@acms-subir/core 0.3.9 → 0.3.11

package/src/lib/mobile/schemas.ts

@@ -8,7 +8,7 @@ const Palette = z.object({ bg: str, ink: str, muted: str, line: str, accent: str
 export const Site = z.object({
   name: str, description: str, logo: str, logoDark: str, icon: str, menu: z.array(z.object({ label: str, href: str })),
   languages: z.object({ default: locale, locales: z.array(z.object({ code: str, name: str })) }),
-  features: z.object({ blog: z.array(z.object({ key: str, name: str, url: str })), calendar: bool, bookings: bool, search: bool }), apiVersion: z.literal(1),
+  features: z.object({ blog: z.array(z.object({ key: str, name: str, url: str })), calendar: bool, bookings: bool, search: bool, bookingChanges: bool, guestSignIn: bool, forms: bool, links: bool }), apiVersion: z.literal(1),
 });
 export const Theme = z.object({
   id: str, name: str, scheme: z.enum(['auto', 'light', 'dark']), colors: z.object({ light: Palette, dark: Palette }),
@@ -35,6 +35,57 @@ export const Event = CalEvent.pick({
 export const Events = z.object({ locale, timezone: str, from: date, to: date, pagination: Pagination,
   occurrences: z.array(z.object({ id: str, start: date, end: date, allDay: bool, event: Event })),
 });
+const Snippet = z.object({ text: str, highlights: z.array(z.object({ start: z.number().int(), end: z.number().int() })) });
+const ContentHit = ContentSummary.extend({ snippet: Snippet });
+export const SearchResults = z.object({ locale, query: str,
+  posts: z.array(ContentHit), pages: z.array(ContentHit),
+  events: z.array(z.object({ snippet: Snippet, occurrence: z.object({ start: date, end: date, allDay: bool }).nullable(), event: Event })),
+  more: z.object({ posts: bool, pages: bool, events: bool }),
+});
+const Icon = z.object({ type: z.enum(['svg', 'image', 'emoji']), value: str }).nullable();
+const ButtonStyle = { color: str.nullable(), textColor: str.nullable() };
+export const Links = z.object({
+  name: str, bio: str, avatar: str, url: str,
+  socials: z.array(z.object({ label: str, url: str, iconPath: str.nullable() })),
+  items: z.array(z.discriminatedUnion('kind', [
+    z.object({ id: str, kind: z.literal('link'), label: str, url: str, destination: str, icon: Icon, ...ButtonStyle }),
+    z.object({ id: str, kind: z.literal('email'), label: str, url: str, icon: Icon, ...ButtonStyle }),
+    z.object({ id: str, kind: z.literal('phone'), label: str, url: str, icon: Icon, ...ButtonStyle }),
+    z.object({ id: str, kind: z.literal('contact'), label: str, icon: Icon, ...ButtonStyle, contact: z.object({ firstName: str, lastName: str, organization: str, phone: str, email: str, url: str }) }),
+    z.object({ id: str, kind: z.literal('heading'), label: str }),
+    z.object({ id: str, kind: z.literal('text'), text: str }),
+    z.object({ id: str, kind: z.literal('spacer'), size: z.enum(['s', 'm', 'l']) }),
+    z.object({ id: str, kind: z.literal('live') }),
+    z.object({ id: str, kind: z.literal('embed'), url: str }),
+  ])),
+});
+export const Form = z.object({
+  id: str, version: str, title: str, intro: str, submitLabel: str, confirmation: str,
+  fields: z.array(z.object({
+    id: str, type: z.enum(['text', 'textarea', 'email', 'phone', 'number', 'select', 'checkbox', 'date', 'radio', 'checkboxes', 'url', 'consent', 'heading']),
+    label: str, required: bool, help: str, options: strings, placeholder: str, width: z.enum(['full', 'half']), allowOther: bool,
+  })),
+});
+export const FormReceipt = z.object({ received: z.literal(true), confirmation: str });
+const GuestChanges = z.object({ cancel: bool, reschedule: bool, cutoffHours: z.number().int(), closed: bool });
+export const ManagedBooking = z.object({
+  booking: z.object({
+    id: str, reference: str, kind: z.enum(['booking', 'rsvp']), status: z.enum(['pending', 'confirmed', 'declined', 'cancelled']),
+    start: date, end: date, allDay: bool, timezone: str, seats: z.number().int(), name: str, email: str, phone: str, answers: z.record(str), createdAt: date,
+  }),
+  title: str, location: str,
+  resource: z.object({ slug: str, name: str }).nullable(),
+  link: z.object({ slug: str, name: str, mode: z.enum(['slots', 'range', 'day']), lengths: z.array(z.number()) }).nullable(),
+  event: z.object({ slug: str, title: str, url: str }).nullable(),
+  manageUrl: str, can: GuestChanges,
+});
+export const GuestCodeSent = z.object({ sent: z.literal(true), expiresInMinutes: z.number().int() });
+export const GuestToken = z.object({ accessToken: str, tokenType: z.literal('Bearer'), email: str, idleDays: z.number().int() });
+export const GuestBookings = z.object({ email: str, pagination: Pagination, items: z.array(z.object({
+  id: str, reference: str, kind: z.enum(['booking', 'rsvp']), status: z.enum(['pending', 'confirmed', 'declined', 'cancelled']),
+  start: date, end: date, seats: z.number().int(), title: str, manageToken: str, manageUrl: str, can: GuestChanges,
+})) });
+export const GuestSignedOut = z.object({ signedOut: z.literal(true) });
 export const Calendars = z.object({ calendars: z.array(Calendar.pick({ id: true, slug: true, name: true, color: true, description: true, kind: true, visibility: true }).extend({ feedUrl: str })) });
 export const Resources = z.object({ pagination: Pagination, resources: z.array(z.object({
   id: str, slug: str, name: str, kind: str, description: str, capacity: z.number(), amenities: strings, photo: str, timezone: str, url: str,

package/src/lib/mobile/search.ts

@@ -0,0 +1,95 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import { CONTENT } from '../content';
+import { normalizePageLocale } from '../i18n';
+import { siteOrigin } from '../seo';
+import { SEARCH } from '../search-config';
+import { CALENDAR } from '../calendar/config';
+import { eventIsListed, featuredOccurrence } from '../calendar/events';
+import { localizeDoc } from '../translations';
+import { ApiError } from '../api';
+import { contentDto } from './content';
+import { publicEventDto } from './calendar';
+import { queryParams } from './http';
+import { localeQuery, mobileLocale } from './locale';
+
+// One query across posts, pages and events for an app's search screen: the
+// same FTS index and ranking as the website's search box. Each group holds
+// the top `limit` matches; `more` says a group has further matches, which
+// apps page through with /content?q= (or /events?q=, date-ordered in a window,
+// matching the same index plus title/excerpt/location).
+
+const TYPES = ['post', 'page', 'event'] as const;
+export const searchQuery = z.object({
+  q: z.string().trim().min(1).max(100),
+  types: z.string().max(40).optional()
+    .transform((v, ctx) => {
+      const list = v ? v.split(',').map((t) => t.trim()).filter(Boolean) : [...TYPES];
+      const bad = list.find((t) => !(TYPES as readonly string[]).includes(t));
+      if (bad) { ctx.addIssue({ code: 'custom', message: 'Use a comma-separated list of post, page and event.' }); return z.NEVER; }
+      return list as (typeof TYPES)[number][];
+    }),
+  collection: z.string().min(1).max(80).optional(),
+  limit: z.coerce.number().int().min(1).max(20).default(5),
+  locale: localeQuery,
+}).strict();
+
+const MARK = /<mark>(.*?)<\/mark>/g;
+const decode = (s: string) => s.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&');
+/** The repo's safe-HTML snippet as plain text plus the matched ranges. */
+export function plainSnippet(html: string) {
+  let text = '';
+  const highlights: { start: number; end: number }[] = [];
+  let last = 0;
+  for (const m of html.matchAll(MARK)) {
+    text += decode(html.slice(last, m.index));
+    const start = text.length;
+    text += decode(m[1]);
+    highlights.push({ start, end: text.length });
+    last = m.index! + m[0].length;
+  }
+  return { text: text + decode(html.slice(last)), highlights };
+}
+
+export async function search(repo: ContentRepository, url: URL) {
+  if (!SEARCH.enabled) throw new ApiError(404, 'This feature is disabled.');
+  const q = searchQuery.parse(queryParams(url));
+  if (q.collection && !Object.hasOwn(CONTENT.collections, q.collection)) throw new ApiError(400, 'Unknown collection.');
+  const locale = mobileLocale(q.locale);
+  const [found, settings, calendars] = await Promise.all([
+    repo.searchPublished(q.q, { locale: normalizePageLocale(locale ?? ''), limit: q.limit + 1, collections: q.collection ? [q.collection] : Object.keys(CONTENT.collections) }),
+    repo.getSettings(), repo.listCalendars(),
+  ]);
+  const origin = siteOrigin(settings, url);
+  const want = new Set(q.types);
+  const posts = want.has('post') ? found.posts : [];
+  // a collection narrows the search to that collection's posts
+  const pages = want.has('page') && !q.collection ? found.pages : [];
+  const all = new Map(calendars.map((c) => [c.id, c]));
+  const listed = new Map(calendars.filter((c) => c.visibility === 'public').map((c) => [c.id, c]));
+  let events = want.has('event') && CALENDAR.enabled && !q.collection ? found.events.filter(({ doc }) => eventIsListed(doc, all)) : [];
+  // the index ranks before visibility is known: if unlisted events filled the
+  // first batch, look deeper once (the repo's 200-row cap) for listed ones
+  if (want.has('event') && CALENDAR.enabled && !q.collection && events.length <= q.limit && found.events.length >= q.limit + 1) {
+    const deeper = await repo.searchPublished(q.q, { locale: normalizePageLocale(locale ?? ''), limit: 200, collections: [] });
+    events = deeper.events.filter(({ doc }) => eventIsListed(doc, all));
+  }
+  const now = Date.now();
+  const iso = (n: number) => new Date(n).toISOString();
+  return {
+    locale, query: q.q,
+    posts: posts.slice(0, q.limit).map(({ doc, snippet }) => ({ ...contentDto(doc, 'post', origin, false, locale), snippet: plainSnippet(snippet) })),
+    pages: pages.slice(0, q.limit).map(({ doc, snippet }) => ({ ...contentDto(doc, 'page', origin, false, locale), snippet: plainSnippet(snippet) })),
+    events: events.slice(0, q.limit).map(({ doc, snippet }) => {
+      const e = localizeDoc(doc, locale ?? undefined);
+      const o = featuredOccurrence(e, settings, now);
+      return {
+        snippet: plainSnippet(snippet),
+        // the next occurrence, or the latest one when the event is over
+        occurrence: o ? { start: iso(o.start), end: iso(o.end), allDay: o.allDay } : null,
+        event: publicEventDto(e, origin, listed, settings.timezone, locale),
+      };
+    }),
+    more: { posts: posts.length > q.limit, pages: pages.length > q.limit, events: events.length > q.limit },
+  };
+}

package/src/lib/mobile/site.ts

@@ -9,8 +9,9 @@ import { resolveDesign } from '../theme';
 import { darkPalette } from '../themeTokens';
 import { safeUrl } from './content';
 import { queryParams } from './http';
+import { guestSignInReady } from './guest';
 
-export async function getSite(repo: ContentRepository, url: URL) {
+export async function getSite(repo: ContentRepository, url: URL, _id = '', locals?: unknown) {
   z.object({}).strict().parse(queryParams(url));
   const [settings, nav, pages] = await Promise.all([repo.getSettings(), repo.listNavItems(), repo.listPages()]);
   const origin = siteOrigin(settings, url);
@@ -26,7 +27,12 @@ export async function getSite(repo: ContentRepository, url: URL) {
     logo: safeUrl(settings.siteLogo, origin), logoDark: safeUrl(settings.siteLogoDark, origin), icon: safeUrl(settings.siteFavicon, origin),
     menu: menu.map(n => ({ label: n.label, href: safeUrl(n.url, origin, true) })),
     languages: { default: I18N.defaultLocale || null, locales: I18N.locales.map(code => ({ code, name: localeName(code, true) })) },
-    features: { blog: Object.entries(CONTENT.collections).map(([key, c]) => ({ key, name: c.plural, url: safeUrl(c.base, origin) })), calendar: CALENDAR.enabled, bookings: bookingsEnabled(), search: SEARCH.enabled },
+    features: {
+      blog: Object.entries(CONTENT.collections).map(([key, c]) => ({ key, name: c.plural, url: safeUrl(c.base, origin) })), calendar: CALENDAR.enabled, bookings: bookingsEnabled(), search: SEARCH.enabled,
+      // Admin → Mobile app → App access
+      bookingChanges: CALENDAR.enabled && settings.mobileAccess.bookingChanges, guestSignIn: await guestSignInReady(repo, locals),
+      forms: settings.mobileAccess.forms, links: settings.mobileAccess.links,
+    },
     apiVersion: 1,
   };
 }

package/src/lib/monitoring.ts

@@ -0,0 +1,171 @@
+import type { ContentRepository } from './repo/types';
+import type { Monitoring } from './schema';
+import { resolveConfig, runtimeValue } from './email/config';
+import { z } from 'zod';
+import { ApiError } from './api';
+import { fetchPublicUrl } from './net';
+
+// Uptime monitoring with Uptime Kuma: a public health check Kuma polls
+// (GET /api/health), a heartbeat the scheduler pushes to a Kuma push monitor
+// after every run, and a reader for a Kuma status page (Settings → Monitoring).
+
+/** the scheduler runs every minute; three missed runs means it stopped */
+export const SCHEDULER_STALE_MS = 3 * 60_000;
+/** queued mail this far past its send time means the queue is stuck */
+const EMAIL_STUCK_MS = 15 * 60_000;
+const CACHE_MS = 10_000;
+
+export type CheckState = 'ok' | 'down' | 'stalled' | 'stuck' | 'off';
+export interface HealthReport {
+  /** down: the site can't do its job (503); degraded: email is stuck (200) */
+  status: 'ok' | 'degraded' | 'down';
+  checks: { database: CheckState; scheduler: CheckState; email: CheckState };
+  checkedAt: string;
+}
+
+let cached: { at: number; report: HealthReport } | null = null;
+/** test hook */
+export const resetHealthCache = () => { cached = null; };
+
+export async function healthReport(repo: ContentRepository, locals?: unknown, now = Date.now()): Promise<HealthReport> {
+  if (cached && now - cached.at < CACHE_MS) return cached.report;
+  const checks: HealthReport['checks'] = { database: 'down', scheduler: 'stalled', email: 'off' };
+  try {
+    await repo.getSettings();
+    checks.database = 'ok';
+    const run = await repo.email.schedulerStatus();
+    checks.scheduler = run && now - run.finishedAt < SCHEDULER_STALE_MS ? 'ok' : 'stalled';
+    const email = resolveConfig(await repo.email.config(), locals);
+    if (!email.error && email.provider !== 'none' && email.config.enabled) checks.email = await repo.email.stuckJobs(now - EMAIL_STUCK_MS) > 0 ? 'stuck' : 'ok';
+  } catch { /* whatever didn't answer stays failed */ }
+  const status = checks.database !== 'ok' || checks.scheduler !== 'ok' ? 'down' : checks.email === 'stuck' ? 'degraded' : 'ok';
+  const report: HealthReport = { status, checks, checkedAt: new Date(now).toISOString() };
+  cached = { at: now, report };
+  return report;
+}
+
+// ---- scheduler heartbeat ----------------------------------------------------
+
+const PUSH = /^https?:\/\/[^/?#\s]+(?:\/[^?#\s]*)?\/api\/push\/[A-Za-z0-9_-]{4,100}$/;
+/** a Kuma push URL without its query (Kuma shows "?status=up&msg=OK&ping=" after it) */
+export function normalizePushUrl(raw: string): string | null {
+  const url = raw.trim().split('?')[0].replace(/\/+$/, '');
+  return url === '' ? '' : PUSH.test(url) ? url : null;
+}
+/** UPTIME_PUSH_URL wins over the admin setting */
+export function pushUrlFor(monitoring: Partial<Monitoring> | undefined, locals?: unknown) {
+  return normalizePushUrl(runtimeValue('UPTIME_PUSH_URL', locals)) || normalizePushUrl(monitoring?.pushUrl ?? '') || '';
+}
+
+/**
+ * Tells the Kuma push monitor the scheduler ran (status=down names the
+ * failed jobs). Never throws and gives up after 5 s: a slow or missing Kuma
+ * must not affect the site.
+ */
+export async function pushHeartbeat(url: string, report: { ok: boolean; startedAt: number; finishedAt: number; jobs: Record<string, { ok: boolean }> }, message?: string) {
+  if (!url) return false;
+  const failed = Object.entries(report.jobs).filter(([, j]) => !j.ok).map(([name]) => name);
+  const q = new URLSearchParams({
+    status: report.ok ? 'up' : 'down',
+    msg: message ?? (report.ok ? `${Object.keys(report.jobs).length} jobs ok` : `failed: ${failed.join(', ')}`),
+    ping: String(Math.max(0, report.finishedAt - report.startedAt)),
+  });
+  try {
+    const res = await fetch(`${url}?${q}`, { signal: AbortSignal.timeout(5000), headers: { 'User-Agent': 'acms-scheduler' } });
+    const body = await res.json().catch(() => null) as { ok?: boolean } | null;
+    return res.ok && body?.ok !== false;
+  } catch { return false; }
+}
+
+// ---- status page (admin card) -----------------------------------------------
+
+/** https://kuma.example/status/my-site → { origin, slug } */
+export function parseStatusPage(raw: string): { origin: string; slug: string } | null {
+  try {
+    const u = new URL(raw.trim());
+    const m = /^\/status\/([A-Za-z0-9_-]{1,100})\/?$/.exec(u.pathname);
+    return /^https?:$/.test(u.protocol) && m ? { origin: u.origin, slug: m[1] } : null;
+  } catch { return null; }
+}
+
+export interface MonitorStatus { id: number; name: string; status: 'up' | 'down' | 'pending' | 'maintenance' | 'unknown'; since: string | null; uptime24h: number | null; message: string; recent: ('up' | 'down' | 'pending' | 'maintenance')[] }
+const STATES = ['down', 'up', 'pending', 'maintenance'] as const;
+// Kuma writes "2026-10-03 12:00:00" in UTC without a zone
+const iso = (t: string) => { const n = Date.parse(/[zZ]|[+-]\d\d:?\d\d$/.test(t) ? t : `${t.replace(' ', 'T')}Z`); return Number.isFinite(n) ? new Date(n).toISOString() : null; };
+let pageCache: { key: string; at: number; data: MonitorStatus[] } | null = null;
+
+/** the monitors on a public Kuma status page with their latest beats (cached 60 s) */
+export async function readStatusPage(raw: string, now = Date.now()): Promise<MonitorStatus[] | null> {
+  const page = parseStatusPage(raw);
+  if (!page) return null;
+  if (pageCache && pageCache.key === raw && now - pageCache.at < 60_000) return pageCache.data;
+  const get = async (path: string) => {
+    const r = await fetchPublicUrl(`${page.origin}${path}`, { accept: 'application/json', userAgent: 'acms-monitoring', timeoutMs: 6000 });
+    return r && r.res.ok ? await r.res.json().catch(() => null) : null;
+  };
+  const [info, beats] = await Promise.all([get(`/api/status-page/${page.slug}`), get(`/api/status-page/heartbeat/${page.slug}`)]);
+  if (!info || !beats) return null;
+  const monitors = ((info.publicGroupList ?? []) as { monitorList?: { id: number; name: string }[] }[]).flatMap((g) => g.monitorList ?? []);
+  const data = monitors.map((m): MonitorStatus => {
+    const list = ((beats.heartbeatList?.[m.id] ?? []) as { status: number; time: string; msg?: string }[]).slice(-30);
+    const last = list[list.length - 1];
+    const state = (n: number) => STATES[n] ?? 'pending';
+    // when the current state began, if the change is among the recent beats
+    // (all beats alike: it began before them, so the duration is unknown)
+    let since: string | null = null;
+    if (last) { let i = list.length - 1; while (i > 0 && list[i - 1].status === last.status) i--; if (i > 0) since = iso(list[i].time); }
+    const uptime = beats.uptimeList?.[`${m.id}_24`];
+    return {
+      id: m.id, name: m.name, status: last ? state(last.status) : 'unknown', since,
+      uptime24h: typeof uptime === 'number' ? uptime : null, message: last?.msg ?? '', recent: list.map((b) => state(b.status)),
+    };
+  });
+  pageCache = { key: raw, at: now, data };
+  return data;
+}
+
+// ---- Settings → Monitoring (owner) --------------------------------------------
+
+/** "https://kuma.example/api/push/Xk29…": enough to recognise, not to use */
+const masked = (url: string) => (url ? url.replace(/(\/api\/push\/)(.{4}).*$/, '$1$2…') : '');
+export async function monitoringState(repo: ContentRepository, locals?: unknown) {
+  const settings = await repo.getSettings();
+  const m = settings.monitoring;
+  const fromEnv = !!normalizePushUrl(runtimeValue('UPTIME_PUSH_URL', locals));
+  const run = await repo.email.schedulerStatus();
+  const monitors = m.statusPage ? await readStatusPage(m.statusPage) : null;
+  return {
+    pushUrl: masked(pushUrlFor(m, locals)), pushFromEnv: fromEnv, statusPage: m.statusPage,
+    // null with a statusPage set: Kuma didn't answer or the page doesn't exist
+    monitors, lastRun: run ? new Date(run.finishedAt).toISOString() : null,
+    health: await healthReport(repo, locals),
+  };
+}
+export type MonitoringState = Awaited<ReturnType<typeof monitoringState>>;
+
+export const MonitoringInput = z.discriminatedUnion('action', [
+  z.object({ action: z.literal('save'), pushUrl: z.string().max(500).optional(), statusPage: z.string().max(500).optional() }).strict(),
+  z.object({ action: z.literal('test') }).strict(),
+]);
+export async function monitoringAction(repo: ContentRepository, input: z.infer<typeof MonitoringInput>, locals?: unknown) {
+  const settings = await repo.getSettings();
+  if (input.action === 'test') {
+    const url = pushUrlFor(settings.monitoring, locals);
+    if (!url) throw new ApiError(400, 'Add the push URL first.');
+    const now = Date.now();
+    if (!await pushHeartbeat(url, { ok: true, startedAt: now, finishedAt: now, jobs: {} }, 'Test from ACMS admin')) throw new ApiError(502, 'Kuma didn’t accept the test. Check the push URL and that the monitor is active.');
+    return;
+  }
+  const next = { ...settings.monitoring };
+  if (input.pushUrl !== undefined) {
+    const url = normalizePushUrl(input.pushUrl);
+    if (url === null) throw new ApiError(400, 'Paste the push URL from the Kuma push monitor (…/api/push/…).');
+    next.pushUrl = url;
+  }
+  if (input.statusPage !== undefined) {
+    const page = input.statusPage.trim();
+    if (page && !parseStatusPage(page)) throw new ApiError(400, 'Paste the status page address (…/status/your-page).');
+    next.statusPage = page;
+  }
+  await repo.updateSettings({ monitoring: next });
+}

package/src/lib/net.ts

@@ -1,20 +1,88 @@
 // SSRF guard shared by every server-side fetch of a user-supplied URL (the
 // bookmark card's metadata scrape, the calendar card's ICS feed): block
-// loopback, RFC1918, CGNAT, link-local and IPv6 ULA hosts so a pasted URL —
-// or a redirect hop — can never reach the Worker's own network.
-export function isPrivateHost(hostname: string): boolean {
-  const h = hostname.toLowerCase();
-  if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal')) return true;
-  const v4 = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+// loopback, RFC1918, CGNAT, link-local, multicast/reserved and IPv6 ULA hosts
+// so a pasted URL — or a redirect hop — can never reach the server's own network.
+
+function v4Private(a: number, b: number): boolean {
+  return (
+    a === 0 || a === 10 || a === 127 || a >= 224 || (a === 100 && b >= 64 && b <= 127) ||
+    (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) ||
+    (a === 198 && (b === 18 || b === 19))
+  );
+}
+
+// eight 16-bit groups, or null when not an IPv6 address (zone ids dropped)
+function v6Groups(ip: string): number[] | null {
+  let s = ip.split('%')[0];
+  const v4 = s.match(/:(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    const o = v4.slice(1).map(Number);
+    if (o.some((n) => n > 255)) return null;
+    s = `${s.slice(0, v4.index! + 1)}${((o[0] << 8) | o[1]).toString(16)}:${((o[2] << 8) | o[3]).toString(16)}`;
+  }
+  const parts = s.split('::');
+  if (parts.length > 2) return null;
+  const head = parts[0] ? parts[0].split(':') : [];
+  const tail = parts.length === 2 && parts[1] ? parts[1].split(':') : [];
+  const fill = 8 - head.length - tail.length;
+  if (parts.length === 1 ? fill !== 0 : fill < 1) return null;
+  const groups = [...head, ...Array(parts.length === 2 ? fill : 0).fill('0'), ...tail];
+  if (!groups.every((g) => /^[0-9a-f]{1,4}$/i.test(g))) return null;
+  return groups.map((g) => parseInt(g, 16));
+}
+
+/** true for any IP literal that isn't a public unicast address; non-IPs count as private */
+export function isPrivateAddress(ip: string): boolean {
+  const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
   if (v4) {
-    const [a, b] = [Number(v4[1]), Number(v4[2])];
-    return (
-      a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b <= 127) ||
-      (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168)
-    );
+    const o = v4.slice(1).map(Number);
+    return o.some((n) => n > 255) || v4Private(o[0], o[1]);
   }
-  if (h.includes(':')) return h === '::1' || h.startsWith('fe80') || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('[');
-  return false;
+  const g = v6Groups(ip.replace(/^\[|\]$/g, ''));
+  if (!g) return true;
+  // IPv4-mapped (::ffff:a.b.c.d), IPv4-compatible (::a.b.c.d) and NAT64 (64:ff9b::/96) carry an IPv4 address
+  const embedded = (g.slice(0, 5).every((n) => n === 0) && (g[5] === 0xffff || g[5] === 0))
+    || (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every((n) => n === 0));
+  if (embedded && (g[6] || g[7] || g[5] === 0xffff)) return v4Private(g[6] >> 8, g[6] & 0xff);
+  return (
+    g.every((n) => n === 0) || (g.slice(0, 7).every((n) => n === 0) && g[7] === 1) ||
+    (g[0] & 0xfe00) === 0xfc00 || (g[0] & 0xffc0) === 0xfe80 || (g[0] & 0xffc0) === 0xfec0 || (g[0] & 0xff00) === 0xff00
+  );
+}
+
+const isIp = (h: string) => /^\d{1,3}(\.\d{1,3}){3}$/.test(h) || h.includes(':');
+const bare = (hostname: string) => hostname.toLowerCase().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+
+/** literal check only: names that are private by convention, and private IP literals */
+export function isPrivateHost(hostname: string): boolean {
+  const h = bare(hostname);
+  if (!h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal')) return true;
+  return isIp(h) && isPrivateAddress(h);
+}
+
+type Lookup = (host: string, opts: { all: true; verbatim: true }) => Promise<{ address: string }[]>;
+let dnsLookup: Promise<Lookup | null> | undefined;
+// Workers have no usable node:dns, and their fetch can't reach private
+// networks anyway; there (or wherever the import fails) only the literal check runs
+const loadLookup = () => (dnsLookup ??= typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers'
+  ? Promise.resolve(null)
+  : import(/* @vite-ignore */ 'node:dns/promises').then((m) => m.lookup as unknown as Lookup, () => null));
+
+/**
+ * isPrivateHost, plus (on Node) true when the name resolves to ANY private
+ * address — a public name pointing at 127.0.0.1 or 169.254.169.254. fetch
+ * resolves again and can't be pinned to the checked IP, so a rebinding DNS
+ * server can still race this: it narrows the window, it doesn't close it. A
+ * failed lookup passes (fetch's own lookup will fail the same way).
+ */
+export async function resolvesToPrivate(hostname: string): Promise<boolean> {
+  if (isPrivateHost(hostname)) return true;
+  const h = bare(hostname);
+  if (isIp(h)) return false;
+  const lookup = await loadLookup();
+  if (!lookup) return false;
+  const addrs = await lookup(h, { all: true, verbatim: true }).catch((): { address: string }[] => []);
+  return addrs.some((a) => isPrivateAddress(a.address));
 }
 
 // Fetch that follows redirects manually so EVERY hop is re-checked against the
@@ -32,7 +100,7 @@ export async function fetchPublicUrl(
     } catch {
       return null;
     }
-    if (!/^https?:$/.test(u.protocol) || isPrivateHost(u.hostname)) return null;
+    if (!/^https?:$/.test(u.protocol) || await resolvesToPrivate(u.hostname)) return null;
     const res = await fetch(u.href, {
       redirect: 'manual',
       signal: AbortSignal.timeout(init.timeoutMs ?? 8000),

package/src/lib/repo/migrate-runner.ts

@@ -0,0 +1,96 @@
+import { MIGRATIONS, MIGRATIONS_TABLE } from './migrations';
+
+// Applies pending schema migrations under a database lock. Shared by the app
+// (first request after a deploy — the fallback) and `acms migrate` (Docker
+// entrypoint, before `wrangler deploy`), which runs a bundled copy of this
+// file (cli/migrations.generated.mjs), so the two can never disagree.
+
+export interface MigrationDriver {
+  all(sql: string, args?: unknown[]): Promise<Record<string, unknown>[]>;
+  run(sql: string, args?: unknown[]): Promise<void>;
+  batch(stmts: Array<{ sql: string; args?: unknown[] }>): Promise<void>;
+}
+
+export const MIGRATION_LOCK_TABLE = `CREATE TABLE IF NOT EXISTS migration_lock (
+  id INTEGER PRIMARY KEY CHECK (id = 1), owner TEXT NOT NULL, expires_at INTEGER NOT NULL
+)`;
+// a crashed migrator's lock expires; long enough for a big table rebuild
+const LOCK_TTL_MS = 10 * 60_000;
+
+export interface MigrationResult {
+  from: number; to: number; applied: number[];
+  /** set when a refused version is pending: nothing was applied, the site will migrate itself on start */
+  deferred?: number;
+}
+export interface MigrateOptions {
+  /** how long to wait for another migrator before giving up (ms) */
+  waitMs?: number;
+  /** versions this runner can't finish on an existing database (the CLI can't rebuild search for v21) */
+  refuse?: number[];
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+  log?: (message: string) => void;
+}
+
+export class MigrationLockTimeout extends Error {}
+
+async function appliedVersion(db: MigrationDriver): Promise<number> {
+  const r = (await db.all('SELECT MAX(version) AS v FROM migrations'))[0];
+  return Number(r?.v ?? 0);
+}
+
+export async function pendingMigrations(db: MigrationDriver) {
+  await db.run(MIGRATIONS_TABLE);
+  let applied = await appliedVersion(db);
+  // Pre-migrations DB: the baseline tables already exist, count v1 as applied
+  if (applied === 0 && (await db.all("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'pages'")).length) applied = 1;
+  return { applied, pending: MIGRATIONS.filter((m) => m.version > applied) };
+}
+
+export async function runMigrations(db: MigrationDriver, opts: MigrateOptions = {}): Promise<MigrationResult> {
+  const now = opts.now ?? Date.now;
+  const sleep = opts.sleep ?? ((ms: number) => new Promise((r) => setTimeout(r, ms)));
+  // the common case (nothing to do) takes no lock and writes nothing
+  const first = await pendingMigrations(db);
+  if (!first.pending.length) return { from: first.applied, to: first.applied, applied: [] };
+  // a brand-new database has nothing to rebuild, so only old ones are refused
+  const refused = first.applied > 0 && first.pending.find((m) => opts.refuse?.includes(m.version));
+  if (refused) return { from: first.applied, to: first.applied, applied: [], deferred: refused.version };
+
+  await db.run(MIGRATION_LOCK_TABLE);
+  const owner = crypto.randomUUID();
+  const deadline = now() + (opts.waitMs ?? 60_000);
+  let waited = false;
+  for (;;) {
+    const t = now();
+    await db.run(
+      `INSERT INTO migration_lock (id, owner, expires_at) VALUES (1, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET owner = excluded.owner, expires_at = excluded.expires_at WHERE migration_lock.expires_at < ?`,
+      [owner, t + LOCK_TTL_MS, t],
+    );
+    const holder = (await db.all('SELECT owner FROM migration_lock WHERE id = 1'))[0];
+    if (holder?.owner === owner) break;
+    if (t >= deadline) throw new MigrationLockTimeout('Another process is migrating this database. Try again when it finishes.');
+    if (!waited) { opts.log?.('Waiting for another migration to finish…'); waited = true; }
+    await sleep(500);
+  }
+  try {
+    // someone else may have finished while we waited
+    const { applied, pending } = await pendingMigrations(db);
+    if (applied === 1 && !(await appliedVersion(db))) {
+      await db.run('INSERT INTO migrations (version, applied_at) VALUES (1, ?)', [now()]);
+    }
+    for (const m of pending) {
+      opts.log?.(`Applying migration ${m.version}`);
+      await db.batch([
+        ...m.statements.map((sql) => ({ sql })),
+        { sql: 'INSERT INTO migrations (version, applied_at) VALUES (?, ?)', args: [m.version, now()] },
+      ]);
+    }
+    return { from: applied, to: pending.length ? pending[pending.length - 1].version : applied, applied: pending.map((m) => m.version) };
+  } finally {
+    await db.run('DELETE FROM migration_lock WHERE id = 1 AND owner = ?', [owner]).catch(() => {});
+  }
+}
+
+export { MIGRATIONS, LATEST_VERSION } from './migrations';