@acms-subir/core 0.3.9 → 0.3.10

package/src/lib/repo/sql.ts

@@ -1,4 +1,5 @@
 import { FormStore, formInsert, submissionInsert } from '../forms/store';
+import { GuestStore } from '../mobile/guest-store';
 import { LiveStore } from '../live/store';
 import { PushStore } from '../push/store';
 import { EditorStore } from '../editor/store';
@@ -183,7 +184,7 @@ function rowToLink2(r: Row): BookingLink {
     id: r.id, resourceId: r.resource_id, slug: r.slug, name: r.name, description: r.description ?? '', mode: r.mode ?? 'slots',
     duration: Number(r.duration), lengths: json(r.lengths, []), minDays: Number(r.min_days), maxDays: Number(r.max_days),
     step: Number(r.step), bufferBefore: Number(r.buffer_before), bufferAfter: Number(r.buffer_after),
-    minNotice: Number(r.min_notice), maxAdvance: Number(r.max_advance), perDayCap: Number(r.per_day_cap),
+    minNotice: Number(r.min_notice), maxAdvance: Number(r.max_advance), perDayCap: Number(r.per_day_cap), changeCutoff: Number(r.change_cutoff ?? 0),
     hours: r.hours ? json(r.hours, null) : null, autoConfirm: Boolean(r.auto_confirm), visibility: r.visibility ?? 'public',
     approval: r.approval ?? 'default', approvalRules: json(r.approval_rules, {}),
     askPhone: Boolean(r.ask_phone), questions: json(r.questions, []), confirmMessage: r.confirm_message ?? '',
@@ -259,6 +260,7 @@ export class SqlRepository implements ContentRepository {
   private ready: Promise<void>;
   readonly email: EmailStore;
   readonly forms: FormStore;
+  readonly guests: GuestStore;
   readonly live: LiveStore;
   readonly push: PushStore;
   readonly editor: EditorStore;
@@ -266,6 +268,7 @@ export class SqlRepository implements ContentRepository {
   constructor(driver: SqlDriver | (() => Promise<SqlDriver>)) {
     this.ready = this.init(driver);
     this.forms = new FormStore(async () => { await this.ready; return this.driver; });
+    this.guests = new GuestStore(async () => { await this.ready; return this.driver; });
     this.live = new LiveStore(async () => { await this.ready; return this.driver; });
     this.push = new PushStore(async () => { await this.ready; return this.driver; });
     this.editor = new EditorStore(async () => { await this.ready; return this.driver; });
@@ -1031,11 +1034,11 @@ export class SqlRepository implements ContentRepository {
     return {
       sql: `INSERT INTO booking_links (id, resource_id, slug, name, description, mode, duration, lengths, min_days, max_days, step, buffer_before,
         buffer_after, min_notice, max_advance, per_day_cap, hours, auto_confirm, visibility, ask_phone, questions, confirm_message, redirect_url,
-        active, ord, created_at, updated_at, approval, approval_rules) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        active, ord, created_at, updated_at, approval, approval_rules, change_cutoff) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       args: [l.id, l.resourceId, l.slug, l.name, l.description, l.mode, l.duration, JSON.stringify(l.lengths), l.minDays, l.maxDays, l.step,
         l.bufferBefore, l.bufferAfter, l.minNotice, l.maxAdvance, l.perDayCap, l.hours ? JSON.stringify(l.hours) : null, l.autoConfirm ? 1 : 0,
         l.visibility, l.askPhone ? 1 : 0, JSON.stringify(l.questions), l.confirmMessage, l.redirectUrl, l.active ? 1 : 0, l.order, l.createdAt, l.updatedAt,
-        l.approval, JSON.stringify(l.approvalRules)],
+        l.approval, JSON.stringify(l.approvalRules), l.changeCutoff],
     };
   }
   private bookingInsert(b: Booking): SqlStatement {
@@ -1126,10 +1129,10 @@ export class SqlRepository implements ContentRepository {
     await this.driver.run(
       `UPDATE booking_links SET slug = ?, name = ?, description = ?, mode = ?, duration = ?, lengths = ?, min_days = ?, max_days = ?, step = ?,
         buffer_before = ?, buffer_after = ?, min_notice = ?, max_advance = ?, per_day_cap = ?, hours = ?, auto_confirm = ?, visibility = ?,
-        ask_phone = ?, questions = ?, confirm_message = ?, redirect_url = ?, active = ?, ord = ?, updated_at = ?, approval = ?, approval_rules = ? WHERE id = ?`,
+        ask_phone = ?, questions = ?, confirm_message = ?, redirect_url = ?, active = ?, ord = ?, updated_at = ?, approval = ?, approval_rules = ?, change_cutoff = ? WHERE id = ?`,
       [l.slug, l.name, l.description, l.mode, l.duration, JSON.stringify(l.lengths), l.minDays, l.maxDays, l.step, l.bufferBefore, l.bufferAfter,
         l.minNotice, l.maxAdvance, l.perDayCap, l.hours ? JSON.stringify(l.hours) : null, l.autoConfirm ? 1 : 0, l.visibility, l.askPhone ? 1 : 0,
-        JSON.stringify(l.questions), l.confirmMessage, l.redirectUrl, l.active ? 1 : 0, l.order, l.updatedAt, l.approval, JSON.stringify(l.approvalRules), id]
+        JSON.stringify(l.questions), l.confirmMessage, l.redirectUrl, l.active ? 1 : 0, l.order, l.updatedAt, l.approval, JSON.stringify(l.approvalRules), l.changeCutoff, id]
     );
   }
   async deleteBookingLink(id: string) {
@@ -1147,9 +1150,12 @@ export class SqlRepository implements ContentRepository {
     if (filter.email) { where.push('email = ?'); args.push(filter.email.toLowerCase()); }
     if (filter.from !== undefined) { where.push('end_at > ?'); args.push(filter.from); }
     if (filter.to !== undefined) { where.push('start_at < ?'); args.push(filter.to); }
+    if (filter.endedBy !== undefined) { where.push('end_at <= ?'); args.push(filter.endedBy); }
     if (filter.statuses?.length) { where.push(`status IN (${filter.statuses.map(() => '?').join(', ')})`); args.push(...filter.statuses); }
     if (filter.kinds?.length) { where.push(`kind IN (${filter.kinds.map(() => '?').join(', ')})`); args.push(...filter.kinds); }
-    const rows = await this.driver.all(`SELECT * FROM bookings${where.length ? ` WHERE ${where.join(' AND ')}` : ''} ORDER BY start_at ASC LIMIT 5000`, args);
+    const dir = filter.newestFirst ? 'DESC' : 'ASC';
+    const limit = Math.min(Math.max(Math.trunc(filter.limit ?? 5000), 1), 5000), offset = Math.max(Math.trunc(filter.offset ?? 0), 0);
+    const rows = await this.driver.all(`SELECT * FROM bookings${where.length ? ` WHERE ${where.join(' AND ')}` : ''} ORDER BY start_at ${dir}, id ${dir} LIMIT ${limit} OFFSET ${offset}`, args);
     return rows.map(rowToBooking);
   }
   async getBooking(id: string) {
@@ -1163,6 +1169,12 @@ export class SqlRepository implements ContentRepository {
     const r = await this.first('SELECT * FROM bookings WHERE manage_token = ?', [token]);
     return r ? rowToBooking(r) : null;
   }
+  async countBookingsByEmail(email: string, since: number) {
+    await this.ready;
+    // staff bookings made for someone don't use up that person's public allowance
+    const r = await this.first("SELECT COUNT(*) AS n FROM bookings WHERE email = ? AND created_at >= ? AND kind != 'block' AND source != 'admin'", [email.trim().toLowerCase(), since]);
+    return Number(r?.n ?? 0);
+  }
   // One INSERT … SELECT … WHERE NOT EXISTS: the overlap test and the write
   // are a single statement, so two people racing for the same slot can't
   // both win — the loser's insert simply affects no rows.
@@ -1445,6 +1457,30 @@ export class SqlRepository implements ContentRepository {
     await this.ready;
     await this.driver.run('DELETE FROM links WHERE id = ?', [id]);
   }
+  async linksRevision() {
+    await this.ready;
+    return Number((await this.first('SELECT links_revision FROM settings WHERE id = 1'))?.links_revision ?? 0);
+  }
+  async replaceLinks(expectedRevision: number, items: Parameters<ContentRepository['replaceLinks']>[1], profile: Parameters<ContentRepository['replaceLinks']>[2] = {}) {
+    await this.ready;
+    const keep = items.flatMap((i) => (i.keep ? [i.keep] : []));
+    const settings = this.settingsStatement(profile);
+    try {
+      await this.driver.batch([
+        // fails the CHECK (and so the whole batch) when someone saved in between
+        { sql: 'INSERT INTO revision_checks (expected, actual) SELECT ?, links_revision FROM settings WHERE id = 1', args: [expectedRevision] },
+        { sql: 'DELETE FROM revision_checks' },
+        keep.length ? { sql: `DELETE FROM links WHERE id NOT IN (${keep.map(() => '?').join(', ')})`, args: keep } : { sql: 'DELETE FROM links' },
+        ...items.map((i, ord) => i.keep
+          ? { sql: 'UPDATE links SET label = ?, url = ?, icon = ?, html = ?, meta = ?, ord = ? WHERE id = ?', args: [i.label, i.url, i.icon, i.html, JSON.stringify(i.meta), ord, i.keep] }
+          : { sql: 'INSERT INTO links (id, kind, label, url, icon, html, meta, ord) VALUES (?, ?, ?, ?, ?, ?, ?, ?)', args: [crypto.randomUUID(), i.kind, i.label, i.url, i.icon, i.html, JSON.stringify(i.meta), ord] }),
+        ...(settings ? [settings] : []),
+      ]);
+    } catch (e) {
+      if (/CHECK constraint/i.test(String(e))) throw new ApiError(409, 'The links page changed since you opened it. Reload and try again.');
+      throw e;
+    }
+  }
   async trackClick(id: string) {
     await this.ready;
     const r = await this.first('SELECT url FROM links WHERE id = ?', [id]);
@@ -1611,8 +1647,12 @@ export class SqlRepository implements ContentRepository {
   }
 
   // ---- search ----
-  async searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults> {
+  async searchPublished(query: string, opts?: { locale?: string; limit?: number; collections?: string[] }): Promise<SearchResults> {
     await this.ready;
+    // per-kind cap; the public API widens it for deeper result pages
+    const limit = Math.min(Math.max(Math.trunc(opts?.limit ?? 50), 1), 200);
+    const inCollections = opts?.collections ? ` AND p.collection IN (${opts.collections.map(() => '?').join(', ') || 'NULL'})` : '';
+    const collectionArgs = opts?.collections ?? [];
     const trimmed = query.trim();
     if (!trimmed) return { posts: [], pages: [], events: [], tags: [], authors: [] };
     const locale = opts?.locale ?? '';
@@ -1623,29 +1663,29 @@ export class SqlRepository implements ContentRepository {
       [postRows, pageRows, eventRows] = await Promise.all([
         this.driver.all(
           `SELECT p.*, ${SNIPPET} AS snip FROM search_index JOIN posts p ON p.id = search_index.ref_id
-           WHERE search_index MATCH ? AND search_index.kind = 'post' AND p.status = 'published'
-           ORDER BY ${RANK} LIMIT 50`,
-          [ftsQuery(trimmed)]
+           WHERE search_index MATCH ? AND search_index.kind = 'post' AND p.status = 'published'${inCollections}
+           ORDER BY ${RANK} LIMIT ${limit}`,
+          [ftsQuery(trimmed), ...collectionArgs]
         ),
         // locale is a boost, never a filter: the visitor's language sorts
         // first, every locale stays visible (en/es cover different topics)
         this.driver.all(
           `SELECT g.*, ${SNIPPET} AS snip FROM search_index JOIN pages g ON g.id = search_index.ref_id
            WHERE search_index MATCH ? AND search_index.kind = 'page' AND g.status = 'published'
-           ORDER BY (search_index.locale = ?) DESC, ${RANK} LIMIT 50`,
+           ORDER BY (search_index.locale = ?) DESC, ${RANK} LIMIT ${limit}`,
           [ftsQuery(trimmed), locale]
         ),
         this.driver.all(
           `SELECT e.*, ${SNIPPET} AS snip FROM search_index JOIN events e ON e.id = search_index.ref_id
            WHERE search_index MATCH ? AND search_index.kind = 'event' AND e.status = 'published'
-           ORDER BY ${RANK} LIMIT 50`,
+           ORDER BY ${RANK} LIMIT ${limit}`,
           [ftsQuery(trimmed)]
         ),
       ]);
     } catch {
       // FTS5 unavailable or a query form it rejects — degrade to the old
       // LIKE scan (recency-ordered, snippets fall back to excerpt/seo_desc)
-      [postRows, pageRows, eventRows] = await this.likeSearch(trimmed, locale);
+      [postRows, pageRows, eventRows] = await this.likeSearch(trimmed, locale, limit, opts?.collections);
     }
     const like = `%${trimmed.replace(/[%_]/g, ' ').trim()}%`;
     const [authors, tagRows, userRows] = await Promise.all([
@@ -1675,20 +1715,20 @@ export class SqlRepository implements ContentRepository {
       authors: userRows.map(rowToUser),
     };
   }
-  private async likeSearch(query: string, locale: string): Promise<[Row[], Row[], Row[]]> {
+  private async likeSearch(query: string, locale: string, limit: number, collections?: string[]): Promise<[Row[], Row[], Row[]]> {
     const q = `%${query.replace(/[%_]/g, ' ').trim()}%`;
     if (q === '%%') return [[], [], []];
     return Promise.all([
       this.driver.all(
-        "SELECT * FROM posts WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ? OR body LIKE ?) ORDER BY published_at DESC LIMIT 50",
-        [q, q, q, q]
+        `SELECT * FROM posts WHERE status = 'published'${collections ? ` AND collection IN (${collections.map(() => '?').join(', ') || 'NULL'})` : ''} AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ? OR body LIKE ?) ORDER BY published_at DESC LIMIT ${limit}`,
+        [...(collections ?? []), q, q, q, q]
       ),
       this.driver.all(
-        "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY (locale = ?) DESC, updated_at DESC LIMIT 50",
+        `SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY (locale = ?) DESC, updated_at DESC LIMIT ${limit}`,
         [q, q, locale]
       ),
       this.driver.all(
-        "SELECT * FROM events WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ?) ORDER BY start_at DESC LIMIT 50",
+        `SELECT * FROM events WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ?) ORDER BY start_at DESC LIMIT ${limit}`,
         [q, q, q]
       ),
     ]);
@@ -1938,6 +1978,8 @@ export class SqlRepository implements ContentRepository {
       live: JSON.parse(String(r?.live ?? '{}')),
       push: JSON.parse(String(r?.push ?? '{}')),
       calendar: JSON.parse(String(r?.calendar ?? '{}')),
+      mobileAccess: JSON.parse(String(r?.mobile_access ?? '{}')),
+      monitoring: JSON.parse(String(r?.monitoring ?? '{}')),
       agent: JSON.parse(String(r?.agent ?? '{}')),
       draftsApiKey: r?.drafts_api_key ?? '',
       draftsAllowedOrigins: JSON.parse(String(r?.drafts_allowed_origins ?? '[]')),
@@ -1949,14 +1991,18 @@ export class SqlRepository implements ContentRepository {
     const statement = this.settingsStatement(data);
     if (statement) await this.driver.run(statement.sql, statement.args);
   }
+  async patchMobileAccess(patch: Partial<Settings['mobileAccess']>) {
+    await this.ready;
+    await this.driver.run('UPDATE settings SET mobile_access = json_patch(mobile_access, ?) WHERE id = 1', [JSON.stringify(patch)]);
+  }
   private settingsStatement(data: Partial<Settings>): SqlStatement | undefined {
     const columns: Record<string, string> = {
       siteTitle:'site_title', tagline:'tagline', footerText:'footer_text', linksName:'links_name', linksBio:'links_bio', linksAvatar:'links_avatar',
       activeTheme:'active_theme', designOverrides:'design_overrides', sectionPages:'section_pages', siteLogo:'site_logo', siteLogoDark:'site_logo_dark', siteUrl:'site_url', siteFavicon:'site_favicon', siteCover:'site_cover',
       announcement:'announcement', analytics:'analytics', headCode:'head_code', footerCode:'footer_code', timezone:'timezone', locale:'locale',
-      draftsApiKey:'drafts_api_key', draftsAllowedOrigins:'drafts_allowed_origins', draftDesign:'draft_design', ai:'ai', agent:'agent', live:'live', push:'push', calendar:'calendar',
+      draftsApiKey:'drafts_api_key', draftsAllowedOrigins:'drafts_allowed_origins', draftDesign:'draft_design', ai:'ai', agent:'agent', live:'live', push:'push', calendar:'calendar', mobileAccess:'mobile_access', monitoring:'monitoring',
     };
-    const jsonKeys = new Set(['designOverrides','sectionPages','announcement','analytics','draftsAllowedOrigins','draftDesign','ai','agent','live','push','calendar']);
+    const jsonKeys = new Set(['designOverrides','sectionPages','announcement','analytics','draftsAllowedOrigins','draftDesign','ai','agent','live','push','calendar','mobileAccess','monitoring']);
     const entries = Object.entries(data).filter(([k,v]) => columns[k] && v !== undefined);
     if (!entries.length) return;
     const design = entries.some(([k]) => ['activeTheme','designOverrides','sectionPages','siteLogo','siteLogoDark','siteFavicon','siteCover','draftDesign'].includes(k));

package/src/lib/repo/types.ts

@@ -1,4 +1,5 @@
 import type { FormStore } from '../forms/store';
+import type { GuestStore } from '../mobile/guest-store';
 import type { SavedForm, FormSubmission } from '../forms/schema';
 import type { LiveStore } from '../live/store';
 import type { BookingRequest } from '../backup/content';
@@ -51,6 +52,7 @@ export type EventUpdate = Partial<
 export interface ContentRepository {
   readonly email: EmailStore;
   readonly forms: FormStore;
+  readonly guests: GuestStore;
   readonly live: LiveStore;
   readonly push: PushStore;
   readonly editor: EditorStore;
@@ -168,9 +170,12 @@ export interface ContentRepository {
   // write that can fail on a race: it inserts atomically only if the held
   // range is still free (resource bookings) or seats remain (RSVPs), and
   // returns null when it lost.
-  listBookings(filter?: { resourceId?: string; eventId?: string; email?: string; from?: number; to?: number; statuses?: BookingStatus[]; kinds?: Booking['kind'][] }): Promise<Booking[]>;
+  /** from/to: overlaps the window; endedBy: ended at or before; default order start ascending, at most 5000 rows */
+  listBookings(filter?: { resourceId?: string; eventId?: string; email?: string; from?: number; to?: number; endedBy?: number; statuses?: BookingStatus[]; kinds?: Booking['kind'][]; newestFirst?: boolean; limit?: number; offset?: number }): Promise<Booking[]>;
   getBooking(id: string): Promise<Booking | null>;
   getBookingByToken(token: string): Promise<Booking | null>;
+  // bookings + RSVPs (never staff blocks) this address made since `since`
+  countBookingsByEmail(email: string, since: number): Promise<number>;
   createBooking(
     data: Omit<Booking, 'id' | 'createdAt' | 'updatedAt' | 'reminderSentAt' | 'notificationVersion'>,
     guard?: { capacity?: number; idempotency?: { keyHash: string; requestHash: string } }
@@ -222,6 +227,15 @@ export interface ContentRepository {
   // full ordering in one call (drag-and-drop); ids in desired display order
   reorderLinks(ids: string[]): Promise<void>;
   deleteLink(id: string): Promise<void>;
+  /** changes whenever the links page's blocks or profile change, by any path (not on clicks) */
+  linksRevision(): Promise<number>;
+  /**
+   * the whole links page in one atomic write, only if it is still at
+   * `expectedRevision` (409 otherwise, nothing saved): `keep` ids are updated
+   * in place, other items are added, everything else is removed; `profile`
+   * (links name/bio/avatar) saves in the same batch.
+   */
+  replaceLinks(expectedRevision: number, items: (Pick<Link, 'kind' | 'label' | 'url' | 'icon' | 'html' | 'meta'> & { keep?: string })[], profile?: Partial<Pick<Settings, 'linksName' | 'linksBio' | 'linksAvatar'>>): Promise<void>;
   trackClick(id: string): Promise<string | null>; // returns url to redirect to
 
   // tags — registry of tag entities; posts store tag names, this table adds
@@ -260,7 +274,8 @@ export interface ContentRepository {
   // #tags excluded) and author profiles. opts.locale is a ranking boost,
   // never a filter: pages in the visitor's locale sort first, every locale
   // stays visible (en/es cover different topics, not translations).
-  searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults>;
+  // collections: only posts in these (configured) collections
+  searchPublished(query: string, opts?: { locale?: string; limit?: number; collections?: string[] }): Promise<SearchResults>;
 
   // backup restore — id-preserving replace-all from a backup's content.json.
   // Users restore WITHOUT password hashes (backups never contain them).
@@ -310,6 +325,8 @@ export interface ContentRepository {
   // settings & dashboard
   getSettings(): Promise<Settings>;
   updateSettings(data: Partial<Settings>): Promise<void>;
+  /** merges just these App access fields in one statement, so concurrent saves don't undo each other */
+  patchMobileAccess(patch: Partial<Settings['mobileAccess']>): Promise<void>;
   // Design-screen staging: save stages into settings.draftDesign, apply
   // copies staged → live design fields and clears, discard just clears
   saveDesignDraft(data: Partial<Pick<Settings, 'activeTheme' | 'designOverrides' | 'siteLogo' | 'siteLogoDark' | 'siteFavicon' | 'siteCover' | 'sectionPages'>> & {

package/src/lib/scheduler.ts

@@ -4,6 +4,8 @@ import { processDueDeliveries } from './webhooks';
 import { dispatchEmail } from './email/service';
 import { decideOverdue, sendDueReminders } from './booking/service';
 import { runPushJobs } from './push/service';
+import { GUEST_IDLE_MS } from './mobile/guest-store';
+import { pushHeartbeat, pushUrlFor } from './monitoring';
 
 // All work is awaited on both hosts. Traffic-triggered fallbacks do not mark
 // this heartbeat: monitoring must prove the independent scheduler ran.
@@ -20,6 +22,8 @@ export async function runScheduledTasks(repo: ContentRepository, locals?: unknow
     live: () => syncDueLive(repo, locals),
     // queued first-publish notices, starting-soon reminders, receipts, retention
     push: () => runPushJobs(repo, { locals, now: startedAt }),
+    // expired guest sign-in codes and app sessions unused for 90 days
+    guests: () => repo.guests.purge(GUEST_IDLE_MS, startedAt).then(() => 0),
   };
   const results: Record<string, { ok: boolean; count?: number }> = {};
   for (const [name, run] of Object.entries(jobs)) {
@@ -28,5 +32,8 @@ export async function runScheduledTasks(repo: ContentRepository, locals?: unknow
   }
   const report = { startedAt, finishedAt: Date.now(), ok: Object.values(results).every(r => r.ok), jobs: results };
   await repo.email.recordScheduler(report);
+  // Uptime Kuma push monitor (Settings → Monitoring): a missing beat means the scheduler stopped
+  // (never allowed to fail the run)
+  await Promise.resolve().then(() => pushHeartbeat(pushUrlFor(settings.monitoring, locals), report)).catch(() => false);
   return report;
 }

package/src/lib/schema.ts

@@ -425,7 +425,8 @@ export type WeeklyHours = z.infer<typeof WeeklyHours>;
 // a date (or inclusive date span) with replacement hours; [] = closed
 export const DateOverride = z.object({
   date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-  endDate: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).default(''),
+  // '' = a single day
+  endDate: z.union([z.literal(''), z.string().regex(/^\d{4}-\d{2}-\d{2}$/)]).default(''),
   ranges: z.array(TimeRange).default([]),
   label: z.string().default(''),
 });
@@ -526,6 +527,35 @@ export const CalendarSettings = z.object({
 });
 export type CalendarSettings = z.infer<typeof CalendarSettings>;
 
+// Admin → Mobile app → App access: owner switches and abuse limits for the
+// public app routes. Turning a switch off answers 404 at once, no redeploy.
+export const MobileAccess = z.object({
+  // visitors view, cancel and move a booking with its private token
+  bookingChanges: z.boolean().default(true),
+  // "My bookings" through an emailed sign-in code (also needs email sending)
+  guestSignIn: z.boolean().default(true),
+  // published forms accept responses from apps
+  forms: z.boolean().default(true),
+  links: z.boolean().default(true),
+  // new bookings + RSVPs per email address per day, every channel; 0 = no cap
+  bookingsPerEmailDay: z.number().int().min(0).max(1000).default(10),
+  // responses per form per day from apps; 0 = no cap
+  responsesPerFormDay: z.number().int().min(0).max(100000).default(500),
+  // who changes rooms, booking types, hours and calendars from staff apps
+  scheduleRoles: z.enum(['admins', 'staff']).default('admins'),
+});
+export type MobileAccess = z.infer<typeof MobileAccess>;
+
+// Settings → Monitoring (owner): Uptime Kuma. pushUrl is a Kuma push monitor
+// the scheduler reports to after every run (a small secret: left out of
+// exports; UPTIME_PUSH_URL overrides it). statusPage is a public Kuma status
+// page the admin card reads.
+export const Monitoring = z.object({
+  pushUrl: z.string().max(500).default(''),
+  statusPage: z.string().max(500).default(''),
+});
+export type Monitoring = z.infer<typeof Monitoring>;
+
 export const BookingLink = z.object({
   id: z.string(),
   resourceId: z.string(),
@@ -543,6 +573,8 @@ export const BookingLink = z.object({
   bufferAfter: z.number().int().default(0),
   minNotice: z.number().int().default(120), // minutes
   maxAdvance: z.number().int().default(90), // days
+  // guests can cancel or move until this many hours before the start; 0 = any time
+  changeCutoff: z.number().int().min(0).max(8760).default(0),
   perDayCap: z.number().int().default(0), // 0 = unlimited
   // narrows the resource's hours; null = use the resource's hours as-is
   hours: WeeklyHours.nullable().default(null),
@@ -671,6 +703,8 @@ export function normalizeRedirectPath(input: string): string {
 export const Settings = z.object({
   live: LiveConfig.default({}),
   calendar: CalendarSettings.default({}),
+  mobileAccess: MobileAccess.default({}),
+  monitoring: Monitoring.default({}),
   // push notification automation (lib/push); the feature itself is acms({ mobile: { push } })
   push: PushSettings.default({}),
   siteTitle: z.string().default('My Site'),

package/src/pages/admin/calendar/resources/link.astro

@@ -80,6 +80,7 @@ if (Astro.request.method === 'POST') {
     minNotice: int(form.get('minNoticeH'), 0, 24 * 60, 2) * 60,
     maxAdvance: int(form.get('maxAdvance'), 1, 730, 90),
     perDayCap: int(form.get('perDayCap'), 0, 100, 0),
+    changeCutoff: int(form.get('changeCutoff'), 0, 8760, 0),
     hours: form.get('customHours') ? hoursFromForm(form, 'lh') : null,
     approval, approvalRules,
     // legacy flag for older API readers; approval is what decides
@@ -183,6 +184,7 @@ const effective = linkApproval(view, settings).mode;
           <label class="field"><span>Max per day <em class="hint">0 = no limit</em></span><input type="number" name="perDayCap" min="0" max="100" value={view.perDayCap} /></label>
           <label class="field"><span>Book at least (hours ahead)</span><input type="number" name="minNoticeH" min="0" max="1440" value={Math.round(view.minNotice / 60)} /></label>
           <label class="field"><span>Book up to (days ahead)</span><input type="number" name="maxAdvance" min="1" max="730" value={view.maxAdvance} /></label>
+          <label class="field"><span>Guests can change until (hours before) <em class="hint">0 = any time</em></span><input type="number" name="changeCutoff" min="0" max="8760" value={view.changeCutoff} /></label>
         </div>
       </section>
 

package/src/pages/admin/mobile.astro

@@ -1,8 +1,10 @@
 ---
 import Admin from '../../layouts/Admin.astro';
+import AppAccess from '../../components/AppAccess';
 import MobileApp from '../../components/MobileApp';
 import { getRepo } from '../../lib/repo';
 import { requireSession } from '../../lib/api';
+import { PUSH } from '../../lib/push/config';
 const repo = await getRepo(Astro.locals);
 try { await requireSession(Astro.request, Astro.cookies, repo, true); }
 catch { return new Response('Owner access is required.', { status: 403 }); }
@@ -11,8 +13,10 @@ catch { return new Response('Owner access is required.', { status: 403 }); }
   <div class="page-head">
     <div>
       <h1>Mobile app</h1>
-      <p class="sub">Notifications for people who installed your app.</p>
+      <p class="sub">What your app can do on this site{PUSH.enabled ? ', and notifications for people who installed it' : ''}.</p>
     </div>
   </div>
-  <MobileApp client:only="react" />
+  <AppAccess client:only="react" />
+  {PUSH.enabled && <h2 class="section-title">Notifications</h2>}
+  {PUSH.enabled && <MobileApp client:only="react" />}
 </Admin>

package/src/pages/admin/settings.astro

@@ -1,6 +1,7 @@
 ---
 import Admin from '../../layouts/Admin.astro';
 import AiSettings from '../../components/AiSettings';
+import MonitoringSettings from '../../components/MonitoringSettings';
 import { getRepo } from '../../lib/repo';
 import { validateSession, OWNER_ENV, SESSION_COOKIE } from '../../lib/auth';
 import { invalidateRedirectCache } from '../../middleware';
@@ -227,6 +228,7 @@ const groups = [
     { id: 'ai-agents', label: 'AI & agents', terms: 'ai agents openai custom kimi deepseek cli proxy cpamc tailscale mcp' },
     { id: 'analytics', label: 'Analytics', terms: 'analytics umami replay meta pixel tiktok tracking' },
     { id: 'code', label: 'Code injection', terms: 'code injection head footer scripts' },
+    { id: 'monitoring', label: 'Monitoring', terms: 'monitoring uptime kuma health status down alerts heartbeat scheduler' },
   ] }] : []),
   { label: 'Advanced', items: [
     ...(isOwner ? [{ id: 'import', label: 'Import & export', terms: 'import export ghost wordpress migrate migration move content' }] : []),
@@ -570,6 +572,16 @@ const groups = [
 
       {isOwner && <section class="scard" id="ai-agents"><header class="scard-head"><a class="scard-back" href="#" aria-label="All settings">←</a><div class="grow"><h2>AI &amp; agents</h2></div><a class="btn" href="/admin/ai">Import document</a></header><AiSettings client:load /></section>}
 
+      {isOwner && (
+        <section class="scard" id="monitoring">
+          <header class="scard-head">
+            <a class="scard-back" href="#" aria-label="All settings"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M15 6l-6 6 6 6" /></svg></a>
+            <div class="grow"><h2>Monitoring</h2><p>Uptime Kuma watches the website, the app APIs and the scheduler, and alerts you when one stops.</p></div>
+          </header>
+          <MonitoringSettings client:visible />
+        </section>
+      )}
+
       <div class="set-group-title">Advanced</div>
 
       {isOwner && (

package/src/pages/api/health.ts

@@ -0,0 +1,17 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../lib/repo';
+import { healthReport } from '../../lib/monitoring';
+
+// Public health check for uptime monitors (Uptime Kuma): 200 when the site
+// works, 503 when the database or the scheduler is down. Names only which part
+// failed; no settings, versions or secrets. Cached 10 s.
+const headers = { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' };
+export const GET: APIRoute = async ({ locals }) => {
+  try {
+    const report = await healthReport(await getRepo(locals), locals);
+    return Response.json(report, { status: report.status === 'down' ? 503 : 200, headers });
+  } catch {
+    return Response.json({ status: 'down', checks: { database: 'down', scheduler: 'stalled', email: 'off' }, checkedAt: new Date().toISOString() }, { status: 503, headers });
+  }
+};
+export const HEAD: APIRoute = async (c) => { const r = await GET(c); return new Response(null, { status: r.status, headers }); };

package/src/pages/api/mobile/access.ts

@@ -0,0 +1,22 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../lib/repo';
+import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
+import { AppAccessInput, appAccessAction, appAccessState } from '../../../lib/mobile/access-admin';
+
+// Admin → Mobile app → App access (owner only, this site's admin only).
+export const GET: APIRoute = async ({ request, cookies, locals }) => {
+  try {
+    const repo = await getRepo(locals);
+    await requireSession(request, cookies, repo, true);
+    return json(await appAccessState(repo, locals));
+  } catch (e) { return apiError(e); }
+};
+export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
+  try {
+    const repo = await getRepo(locals);
+    await requireSession(request, cookies, repo, true);
+    if (request.headers.get('origin') !== url.origin) throw new ApiError(403, 'Change this from this site’s admin.');
+    await appAccessAction(repo, AppAccessInput.parse(await readJson(request, 5_000)));
+    return json(await appAccessState(repo, locals));
+  } catch (e) { return apiError(e); }
+};

package/src/pages/api/monitoring.ts

@@ -0,0 +1,22 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../lib/repo';
+import { ApiError, apiError, json, readJson, requireSession } from '../../lib/api';
+import { MonitoringInput, monitoringAction, monitoringState } from '../../lib/monitoring';
+
+// Settings → Monitoring (owner only, this site's admin only).
+export const GET: APIRoute = async ({ request, cookies, locals }) => {
+  try {
+    const repo = await getRepo(locals);
+    await requireSession(request, cookies, repo, true);
+    return json(await monitoringState(repo, locals));
+  } catch (e) { return apiError(e); }
+};
+export const POST: APIRoute = async ({ request, cookies, locals, url }) => {
+  try {
+    const repo = await getRepo(locals);
+    await requireSession(request, cookies, repo, true);
+    if (request.headers.get('origin') !== url.origin) throw new ApiError(403, 'Change this from this site’s admin.');
+    await monitoringAction(repo, MonitoringInput.parse(await readJson(request, 5_000)), locals);
+    return json(await monitoringState(repo, locals));
+  } catch (e) { return apiError(e); }
+};

package/src/pages/api/ops/status.ts

@@ -17,7 +17,8 @@ export const GET: APIRoute = async ({ request, locals }) => {
     return Response.json({ ok: canonicalHttps && secretsPresent && schedulerHealthy,
       database: env?.DB ? 'd1' : 'sqlite', media: env?.MEDIA ? 'r2' : 'filesystem',
       canonicalHttps, secretsPresent, schedulerHealthy, scheduler,
-    }, { headers });
+    // 503 when anything is wrong, so a plain HTTP monitor sees it too
+    }, { status: canonicalHttps && secretsPresent && schedulerHealthy ? 200 : 503, headers });
   } catch { return Response.json({ ok: false, error: 'Unable to check deployment.' }, { status: 503, headers }); }
 };
 // Explicit authenticated probe; writes only a random short-lived object.

package/src/pages/api/v1/admin/bookings/[id]/[action].ts

@@ -1,11 +1,17 @@
 import { editorRoute, logWrite } from '../../../../../../lib/editor/http';
 import { BookingActionInput, bookingAction } from '../../../../../../lib/editor/bookings';
+import { RescheduleInput, staffReschedule } from '../../../../../../lib/editor/schedule';
 import { methodNotAllowed } from '../../../../../../lib/mobile/http';
 import { readJson } from '../../../../../../lib/api';
 export { preflight as OPTIONS } from '../../../../../../lib/mobile/http';
-// approve | decline | cancel — the guest is emailed, as from Admin → Bookings
+// approve | decline | cancel | reschedule — the guest is emailed, as from Admin → Bookings
 export const POST = editorRoute(async (c) => {
   const { id, action } = c.context.params;
+  if (action === 'reschedule') {
+    const result = await staffReschedule(c, id!, RescheduleInput.parse(await readJson(c.context.request, 5_000)));
+    await logWrite(c, 'booking-reschedule', `booking:${id}`);
+    return result;
+  }
   const body = c.context.request.headers.get('content-type') ? BookingActionInput.parse(await readJson(c.context.request, 5_000)) : {};
   const result = await bookingAction(c.repo, id!, action!, body, { url: c.context.url, locals: c.context.locals });
   await logWrite(c, `booking-${action}`, `booking:${id}`);

package/src/pages/api/v1/admin/bookings/index.ts

@@ -1,6 +1,14 @@
-import { editorRoute } from '../../../../../lib/editor/http';
+import { editorRoute, logWrite } from '../../../../../lib/editor/http';
 import { InboxQuery, inbox } from '../../../../../lib/editor/bookings';
+import { StaffBookingInput, staffBook } from '../../../../../lib/editor/schedule';
 import { methodNotAllowed, queryParams } from '../../../../../lib/mobile/http';
+import { readJson } from '../../../../../lib/api';
 export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
 export const GET = editorRoute(async ({ repo, context }) => inbox(repo, InboxQuery.parse(queryParams(context.url))));
-export const ALL = () => methodNotAllowed('GET, OPTIONS');
+// book on someone's behalf (the guest gets the usual emails)
+export const POST = editorRoute(async (c) => {
+  const b = await staffBook(c, StaffBookingInput.parse(await readJson(c.context.request, 50_000)));
+  await logWrite(c, 'booking-create', `booking:${b.id}`);
+  return b;
+}, { write: true, status: 201 });
+export const ALL = () => methodNotAllowed('GET, POST, OPTIONS');

package/src/pages/api/v1/admin/calendars/[id].ts

@@ -0,0 +1,16 @@
+import { editorRoute, logWrite } from '../../../../../lib/editor/http';
+import { CalendarPatch, deleteCalendarFor, updateCalendarFor } from '../../../../../lib/editor/schedule';
+import { methodNotAllowed } from '../../../../../lib/mobile/http';
+import { readJson } from '../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const PATCH = editorRoute(async (c) => {
+  const cal = await updateCalendarFor(c, c.context.params.id!, CalendarPatch.parse(await readJson(c.context.request, 10_000)));
+  await logWrite(c, 'calendar-update', `calendar:${cal.id}`);
+  return cal;
+}, { write: true });
+export const DELETE = editorRoute(async (c) => {
+  const cal = await deleteCalendarFor(c, c.context.params.id!);
+  await logWrite(c, 'calendar-delete', `calendar:${cal.id}`);
+  return cal;
+}, { write: true });
+export const ALL = () => methodNotAllowed('PATCH, DELETE, OPTIONS');

package/src/pages/api/v1/admin/calendars/index.ts

@@ -0,0 +1,12 @@
+import { editorRoute, logWrite } from '../../../../../lib/editor/http';
+import { CalendarBody, createCalendarFor, listCalendarsFor } from '../../../../../lib/editor/schedule';
+import { methodNotAllowed } from '../../../../../lib/mobile/http';
+import { readJson } from '../../../../../lib/api';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const GET = editorRoute(async (c) => listCalendarsFor(c));
+export const POST = editorRoute(async (c) => {
+  const cal = await createCalendarFor(c, CalendarBody.parse(await readJson(c.context.request, 10_000)));
+  await logWrite(c, 'calendar-create', `calendar:${cal.id}`);
+  return cal;
+}, { write: true, status: 201 });
+export const ALL = () => methodNotAllowed('GET, POST, OPTIONS');

package/src/pages/api/v1/admin/forms/[id]/responses.ts

@@ -0,0 +1,7 @@
+import { editorRoute } from '../../../../../../lib/editor/http';
+import { ResponsesQuery, formResponsesFor } from '../../../../../../lib/editor/site-data';
+import { methodNotAllowed, queryParams } from '../../../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../../../lib/mobile/http';
+// administrators and owners only: responses hold personal details
+export const GET = editorRoute(async (c) => formResponsesFor(c, c.context.params.id!, ResponsesQuery.parse(queryParams(c.context.url))));
+export const ALL = () => methodNotAllowed('GET, OPTIONS');

package/src/pages/api/v1/admin/forms/index.ts

@@ -0,0 +1,6 @@
+import { editorRoute } from '../../../../../lib/editor/http';
+import { listFormsFor } from '../../../../../lib/editor/site-data';
+import { methodNotAllowed } from '../../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const GET = editorRoute(async (c) => listFormsFor(c));
+export const ALL = () => methodNotAllowed('GET, OPTIONS');