link } = await resourceAndLink(c.repo, body.resource, body.link);
+  const start = Date.parse(body.start);
+  const minutes = body.minutes ?? (link.mode === 'day' ? 1440 : link.mode === 'range' ? link.lengths[0] ?? link.duration : link.duration);
+  const end = start + minutes * 60_000;
+  if (!body.ignoreRules && !isBookable(await availabilityContext(c.repo, resource, link, settings, Date.now()), start, end)) throw new ApiError(409, 'That time isn’t available. Pick another, or (as an administrator) book it outside the rules.');
+  // source 'admin' skips the rule check inside (done above) but never overlaps
+  const b = await createResourceBooking(c.repo, { resource, link, start, end, status: body.status, source: 'admin',
+    booker: { name: body.name, email: body.email, phone: body.phone, answers: body.answers } }, flow(c, settings));
+  return staffBookingView(b, resource, link);
+}
+
+export const RescheduleInput = z.object({
+  start: z.string().datetime({ offset: true }), minutes: z.number().int().min(1).max(44640).optional(),
+  ignoreRules: z.boolean().default(false),
+}).strict();
+export async function staffReschedule(c: EditorContext, id: string, body: z.infer<typeof RescheduleInput>) {
+  requireBookings();
+  if (body.ignoreRules) requireAdmin(c.who, 'move bookings outside the normal rules');
+  const b = await c.repo.getBooking(id);
+  if (!b || b.kind !== 'booking') throw new ApiError(404, 'Booking not found.');
+  const settings = await c.repo.getSettings();
+  const start = Date.parse(body.start);
+  const minutes = body.minutes ?? Math.round((b.end - b.start) / 60_000);
+  const next = await rescheduleBooking(c.repo, b, start, start + minutes * 60_000, { ...flow(c, settings), skipRules: body.ignoreRules });
+  const [resource, link] = await Promise.all([c.repo.getResource(next.resourceId), c.repo.getBookingLink(next.linkId)]);
+  return staffBookingView(next, resource, link);
+}
+
+function staffBookingView(b: Booking, resource: Resource | null, link: BookingLink | null) {
+  return { ...bookingJson(b), title: [resource?.name, link?.name].filter(Boolean).join(' · ') || 'Booking', notes: b.notes, updatedAt: iso(b.updatedAt) };
+}
+
+// ---- blocked time -------------------------------------------------------------
+
+export const BlockInput = z.object({
+  start: z.string().datetime({ offset: true }), end: z.string().datetime({ offset: true }), note: z.string().trim().max(500).default(''),
+}).strict().refine((b) => Date.parse(b.end) > Date.parse(b.start) && Date.parse(b.end) - Date.parse(b.start) <= 366 * DAY, 'The block must end after it starts (up to a year).');
+export async function addBlock(c: EditorContext, resourceId: string, body: z.infer<typeof BlockInput>) {
+  requireBookings();
+  const resource = await c.repo.getResource(resourceId);
+  if (!resource) throw new ApiError(404, 'Room or service not found.');
+  const b = await createBlock(c.repo, resource, Date.parse(body.start), Date.parse(body.end), body.note);
+  if (!b) throw new ApiError(409, 'That time overlaps a booking. Move or cancel it first.');
+  return { id: b.id, resourceId: resource.id, start: iso(b.start), end: iso(b.end), note: b.notes };
+}
+export async function removeBlock(c: EditorContext, resourceId: string, blockId: string) {
+  requireBookings();
+  const b = await c.repo.getBooking(blockId);
+  if (!b || b.kind !== 'block' || b.resourceId !== resourceId) throw new ApiError(404, 'Blocked time not found.');
+  await c.repo.deleteBooking(b.id);
+  return { id: b.id, deleted: true as const };
+}
+
+// ---- rooms and services -------------------------------------------------------
+
+// a real clock time; as in the booking engine an end of 00:00 means midnight (end of day)
+const clock = z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, 'Use a 24-hour time like 09:30.');
+const hhmm = (s: string, end = false) => (end && s === '00:00' ? 1440 : Number(s.slice(0, 2)) * 60 + Number(s.slice(3, 5)));
+const Range = TimeRange.extend({ start: clock, end: clock }).refine((r) => hhmm(r.start) < hhmm(r.end, true), 'Each time range must end after it starts.');
+const Hours = WeeklyHours.extend(Object.fromEntries(['su', 'mo', 'tu', 'we', 'th', 'fr', 'sa'].map((d) => [d, z.array(Range).max(12).default([])])) as Record<'su', z.ZodDefault<z.ZodArray<typeof Range>>>);
+// endDate: leave out (or '') for a single day
+const Override = DateOverride.extend({
+  ranges: z.array(Range).max(12).default([]), label: z.string().max(120).default(''),
+}).refine((o) => !o.endDate || o.endDate >= o.date, 'An override must end on or after its first day.');
+const imageUrl = z.string().max(1000).refine((v) => !v || /^(https?:\/\/|\/)/.test(v), 'Use an http(s) or site path image.');
+
+export const ResourceInput = z.object({
+  name: z.string().trim().min(1).max(120), slug: z.string().max(120).optional(), kind: z.string().trim().max(40).optional(),
+  description: z.string().max(2000).optional(), photo: imageUrl.optional(), capacity: z.number().int().min(1).max(100000).nullable().optional(),
+  amenities: z.array(z.string().trim().min(1).max(80)).max(20).optional(),
+  timezone: z.string().max(64).refine((t) => !t || isValidTimeZone(t), 'Unknown timezone.').optional(),
+  hours: Hours.optional(), overrides: z.array(Override).max(200).optional(),
+  visibility: z.enum(['public', 'unlisted']).optional(), showOnCalendar: z.boolean().optional(), placeId: z.string().max(100).optional(),
+  // ICS / Google calendars whose events block this room (fetched like calendar feeds)
+  busyFeeds: z.array(z.string().max(2000)).max(10).optional(),
+  notifyEmails: z.array(z.string().trim().email().max(200)).max(10).optional(),
+}).strict();
+export const ResourcePatch = ResourceInput.partial();
+
+async function uniqueResourceSlug(repo: ContentRepository, wanted: string, id?: string) {
+  const base = slugify(wanted) || 'room';
+  for (let n = 1; ; n++) {
+    const slug = n === 1 ? base : `${base}-${n}`;
+    const hit = await repo.getResourceBySlug(slug);
+    if (!hit || hit.id === id) return slug;
+  }
+}
+async function resourceFields(repo: ContentRepository, body: z.infer<typeof ResourcePatch>) {
+  const out: Partial<Resource> = { ...body } as Partial<Resource>;
+  delete (out as { slug?: string }).slug;
+  if (body.busyFeeds) {
+    const feeds = body.busyFeeds.map((f) => normalizeCalendarSrc(f));
+    if (feeds.some((f) => !f)) throw new ApiError(400, 'Each busy calendar must be an ICS or Google Calendar link.');
+    out.busyFeeds = feeds as string[];
+  }
+  if (body.placeId) { if (!(await repo.listPlaces()).some((p) => p.id === body.placeId)) throw new ApiError(400, 'Unknown place.'); }
+  return out;
+}
+function resourceView(r: Resource, links: BookingLink[], canManage: boolean) {
+  // the staff feed token is a secret; it never leaves the web admin. Busy
+  // calendars are often private Google "secret address" links: setup only.
+  const { feedToken: _secret, ...rest } = r;
+  return { ...rest, busyFeeds: canManage ? r.busyFeeds : [], createdAt: iso(r.createdAt), updatedAt: iso(r.updatedAt), links: links.filter((l) => l.resourceId === r.id).map(linkView) };
+}
+const linkView = (l: BookingLink) => ({ ...l, createdAt: iso(l.createdAt), updatedAt: iso(l.updatedAt) });
+
+export async function listResourcesFor(c: EditorContext) {
+  requireBookings();
+  const [resources, links, settings] = await Promise.all([c.repo.listResources(), c.repo.listBookingLinks(), c.repo.getSettings()]);
+  const canEdit = canManageSchedule(c.who, settings);
+  return { canEdit, resources: resources.map((r) => resourceView(r, links, canEdit)) };
+}
+export async function getResourceFor(c: EditorContext, id: string) {
+  requireBookings();
+  const r = await c.repo.getResource(id);
+  if (!r) throw new ApiError(404, 'Room or service not found.');
+  return resourceView(r, await c.repo.listBookingLinks(r.id), canManageSchedule(c.who, await c.repo.getSettings()));
+}
+export async function createResourceFor(c: EditorContext, body: z.infer<typeof ResourceInput>) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const r = await c.repo.createResource({ ...(await resourceFields(c.repo, body)), name: body.name, slug: await uniqueResourceSlug(c.repo, body.slug || body.name) });
+  return resourceView(r, [], true);
+}
+export async function updateResourceFor(c: EditorContext, id: string, body: z.infer<typeof ResourcePatch>) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const cur = await c.repo.getResource(id);
+  if (!cur) throw new ApiError(404, 'Room or service not found.');
+  await c.repo.updateResource(id, { ...(await resourceFields(c.repo, body)), ...(body.slug !== undefined ? { slug: await uniqueResourceSlug(c.repo, body.slug || cur.name, id) } : {}) });
+  return getResourceFor(c, id);
+}
+export async function deleteResourceFor(c: EditorContext, id: string) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  if (!await c.repo.getResource(id)) throw new ApiError(404, 'Room or service not found.');
+  await c.repo.deleteResource(id);
+  return { id, deleted: true as const };
+}
+
+// ---- booking types (links) ----------------------------------------------------
+
+const Question = z.object({
+  id: z.string().regex(/^[a-zA-Z0-9_-]{1,40}$/), label: z.string().trim().min(1).max(200), type: z.enum(QUESTION_TYPES).default('text'),
+  required: z.boolean().default(false), options: z.array(z.string().trim().min(1).max(200)).max(50).default([]), help: z.string().max(300).default(''),
+}).strict();
+export const LinkInput = z.object({
+  name: z.string().trim().min(1).max(120), slug: z.string().max(120).optional(), description: z.string().max(2000).optional(),
+  mode: BookingMode.optional(), duration: z.number().int().min(5).max(1440).optional(), lengths: z.array(z.number().int().min(5).max(1440)).max(12).optional(),
+  minDays: z.number().int().min(1).max(60).optional(), maxDays: z.number().int().min(1).max(60).optional(), step: z.number().int().min(5).max(240).optional(),
+  bufferBefore: z.number().int().min(0).max(480).optional(), bufferAfter: z.number().int().min(0).max(480).optional(),
+  minNotice: z.number().int().min(0).max(86_400).optional(), maxAdvance: z.number().int().min(1).max(730).optional(), perDayCap: z.number().int().min(0).max(100).optional(),
+  hours: Hours.nullable().optional(), approval: z.union([ApprovalMode, z.literal('default')]).optional(), approvalRules: ApprovalRules.optional(),
+  visibility: z.enum(['public', 'unlisted']).optional(), askPhone: z.boolean().optional(), questions: z.array(Question).max(20).optional(),
+  confirmMessage: z.string().max(1000).optional(), redirectUrl: z.string().max(1000).refine((v) => !v || /^https?:\/\//.test(v), 'Use an http(s) URL.').optional(),
+  active: z.boolean().optional(),
+  changeCutoff: z.number().int().min(0).max(8760).optional(),
+}).strict();
+export const LinkPatch = LinkInput.partial();
+
+async function uniqueLinkSlug(repo: ContentRepository, resourceId: string, wanted: string, id?: string) {
+  const base = slugify(wanted) || 'booking';
+  for (let n = 1; ; n++) {
+    const slug = n === 1 ? base : `${base}-${n}`;
+    const hit = await repo.getBookingLinkBySlug(resourceId, slug);
+    if (!hit || hit.id === id) return slug;
+  }
+}
+async function linkOf(repo: ContentRepository, resourceId: string, linkId: string) {
+  const l = await repo.getBookingLink(linkId);
+  if (!l || l.resourceId !== resourceId) throw new ApiError(404, 'Booking type not found.');
+  return l;
+}
+export async function createLinkFor(c: EditorContext, resourceId: string, body: z.infer<typeof LinkInput>) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  if (!await c.repo.getResource(resourceId)) throw new ApiError(404, 'Room or service not found.');
+  const { slug, ...rest } = body;
+  const created = await c.repo.createBookingLink({ resourceId, name: body.name, slug: await uniqueLinkSlug(c.repo, resourceId, slug || body.name) });
+  if (Object.keys(rest).length > 1) await c.repo.updateBookingLink(created.id, rest);
+  return linkView((await c.repo.getBookingLink(created.id))!);
+}
+export async function updateLinkFor(c: EditorContext, resourceId: string, linkId: string, body: z.infer<typeof LinkPatch>) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const cur = await linkOf(c.repo, resourceId, linkId);
+  const { slug, ...rest } = body;
+  await c.repo.updateBookingLink(cur.id, { ...rest, ...(slug !== undefined ? { slug: await uniqueLinkSlug(c.repo, resourceId, slug || cur.name, cur.id) } : {}) });
+  return linkView((await c.repo.getBookingLink(cur.id))!);
+}
+export async function deleteLinkFor(c: EditorContext, resourceId: string, linkId: string) {
+  requireBookings();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const cur = await linkOf(c.repo, resourceId, linkId);
+  await c.repo.deleteBookingLink(cur.id);
+  return { id: cur.id, deleted: true as const };
+}
+
+// ---- calendars ----------------------------------------------------------------
+
+export const CalendarBody = z.object({
+  name: z.string().trim().min(1).max(120), slug: z.string().max(120).optional(), color: z.string().max(20).optional(),
+  description: z.string().max(1000).optional(), kind: z.enum(['native', 'feed']).optional(), feedUrl: z.string().max(2000).optional(),
+  visibility: z.enum(['public', 'unlisted', 'private']).optional(),
+}).strict();
+export const CalendarPatch = CalendarBody.omit({ kind: true }).partial();
+const calendarView = (cal: Awaited<ReturnType<ContentRepository['listCalendars']>>[number], canManage = true) => {
+  // the private feed token stays in the web admin; a subscribed feed's URL can be a secret link (setup only)
+  const { feedToken: _secret, ...rest } = cal;
+  return { ...rest, feedUrl: canManage ? cal.feedUrl : '', createdAt: iso(cal.createdAt), updatedAt: iso(cal.updatedAt) };
+};
+export async function listCalendarsFor(c: EditorContext) {
+  requireCalendarModule();
+  const [list, settings] = await Promise.all([c.repo.listCalendars(), c.repo.getSettings()]);
+  const canEdit = canManageSchedule(c.who, settings);
+  return { canEdit, calendars: list.map((cal) => calendarView(cal, canEdit)) };
+}
+export async function createCalendarFor(c: EditorContext, body: z.infer<typeof CalendarBody>) {
+  requireCalendarModule();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  return calendarView(await saveCalendar(c.repo, undefined, body));
+}
+export async function updateCalendarFor(c: EditorContext, id: string, body: z.infer<typeof CalendarPatch>) {
+  requireCalendarModule();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  const cur = await c.repo.getCalendar(id);
+  if (!cur) throw new ApiError(404, 'Calendar not found.');
+  return calendarView(await saveCalendar(c.repo, id, { ...body, name: body.name ?? cur.name, slug: body.slug ?? cur.slug }));
+}
+export async function deleteCalendarFor(c: EditorContext, id: string) {
+  requireCalendarModule();
+  requireScheduleRole(c.who, await c.repo.getSettings());
+  if (!await c.repo.getCalendar(id)) throw new ApiError(404, 'Calendar not found.');
+  await c.repo.deleteCalendar(id);
+  return { id, deleted: true as const };
+}
+

package/src/lib/editor/schemas.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { FormDefinition } from '../forms/schema';
-import { Booking } from '../schema';
+import { Booking, BookingLink, Calendar, LinkKind, Resource } from '../schema';
 
 // Response shapes of the editor-app API (OpenAPI components, client types).
 const str = z.string(), bool = z.boolean(), num = z.number(), date = str.datetime();
@@ -25,6 +25,10 @@ export const EditorMe = z.object({
     documents: z.object({ edit: bool, publish: bool }),
     sections: z.object({ editContent: bool, editLocked: bool, publishSection: bool, changeLayout: bool }),
     bookings: bool,
+    // rooms, booking types, hours and calendars; book or move outside the rules
+    schedule: z.object({ view: bool, manage: bool, ignoreRules: bool }),
+    forms: z.object({ list: bool, readResponses: bool }),
+    links: z.object({ edit: bool, editHtml: bool }),
   }),
 });
 
@@ -84,6 +88,37 @@ export const EditorBooking = Booking.pick({ id: true, kind: true, status: true,
   .extend({ start: date, end: date, resourceId: str.nullable(), linkId: str.nullable(), eventId: str.nullable(), createdAt: date, updatedAt: date, title: str });
 export const EditorBookingList = z.object({ pending: num.int(), items: z.array(EditorBooking), pagination: Pagination });
 
+// ---- schedule, setup, forms, links page ----
+export const EditorSchedule = z.object({
+  timezone: str, from: str, to: str,
+  resources: z.array(z.object({ id: str, slug: str, name: str, kind: str })),
+  calendars: z.array(z.object({ id: str, name: str, color: str, kind: z.enum(['native', 'feed']), visibility: z.enum(['public', 'unlisted', 'private']) })),
+  items: z.array(z.union([
+    z.object({ kind: z.enum(['event', 'feed']), id: str, title: str, start: date, end: date, allDay: bool, status: str, calendarId: str, color: str, location: str, cancelled: bool, repeat: str, resourceIds: z.array(str) }),
+    z.object({ kind: z.enum(['booking', 'block']), id: str, title: str, start: date, end: date, allDay: bool, status: z.enum(['pending', 'confirmed']), resourceId: str, linkId: str.nullable(), name: str, email: str, phone: str, notes: str }),
+  ])),
+  errors: z.array(str),
+});
+export const EditorBookingLink = BookingLink.extend({ createdAt: date, updatedAt: date });
+export const EditorResource = Resource.omit({ feedToken: true }).extend({ createdAt: date, updatedAt: date, links: z.array(EditorBookingLink) });
+export const EditorResourceList = z.object({ canEdit: bool, resources: z.array(EditorResource) });
+export const EditorBlock = z.object({ id: str, resourceId: str, start: date, end: date, note: str });
+export const EditorCalendar = Calendar.omit({ feedToken: true }).extend({ createdAt: date, updatedAt: date });
+export const EditorCalendarList = z.object({ canEdit: bool, calendars: z.array(EditorCalendar) });
+export const EditorDeleted = z.object({ id: str, deleted: z.literal(true) });
+export const EditorFormList = z.object({ canReadResponses: bool, forms: z.array(z.object({
+  id: str, name: str, title: str, purpose: z.enum(['event', 'general']), status: z.enum(['draft', 'published', 'archived']), hasDraft: bool,
+  responses: num.int(), lastResponseAt: date.nullable(), updatedAt: date.nullable(),
+})) });
+export const EditorFormResponses = z.object({
+  form: z.object({ id: str, name: str }),
+  items: z.array(z.object({ id: str, createdAt: date, answers: z.array(z.object({ label: str, value: str })) })),
+  pagination: Pagination,
+});
+export const EditorLinksPage = z.object({ revision: num.int(), name: str, bio: str, avatar: str, canEditHtml: bool, items: z.array(z.object({
+  id: str, kind: LinkKind, label: str, url: str, icon: str, html: str, meta: z.record(z.unknown()), clicks: num.int(),
+})) });
+
 /** documented request body for POST /api/v1/auth/token (form-encoded or JSON) */
 export const EditorTokenRequest = z.discriminatedUnion('grant_type', [
   z.object({ grant_type: z.literal('authorization_code'), code: str, code_verifier: str, redirect_uri: str, client_id: str }).strict(),

package/src/lib/editor/site-data.ts

@@ -0,0 +1,110 @@
+import { z } from 'zod';
+import type { Link } from '../schema';
+import { LinkKind } from '../schema';
+import { ApiError } from '../api';
+import { displayAnswers } from '../forms/service';
+import type { EditorContext } from './http';
+import { isAdmin, requireAdmin } from './roles';
+
+// Forms and the links page from editor apps. Any staff account sees which
+// forms exist and how many responses they have; reading responses (personal
+// details) takes an administrator or owner. The links page is editable by
+// staff, except raw HTML blocks and inline SVG icons, which run on the
+// public page and so need an administrator or owner.
+
+const iso = (n: number | null) => (n === null ? null : new Date(n).toISOString());
+
+export async function listFormsFor(c: EditorContext) {
+  const [forms, stats] = await Promise.all([c.repo.forms.list(), c.repo.forms.stats()]);
+  return {
+    canReadResponses: isAdmin(c.who),
+    forms: forms.filter((f) => f.kind === 'form').map((f) => ({
+      id: f.id, name: f.name, title: f.definition.title || f.name, purpose: f.purpose, status: f.status, hasDraft: Boolean(f.draft),
+      responses: stats.get(f.id)?.count ?? 0, lastResponseAt: iso(stats.get(f.id)?.last ?? null), updatedAt: iso(f.updatedAt),
+    })),
+  };
+}
+
+export const ResponsesQuery = z.object({
+  q: z.string().max(100).optional(), since: z.string().datetime({ offset: true }).optional(),
+  page: z.coerce.number().int().min(1).max(10000).default(1), limit: z.coerce.number().int().min(1).max(100).default(25),
+}).strict();
+export async function formResponsesFor(c: EditorContext, id: string, q: z.infer<typeof ResponsesQuery>) {
+  requireAdmin(c.who, 'read form responses');
+  const form = await c.repo.forms.get(id);
+  if (!form || form.kind !== 'form') throw new ApiError(404, 'Form not found.');
+  const rows = await c.repo.forms.searchSubmissions(id, { q: q.q, since: q.since ? Date.parse(q.since) : undefined, limit: q.limit + 1, offset: (q.page - 1) * q.limit });
+  return {
+    form: { id: form.id, name: form.name },
+    items: rows.slice(0, q.limit).map((s) => ({
+      id: s.id, createdAt: iso(s.createdAt)!,
+      // labelled answers from the questions as they were when submitted
+      answers: Object.entries(displayAnswers(s.response)).map(([label, value]) => ({ label, value })),
+    })),
+    pagination: { page: q.page, limit: q.limit, nextPage: rows.length > q.limit ? q.page + 1 : null },
+  };
+}
+
+// ---- links page ----------------------------------------------------------------
+
+const linkView = (l: Link) => ({ id: l.id, kind: l.kind, label: l.label, url: l.url, icon: l.icon, html: l.html, meta: l.meta, clicks: l.clicks });
+
+export async function getLinksFor(c: EditorContext) {
+  // revision first: a change landing between the reads leaves it stale (the
+  // next save gets a 409), never newer than the blocks it is sent with
+  const revision = await c.repo.linksRevision();
+  const [settings, links] = await Promise.all([c.repo.getSettings(), c.repo.listLinks()]);
+  return { revision, name: settings.linksName, bio: settings.linksBio, avatar: settings.linksAvatar, canEditHtml: isAdmin(c.who), items: links.map(linkView) };
+}
+
+const Item = z.object({
+  // omit for a new block; an existing id keeps its click count
+  id: z.string().max(100).optional(),
+  kind: LinkKind.default('link'), label: z.string().max(200).default(''), url: z.string().max(2000).default(''),
+  icon: z.string().max(5000).default(''), html: z.string().max(20_000).default(''),
+  meta: z.record(z.unknown()).default({}).refine((m) => JSON.stringify(m).length <= 4000, 'Block settings are too large.'),
+}).strict();
+export const LinksPut = z.object({
+  // from GET /admin/links; a stale revision is a 409 and nothing is saved
+  revision: z.number().int().min(0),
+  name: z.string().max(120).optional(), bio: z.string().max(500).optional(),
+  avatar: z.string().max(1000).refine((v) => !v || /^(https?:\/\/|\/)/.test(v), 'Use an http(s) or site path image.').optional(),
+  // the whole page in display order; blocks left out are removed
+  items: z.array(Item).max(200),
+}).strict();
+
+const urlKinds = new Set(['link']);
+function checkItem(i: z.infer<typeof Item>) {
+  const url = i.url.trim();
+  // http(s) or a path on this site; "//host" and "/\\host" would leave it (open redirect through /go)
+  if (urlKinds.has(i.kind) && url && !/^https?:\/\//i.test(url) && !/^\/(?![\/\\])/.test(url)) throw new ApiError(400, `“${i.label || 'Link'}” needs an http(s) address.`);
+}
+// inline SVG icons render as markup on the public page, exactly like HTML blocks
+const isMarkup = (icon: string) => icon.trim().toLowerCase().startsWith('<svg');
+
+export async function putLinksFor(c: EditorContext, body: z.infer<typeof LinksPut>) {
+  const current = await c.repo.listLinks();
+  const byId = new Map(current.map((l) => [l.id, l]));
+  const admin = isAdmin(c.who);
+  const markupChanged = (i: z.infer<typeof Item>) => {
+    const old = i.id ? byId.get(i.id) : undefined;
+    const html = i.kind === 'html' && (!old || old.kind !== 'html' || old.html !== i.html);
+    const svg = isMarkup(i.icon) && (!old || old.icon !== i.icon);
+    return html || svg;
+  };
+  const ids = body.items.map((i) => i.id).filter(Boolean);
+  if (new Set(ids).size !== ids.length) throw new ApiError(400, 'Each block can appear once.');
+  for (const i of body.items) {
+    if (i.id && !byId.has(i.id)) throw new ApiError(409, 'The links page changed since you opened it. Reload and try again.');
+    checkItem(i);
+    if (!admin && markupChanged(i)) requireAdmin(c.who, 'add or change HTML blocks or SVG icons');
+  }
+  // one atomic write: a failure leaves the page as it was. Blocks left out
+  // are removed (fine for anyone, even HTML: it only takes code away); a
+  // block whose kind changed is replaced
+  await c.repo.replaceLinks(body.revision, body.items.map((i) => {
+    const old = i.id ? byId.get(i.id) : undefined;
+    return { kind: i.kind, label: i.label, url: i.url, icon: i.icon, html: i.html, meta: i.meta, keep: old && old.kind === i.kind ? old.id : undefined };
+  }), { linksName: body.name, linksBio: body.bio, linksAvatar: body.avatar });
+  return getLinksFor(c);
+}

package/src/lib/email/service.ts

@@ -1,13 +1,20 @@
 import type { ContentRepository } from '../repo/types';
 import { resolveConfig, decrypt, encrypt, runtimeValue } from './config';
 import { sendWithProvider } from './providers';
-import { accountMail, canonicalOrigin, EmailLinkError } from './templates';
+import { accountMail, canonicalOrigin, guestCodeMail, EmailLinkError } from './templates';
 import { bookingMail } from '../booking/service';
 import type { EmailJob, Mail } from './types';
 
 async function render(repo: ContentRepository, job: EmailJob, locals?: unknown, from = ''): Promise<Mail | null> {
   const settings = await repo.getSettings();
   if (job.kind === 'test') return accountMail('test', job.recipient, settings.siteTitle);
+  if (job.kind === 'guest-code') {
+    // only the latest, unexpired code is worth sending
+    const payload = JSON.parse(job.payload) as { issuedAt: number; code: string };
+    const current = await repo.guests.code(job.recipient);
+    if (!current || current.createdAt !== payload.issuedAt || current.expiresAt <= Date.now()) return null;
+    return guestCodeMail(job.recipient, settings.siteTitle, decrypt<string>(payload.code, `guest-code:${job.dedupe}`, locals));
+  }
   const origin = canonicalOrigin(settings.siteUrl);
   if (job.kind === 'booking') {
     const payload = JSON.parse(job.payload);

package/src/lib/email/store.ts

@@ -112,9 +112,19 @@ export class EmailStore {
       count=CASE WHEN expires_at <= ? THEN 1 ELSE count+1 END, expires_at=CASE WHEN expires_at <= ? THEN ? ELSE expires_at END RETURNING count`, [key,now+windowMs,now,now,now+windowMs]);
     return Number(rows[0].count) <= max;
   }
+  /** true when key's current window already holds max hits (checks without counting) */
+  async rateLimited(key: string, max: number): Promise<boolean> {
+    const rows = await (await this.getDriver()).all('SELECT count FROM email_rate_limits WHERE key=? AND expires_at > ?', [key, Date.now()]);
+    return rows.length > 0 && Number(rows[0].count) >= max;
+  }
   async recordScheduler(report: { startedAt: number; finishedAt: number; ok: boolean; jobs: Record<string, { ok: boolean; count?: number }> }) {
     await (await this.getDriver()).run("INSERT INTO email_meta(key,value) VALUES ('scheduler-heartbeat',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value", [JSON.stringify(report)]);
   }
+  /** mail that should have gone out before `before` but is still waiting (a stuck queue) */
+  async stuckJobs(before: number): Promise<number> {
+    const rows = await (await this.getDriver()).all("SELECT COUNT(*) AS n FROM email_jobs WHERE state IN ('queued','retrying') AND next_at < ?", [before]);
+    return Number(rows[0]?.n ?? 0);
+  }
   async schedulerStatus(): Promise<{ startedAt: number; finishedAt: number; ok: boolean; jobs: Record<string, { ok: boolean; count?: number }> } | null> {
     const rows = await (await this.getDriver()).all("SELECT value FROM email_meta WHERE key='scheduler-heartbeat'");
     return rows[0] ? JSON.parse(String(rows[0].value)) : null;

package/src/lib/email/templates.ts

@@ -11,6 +11,12 @@ export function accountMail(kind: 'invite'|'reset'|'welcome'|'password-changed'|
   return { to, subject: `${copy[0]} · ${site}`, text: [copy[0], '', copy[1], ...(url ? ['',`${copy[2]}: ${url}`] : [])].join('\n'),
     html: `<!doctype html><html><body style="margin:0;background:#f6f5f2;color:#24211c;font:16px/1.6 system-ui,sans-serif"><div style="max-width:520px;margin:auto;padding:32px 24px"><p style="color:#7d776e">${escape(site)}</p><h1 style="font-size:24px">${escape(copy[0])}</h1><p>${escape(copy[1])}</p>${url ? `<p><a style="display:inline-block;background:#ee5d20;color:#fff;padding:10px 18px;border-radius:8px;text-decoration:none" href="${escape(url)}">${escape(copy[2])}</a></p>` : ''}</div></body></html>` };
 }
+/** a guest's app sign-in code; no link, so it works on any device */
+export function guestCodeMail(to: string, site: string, code: string): Mail {
+  const intro = `Enter this code in the ${site} app to see your bookings. It expires in 10 minutes. If you did not ask for it, ignore this message.`;
+  return { to, subject: `${code} is your sign-in code · ${site}`, text: ['Your sign-in code', '', code, '', intro].join('\n'),
+    html: `<!doctype html><html><body style="margin:0;background:#f6f5f2;color:#24211c;font:16px/1.6 system-ui,sans-serif"><div style="max-width:520px;margin:auto;padding:32px 24px"><p style="color:#7d776e">${escape(site)}</p><h1 style="font-size:24px">Your sign-in code</h1><p style="font:700 32px/1.2 ui-monospace,Menlo,monospace;letter-spacing:.2em">${escape(code)}</p><p>${escape(intro)}</p></div></body></html>` };
+}
 export class EmailLinkError extends Error {}
 export function canonicalOrigin(value: string): string {
   const raw = value.trim();

package/src/lib/forms/store.ts

@@ -25,6 +25,11 @@ export class FormStore {
   async submissions(formId?: string, limit = 100, offset = 0) {
     return (await (await this.driver()).all(`SELECT * FROM form_submissions ${formId ? 'WHERE form_id=?' : ''} ORDER BY created_at DESC LIMIT ? OFFSET ?`, [...(formId ? [formId] : []), limit, offset])).map(r => FormSubmission.parse({ id: r.id, formId: r.form_id, response: JSON.parse(String(r.response)), createdAt: r.created_at }));
   }
+  /** the response this request id already saved to this form, if any (as stored JSON) */
+  async receipt(formId: string, requestId: string) {
+    const r = (await (await this.driver()).all('SELECT response FROM form_submissions WHERE id=? AND form_id=?', [requestId, formId]))[0];
+    return r ? String(r.response) : null;
+  }
   async submit(formId: string, response: FormResponse, requestId: string) {
     response = FormResponse.parse(response);
     const db = await this.driver();

package/src/lib/mobile/access-admin.ts

@@ -0,0 +1,34 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import { MobileAccess } from '../schema';
+import { CALENDAR, bookingsEnabled } from '../calendar/config';
+import { encryptionAvailable, resolveConfig } from '../email/config';
+import { GUEST_IDLE_MS } from './guest-store';
+
+// Admin → Mobile app → App access (owner only): switches and limits for the
+// public app routes, plus "Sign out all" for guest sessions.
+
+export async function appAccessState(repo: ContentRepository, locals?: unknown) {
+  const settings = await repo.getSettings();
+  const email = resolveConfig(await repo.email.config(), locals);
+  const emailReady = !email.error && email.provider !== 'none' && email.config.enabled;
+  return {
+    access: settings.mobileAccess,
+    modules: { calendar: CALENDAR.enabled, bookings: bookingsEnabled() },
+    // why guest sign-in can't run yet, if it can't
+    guestSignIn: {
+      blocker: !CALENDAR.enabled ? 'calendar' as const : !emailReady ? 'email' as const : !encryptionAvailable(locals) ? 'encryption' as const : null,
+      devices: await repo.guests.count(Date.now() - GUEST_IDLE_MS),
+    },
+  };
+}
+export type AppAccessState = Awaited<ReturnType<typeof appAccessState>>;
+
+export const AppAccessInput = z.discriminatedUnion('action', [
+  z.object({ action: z.literal('save'), access: MobileAccess.partial().strict() }).strict(),
+  z.object({ action: z.literal('signOutGuests') }).strict(),
+]);
+export async function appAccessAction(repo: ContentRepository, input: z.infer<typeof AppAccessInput>) {
+  if (input.action === 'signOutGuests') { await repo.guests.deleteAll(); return; }
+  await repo.patchMobileAccess(input.access);
+}

package/src/lib/mobile/access.ts

@@ -0,0 +1,28 @@
+import type { ContentRepository } from '../repo/types';
+import type { MobileAccess, Settings } from '../schema';
+import { ApiError } from '../api';
+import { sha256Hex } from '../api-keys';
+
+type Switch = Exclude<{ [K in keyof MobileAccess]: MobileAccess[K] extends boolean ? K : never }[keyof MobileAccess], undefined>;
+
+/** Owner switch (Admin → Mobile app → App access); off answers 404 like a disabled module. */
+export async function requireAccess(repo: ContentRepository, key: Switch): Promise<Settings> {
+  const settings = await repo.getSettings();
+  if (!settings.mobileAccess[key]) throw new ApiError(404, 'This feature is turned off.');
+  return settings;
+}
+
+/**
+ * Lockout for secret guessing: only failures count, per client address.
+ * `check` before the lookup (already locked → 429), `miss` after a failure.
+ */
+export async function failureLock(repo: ContentRepository, scope: string, address: string, max = 20, windowMs = 10 * 60_000) {
+  const key = `lock:${scope}:${await sha256Hex(address)}`;
+  // without a real client address everyone would share one bucket, and a few
+  // junk requests would lock every visitor out; per-target limits still apply
+  if (!address || address === 'unknown') return { async check() {}, async miss() {} };
+  return {
+    async check() { if (await repo.email.rateLimited(key, max)) throw new ApiError(429, 'Too many failed attempts. Try again in a few minutes.', windowMs / 1000); },
+    async miss() { await repo.email.rateLimit(key, max, windowMs); },
+  };
+}