@acms-subir/core 0.3.9 → 0.3.10

package/src/lib/mobile/calendar.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { ContentRepository } from '../repo/types';
+import type { BookingLink, CalEvent, Calendar, Resource, Settings } from '../schema';
 import { ApiError } from '../api';
 import { CALENDAR, bookingsEnabled, resourceUrl, bookingLinkUrl } from '../calendar/config';
 import { calendarToJson, eventToJson } from '../calendar/api';
@@ -27,7 +28,10 @@ export async function listEvents(repo: ContentRepository, url: URL) {
   requireCalendar();
   const q = eventsQuery.parse(queryParams(url));
   const locale = mobileLocale(q.locale);
-  const [settings, calendars, events] = await Promise.all([repo.getSettings(), repo.listCalendars(), repo.listPublishedEvents()]);
+  const term = q.q?.trim() ?? '';
+  const [settings, calendars, events, indexed] = await Promise.all([repo.getSettings(), repo.listCalendars(), repo.listPublishedEvents(),
+    // the search index's matches (body text, word prefixes), so "more" from /search continues here
+    term ? repo.searchPublished(term, { limit: 200, collections: [] }).then((r) => new Set(r.events.map(({ doc }) => doc.id))) : null]);
   // days are the site's calendar days (a New York site's "today" starts at midnight there, not UTC)
   const tz = settings.timezone || 'UTC';
   // a plain day is the site's midnight; a date-time is that exact instant
@@ -41,25 +45,30 @@ export async function listEvents(repo: ContentRepository, url: URL) {
   if (q.calendar && !cal) throw new ApiError(404, 'Calendar not found.');
   const publicCalendars = new Map(calendars.filter(c => c.visibility === 'public' || c.id === cal?.id).map(c => [c.id, c]));
   const visible = events.map(e => localizeDoc(e, locale ?? undefined)).filter(e => (cal ? e.calendarIds.includes(cal.id) && eventIsPublic(e, all) : eventIsListed(e, all))
-    && (!q.q || `${e.title} ${e.excerpt} ${e.location.name}`.toLowerCase().includes(q.q.toLowerCase())));
+    && (!term || indexed!.has(e.id) || `${e.title} ${e.excerpt} ${e.location.name}`.toLowerCase().includes(term.toLowerCase())));
   const occurrences = expandEvents(visible, settings, { displayTz: settings.timezone || 'UTC', now: Date.now(), windowStartMs: from, windowEndMs: to });
   occurrences.sort((a, b) => a.start - b.start || (a.event.id < b.event.id ? -1 : a.event.id > b.event.id ? 1 : 0));
   const start = (q.page - 1) * q.limit;
   const origin = siteOrigin(settings, url);
   return {
     locale, timezone: settings.timezone || 'UTC', from: new Date(from).toISOString(), to: new Date(to).toISOString(),
-    occurrences: occurrences.slice(start, start + q.limit).map(o => {
-      const event = eventToJson(o.event, origin, publicCalendars, settings.timezone);
-      event.url = localizedUrl(event.url, origin, locale);
-      // Only configured public event fields; no undeclared imported metadata.
-      event.fields = Object.fromEntries(CALENDAR.eventFields.filter(f => Object.hasOwn(o.event.fields, f.key)).map(f => [f.key, o.event.fields[f.key]]));
-      event.image = safeUrl(o.event.cover, origin);
-      event.cta = { ...event.cta, href: localizedUrl(safeUrl(event.cta.href, origin, true), origin, locale) };
-      return { id: `${o.event.id}:${o.start}`, start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(), allDay: o.allDay, event };
-    }),
+    occurrences: occurrences.slice(start, start + q.limit).map(o => ({
+      id: `${o.event.id}:${o.start}`, start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(), allDay: o.allDay,
+      event: publicEventDto(o.event, origin, publicCalendars, settings.timezone, locale),
+    })),
     pagination: { page: q.page, limit: q.limit, nextPage: occurrences.length > start + q.limit ? q.page + 1 : null },
   };
 }
+// e is already localized; publicCalendars limits which calendars are named
+export function publicEventDto(e: CalEvent, origin: string, publicCalendars: Map<string, Calendar>, siteTz: string, locale: string | null) {
+  const event = eventToJson(e, origin, publicCalendars, siteTz);
+  event.url = localizedUrl(event.url, origin, locale);
+  // Only configured public event fields; no undeclared imported metadata.
+  event.fields = Object.fromEntries(CALENDAR.eventFields.filter(f => Object.hasOwn(e.fields, f.key)).map(f => [f.key, e.fields[f.key]]));
+  event.image = safeUrl(e.cover, origin);
+  event.cta = { ...event.cta, href: localizedUrl(safeUrl(event.cta.href, origin, true), origin, locale) };
+  return event;
+}
 export async function listResources(repo: ContentRepository, url: URL) {
   requireCalendar(true);
   const q = z.object(pageQuery).strict().parse(queryParams(url));
@@ -85,8 +94,12 @@ export async function getAvailability(repo: ContentRepository, url: URL) {
   const resource = await repo.getResourceBySlug(q.resource);
   const link = resource ? await repo.getBookingLinkBySlug(resource.id, q.link) : null;
   if (!resource || !link || !link.active) throw new ApiError(404, 'Resource or booking link not found.');
-  const settings = await repo.getSettings();
-  const ctx = await availabilityContext(repo, resource, link, settings);
+  return availabilityFor(repo, resource, link, await repo.getSettings(), q);
+}
+/** open slots for a link; excludeBookingId frees that booking's own time (moving it) */
+export async function availabilityFor(repo: ContentRepository, resource: Resource, link: BookingLink, settings: Settings,
+  q: { from?: string; days: number; minutes?: number }, excludeBookingId?: string) {
+  const ctx = await availabilityContext(repo, resource, link, settings, Date.now(), excludeBookingId);
   const timezone = resource.timezone || settings.timezone || 'UTC';
   const from = q.from ?? ymd(Date.now(), timezone);
   return { timezone, mode: link.mode, lengths: linkLengths(link), autoConfirm: confirmsInstantly(linkApproval(link, settings)),

package/src/lib/mobile/content.ts

@@ -4,7 +4,8 @@ import type { ContentRepository } from '../repo/types';
 import type { Page, Post } from '../schema';
 import { publicTags } from '../schema';
 import { CONTENT, collectionUrl } from '../content';
-import { I18N, localeHomeUrl } from '../i18n';
+import { I18N, localeHomeUrl, normalizePageLocale } from '../i18n';
+import { SEARCH } from '../search-config';
 import { siteOrigin } from '../seo';
 import { renderMarkdown } from '../markdown';
 import { blocksToHtml } from '../blocksToHtml';
@@ -16,6 +17,7 @@ import { localeQuery, mobileLocale, localizedUrl } from './locale';
 export const contentQuery = z.object({
   ...pageQuery, kind: z.enum(['post', 'page']).optional(),
   collection: z.string().min(1).max(80).optional(), locale: localeQuery,
+  q: z.string().max(100).optional(),
 }).strict();
 export function safeUrl(value: string, origin: string, link = false): string {
   if (!value) return '';
@@ -61,12 +63,30 @@ export function contentDto(raw: Page | Post, kind: 'page' | 'post', origin: stri
 function visible(doc: Page | Post, kind: 'page' | 'post') {
   return doc.status === 'published' && (kind === 'page' || Object.hasOwn(CONTENT.collections, (doc as Post).collection));
 }
+// most matches a search can page through, per kind
+export const SEARCH_WINDOW = 200;
 export async function listContent(repo: ContentRepository, url: URL) {
   const q = contentQuery.parse(queryParams(url));
   if (q.collection && !Object.hasOwn(CONTENT.collections, q.collection)) throw new ApiError(400, 'Unknown collection.');
   if (q.collection && q.kind === 'page') throw new ApiError(400, 'Pages do not belong to post collections.');
   const locale = mobileLocale(q.locale);
   const origin = siteOrigin(await repo.getSettings(), url);
+  const term = q.q?.trim();
+  if (term) {
+    if (!SEARCH.enabled) throw new ApiError(400, 'Search is disabled on this site.');
+    // ranked matches, posts before pages; deep pages stop at SEARCH_WINDOW
+    const end = q.page * q.limit;
+    if (end - q.limit >= SEARCH_WINDOW) return { locale, items: [], pagination: { page: q.page, limit: q.limit, nextPage: null } };
+    const found = await repo.searchPublished(term, { locale: normalizePageLocale(locale ?? ''), limit: Math.min(end + 1, SEARCH_WINDOW), collections: q.collection ? [q.collection] : Object.keys(CONTENT.collections) });
+    const hits = [
+      ...(q.kind === 'page' ? [] : found.posts.map(({ doc }) => ({ doc, kind: 'post' as const }))),
+      ...(q.kind === 'post' || q.collection ? [] : found.pages.map(({ doc }) => ({ doc, kind: 'page' as const }))),
+    ];
+    return {
+      locale, items: hits.slice(end - q.limit, end).map(({ doc, kind }) => contentDto(doc, kind, origin, false, locale)),
+      pagination: { page: q.page, limit: q.limit, nextPage: hits.length > end && end < SEARCH_WINDOW ? q.page + 1 : null },
+    };
+  }
   const rows = await repo.listPublicContent({ ...q, locale: undefined, collections: Object.keys(CONTENT.collections), defaultLocale: I18N.defaultLocale });
   const items = await Promise.all(rows.slice(0, q.limit).map(async (r) => {
     const doc = r.kind === 'post' ? await repo.getPost(r.id) : await repo.getPage(r.id);

package/src/lib/mobile/forms.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import type { SavedForm } from '../forms/schema';
+import { collectResponse, formVersion } from '../forms/service';
+import { ApiError, readJson } from '../api';
+import { sha256Hex } from '../api-keys';
+import { queryParams } from './http';
+import { requireAccess } from './access';
+import type { PublicContext } from './route';
+
+// Published general forms for apps: read the questions, send answers. The
+// same validation and storage as the web form (/forms/<id>), plus app
+// limits: an Idempotency-Key per response (retries never duplicate), 10
+// responses per address per form per minute, and a per-form daily ceiling
+// from Admin → Mobile app so one form can't be flooded.
+
+const UUID4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+async function publishedForm(repo: ContentRepository, id: string): Promise<SavedForm> {
+  // ids are UUIDs; anything else can't be a form
+  const form = id && id.length <= 100 ? await repo.forms.get(id) : null;
+  if (!form || form.kind !== 'form' || form.purpose !== 'general' || form.status === 'draft') throw new ApiError(404, 'Form not found.');
+  if (form.status === 'archived') throw new ApiError(410, 'This form is no longer accepting responses.');
+  return form;
+}
+
+export async function getForm(repo: ContentRepository, url: URL, id: string) {
+  z.object({}).strict().parse(queryParams(url));
+  await requireAccess(repo, 'forms');
+  const form = await publishedForm(repo, id);
+  const d = form.definition;
+  return {
+    id: form.id, version: await formVersion(d),
+    title: d.title || form.name, intro: d.intro, submitLabel: d.submitLabel || 'Submit', confirmation: d.confirmation,
+    fields: d.fields.map((f) => ({
+      id: f.id, type: f.type, label: f.label, required: f.required, help: f.help, options: f.options,
+      placeholder: f.placeholder ?? '', width: f.width ?? 'full', allowOther: f.allowOther ?? false,
+    })),
+  };
+}
+
+export const formResponseInput = z.object({
+  // field id → answer; checkbox groups send a list. "Other" answers send the typed text.
+  answers: z.record(z.union([z.string().max(2000), z.array(z.string().max(2000)).max(51)])).refine((a) => Object.keys(a).length <= 30, 'Too many answers.'),
+  // the version from GET /forms/{id}; a changed form answers 409 instead of saving
+  version: z.string().max(100).optional(),
+  // spam trap: apps leave it out or empty
+  website: z.string().max(200).optional(),
+}).strict();
+
+export async function submitFormResponse(c: PublicContext) {
+  const settings = await requireAccess(c.repo, 'forms');
+  const id = c.params.id ?? '';
+  const key = c.request.headers.get('idempotency-key') ?? '';
+  if (!UUID4.test(key)) throw new ApiError(400, 'Send a random UUID v4 in Idempotency-Key and reuse it only for retries.');
+  const body = formResponseInput.parse(await readJson(c.request, 50_000));
+  if (body.website) throw new ApiError(400, 'Could not submit this form.');
+  const form = await publishedForm(c.repo, id);
+  if (!await c.repo.email.rateLimit(`forms:app:${await sha256Hex(`${form.id}:${c.address}`)}`, 10, 60_000)) throw new ApiError(429, 'Too many responses. Please try again in a minute.');
+  const answers = Object.fromEntries(Object.entries(body.answers).map(([k, v]) => [k, Array.isArray(v) ? v.map((x) => x.trim()).filter(Boolean).join('\n') : v]));
+  // the key is the stored response id: a retry of a saved response answers
+  // as before and costs nothing (also after the form changed); the same key
+  // with different answers is a 409
+  const prior = await c.repo.forms.receipt(form.id, key.toLowerCase());
+  if (prior) {
+    const unchanged = JSON.stringify((JSON.parse(prior) as { definition: unknown }).definition) === JSON.stringify(form.definition);
+    if (unchanged && JSON.stringify(await collectResponse(form.definition, answers, body.version)) !== prior)
+      throw new ApiError(409, 'This request was already submitted with different answers. Reload to send a new response.');
+    return { received: true as const, confirmation: form.definition.confirmation };
+  }
+  const response = await collectResponse(form.definition, answers, body.version);
+  // only valid new responses count toward the daily ceiling
+  const cap = settings.mobileAccess.responsesPerFormDay;
+  if (cap && !await c.repo.email.rateLimit(`forms:day:${form.id}`, cap, 86_400_000)) throw new ApiError(429, 'This form has had a lot of responses today. Please try again tomorrow.', 86_400);
+  await c.repo.forms.submit(form.id, response, key.toLowerCase());
+  return { received: true as const, confirmation: form.definition.confirmation };
+}

package/src/lib/mobile/guest-store.ts

@@ -0,0 +1,62 @@
+import type { SqlDriver } from '../repo/sql';
+
+// Guest sign-in storage: one pending code per address and one session per
+// signed-in device. Only SHA-256 hashes of codes and tokens are stored.
+
+/** guest app sessions end after this long unused */
+export const GUEST_IDLE_MS = 90 * 86_400_000;
+
+export interface GuestSession { id: string; email: string; deviceName: string; createdAt: number; lastSeenAt: number }
+const session = (r: Record<string, unknown>): GuestSession => ({ id: String(r.id), email: String(r.email), deviceName: String(r.device_name ?? ''), createdAt: Number(r.created_at), lastSeenAt: Number(r.last_seen_at) });
+
+export class GuestStore {
+  constructor(private driver: () => Promise<SqlDriver>) {}
+  /** replaces any earlier code for the address (a new request voids the old code) */
+  async saveCode(email: string, codeHash: string, expiresAt: number, now = Date.now()) {
+    await (await this.driver()).run(`INSERT INTO guest_codes (email, code_hash, attempts, expires_at, created_at) VALUES (?, ?, 0, ?, ?)
+      ON CONFLICT(email) DO UPDATE SET code_hash = excluded.code_hash, attempts = 0, expires_at = excluded.expires_at, created_at = excluded.created_at`, [email, codeHash, expiresAt, now]);
+  }
+  async code(email: string) {
+    const r = (await (await this.driver()).all('SELECT code_hash, attempts, expires_at, created_at FROM guest_codes WHERE email = ?', [email]))[0];
+    return r ? { codeHash: String(r.code_hash), attempts: Number(r.attempts), expiresAt: Number(r.expires_at), createdAt: Number(r.created_at) } : null;
+  }
+  /**
+   * counts one verification attempt in a single statement, so concurrent
+   * guesses can't exceed `maxTries`; returns the code hash it was counted
+   * against, or null when there is no live code with tries left
+   */
+  async attempt(email: string, maxTries: number, now = Date.now()) {
+    const r = (await (await this.driver()).all('UPDATE guest_codes SET attempts = attempts + 1 WHERE email = ? AND attempts < ? AND expires_at > ? RETURNING code_hash, attempts', [email, maxTries, now]))[0];
+    return r ? { codeHash: String(r.code_hash), attempts: Number(r.attempts) } : null;
+  }
+  /** deletes this exact code; true for exactly one caller, so a code signs in once */
+  async consumeCode(email: string, codeHash: string) {
+    return (await (await this.driver()).all('DELETE FROM guest_codes WHERE email = ? AND code_hash = ? RETURNING email', [email, codeHash])).length > 0;
+  }
+  async deleteCode(email: string) { await (await this.driver()).run('DELETE FROM guest_codes WHERE email = ?', [email]); }
+
+  /** keeps the newest `keep` sessions per address so old devices age out */
+  async createSession(s: { id: string; tokenHash: string; email: string; deviceName: string }, now = Date.now(), keep = 20) {
+    const d = await this.driver();
+    await d.batch([
+      { sql: 'INSERT INTO guest_sessions (id, token_hash, email, device_name, created_at, last_seen_at) VALUES (?, ?, ?, ?, ?, ?)', args: [s.id, s.tokenHash, s.email, s.deviceName, now, now] },
+      { sql: 'DELETE FROM guest_sessions WHERE email = ? AND id NOT IN (SELECT id FROM guest_sessions WHERE email = ? ORDER BY last_seen_at DESC LIMIT ?)', args: [s.email, s.email, keep] },
+    ]);
+  }
+  async sessionByHash(tokenHash: string) {
+    const r = (await (await this.driver()).all('SELECT * FROM guest_sessions WHERE token_hash = ?', [tokenHash]))[0];
+    return r ? session(r) : null;
+  }
+  async touch(id: string, now = Date.now()) { await (await this.driver()).run('UPDATE guest_sessions SET last_seen_at = ? WHERE id = ?', [now, id]); }
+  async deleteSession(id: string) { await (await this.driver()).run('DELETE FROM guest_sessions WHERE id = ?', [id]); }
+  /** every device signs out (owner switch "Sign out all") */
+  async deleteAll() { await (await this.driver()).run('DELETE FROM guest_sessions'); }
+  async count(since = 0) { return Number((await (await this.driver()).all('SELECT COUNT(*) AS n FROM guest_sessions WHERE last_seen_at >= ?', [since]))[0]?.n ?? 0); }
+  /** drops expired codes and sessions unused for `idleMs` */
+  async purge(idleMs: number, now = Date.now()) {
+    await (await this.driver()).batch([
+      { sql: 'DELETE FROM guest_codes WHERE expires_at <= ?', args: [now] },
+      { sql: 'DELETE FROM guest_sessions WHERE last_seen_at <= ?', args: [now - idleMs] },
+    ]);
+  }
+}

package/src/lib/mobile/guest.ts

@@ -0,0 +1,160 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import type { Booking } from '../schema';
+import { ApiError, readJson } from '../api';
+import { sha256Hex } from '../api-keys';
+import { randomToken, safeEqual } from '../editor/auth';
+import { CALENDAR, bookingsEnabled, manageUrl } from '../calendar/config';
+import { encrypt, encryptionAvailable, resolveConfig, validAddress } from '../email/config';
+import { kickEmail } from '../email/service';
+import { guestChanges } from '../booking/service';
+import { siteOrigin } from '../seo';
+import { waitUntilFrom } from '../webhooks';
+import { pageQuery, queryParams } from './http';
+import { failureLock } from './access';
+import type { PublicContext } from './route';
+import { GUEST_IDLE_MS } from './guest-store';
+export { GUEST_IDLE_MS };
+
+// Guest sign-in for "My bookings": the visitor proves they read an inbox.
+// POST /guest/code emails a 6-digit code (10 minutes, 5 tries, only its hash
+// is stored); POST /guest/token trades email + code for a per-device token
+// (opaque, hashed at rest, ends after 90 days unused). The token reads that
+// address's bookings and nothing else — it never reaches staff routes.
+// Replies never say whether an address has bookings.
+
+export const GUEST_PREFIX = 'acms_guest_';
+const CODE_MS = 10 * 60_000;
+const MAX_TRIES = 5;
+// wrong codes per address per day before sign-in for it pauses (guessing 6 digits stays hopeless)
+const EMAIL_FAILURES_PER_DAY = 10;
+const SITE_CODES_PER_HOUR = 200;
+const TOKEN = /^acms_guest_[0-9a-f]{64}$/;
+
+/** guest sign-in needs the owner switch, working email and an encryption key */
+export async function guestSignInReady(repo: ContentRepository, locals?: unknown) {
+  const settings = await repo.getSettings();
+  if (!settings.mobileAccess.guestSignIn || !CALENDAR.enabled) return false;
+  const c = resolveConfig(await repo.email.config(), locals);
+  return !c.error && c.provider !== 'none' && c.config.enabled && encryptionAvailable(locals);
+}
+async function requireGuest(c: PublicContext) {
+  if (!await guestSignInReady(c.repo, c.locals)) throw new ApiError(404, 'This feature is turned off.');
+}
+const emailField = z.string().trim().toLowerCase().max(254).refine(validAddress, 'Enter a valid email address.');
+const hash = (email: string, code: string) => sha256Hex(`guest-code:${email}:${code}`);
+function sixDigits() {
+  // rejection sampling keeps every code equally likely
+  const buf = new Uint32Array(1);
+  do crypto.getRandomValues(buf); while (buf[0] >= 4_294_000_000);
+  return String(buf[0] % 1_000_000).padStart(6, '0');
+}
+
+export const codeInput = z.object({ email: emailField }).strict();
+export async function requestCode(c: PublicContext) {
+  await requireGuest(c);
+  const { email } = codeInput.parse(await readJson(c.request, 1000));
+  if (!await c.repo.email.rateLimit(`guest:code:ip:${await sha256Hex(c.address)}`, 20, 15 * 60_000)) throw new ApiError(429, 'Too many requests. Try again in a few minutes.', 900);
+  // site-wide ceiling: rotating client addresses can't turn this into a mail cannon
+  if (!await c.repo.email.rateLimit('guest:code:site', SITE_CODES_PER_HOUR, 3_600_000)) throw new ApiError(429, 'Sign-in is busy right now. Try again in a little while.', 3600);
+  const emailKey = await sha256Hex(email);
+  // an address that already got 3 codes, or that ran out of guesses today, quietly gets no more
+  if (!await c.repo.email.rateLimited(`guest:fail:email:${emailKey}`, EMAIL_FAILURES_PER_DAY)
+    && await c.repo.email.rateLimit(`guest:code:email:${emailKey}`, 3, 15 * 60_000)) {
+    const now = Date.now(), code = sixDigits(), dedupe = `guest-code:${crypto.randomUUID()}`;
+    await c.repo.guests.saveCode(email, await hash(email, code), now + CODE_MS, now);
+    const config = await c.repo.email.config();
+    await c.repo.email.enqueue({ dedupe, kind: 'guest-code', recipient: email, configVersion: config?.version ?? 0, expiresAt: now + CODE_MS,
+      payload: JSON.stringify({ issuedAt: now, code: encrypt(code, `guest-code:${dedupe}`, c.locals) }) });
+    await kickEmail(c.repo, c.locals, waitUntilFrom(c.locals));
+  }
+  return { sent: true as const, expiresInMinutes: CODE_MS / 60_000 };
+}
+
+export const tokenInput = z.object({
+  email: emailField, code: z.string().regex(/^\d{6}$/, 'Enter the 6-digit code.'),
+  // shown to the owner ("Ana's iPhone"); optional
+  deviceName: z.string().trim().max(80).default(''),
+}).strict();
+export async function exchangeCode(c: PublicContext) {
+  await requireGuest(c);
+  const body = tokenInput.parse(await readJson(c.request, 1000));
+  const lock = await failureLock(c.repo, 'guest-code', c.address, 30);
+  await lock.check();
+  // per address, across every code: new codes reset the 5 tries, not this budget
+  const failKey = `guest:fail:email:${await sha256Hex(body.email)}`;
+  if (await c.repo.email.rateLimited(failKey, EMAIL_FAILURES_PER_DAY)) {
+    await c.repo.guests.deleteCode(body.email);
+    throw new ApiError(400, 'That code is wrong or has expired. Check the latest email or ask for a new code.');
+  }
+  // the try is counted and the code consumed atomically: concurrent requests
+  // can't share one code or squeeze in extra guesses (spent codes stay until
+  // purged; attempt() already refuses them)
+  const tried = await c.repo.guests.attempt(body.email, MAX_TRIES);
+  const ok = !!tried && safeEqual(tried.codeHash, await hash(body.email, body.code)) && await c.repo.guests.consumeCode(body.email, tried.codeHash);
+  if (!ok) {
+    await lock.miss();
+    await c.repo.email.rateLimit(failKey, EMAIL_FAILURES_PER_DAY, 86_400_000);
+    throw new ApiError(400, 'That code is wrong or has expired. Check the latest email or ask for a new code.');
+  }
+  const token = randomToken(GUEST_PREFIX);
+  await c.repo.guests.createSession({ id: crypto.randomUUID(), tokenHash: await sha256Hex(token), email: body.email, deviceName: body.deviceName });
+  return { accessToken: token, tokenType: 'Bearer' as const, email: body.email, idleDays: GUEST_IDLE_MS / 86_400_000 };
+}
+
+/** the signed-in guest behind `Authorization: Bearer acms_guest_…` */
+export async function authenticateGuest(c: PublicContext) {
+  await requireGuest(c);
+  const raw = /^Bearer (\S+)$/.exec(c.request.headers.get('authorization') ?? '')?.[1] ?? '';
+  const lock = await failureLock(c.repo, 'guest-token', c.address);
+  await lock.check();
+  const session = TOKEN.test(raw) ? await c.repo.guests.sessionByHash(await sha256Hex(raw)) : null;
+  const now = Date.now();
+  if (!session || session.lastSeenAt <= now - GUEST_IDLE_MS) {
+    await lock.miss();
+    if (session) await c.repo.guests.deleteSession(session.id);
+    throw new ApiError(401, 'Sign in again.');
+  }
+  // sliding expiry without a write on every request
+  if (now - session.lastSeenAt > 3_600_000) await c.repo.guests.touch(session.id, now);
+  return session;
+}
+
+export const myBookingsQuery = z.object({ when: z.enum(['upcoming', 'past']).default('upcoming'), ...pageQuery }).strict();
+export async function myBookings(c: PublicContext) {
+  const q = myBookingsQuery.parse(queryParams(c.url));
+  const session = await authenticateGuest(c);
+  const settings = await c.repo.getSettings();
+  const origin = siteOrigin(settings, c.url);
+  const now = Date.now();
+  const kinds: Booking['kind'][] = bookingsEnabled() ? ['booking', 'rsvp'] : ['rsvp'];
+  const start = (q.page - 1) * q.limit;
+  // filtered, ordered and paged in SQL (one extra row says whether there is a next page)
+  const [list, resources, links, events] = await Promise.all([
+    c.repo.listBookings({ email: session.email, kinds, ...(q.when === 'upcoming' ? { from: now } : { endedBy: now, newestFirst: true }), limit: q.limit + 1, offset: start }),
+    c.repo.listResources(), c.repo.listBookingLinks(), c.repo.listEvents(),
+  ]);
+  const res = new Map(resources.map((r) => [r.id, r])), lnk = new Map(links.map((l) => [l.id, l])), ev = new Map(events.map((e) => [e.id, e]));
+  return {
+    email: session.email,
+    items: list.slice(0, q.limit).map((b) => {
+      const resource = res.get(b.resourceId), link = lnk.get(b.linkId) ?? null, event = ev.get(b.eventId);
+      return {
+        id: b.id, reference: b.id.slice(0, 8).toUpperCase(), kind: b.kind as 'booking' | 'rsvp', status: b.status,
+        start: new Date(b.start).toISOString(), end: new Date(b.end).toISOString(), seats: b.seats,
+        title: event ? event.title : [resource?.name, link?.name].filter(Boolean).join(' · ') || 'Booking',
+        // use with the Booking-Token header on /bookings/manage/*
+        manageToken: b.manageToken, manageUrl: origin + manageUrl(b.manageToken),
+        can: guestChanges(b, link, now),
+      };
+    }),
+    pagination: { page: q.page, limit: q.limit, nextPage: list.length > q.limit ? q.page + 1 : null },
+  };
+}
+
+export async function revokeGuest(c: PublicContext) {
+  const session = await authenticateGuest(c);
+  await c.repo.guests.deleteSession(session.id);
+  return { signedOut: true as const };
+}
+

package/src/lib/mobile/http.ts

@@ -8,7 +8,7 @@ const headers = {
   'Access-Control-Allow-Origin': '*',
   'Access-Control-Allow-Methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
   // Authorization carries editor-app bearer tokens; no route reads cookies
-  'Access-Control-Allow-Headers': 'Authorization, Content-Type, Idempotency-Key, If-None-Match',
+  'Access-Control-Allow-Headers': 'Authorization, Booking-Token, Content-Type, Idempotency-Key, If-None-Match',
   'Access-Control-Expose-Headers': 'ETag, Retry-After, Idempotency-Replayed',
   'X-Content-Type-Options': 'nosniff',
   'Cache-Control': 'no-store',
@@ -35,7 +35,7 @@ export function failure(error: unknown) {
     code: codes[status] ?? 'internal_error',
     message: status === 500 ? 'Request failed. Please try again.' : error instanceof z.ZodError ? 'Invalid request parameters.' : (error as Error).message,
     ...(error instanceof z.ZodError ? { issues: error.issues.map(({ path, message }) => ({ path, message })) } : {}),
-  } }, { status, headers: { ...headers, ...(status === 429 ? { 'Retry-After': '60' } : {}),
+  } }, { status, headers: { ...headers, ...(status === 429 ? { 'Retry-After': String((error as ApiError).retryAfter ?? 60) } : {}),
     ...(status === 401 ? { 'WWW-Authenticate': 'Bearer realm="acms", error="invalid_token"' } : {}) } });
 }
 export async function limitRequest(repo: ContentRepository, address: string, write = false) {

package/src/lib/mobile/links.ts

@@ -0,0 +1,69 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import type { Link } from '../schema';
+import { siteOrigin } from '../seo';
+import { socialIconPath } from '../socialIcons';
+import { safeUrl } from './content';
+import { queryParams } from './http';
+import { requireAccess } from './access';
+
+// The links page (link-in-bio) for apps: the same visible blocks in the same
+// order. Buttons point at /go/<id> so taps still count; raw HTML embeds stay
+// website-only and arrive as `embed` with the page URL to open instead.
+
+const HEX = /^#[0-9a-f]{6}$/i;
+const str = (v: unknown) => (typeof v === 'string' ? v : '');
+
+function icon(l: Link, origin: string) {
+  const value = l.icon.trim();
+  if (!value) return null;
+  if (value.startsWith('<svg')) return { type: 'svg' as const, value };
+  if (value === 'favicon') {
+    try { return { type: 'image' as const, value: `https://www.google.com/s2/favicons?domain=${new URL(l.url).hostname}&sz=64` }; } catch { return null; }
+  }
+  if (value.startsWith('http') || value.startsWith('/')) { const url = safeUrl(value, origin); return url ? { type: 'image' as const, value: url } : null; }
+  return { type: 'emoji' as const, value: value.slice(0, 16) };
+}
+
+function shown(l: Link) {
+  if (l.meta?.hidden) return false;
+  if (l.kind === 'link' || l.kind === 'email' || l.kind === 'phone') return Boolean(l.url.trim());
+  if (l.kind === 'heading') return Boolean(l.label.trim());
+  if (l.kind === 'text' || l.kind === 'html') return Boolean(l.html.trim());
+  return true;
+}
+
+function item(l: Link, origin: string, page: string) {
+  const style = { color: HEX.test(str(l.meta.color)) ? str(l.meta.color) : null, textColor: HEX.test(str(l.meta.textColor)) ? str(l.meta.textColor) : null };
+  switch (l.kind) {
+    case 'heading': return { id: l.id, kind: 'heading' as const, label: l.label };
+    case 'text': return { id: l.id, kind: 'text' as const, text: l.html };
+    case 'spacer': return { id: l.id, kind: 'spacer' as const, size: (['s', 'm', 'l'].includes(str(l.meta.size)) ? str(l.meta.size) : 'm') as 's' | 'm' | 'l' };
+    case 'live': return { id: l.id, kind: 'live' as const };
+    case 'html': return { id: l.id, kind: 'embed' as const, url: page };
+    case 'email': return { id: l.id, kind: 'email' as const, label: l.label || l.url, url: `mailto:${l.url.trim()}`, icon: icon(l, origin), ...style };
+    case 'phone': return { id: l.id, kind: 'phone' as const, label: l.label || l.url, url: `tel:${l.url.replace(/[^+\d]/g, '')}`, icon: icon(l, origin), ...style };
+    case 'vcard': {
+      const m = l.meta;
+      return { id: l.id, kind: 'contact' as const, label: l.label || 'Save contact', icon: icon(l, origin), ...style,
+        contact: { firstName: str(m.firstName), lastName: str(m.lastName), organization: str(m.org), phone: str(m.phone), email: str(m.email), url: safeUrl(str(m.url), origin) } };
+    }
+    default: return { id: l.id, kind: 'link' as const, label: l.label, url: `${origin}/go/${encodeURIComponent(l.id)}`, destination: safeUrl(l.url, origin), icon: icon(l, origin), ...style };
+  }
+}
+
+export async function getLinks(repo: ContentRepository, url: URL) {
+  z.object({}).strict().parse(queryParams(url));
+  const settings = await requireAccess(repo, 'links');
+  const origin = siteOrigin(settings, url);
+  const [links, nav] = await Promise.all([repo.listLinks(), repo.listNavItems()]);
+  const page = `${origin}/links`;
+  return {
+    name: settings.linksName || settings.siteTitle,
+    bio: settings.linksBio || settings.tagline,
+    avatar: safeUrl(settings.linksAvatar, origin),
+    url: page,
+    socials: nav.filter((n) => n.area === 'social').map((n) => ({ label: n.label, url: safeUrl(n.url, origin, true), iconPath: socialIconPath(n.url) })).filter((n) => n.url),
+    items: links.filter(shown).map((l) => item(l, origin, page)).filter((i) => !('url' in i) || i.url),
+  };
+}

package/src/lib/mobile/manage.ts

@@ -0,0 +1,114 @@
+import { z } from 'zod';
+import type { Booking, BookingLink, CalEvent, Resource, Settings } from '../schema';
+import { ApiError, readJson } from '../api';
+import { bookingsEnabled, eventUrl, manageUrl } from '../calendar/config';
+import { eventTimeZone, locationLine } from '../calendar/events';
+import { resourceZone, linkLengths } from '../booking/availability';
+import { bookingIcs } from '../booking/emails';
+import { guestCancel, guestChanges, guestMoveLink, guestReschedule } from '../booking/service';
+import { siteOrigin } from '../seo';
+import { waitUntilFrom } from '../webhooks';
+import { isoDay, queryParams } from './http';
+import { requireCalendar, availabilityFor } from './calendar';
+import { requireAccess, failureLock } from './access';
+import type { PublicContext } from './route';
+
+// A booker's own booking, from an app: the private token every confirmation
+// email links to is the credential. It travels in the Booking-Token header,
+// never the URL, so it stays out of access logs and analytics. Unknown tokens
+// count against the caller's address (20 misses / 10 min → locked out).
+
+export const BOOKING_TOKEN_HEADER = 'Booking-Token';
+const TOKEN = /^[A-Za-z0-9_-]{16,128}$/;
+
+interface Managed { booking: Booking; settings: Settings; resource: Resource | null; link: BookingLink | null; event: CalEvent | null; origin: string }
+
+async function managed(c: PublicContext): Promise<Managed> {
+  requireCalendar();
+  const settings = await requireAccess(c.repo, 'bookingChanges');
+  const token = c.request.headers.get(BOOKING_TOKEN_HEADER) ?? '';
+  if (!token) throw new ApiError(400, `Send the booking’s token in the ${BOOKING_TOKEN_HEADER} header.`);
+  const lock = await failureLock(c.repo, 'booking-token', c.address);
+  await lock.check();
+  const booking = TOKEN.test(token) ? await c.repo.getBookingByToken(token) : null;
+  if (!booking || booking.kind === 'block' || (!bookingsEnabled() && booking.kind !== 'rsvp')) {
+    await lock.miss();
+    throw new ApiError(404, 'Booking not found.');
+  }
+  const [resource, link, event] = await Promise.all([
+    booking.resourceId ? c.repo.getResource(booking.resourceId) : null,
+    booking.linkId ? c.repo.getBookingLink(booking.linkId) : null,
+    booking.eventId ? c.repo.getEvent(booking.eventId) : null,
+  ]);
+  return { booking, settings, resource, link, event, origin: siteOrigin(settings, c.url) };
+}
+
+function view(m: Managed, booking = m.booking) {
+  const { resource, link, event, settings, origin } = m;
+  const can = guestChanges(booking, link);
+  return {
+    booking: {
+      id: booking.id, reference: booking.id.slice(0, 8).toUpperCase(), kind: booking.kind as 'booking' | 'rsvp', status: booking.status,
+      start: new Date(booking.start).toISOString(), end: new Date(booking.end).toISOString(),
+      allDay: event ? event.allDay : link?.mode === 'day',
+      timezone: event ? eventTimeZone(event, settings) : resource ? resourceZone(resource, settings.timezone) : settings.timezone || 'UTC',
+      seats: booking.seats, name: booking.name, email: booking.email, phone: booking.phone, answers: booking.answers,
+      createdAt: new Date(booking.createdAt).toISOString(),
+    },
+    title: event ? event.title : [resource?.name, link?.name].filter(Boolean).join(' · ') || 'Booking',
+    location: event ? locationLine(event.location) : resource?.name ?? '',
+    resource: resource ? { slug: resource.slug, name: resource.name } : null,
+    link: link ? { slug: link.slug, name: link.name, mode: link.mode, lengths: linkLengths(link) } : null,
+    event: event ? { slug: event.slug, title: event.title, url: origin + eventUrl(event.slug) } : null,
+    // the web page for this booking (the same private link the emails carry)
+    manageUrl: origin + manageUrl(booking.manageToken),
+    can,
+  };
+}
+const flow = (m: Managed, c: PublicContext) => ({ origin: m.origin, locals: c.locals, waitUntil: waitUntilFrom(c.locals) });
+
+export const getManaged = async (c: PublicContext) => view(await managed(c));
+
+export async function cancelManaged(c: PublicContext) {
+  const m = await managed(c);
+  return view(m, await guestCancel(c.repo, m.booking, flow(m, c)));
+}
+
+export const manageAvailabilityQuery = z.object({
+  from: isoDay.optional(), days: z.coerce.number().int().min(1).max(31).default(7), minutes: z.coerce.number().int().min(1).max(44640).optional(),
+}).strict();
+export async function managedAvailability(c: PublicContext) {
+  const q = manageAvailabilityQuery.parse(queryParams(c.url));
+  const m = await managed(c);
+  if (!guestChanges(m.booking, m.link).reschedule || !m.resource || !m.link) throw new ApiError(409, 'This booking can’t be moved.');
+  // only times the move itself would accept (outside the change cutoff)
+  return availabilityFor(c.repo, m.resource, guestMoveLink(m.link), m.settings, q, m.booking.id);
+}
+
+export const rescheduleInput = z.object({
+  start: z.string().datetime({ offset: true }),
+  // range/day links: the new length; default keeps the current length
+  minutes: z.number().int().min(1).max(44640).optional(),
+}).strict();
+export async function rescheduleManaged(c: PublicContext) {
+  const body = rescheduleInput.parse(await readJson(c.request, 2000));
+  const m = await managed(c);
+  const start = Date.parse(body.start);
+  const minutes = body.minutes ?? Math.round((m.booking.end - m.booking.start) / 60_000);
+  // availability rules check everything else (hours, notice, overlaps)
+  if (m.link?.mode === 'range' && body.minutes !== undefined && !linkLengths(m.link).includes(minutes)) throw new ApiError(400, 'Pick one of the booking type’s lengths.');
+  return view(m, await guestReschedule(c.repo, m.booking, start, start + minutes * 60_000, flow(m, c)));
+}
+
+export async function managedIcs(c: PublicContext) {
+  z.object({}).strict().parse(queryParams(c.url));
+  const m = await managed(c);
+  const v = view(m);
+  const body = bookingIcs(m.booking, v.title, v.location, v.manageUrl, new URL(m.origin).host, m.booking.status === 'cancelled' ? 'CANCEL' : 'REQUEST', { allDay: v.booking.allDay });
+  return new Response(body, { headers: {
+    'Content-Type': 'text/calendar; charset=utf-8', 'Content-Disposition': 'attachment; filename="booking.ics"',
+    'Cache-Control': 'no-store', 'Access-Control-Allow-Origin': '*', 'X-Content-Type-Options': 'nosniff',
+  } });
+}
+
+export type ManagedBooking = ReturnType<typeof view>;