@acms-subir/core 0.3.9 → 0.3.11

package/src/lib/repo/migrations.ts

@@ -19,6 +19,51 @@ export interface Migration {
   statements: string[];
 }
 
+// Columns whose change a visitor can see (v49 triggers bump content_version).
+// Left out on purpose: drafts and autosave bookkeeping (draft, updated_at,
+// revision counters), click counts, credentials, and staff-only settings.
+// Frozen with v49 — a later column joins by a new migration that recreates
+// that table's triggers (the cache test fails until every column is sorted).
+export const CONTENT_VERSION_COLUMNS: Record<string, string[]> = {
+  settings: ['site_title', 'tagline', 'links_name', 'links_bio', 'links_avatar', 'footer_text', 'active_theme', 'design_overrides', 'site_logo',
+    'site_url', 'site_favicon', 'site_cover', 'announcement', 'head_code', 'footer_code', 'timezone', 'locale', 'analytics', 'section_pages',
+    'live', 'push', 'calendar', 'site_logo_dark', 'mobile_access'],
+  pages: ['id', 'slug', 'title', 'status', 'is_home', 'blocks', 'seo_title', 'seo_desc', 'body_json', 'body_html', 'template', 'locale', 'translations'],
+  posts: ['id', 'slug', 'title', 'body', 'tags', 'cover', 'status', 'published_at', 'body_json', 'body_html', 'excerpt', 'cover_alt', 'seo_title',
+    'seo_desc', 'scheduled_at', 'author_id', 'featured', 'template', 'collection', 'translations'],
+  post_authors: ['post_id', 'author_id', 'ord'],
+  events: ['id', 'slug', 'title', 'body_json', 'body_html', 'excerpt', 'cover', 'cover_alt', 'seo_title', 'seo_desc', 'status', 'featured', 'tags',
+    'template', 'starts', 'ends', 'all_day', 'timezone', 'rrule', 'exdates', 'cancelled', 'location', 'cta', 'calendar_ids', 'fields', 'source_uid',
+    'start_at', 'end_at', 'published_at', 'scheduled_at', 'rsvp', 'translations', 'room_hold'],
+  calendars: ['id', 'slug', 'name', 'color', 'description', 'kind', 'feed_url', 'visibility', 'feed_token', 'ord'],
+  places: ['id', 'name', 'address', 'url', 'lat', 'lng', 'notes', 'is_default', 'map_image', 'map_image_dark', 'ord'],
+  resources: ['id', 'slug', 'name', 'kind', 'description', 'photo', 'capacity', 'amenities', 'timezone', 'hours', 'overrides', 'busy_feeds',
+    'visibility', 'show_on_calendar', 'feed_token', 'ord', 'place_id'],
+  booking_links: ['id', 'resource_id', 'slug', 'name', 'description', 'mode', 'duration', 'lengths', 'min_days', 'max_days', 'step', 'buffer_before',
+    'buffer_after', 'min_notice', 'max_advance', 'per_day_cap', 'hours', 'auto_confirm', 'visibility', 'ask_phone', 'questions', 'confirm_message',
+    'redirect_url', 'active', 'ord', 'approval', 'approval_rules', 'change_cutoff'],
+  links: ['id', 'label', 'url', 'icon', 'ord', 'kind', 'html', 'meta'],
+  nav_items: ['id', 'label', 'url', 'area', 'ord'],
+  tags: ['id', 'name', 'slug', 'description'],
+  media: ['id', 'key', 'filename', 'mime', 'width', 'height', 'size', 'alt', 'variants'],
+  redirects: ['id', 'from_path', 'to_path', 'code'],
+  users: ['id', 'name', 'email', 'role', 'bio', 'avatar', 'slug'],
+  forms: ['id', 'name', 'kind', 'purpose', 'status', 'definition'],
+};
+
+const BUMP_CONTENT_VERSION = 'UPDATE settings SET content_version = content_version + 1 WHERE id = 1;';
+function contentVersionTriggers(table: string, columns: string[]): string[] {
+  const changed = columns.map((c) => `OLD.${c} IS NOT NEW.${c}`).join(' OR ');
+  const update = `CREATE TRIGGER content_version_${table}_update AFTER UPDATE OF ${columns.join(', ')} ON ${table} WHEN ${changed} BEGIN ${BUMP_CONTENT_VERSION} END`;
+  // the settings row itself is created once and never deleted
+  if (table === 'settings') return [update];
+  return [
+    `CREATE TRIGGER content_version_${table}_insert AFTER INSERT ON ${table} BEGIN ${BUMP_CONTENT_VERSION} END`,
+    `CREATE TRIGGER content_version_${table}_delete AFTER DELETE ON ${table} BEGIN ${BUMP_CONTENT_VERSION} END`,
+    update,
+  ];
+}
+
 export const MIGRATIONS_TABLE = `CREATE TABLE IF NOT EXISTS migrations (
   version INTEGER PRIMARY KEY, applied_at INTEGER NOT NULL
 )`;
@@ -526,6 +571,65 @@ export const MIGRATIONS: Migration[] = [
     `CREATE TABLE form_submissions (id TEXT PRIMARY KEY, form_id TEXT NOT NULL, response TEXT NOT NULL, created_at INTEGER NOT NULL)`,
     `CREATE INDEX form_submissions_form_created ON form_submissions(form_id, created_at)`,
   ] },
+  // app access: owner switches + limits, per-link guest change cutoff, and
+  // guest sign-in (emailed codes → per-device tokens; secrets stored hashed)
+  { version: 45, statements: [
+    `ALTER TABLE settings ADD COLUMN mobile_access TEXT NOT NULL DEFAULT '{}'`,
+    `ALTER TABLE booking_links ADD COLUMN change_cutoff INTEGER NOT NULL DEFAULT 0`,
+    `CREATE TABLE guest_codes (email TEXT PRIMARY KEY, code_hash TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL)`,
+    `CREATE TABLE guest_sessions (id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE, email TEXT NOT NULL, device_name TEXT NOT NULL DEFAULT '', created_at INTEGER NOT NULL, last_seen_at INTEGER NOT NULL)`,
+    `CREATE INDEX guest_sessions_email ON guest_sessions(email)`,
+    `CREATE INDEX bookings_email ON bookings(email)`,
+  ] },
+  // links page revision for whole-page saves (staff app): triggers bump it on
+  // every content change, whichever path made it (web admin, API, restore);
+  // click counts don't. revision_checks makes a stale save fail inside its
+  // own batch (CHECK fails → the whole batch rolls back).
+  { version: 46, statements: [
+    `ALTER TABLE settings ADD COLUMN links_revision INTEGER NOT NULL DEFAULT 0`,
+    `CREATE TABLE revision_checks (expected INTEGER NOT NULL, actual INTEGER NOT NULL CHECK (expected = actual))`,
+    `CREATE TRIGGER links_revision_insert AFTER INSERT ON links BEGIN UPDATE settings SET links_revision = links_revision + 1 WHERE id = 1; END`,
+    `CREATE TRIGGER links_revision_delete AFTER DELETE ON links BEGIN UPDATE settings SET links_revision = links_revision + 1 WHERE id = 1; END`,
+    `CREATE TRIGGER links_revision_update AFTER UPDATE OF kind, label, url, icon, html, meta, ord ON links BEGIN UPDATE settings SET links_revision = links_revision + 1 WHERE id = 1; END`,
+    `CREATE TRIGGER links_revision_profile AFTER UPDATE OF links_name, links_bio, links_avatar ON settings
+      WHEN OLD.links_name IS NOT NEW.links_name OR OLD.links_bio IS NOT NEW.links_bio OR OLD.links_avatar IS NOT NEW.links_avatar
+      BEGIN UPDATE settings SET links_revision = links_revision + 1 WHERE id = 1; END`,
+  ] },
+  // Settings → Monitoring: Uptime Kuma push URL + status page
+  { version: 47, statements: [
+    `ALTER TABLE settings ADD COLUMN monitoring TEXT NOT NULL DEFAULT '{}'`,
+  ] },
+  { version: 48, statements: [
+    `CREATE TABLE auth_owner_checks (allowed INTEGER CONSTRAINT keep_clerk_owner CHECK(allowed=1))`,
+    `ALTER TABLE editor_codes ADD COLUMN auth_provider TEXT NOT NULL DEFAULT 'builtin'`,
+    `ALTER TABLE editor_devices ADD COLUMN auth_provider TEXT NOT NULL DEFAULT 'builtin'`,
+    `CREATE TABLE auth_identities (issuer TEXT NOT NULL, subject TEXT NOT NULL, user_id TEXT NOT NULL, disabled INTEGER NOT NULL DEFAULT 0, PRIMARY KEY(issuer,subject), UNIQUE(issuer,user_id))`,
+    `CREATE TABLE auth_bootstrap (issuer TEXT PRIMARY KEY)`,
+    `CREATE TABLE auth_invitations (id TEXT PRIMARY KEY, issuer TEXT NOT NULL, email TEXT NOT NULL, name TEXT NOT NULL, role TEXT NOT NULL, state TEXT NOT NULL, remote_id TEXT NOT NULL, expires_at INTEGER NOT NULL, created_at INTEGER NOT NULL)`,
+    `CREATE UNIQUE INDEX auth_invitation_pending ON auth_invitations(issuer,email) WHERE state IN ('sending','pending')`,
+    `CREATE TABLE auth_mobile (kind TEXT NOT NULL, id TEXT NOT NULL, issuer TEXT NOT NULL, subject TEXT NOT NULL, session_id TEXT NOT NULL, PRIMARY KEY(kind,id))`,
+    `CREATE TRIGGER auth_user_deleted AFTER DELETE ON users BEGIN UPDATE auth_identities SET disabled=1 WHERE user_id=OLD.id; END`,
+    `CREATE TRIGGER auth_code_deleted AFTER DELETE ON editor_codes BEGIN DELETE FROM auth_mobile WHERE kind='code' AND id=OLD.hash; END`,
+    `CREATE TRIGGER auth_device_deleted AFTER DELETE ON editor_devices BEGIN DELETE FROM auth_mobile WHERE kind='device' AND id=OLD.id; END`,
+  ] },
+  // Public cache: content_version goes up on every change a visitor could
+  // see, from any write path (admin, editor API, scheduler, design publish,
+  // restore/import, raw SQL), because triggers do the bumping. Cached pages
+  // and app ETags are keyed by it; the purge loop records how far it got.
+  { version: 49, statements: [
+    `ALTER TABLE settings ADD COLUMN content_version INTEGER NOT NULL DEFAULT 0`,
+    `ALTER TABLE settings ADD COLUMN cache_purged_version INTEGER NOT NULL DEFAULT 0`,
+    // start at a random point so two databases (a reinstall, a test run)
+    // never hand out the same version, and an old ETag can't match by chance
+    `UPDATE settings SET content_version = abs(random() % 1000000000), cache_purged_version = content_version WHERE id = 1`,
+    ...Object.entries(CONTENT_VERSION_COLUMNS).flatMap(([table, columns]) => contentVersionTriggers(table, columns)),
+  ] },
+  // scheduled off-site backups (lib/backup/offsite.ts): last run + lease
+  { version: 50, statements: [
+    `CREATE TABLE backup_state (id INTEGER PRIMARY KEY CHECK (id = 1), last_at INTEGER NOT NULL DEFAULT 0, lease_until INTEGER NOT NULL DEFAULT 0,
+      last_key TEXT NOT NULL DEFAULT '', last_error TEXT NOT NULL DEFAULT '', failed_at INTEGER NOT NULL DEFAULT 0)`,
+    `INSERT INTO backup_state (id) VALUES (1)`,
+  ] },
 ];
 
 export const LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;

package/src/lib/repo/sql.ts

@@ -1,7 +1,11 @@
+import { AUTH } from '../auth/config';
+import { AuthStore } from '../auth/store';
 import { FormStore, formInsert, submissionInsert } from '../forms/store';
+import { GuestStore } from '../mobile/guest-store';
 import { LiveStore } from '../live/store';
 import { PushStore } from '../push/store';
 import { EditorStore } from '../editor/store';
+import { BackupStore } from '../backup/store';
 import { LiveConfig } from '../live/types';
 import { ApiError } from '../api';
 import { EmailStore, bookingJobs } from '../email/store';
@@ -10,7 +14,7 @@ import { DocTranslations, Page, Post, Link, Media, NavItem, Redirect, Settings,
 import { designSnapshot, draftNavItems, pickDesignDraft, pickEventDraft, pickPageDraft, pickPostDraft } from '../drafts';
 import { eventInstants, eventTimeZone, normalizeEventTimes } from '../calendar/events';
 import { cleanRrule } from '../calendar/rrule';
-import { MIGRATIONS, MIGRATIONS_TABLE } from './migrations';
+import { runMigrations } from './migrate-runner';
 import { htmlToPlaintext } from '../plaintext';
 import { SEED } from '../brand';
 import { CONTENT, postsIndexUrl } from '../content';
@@ -183,7 +187,7 @@ function rowToLink2(r: Row): BookingLink {
     id: r.id, resourceId: r.resource_id, slug: r.slug, name: r.name, description: r.description ?? '', mode: r.mode ?? 'slots',
     duration: Number(r.duration), lengths: json(r.lengths, []), minDays: Number(r.min_days), maxDays: Number(r.max_days),
     step: Number(r.step), bufferBefore: Number(r.buffer_before), bufferAfter: Number(r.buffer_after),
-    minNotice: Number(r.min_notice), maxAdvance: Number(r.max_advance), perDayCap: Number(r.per_day_cap),
+    minNotice: Number(r.min_notice), maxAdvance: Number(r.max_advance), perDayCap: Number(r.per_day_cap), changeCutoff: Number(r.change_cutoff ?? 0),
     hours: r.hours ? json(r.hours, null) : null, autoConfirm: Boolean(r.auto_confirm), visibility: r.visibility ?? 'public',
     approval: r.approval ?? 'default', approvalRules: json(r.approval_rules, {}),
     askPhone: Boolean(r.ask_phone), questions: json(r.questions, []), confirmMessage: r.confirm_message ?? '',
@@ -257,18 +261,24 @@ function safeSnippet(raw: unknown): string {
 export class SqlRepository implements ContentRepository {
   private driver!: SqlDriver;
   private ready: Promise<void>;
+  readonly auth: AuthStore;
   readonly email: EmailStore;
   readonly forms: FormStore;
+  readonly guests: GuestStore;
   readonly live: LiveStore;
   readonly push: PushStore;
   readonly editor: EditorStore;
+  readonly backups: BackupStore;
 
   constructor(driver: SqlDriver | (() => Promise<SqlDriver>)) {
     this.ready = this.init(driver);
     this.forms = new FormStore(async () => { await this.ready; return this.driver; });
+    this.guests = new GuestStore(async () => { await this.ready; return this.driver; });
     this.live = new LiveStore(async () => { await this.ready; return this.driver; });
     this.push = new PushStore(async () => { await this.ready; return this.driver; });
     this.editor = new EditorStore(async () => { await this.ready; return this.driver; });
+    this.backups = new BackupStore(async () => { await this.ready; return this.driver; });
+    this.auth = new AuthStore(async () => { await this.ready; return this.driver; });
     this.email = new EmailStore(async () => { await this.ready; return this.driver; });
   }
 
@@ -284,27 +294,11 @@ export class SqlRepository implements ContentRepository {
   }
 
   private async migrate() {
-    await this.driver.run(MIGRATIONS_TABLE);
-    const r = await this.first('SELECT MAX(version) AS v FROM migrations');
-    let applied = Number(r?.v ?? 0);
-    if (applied === 0) {
-      // Pre-migrations DB: the baseline tables already exist, mark v1 applied.
-      const baseline = await this.first("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'pages'");
-      if (baseline) {
-        await this.driver.run('INSERT INTO migrations (version, applied_at) VALUES (1, ?)', [Date.now()]);
-        applied = 1;
-      }
-    }
-    const pending = MIGRATIONS.filter((m) => m.version > applied);
-    for (const m of pending) {
-      await this.driver.batch([
-        ...m.statements.map((sql) => ({ sql })),
-        { sql: 'INSERT INTO migrations (version, applied_at) VALUES (?, ?)', args: [m.version, Date.now()] },
-      ]);
-    }
+    // under the shared migration lock (also used by `acms migrate`)
+    const { applied } = await runMigrations(this.driver);
     // v21 introduced the search index; plaintext can't be derived in SQL, so
     // the backfill runs here once, right after that version lands.
-    if (pending.some((m) => m.version === 21)) await this.reindexSearch();
+    if (applied.includes(21)) await this.reindexSearch();
   }
 
   private async seed() {
@@ -317,7 +311,8 @@ export class SqlRepository implements ContentRepository {
       { id: uuid(), type: 'text', config: { markdown: 'This home page was built in the **widget editor** — open `/admin` to change it.' } },
     ];
     await this.driver.batch([
-      { sql: 'INSERT INTO settings (id, site_title, tagline) VALUES (1, ?, ?)', args: [SEED.siteTitle, SEED.tagline] },
+      // random start: see migration 49
+      { sql: 'INSERT INTO settings (id, site_title, tagline, content_version) VALUES (1, ?, ?, abs(random() % 1000000000))', args: [SEED.siteTitle, SEED.tagline] },
       {
         sql: 'INSERT INTO pages (id, slug, title, status, is_home, blocks, created_at, updated_at) VALUES (?, ?, ?, ?, 1, ?, ?, ?)',
         args: [uuid(), 'home', 'Home', 'published', JSON.stringify(homeBlocks), now, now],
@@ -1031,11 +1026,11 @@ export class SqlRepository implements ContentRepository {
     return {
       sql: `INSERT INTO booking_links (id, resource_id, slug, name, description, mode, duration, lengths, min_days, max_days, step, buffer_before,
         buffer_after, min_notice, max_advance, per_day_cap, hours, auto_confirm, visibility, ask_phone, questions, confirm_message, redirect_url,
-        active, ord, created_at, updated_at, approval, approval_rules) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        active, ord, created_at, updated_at, approval, approval_rules, change_cutoff) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       args: [l.id, l.resourceId, l.slug, l.name, l.description, l.mode, l.duration, JSON.stringify(l.lengths), l.minDays, l.maxDays, l.step,
         l.bufferBefore, l.bufferAfter, l.minNotice, l.maxAdvance, l.perDayCap, l.hours ? JSON.stringify(l.hours) : null, l.autoConfirm ? 1 : 0,
         l.visibility, l.askPhone ? 1 : 0, JSON.stringify(l.questions), l.confirmMessage, l.redirectUrl, l.active ? 1 : 0, l.order, l.createdAt, l.updatedAt,
-        l.approval, JSON.stringify(l.approvalRules)],
+        l.approval, JSON.stringify(l.approvalRules), l.changeCutoff],
     };
   }
   private bookingInsert(b: Booking): SqlStatement {
@@ -1126,10 +1121,10 @@ export class SqlRepository implements ContentRepository {
     await this.driver.run(
       `UPDATE booking_links SET slug = ?, name = ?, description = ?, mode = ?, duration = ?, lengths = ?, min_days = ?, max_days = ?, step = ?,
         buffer_before = ?, buffer_after = ?, min_notice = ?, max_advance = ?, per_day_cap = ?, hours = ?, auto_confirm = ?, visibility = ?,
-        ask_phone = ?, questions = ?, confirm_message = ?, redirect_url = ?, active = ?, ord = ?, updated_at = ?, approval = ?, approval_rules = ? WHERE id = ?`,
+        ask_phone = ?, questions = ?, confirm_message = ?, redirect_url = ?, active = ?, ord = ?, updated_at = ?, approval = ?, approval_rules = ?, change_cutoff = ? WHERE id = ?`,
       [l.slug, l.name, l.description, l.mode, l.duration, JSON.stringify(l.lengths), l.minDays, l.maxDays, l.step, l.bufferBefore, l.bufferAfter,
         l.minNotice, l.maxAdvance, l.perDayCap, l.hours ? JSON.stringify(l.hours) : null, l.autoConfirm ? 1 : 0, l.visibility, l.askPhone ? 1 : 0,
-        JSON.stringify(l.questions), l.confirmMessage, l.redirectUrl, l.active ? 1 : 0, l.order, l.updatedAt, l.approval, JSON.stringify(l.approvalRules), id]
+        JSON.stringify(l.questions), l.confirmMessage, l.redirectUrl, l.active ? 1 : 0, l.order, l.updatedAt, l.approval, JSON.stringify(l.approvalRules), l.changeCutoff, id]
     );
   }
   async deleteBookingLink(id: string) {
@@ -1147,9 +1142,12 @@ export class SqlRepository implements ContentRepository {
     if (filter.email) { where.push('email = ?'); args.push(filter.email.toLowerCase()); }
     if (filter.from !== undefined) { where.push('end_at > ?'); args.push(filter.from); }
     if (filter.to !== undefined) { where.push('start_at < ?'); args.push(filter.to); }
+    if (filter.endedBy !== undefined) { where.push('end_at <= ?'); args.push(filter.endedBy); }
     if (filter.statuses?.length) { where.push(`status IN (${filter.statuses.map(() => '?').join(', ')})`); args.push(...filter.statuses); }
     if (filter.kinds?.length) { where.push(`kind IN (${filter.kinds.map(() => '?').join(', ')})`); args.push(...filter.kinds); }
-    const rows = await this.driver.all(`SELECT * FROM bookings${where.length ? ` WHERE ${where.join(' AND ')}` : ''} ORDER BY start_at ASC LIMIT 5000`, args);
+    const dir = filter.newestFirst ? 'DESC' : 'ASC';
+    const limit = Math.min(Math.max(Math.trunc(filter.limit ?? 5000), 1), 5000), offset = Math.max(Math.trunc(filter.offset ?? 0), 0);
+    const rows = await this.driver.all(`SELECT * FROM bookings${where.length ? ` WHERE ${where.join(' AND ')}` : ''} ORDER BY start_at ${dir}, id ${dir} LIMIT ${limit} OFFSET ${offset}`, args);
     return rows.map(rowToBooking);
   }
   async getBooking(id: string) {
@@ -1163,6 +1161,12 @@ export class SqlRepository implements ContentRepository {
     const r = await this.first('SELECT * FROM bookings WHERE manage_token = ?', [token]);
     return r ? rowToBooking(r) : null;
   }
+  async countBookingsByEmail(email: string, since: number) {
+    await this.ready;
+    // staff bookings made for someone don't use up that person's public allowance
+    const r = await this.first("SELECT COUNT(*) AS n FROM bookings WHERE email = ? AND created_at >= ? AND kind != 'block' AND source != 'admin'", [email.trim().toLowerCase(), since]);
+    return Number(r?.n ?? 0);
+  }
   // One INSERT … SELECT … WHERE NOT EXISTS: the overlap test and the write
   // are a single statement, so two people racing for the same slot can't
   // both win — the loser's insert simply affects no rows.
@@ -1445,6 +1449,30 @@ export class SqlRepository implements ContentRepository {
     await this.ready;
     await this.driver.run('DELETE FROM links WHERE id = ?', [id]);
   }
+  async linksRevision() {
+    await this.ready;
+    return Number((await this.first('SELECT links_revision FROM settings WHERE id = 1'))?.links_revision ?? 0);
+  }
+  async replaceLinks(expectedRevision: number, items: Parameters<ContentRepository['replaceLinks']>[1], profile: Parameters<ContentRepository['replaceLinks']>[2] = {}) {
+    await this.ready;
+    const keep = items.flatMap((i) => (i.keep ? [i.keep] : []));
+    const settings = this.settingsStatement(profile);
+    try {
+      await this.driver.batch([
+        // fails the CHECK (and so the whole batch) when someone saved in between
+        { sql: 'INSERT INTO revision_checks (expected, actual) SELECT ?, links_revision FROM settings WHERE id = 1', args: [expectedRevision] },
+        { sql: 'DELETE FROM revision_checks' },
+        keep.length ? { sql: `DELETE FROM links WHERE id NOT IN (${keep.map(() => '?').join(', ')})`, args: keep } : { sql: 'DELETE FROM links' },
+        ...items.map((i, ord) => i.keep
+          ? { sql: 'UPDATE links SET label = ?, url = ?, icon = ?, html = ?, meta = ?, ord = ? WHERE id = ?', args: [i.label, i.url, i.icon, i.html, JSON.stringify(i.meta), ord, i.keep] }
+          : { sql: 'INSERT INTO links (id, kind, label, url, icon, html, meta, ord) VALUES (?, ?, ?, ?, ?, ?, ?, ?)', args: [crypto.randomUUID(), i.kind, i.label, i.url, i.icon, i.html, JSON.stringify(i.meta), ord] }),
+        ...(settings ? [settings] : []),
+      ]);
+    } catch (e) {
+      if (/CHECK constraint/i.test(String(e))) throw new ApiError(409, 'The links page changed since you opened it. Reload and try again.');
+      throw e;
+    }
+  }
   async trackClick(id: string) {
     await this.ready;
     const r = await this.first('SELECT url FROM links WHERE id = ?', [id]);
@@ -1523,6 +1551,23 @@ export class SqlRepository implements ContentRepository {
     await this.driver.run('DELETE FROM snippets WHERE id = ?', [id]);
   }
 
+  private ownerGuard(id: string): SqlStatement[] {
+    if (AUTH.provider !== 'clerk') return [];
+    // Execute in the same write transaction as demotion/deletion: concurrent
+    // owners cannot each remove the other and leave the site without one.
+    return [{ sql: `INSERT INTO auth_owner_checks(allowed) SELECT 0 FROM users target
+      WHERE target.id=? AND target.role='owner' AND EXISTS (
+        SELECT 1 FROM auth_identities a WHERE a.user_id=target.id AND a.disabled=0 AND NOT EXISTS (
+          SELECT 1 FROM users other JOIN auth_identities b ON b.user_id=other.id
+          WHERE other.id<>target.id AND other.role='owner' AND b.disabled=0 AND b.issuer=a.issuer))`, args: [id] }];
+  }
+  private async guardedUserWrite(statements: SqlStatement[]) {
+    try { await this.driver.batch(statements); }
+    catch (error) {
+      if (String(error).includes('keep_clerk_owner')) throw new Error('Keep at least one linked owner. Add another owner before removing or demoting this account.');
+      throw error;
+    }
+  }
   // ---- users ----
   async listUsers() {
     await this.ready;
@@ -1556,16 +1601,28 @@ export class SqlRepository implements ContentRepository {
     if (data.slug !== undefined) { sets.push('slug = ?'); args.push(data.slug); }
     if (!sets.length) return;
     args.push(id);
-    await this.driver.batch([
+    await this.guardedUserWrite([
+      ...(data.role !== undefined && data.role !== 'owner' ? this.ownerGuard(id) : []),
       {sql:`UPDATE users SET ${sets.join(', ')} WHERE id = ?`,args},
       ...(data.passHash === undefined ? [] : [{sql:`INSERT INTO email_jobs(id,dedupe,kind,recipient,payload,config_version,next_at,created_at,updated_at)
         SELECT ?,?,'password-changed',email,'{}',COALESCE((SELECT MAX(version) FROM email_configs),0),?,?,? FROM users WHERE id=?`,
         args:[crypto.randomUUID(),crypto.randomUUID(),Date.now(),Date.now(),Date.now(),id]}]),
     ]);
   }
+  async changeUserEmail(id: string, email: string, { signOut, notify }: { signOut: boolean; notify: boolean }) {
+    await this.ready;
+    const now = Date.now();
+    // the notice is queued before the update so it reads the previous address
+    await this.driver.batch([
+      ...(notify ? [{sql:`INSERT INTO email_jobs(id,dedupe,kind,recipient,payload,config_version,next_at,created_at,updated_at)
+        SELECT ?,?,'email-changed',email,'{}',COALESCE((SELECT MAX(version) FROM email_configs),0),?,?,? FROM users WHERE id=? AND email<>?`,
+        args:[crypto.randomUUID(),crypto.randomUUID(),now,now,now,id,email.toLowerCase()]}] : []),
+      {sql:`UPDATE users SET email = ?${signOut ? ', session_version = session_version + 1' : ''} WHERE id = ?`,args:[email.toLowerCase(),id]},
+    ]);
+  }
   async deleteUser(id: string) {
     await this.ready;
-    await this.driver.run('DELETE FROM users WHERE id = ?', [id]);
+    await this.guardedUserWrite([...this.ownerGuard(id), { sql: 'DELETE FROM users WHERE id = ?', args: [id] }]);
   }
   async getUserAuth(email: string) {
     await this.ready;
@@ -1611,8 +1668,12 @@ export class SqlRepository implements ContentRepository {
   }
 
   // ---- search ----
-  async searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults> {
+  async searchPublished(query: string, opts?: { locale?: string; limit?: number; collections?: string[] }): Promise<SearchResults> {
     await this.ready;
+    // per-kind cap; the public API widens it for deeper result pages
+    const limit = Math.min(Math.max(Math.trunc(opts?.limit ?? 50), 1), 200);
+    const inCollections = opts?.collections ? ` AND p.collection IN (${opts.collections.map(() => '?').join(', ') || 'NULL'})` : '';
+    const collectionArgs = opts?.collections ?? [];
     const trimmed = query.trim();
     if (!trimmed) return { posts: [], pages: [], events: [], tags: [], authors: [] };
     const locale = opts?.locale ?? '';
@@ -1623,29 +1684,29 @@ export class SqlRepository implements ContentRepository {
       [postRows, pageRows, eventRows] = await Promise.all([
         this.driver.all(
           `SELECT p.*, ${SNIPPET} AS snip FROM search_index JOIN posts p ON p.id = search_index.ref_id
-           WHERE search_index MATCH ? AND search_index.kind = 'post' AND p.status = 'published'
-           ORDER BY ${RANK} LIMIT 50`,
-          [ftsQuery(trimmed)]
+           WHERE search_index MATCH ? AND search_index.kind = 'post' AND p.status = 'published'${inCollections}
+           ORDER BY ${RANK} LIMIT ${limit}`,
+          [ftsQuery(trimmed), ...collectionArgs]
         ),
         // locale is a boost, never a filter: the visitor's language sorts
         // first, every locale stays visible (en/es cover different topics)
         this.driver.all(
           `SELECT g.*, ${SNIPPET} AS snip FROM search_index JOIN pages g ON g.id = search_index.ref_id
            WHERE search_index MATCH ? AND search_index.kind = 'page' AND g.status = 'published'
-           ORDER BY (search_index.locale = ?) DESC, ${RANK} LIMIT 50`,
+           ORDER BY (search_index.locale = ?) DESC, ${RANK} LIMIT ${limit}`,
           [ftsQuery(trimmed), locale]
         ),
         this.driver.all(
           `SELECT e.*, ${SNIPPET} AS snip FROM search_index JOIN events e ON e.id = search_index.ref_id
            WHERE search_index MATCH ? AND search_index.kind = 'event' AND e.status = 'published'
-           ORDER BY ${RANK} LIMIT 50`,
+           ORDER BY ${RANK} LIMIT ${limit}`,
           [ftsQuery(trimmed)]
         ),
       ]);
     } catch {
       // FTS5 unavailable or a query form it rejects — degrade to the old
       // LIKE scan (recency-ordered, snippets fall back to excerpt/seo_desc)
-      [postRows, pageRows, eventRows] = await this.likeSearch(trimmed, locale);
+      [postRows, pageRows, eventRows] = await this.likeSearch(trimmed, locale, limit, opts?.collections);
     }
     const like = `%${trimmed.replace(/[%_]/g, ' ').trim()}%`;
     const [authors, tagRows, userRows] = await Promise.all([
@@ -1675,32 +1736,33 @@ export class SqlRepository implements ContentRepository {
       authors: userRows.map(rowToUser),
     };
   }
-  private async likeSearch(query: string, locale: string): Promise<[Row[], Row[], Row[]]> {
+  private async likeSearch(query: string, locale: string, limit: number, collections?: string[]): Promise<[Row[], Row[], Row[]]> {
     const q = `%${query.replace(/[%_]/g, ' ').trim()}%`;
     if (q === '%%') return [[], [], []];
     return Promise.all([
       this.driver.all(
-        "SELECT * FROM posts WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ? OR body LIKE ?) ORDER BY published_at DESC LIMIT 50",
-        [q, q, q, q]
+        `SELECT * FROM posts WHERE status = 'published'${collections ? ` AND collection IN (${collections.map(() => '?').join(', ') || 'NULL'})` : ''} AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ? OR body LIKE ?) ORDER BY published_at DESC LIMIT ${limit}`,
+        [...(collections ?? []), q, q, q, q]
       ),
       this.driver.all(
-        "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY (locale = ?) DESC, updated_at DESC LIMIT 50",
+        `SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY (locale = ?) DESC, updated_at DESC LIMIT ${limit}`,
         [q, q, locale]
       ),
       this.driver.all(
-        "SELECT * FROM events WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ?) ORDER BY start_at DESC LIMIT 50",
+        `SELECT * FROM events WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ?) ORDER BY start_at DESC LIMIT ${limit}`,
         [q, q, q]
       ),
     ]);
   }
 
   // ---- restore ----
-  async restoreAll(content: Parameters<ContentRepository['restoreAll']>[0]) {
+  async restoreAll(content: Parameters<ContentRepository['restoreAll']>[0], authRecovery?: { issuer: string; subject: string; userId: string }) {
     await this.ready;
     const stmts: SqlStatement[] = [
       // Suppression and re-enabling share the restore transaction. A failed
       // restore cannot leave notifications disabled or emit phantom deletes.
       { sql: 'UPDATE webhook_control SET suppressed=1 WHERE id=1' },
+      { sql: "UPDATE auth_invitations SET state='revoked' WHERE state<>'accepted'" },
       ...['email_jobs', 'email_attempts', 'email_delivery_events', 'email_tokens', 'posts', 'pages', 'media', 'links', 'tags', 'nav_items', 'users', 'post_authors', 'redirects', 'calendars', 'events', 'resources', 'booking_links', 'bookings', 'mobile_booking_requests', 'import_runs', 'import_records', 'places', 'forms', 'form_submissions'].map((t) => ({
         sql: `DELETE FROM ${t}`,
       })),
@@ -1776,6 +1838,7 @@ export class SqlRepository implements ContentRepository {
         args: [r.id, r.fromPath, r.toPath, r.code, r.createdAt],
       })),
     ];
+    if (authRecovery) stmts.push({ sql: `UPDATE auth_identities SET disabled=0 WHERE issuer=? AND subject=? AND user_id=? AND EXISTS(SELECT 1 FROM users WHERE id=? AND role='owner')`, args: [authRecovery.issuer, authRecovery.subject, authRecovery.userId, authRecovery.userId] });
     const settingsWrite = this.settingsStatement({ ...content.settings, live: { ...LiveConfig.parse(content.settings.live ?? {}), mode: 'off', manual: { watchUrl: '', title: 'We’re live', until: 0 } } });
     stmts.push({ sql: "UPDATE live_connections SET enabled=0,tested_at=0,revision=revision+1,lease='',lease_until=0,snapshot=NULL,upcoming=NULL,error='Restored content. Test this connection before enabling automatic checks.'" }, { sql: 'DELETE FROM live_oauth_states' });
     if (settingsWrite) stmts.push(settingsWrite);
@@ -1938,6 +2001,8 @@ export class SqlRepository implements ContentRepository {
       live: JSON.parse(String(r?.live ?? '{}')),
       push: JSON.parse(String(r?.push ?? '{}')),
       calendar: JSON.parse(String(r?.calendar ?? '{}')),
+      mobileAccess: JSON.parse(String(r?.mobile_access ?? '{}')),
+      monitoring: JSON.parse(String(r?.monitoring ?? '{}')),
       agent: JSON.parse(String(r?.agent ?? '{}')),
       draftsApiKey: r?.drafts_api_key ?? '',
       draftsAllowedOrigins: JSON.parse(String(r?.drafts_allowed_origins ?? '[]')),
@@ -1949,14 +2014,27 @@ export class SqlRepository implements ContentRepository {
     const statement = this.settingsStatement(data);
     if (statement) await this.driver.run(statement.sql, statement.args);
   }
+  async patchMobileAccess(patch: Partial<Settings['mobileAccess']>) {
+    await this.ready;
+    await this.driver.run('UPDATE settings SET mobile_access = json_patch(mobile_access, ?) WHERE id = 1', [JSON.stringify(patch)]);
+  }
+  async getCacheState() {
+    await this.ready;
+    const r = await this.first('SELECT content_version, cache_purged_version FROM settings WHERE id = 1');
+    return { version: Number(r?.content_version ?? 0), purged: Number(r?.cache_purged_version ?? 0) };
+  }
+  async markCachePurged(version: number) {
+    await this.ready;
+    await this.driver.run('UPDATE settings SET cache_purged_version = MAX(cache_purged_version, ?) WHERE id = 1', [version]);
+  }
   private settingsStatement(data: Partial<Settings>): SqlStatement | undefined {
     const columns: Record<string, string> = {
       siteTitle:'site_title', tagline:'tagline', footerText:'footer_text', linksName:'links_name', linksBio:'links_bio', linksAvatar:'links_avatar',
       activeTheme:'active_theme', designOverrides:'design_overrides', sectionPages:'section_pages', siteLogo:'site_logo', siteLogoDark:'site_logo_dark', siteUrl:'site_url', siteFavicon:'site_favicon', siteCover:'site_cover',
       announcement:'announcement', analytics:'analytics', headCode:'head_code', footerCode:'footer_code', timezone:'timezone', locale:'locale',
-      draftsApiKey:'drafts_api_key', draftsAllowedOrigins:'drafts_allowed_origins', draftDesign:'draft_design', ai:'ai', agent:'agent', live:'live', push:'push', calendar:'calendar',
+      draftsApiKey:'drafts_api_key', draftsAllowedOrigins:'drafts_allowed_origins', draftDesign:'draft_design', ai:'ai', agent:'agent', live:'live', push:'push', calendar:'calendar', mobileAccess:'mobile_access', monitoring:'monitoring',
     };
-    const jsonKeys = new Set(['designOverrides','sectionPages','announcement','analytics','draftsAllowedOrigins','draftDesign','ai','agent','live','push','calendar']);
+    const jsonKeys = new Set(['designOverrides','sectionPages','announcement','analytics','draftsAllowedOrigins','draftDesign','ai','agent','live','push','calendar','mobileAccess','monitoring']);
     const entries = Object.entries(data).filter(([k,v]) => columns[k] && v !== undefined);
     if (!entries.length) return;
     const design = entries.some(([k]) => ['activeTheme','designOverrides','sectionPages','siteLogo','siteLogoDark','siteFavicon','siteCover','draftDesign'].includes(k));

package/src/lib/repo/sqlite.ts

@@ -39,7 +39,20 @@ export class SqliteRepository extends SqlRepository {
       }
       // remote libSQL (Turso, sqld) needs a token; local files don't
       const authToken = env('SQLITE_AUTH_TOKEN', '');
-      return new LibsqlDriver(createClient(authToken ? { url, authToken } : { url }));
+      const client = createClient(authToken ? { url, authToken } : { url });
+      if (url.startsWith('file:')) await tuneLocalFile(client);
+      return new LibsqlDriver(client);
     });
   }
 }
+
+// Local files only (remote libSQL/Turso manage their own journal): WAL lets
+// page reads continue while a write commits, busy_timeout waits out a
+// concurrent writer (the scheduler, a second process) instead of failing
+// with SQLITE_BUSY, and synchronous=NORMAL is the safe pairing for WAL.
+// File-copy backups must take acms.db, acms.db-wal and acms.db-shm together.
+export async function tuneLocalFile(client: Pick<Client, 'execute'>) {
+  await client.execute('PRAGMA journal_mode=WAL');
+  await client.execute('PRAGMA busy_timeout=5000');
+  await client.execute('PRAGMA synchronous=NORMAL');
+}

package/src/lib/repo/types.ts

@@ -1,4 +1,7 @@
+import { AuthStore } from '../auth/store';
 import type { FormStore } from '../forms/store';
+import type { BackupStore } from '../backup/store';
+import type { GuestStore } from '../mobile/guest-store';
 import type { SavedForm, FormSubmission } from '../forms/schema';
 import type { LiveStore } from '../live/store';
 import type { BookingRequest } from '../backup/content';
@@ -49,8 +52,11 @@ export type EventUpdate = Partial<
 // The single contract both backends implement. The app only ever imports
 // this — never a concrete adapter.
 export interface ContentRepository {
+  readonly auth: AuthStore;
   readonly email: EmailStore;
   readonly forms: FormStore;
+  readonly backups: BackupStore;
+  readonly guests: GuestStore;
   readonly live: LiveStore;
   readonly push: PushStore;
   readonly editor: EditorStore;
@@ -168,9 +174,12 @@ export interface ContentRepository {
   // write that can fail on a race: it inserts atomically only if the held
   // range is still free (resource bookings) or seats remain (RSVPs), and
   // returns null when it lost.
-  listBookings(filter?: { resourceId?: string; eventId?: string; email?: string; from?: number; to?: number; statuses?: BookingStatus[]; kinds?: Booking['kind'][] }): Promise<Booking[]>;
+  /** from/to: overlaps the window; endedBy: ended at or before; default order start ascending, at most 5000 rows */
+  listBookings(filter?: { resourceId?: string; eventId?: string; email?: string; from?: number; to?: number; endedBy?: number; statuses?: BookingStatus[]; kinds?: Booking['kind'][]; newestFirst?: boolean; limit?: number; offset?: number }): Promise<Booking[]>;
   getBooking(id: string): Promise<Booking | null>;
   getBookingByToken(token: string): Promise<Booking | null>;
+  // bookings + RSVPs (never staff blocks) this address made since `since`
+  countBookingsByEmail(email: string, since: number): Promise<number>;
   createBooking(
     data: Omit<Booking, 'id' | 'createdAt' | 'updatedAt' | 'reminderSentAt' | 'notificationVersion'>,
     guard?: { capacity?: number; idempotency?: { keyHash: string; requestHash: string } }
@@ -222,6 +231,15 @@ export interface ContentRepository {
   // full ordering in one call (drag-and-drop); ids in desired display order
   reorderLinks(ids: string[]): Promise<void>;
   deleteLink(id: string): Promise<void>;
+  /** changes whenever the links page's blocks or profile change, by any path (not on clicks) */
+  linksRevision(): Promise<number>;
+  /**
+   * the whole links page in one atomic write, only if it is still at
+   * `expectedRevision` (409 otherwise, nothing saved): `keep` ids are updated
+   * in place, other items are added, everything else is removed; `profile`
+   * (links name/bio/avatar) saves in the same batch.
+   */
+  replaceLinks(expectedRevision: number, items: (Pick<Link, 'kind' | 'label' | 'url' | 'icon' | 'html' | 'meta'> & { keep?: string })[], profile?: Partial<Pick<Settings, 'linksName' | 'linksBio' | 'linksAvatar'>>): Promise<void>;
   trackClick(id: string): Promise<string | null>; // returns url to redirect to
 
   // tags — registry of tag entities; posts store tag names, this table adds
@@ -244,6 +262,9 @@ export interface ContentRepository {
   getUser(id: string): Promise<User | null>;
   createUser(data: { name: string; email: string; role: Role; passHash: string }): Promise<User>;
   updateUser(id: string, data: { name?: string; email?: string; role?: Role; passHash?: string; bio?: string; avatar?: string; slug?: string }): Promise<void>;
+  /** Replace a user's email. `signOut` ends their sessions (the email is their
+   * login); `notify` queues an `email-changed` notice to the previous address. */
+  changeUserEmail(id: string, email: string, opts: { signOut: boolean; notify: boolean }): Promise<void>;
   deleteUser(id: string): Promise<void>;
   getUserAuth(email: string): Promise<{ user: User; passHash: string; sessionVersion: number } | null>;
 
@@ -260,7 +281,8 @@ export interface ContentRepository {
   // #tags excluded) and author profiles. opts.locale is a ranking boost,
   // never a filter: pages in the visitor's locale sort first, every locale
   // stays visible (en/es cover different topics, not translations).
-  searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults>;
+  // collections: only posts in these (configured) collections
+  searchPublished(query: string, opts?: { locale?: string; limit?: number; collections?: string[] }): Promise<SearchResults>;
 
   // backup restore — id-preserving replace-all from a backup's content.json.
   // Users restore WITHOUT password hashes (backups never contain them).
@@ -285,7 +307,7 @@ export interface ContentRepository {
     places?: Place[];
     forms?: SavedForm[];
     formSubmissions?: FormSubmission[];
-  }): Promise<void>;
+  }, authRecovery?: { issuer: string; subject: string; userId: string }): Promise<void>;
 
   // imports (lib/import/apply.ts drives these). writeImported is the
   // id-preserving bulk write for imported posts/pages: original timestamps
@@ -310,6 +332,12 @@ export interface ContentRepository {
   // settings & dashboard
   getSettings(): Promise<Settings>;
   updateSettings(data: Partial<Settings>): Promise<void>;
+  /** merges just these App access fields in one statement, so concurrent saves don't undo each other */
+  patchMobileAccess(patch: Partial<Settings['mobileAccess']>): Promise<void>;
+  /** public cache: version = bumped by triggers on every visible change; purged = last version cleared from caches */
+  getCacheState(): Promise<{ version: number; purged: number }>;
+  /** record that caches were cleared up to `version` (never moves backwards) */
+  markCachePurged(version: number): Promise<void>;
   // Design-screen staging: save stages into settings.draftDesign, apply
   // copies staged → live design fields and clears, discard just clears
   saveDesignDraft(data: Partial<Pick<Settings, 'activeTheme' | 'designOverrides' | 'siteLogo' | 'siteLogoDark' | 'siteFavicon' | 'siteCover' | 'sectionPages'>> & {