@acms-subir/core 0.3.9 → 0.3.11

package/src/lib/scheduler.ts

@@ -4,6 +4,10 @@ import { processDueDeliveries } from './webhooks';
 import { dispatchEmail } from './email/service';
 import { decideOverdue, sendDueReminders } from './booking/service';
 import { runPushJobs } from './push/service';
+import { GUEST_IDLE_MS } from './mobile/guest-store';
+import { pushHeartbeat, pushUrlFor } from './monitoring';
+import { syncCachePurge } from './cache/purge';
+import { runOffsiteBackup } from './backup/offsite';
 
 // All work is awaited on both hosts. Traffic-triggered fallbacks do not mark
 // this heartbeat: monitoring must prove the independent scheduler ran.
@@ -20,6 +24,13 @@ export async function runScheduledTasks(repo: ContentRepository, locals?: unknow
     live: () => syncDueLive(repo, locals),
     // queued first-publish notices, starting-soon reminders, receipts, retention
     push: () => runPushJobs(repo, { locals, now: startedAt }),
+    // expired guest sign-in codes and app sessions unused for 90 days
+    guests: () => repo.guests.purge(GUEST_IDLE_MS, startedAt).then(() => 0),
+    // clear shared caches after scheduled publishes, and retry a purge that
+    // failed after an admin save (Cloudflare API down or rate limited)
+    cache: () => syncCachePurge(repo, locals, { force: true }),
+    // off-site backup ZIP when one is due (BACKUP_* settings / BACKUPS binding)
+    backup: () => runOffsiteBackup(repo, locals),
   };
   const results: Record<string, { ok: boolean; count?: number }> = {};
   for (const [name, run] of Object.entries(jobs)) {
@@ -28,5 +39,8 @@ export async function runScheduledTasks(repo: ContentRepository, locals?: unknow
   }
   const report = { startedAt, finishedAt: Date.now(), ok: Object.values(results).every(r => r.ok), jobs: results };
   await repo.email.recordScheduler(report);
+  // Uptime Kuma push monitor (Settings → Monitoring): a missing beat means the scheduler stopped
+  // (never allowed to fail the run)
+  await Promise.resolve().then(() => pushHeartbeat(pushUrlFor(settings.monitoring, locals), report)).catch(() => false);
   return report;
 }

package/src/lib/schema.ts

@@ -425,7 +425,8 @@ export type WeeklyHours = z.infer<typeof WeeklyHours>;
 // a date (or inclusive date span) with replacement hours; [] = closed
 export const DateOverride = z.object({
   date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-  endDate: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).default(''),
+  // '' = a single day
+  endDate: z.union([z.literal(''), z.string().regex(/^\d{4}-\d{2}-\d{2}$/)]).default(''),
   ranges: z.array(TimeRange).default([]),
   label: z.string().default(''),
 });
@@ -526,6 +527,35 @@ export const CalendarSettings = z.object({
 });
 export type CalendarSettings = z.infer<typeof CalendarSettings>;
 
+// Admin → Mobile app → App access: owner switches and abuse limits for the
+// public app routes. Turning a switch off answers 404 at once, no redeploy.
+export const MobileAccess = z.object({
+  // visitors view, cancel and move a booking with its private token
+  bookingChanges: z.boolean().default(true),
+  // "My bookings" through an emailed sign-in code (also needs email sending)
+  guestSignIn: z.boolean().default(true),
+  // published forms accept responses from apps
+  forms: z.boolean().default(true),
+  links: z.boolean().default(true),
+  // new bookings + RSVPs per email address per day, every channel; 0 = no cap
+  bookingsPerEmailDay: z.number().int().min(0).max(1000).default(10),
+  // responses per form per day from apps; 0 = no cap
+  responsesPerFormDay: z.number().int().min(0).max(100000).default(500),
+  // who changes rooms, booking types, hours and calendars from staff apps
+  scheduleRoles: z.enum(['admins', 'staff']).default('admins'),
+});
+export type MobileAccess = z.infer<typeof MobileAccess>;
+
+// Settings → Monitoring (owner): Uptime Kuma. pushUrl is a Kuma push monitor
+// the scheduler reports to after every run (a small secret: left out of
+// exports; UPTIME_PUSH_URL overrides it). statusPage is a public Kuma status
+// page the admin card reads.
+export const Monitoring = z.object({
+  pushUrl: z.string().max(500).default(''),
+  statusPage: z.string().max(500).default(''),
+});
+export type Monitoring = z.infer<typeof Monitoring>;
+
 export const BookingLink = z.object({
   id: z.string(),
   resourceId: z.string(),
@@ -543,6 +573,8 @@ export const BookingLink = z.object({
   bufferAfter: z.number().int().default(0),
   minNotice: z.number().int().default(120), // minutes
   maxAdvance: z.number().int().default(90), // days
+  // guests can cancel or move until this many hours before the start; 0 = any time
+  changeCutoff: z.number().int().min(0).max(8760).default(0),
   perDayCap: z.number().int().default(0), // 0 = unlimited
   // narrows the resource's hours; null = use the resource's hours as-is
   hours: WeeklyHours.nullable().default(null),
@@ -671,6 +703,8 @@ export function normalizeRedirectPath(input: string): string {
 export const Settings = z.object({
   live: LiveConfig.default({}),
   calendar: CalendarSettings.default({}),
+  mobileAccess: MobileAccess.default({}),
+  monitoring: Monitoring.default({}),
   // push notification automation (lib/push); the feature itself is acms({ mobile: { push } })
   push: PushSettings.default({}),
   siteTitle: z.string().default('My Site'),

package/src/lib/theme-transfer.ts

@@ -0,0 +1,163 @@
+import { z } from 'zod';
+import { SectionLayout, type SectionPages } from '../theme-sdk/contract.mjs';
+import type { NavItem, Page, Settings } from './schema';
+
+// Theme transfer (acms-theme v1): a theme as you see it on the Design screen,
+// moved between sites or machines as one ZIP:
+//   manifest.json   format, theme identity, core version, what's included
+//   design.json     the database half: overrides, brand images, section
+//                   layouts (keyed by page slug, not ID), optional navigation
+//   media/<key>     brand and section images, ids and keys verbatim
+// Theme code (src/themes/<slug>/) is compiled into the build, so it never
+// installs at runtime; an import that names a theme this site lacks stages
+// the rest and keeps the current theme.
+
+export const THEME_TRANSFER_FORMAT = 'acms-theme';
+
+export const ThemeTransferManifest = z.object({
+  format: z.literal(THEME_TRANSFER_FORMAT),
+  version: z.literal(1),
+  exportedAt: z.number().int().nonnegative(),
+  coreVersion: z.string().max(50).default(''),
+  source: z.object({ title: z.string().max(300).default(''), siteUrl: z.string().max(2000).default('') }).default({}),
+  theme: z.object({ slug: z.string().max(50), name: z.string().max(200).default(''), version: z.string().max(50).default(''), project: z.boolean().default(false) }),
+  includes: z.array(z.enum(['design', 'media', 'nav'])).max(10),
+}).passthrough();
+export type ThemeTransferManifest = z.infer<typeof ThemeTransferManifest>;
+
+const PageKey = z.object({ slug: z.string().max(300), locale: z.string().max(20).default(''), isHome: z.boolean().default(false), title: z.string().max(500).default('') });
+export const ThemeDesignFile = z.object({
+  activeTheme: z.string().max(50),
+  designOverrides: z.record(z.union([z.string().max(2000), z.number().finite()])).default({}),
+  siteLogo: z.string().max(2000).default(''),
+  siteLogoDark: z.string().max(2000).default(''),
+  siteFavicon: z.string().max(2000).default(''),
+  siteCover: z.string().max(2000).default(''),
+  layouts: z.array(z.object({ page: PageKey, layout: SectionLayout })).max(500).default([]),
+  // link refs (page:/post:/event:/booking:<id>) → the public URL they pointed
+  // at, so the importing site can find its own item at the same address
+  refs: z.record(z.string().max(200), z.string().max(2000)).default({}),
+  navItems: z.array(z.object({ label: z.string().max(200), url: z.string().max(2000), area: z.enum(['header', 'footer', 'social']) })).max(200).optional(),
+});
+export type ThemeDesignFile = z.infer<typeof ThemeDesignFile>;
+
+type Pages = z.infer<typeof SectionPages>;
+type PageRow = Pick<Page, 'id' | 'slug' | 'locale' | 'isHome' | 'title'>;
+export interface LinkRef { ref: string; url: string }
+
+const walk = (v: unknown, fn: (s: string) => string): unknown => {
+  if (typeof v === 'string') return fn(v);
+  if (Array.isArray(v)) return v.map((x) => walk(x, fn));
+  if (v && typeof v === 'object') return Object.fromEntries(Object.entries(v as Record<string, unknown>).map(([k, x]) => [k, walk(x, fn)]));
+  return v;
+};
+const collectRefs = (v: unknown, out: Set<string>) => {
+  if (Array.isArray(v)) v.forEach((x) => collectRefs(x, out));
+  else if (v && typeof v === 'object') {
+    for (const [k, x] of Object.entries(v as Record<string, unknown>)) {
+      if (k === 'ref' && typeof x === 'string') out.add(x); else collectRefs(x, out);
+    }
+  }
+};
+
+/** every uploaded-media key a value points at (/media/<id>/<file>) */
+export function mediaKeysIn(value: unknown): string[] {
+  const keys = new Set<string>();
+  walk(value, (s) => {
+    for (const m of s.matchAll(/\/media\/([\w-]+\/[\w.-]+)/g)) keys.add(m[1]);
+    return s;
+  });
+  return [...keys];
+}
+
+/**
+ * The database half of an export: the design as the Design screen shows it
+ * (draft merged over live). Same-origin absolute media URLs become
+ * site-relative so they resolve on the importing site.
+ */
+export function buildDesignExport(input: {
+  settings: Settings; navItems: Pick<NavItem, 'label' | 'url' | 'area'>[]; pages: PageRow[]; links: LinkRef[]; origin: string; includeNav: boolean;
+}): ThemeDesignFile {
+  const { settings: s, origin } = input;
+  const local = (v: string) => (origin && v.startsWith(`${origin}/media/`) ? v.slice(origin.length) : v);
+  const byId = new Map(input.pages.map((p) => [p.id, p]));
+  const layouts = Object.entries(s.sectionPages as Pages).flatMap(([id, layout]) => {
+    const p = byId.get(id);
+    return p ? [{ page: { slug: p.slug, locale: p.locale ?? '', isHome: Boolean(p.isHome), title: p.title ?? '' }, layout: walk(layout, local) as Pages[string] }] : [];
+  });
+  const used = new Set<string>();
+  collectRefs(layouts, used);
+  const urls = new Map(input.links.map((l) => [l.ref, l.url]));
+  const refs = Object.fromEntries([...used].flatMap((r) => (urls.has(r) ? [[r, urls.get(r)!]] : [])));
+  return {
+    activeTheme: s.activeTheme,
+    designOverrides: (s.designOverrides ?? {}) as Record<string, string | number>,
+    siteLogo: local(s.siteLogo ?? ''), siteLogoDark: local(s.siteLogoDark ?? ''), siteFavicon: local(s.siteFavicon ?? ''), siteCover: local(s.siteCover ?? ''),
+    layouts, refs,
+    ...(input.includeNav ? { navItems: input.navItems.map(({ label, url, area }) => ({ label, url: local(url), area })) } : {}),
+  };
+}
+
+export interface DesignImportReport {
+  theme: { slug: string; installed: boolean };
+  layouts: { matched: string[]; skipped: string[] };
+  links: { kept: number; dropped: number };
+  nav: number | null;
+}
+
+/**
+ * The stage patch for an imported design file, against this site's pages,
+ * link targets and installed themes. Layouts land on the page with the same
+ * slug (and locale, else the home page for the exported home), replacing any
+ * staged layout there; pages without a match are reported, never created.
+ * Link refs follow the item at the same URL, else fall back to their href.
+ */
+export function planDesignImport(input: {
+  file: ThemeDesignFile; pages: PageRow[]; links: LinkRef[]; installedThemes: string[];
+  stagedPages: Pages; includeNav: boolean;
+}): { patch: Record<string, unknown>; report: DesignImportReport } {
+  const { file } = input;
+  const installed = input.installedThemes.includes(file.activeTheme);
+  const refByUrl = new Map(input.links.map((l) => [l.url, l.ref]));
+  let kept = 0, dropped = 0;
+  const remap = (v: unknown): unknown => {
+    if (Array.isArray(v)) return v.map(remap);
+    if (!v || typeof v !== 'object') return v;
+    const o = Object.fromEntries(Object.entries(v as Record<string, unknown>).map(([k, x]) => [k, remap(x)]));
+    if (typeof o.ref === 'string') {
+      const url = file.refs[o.ref];
+      const to = url !== undefined ? refByUrl.get(url) : undefined;
+      if (to) { o.ref = to; kept++; } else { delete o.ref; dropped++; }
+    }
+    return o;
+  };
+  const find = (k: ThemeDesignFile['layouts'][number]['page']) =>
+    input.pages.find((p) => p.slug === k.slug && (p.locale ?? '') === k.locale)
+    ?? input.pages.find((p) => p.slug === k.slug)
+    ?? (k.isHome ? input.pages.find((p) => p.isHome && (p.locale ?? '') === k.locale) ?? input.pages.find((p) => p.isHome) : undefined);
+  const sectionPages: Pages = { ...input.stagedPages };
+  const matched: string[] = [], skipped: string[] = [];
+  for (const { page, layout } of file.layouts) {
+    const label = page.isHome ? 'Home' : `/${page.slug}`;
+    const target = find(page);
+    if (!target) { skipped.push(label); continue; }
+    sectionPages[target.id] = { ...layout, sections: layout.sections.map((s) => ({ ...s, data: remap(s.data) as typeof s.data })) };
+    matched.push(label);
+  }
+  const patch: Record<string, unknown> = {
+    designOverrides: file.designOverrides,
+    siteLogo: file.siteLogo, siteLogoDark: file.siteLogoDark, siteFavicon: file.siteFavicon, siteCover: file.siteCover,
+  };
+  if (installed) patch.activeTheme = file.activeTheme;
+  if (matched.length) patch.sectionPages = sectionPages;
+  // an empty list never wipes the receiving site's menus
+  const nav = input.includeNav && file.navItems?.length ? file.navItems : null;
+  if (nav) patch.navItems = nav.map((n) => ({ ...n, id: `tmp-${crypto.randomUUID()}` }));
+  return {
+    patch,
+    report: { theme: { slug: file.activeTheme, installed }, layouts: { matched, skipped }, links: { kept, dropped }, nav: nav ? nav.length : null },
+  };
+}
+
+export const themeFileName = (slug: string, now: number) =>
+  `${slug.replace(/[^a-z0-9-]/gi, '') || 'theme'}-${new Date(now).toISOString().slice(0, 10)}.acms-theme.zip`;

package/src/lib/theme.ts

@@ -194,6 +194,11 @@ export function listThemes(): Theme[] {
   return themes;
 }
 
+/** true for a theme from the project's src/themes/ (its code lives in the site repo) */
+export function isProjectTheme(slug: string): boolean {
+  return projectSlugs.has(slug);
+}
+
 export function getTheme(slug: string): Theme {
   return themes.find((t) => t.slug === slug) ?? themes.find((t) => t.slug === DEFAULT_THEME) ?? themes[0];
 }

package/src/lib/webhooks.ts

@@ -11,7 +11,7 @@
 // rejecting stale timestamps.
 import type { ContentRepository } from './repo/types';
 import type { Webhook, WebhookDelivery, WebhookEventType } from './schema';
-import { isPrivateHost } from './net';
+import { isPrivateHost, resolvesToPrivate } from './net';
 
 export const MAX_ATTEMPTS = 4;
 // minutes until attempt n+1 (after the first immediate try)
@@ -82,7 +82,12 @@ export async function attemptDelivery(repo: ContentRepository, d: WebhookDeliver
   const claimed = await repo.claimDelivery(d.id, now);
   if (!claimed) return false;
   d = claimed;
-  const fetcher: Fetcher = opts.fetcher ?? ((url, init) => fetch(url, init));
+  // the URL passed validateWebhookUrl when saved; re-check what its name
+  // resolves to now (dev allows local receivers, as validation does)
+  const fetcher: Fetcher = opts.fetcher ?? (async (url, init) => {
+    if (!import.meta.env?.DEV && await resolvesToPrivate(new URL(url).hostname)) throw new Error('private host');
+    return fetch(url, init);
+  });
   const ts = Math.floor(now / 1000);
   let code: number | null = null;
   try {

package/src/middleware.ts

@@ -1,6 +1,8 @@
 import { defineMiddleware } from 'astro:middleware';
+import type { APIContext, MiddlewareNext } from 'astro';
 import { I18N } from './lib/i18n';
-import { validateSession, SESSION_COOKIE } from './lib/auth';
+import { bindAuthEnvironment, getRequestAuth, shouldResolveClerk, validateRequestSession, withClerkHeaders } from './lib/auth/request';
+import { AUTH } from './lib/auth/config';
 import { getRepo } from './lib/repo';
 import { CONTENT } from './lib/content';
 import { processDueDeliveries, waitUntilFrom } from './lib/webhooks';
@@ -9,6 +11,8 @@ import { decideOverdue, sendDueReminders } from './lib/booking/service';
 import { PUSH } from './lib/push/config';
 import { processPushQueue, runPushJobs } from './lib/push/service';
 import { previewParamRedirect, hasPreviewCookie } from './lib/designPreview';
+import { applyCachePolicy } from './lib/cache/policy';
+import { bindExecutionContext, syncCachePurge } from './lib/cache/purge';
 
 // Legacy content-URL redirects, checked only on would-be 404s (below) so they
 // can never shadow real content. Tags moved from `${base}/tag/` to a
@@ -48,8 +52,16 @@ export function legacyContentRedirect(pathname: string): string | null {
 // Node target and local dev.
 let lastPublishCheck = 0;
 
-export const onRequest = defineMiddleware(async (context, next) => {
+// Every response, early redirects included, leaves through the cache policy
+// (lib/cache/policy.ts): public GET pages and the public app API get a
+// shared-cache header; everything personal or staff-only is private.
+export const onRequest = defineMiddleware(async (context, next) =>
+  applyCachePolicy(context.request, await handle(context, next), context.url.pathname));
+
+async function handle(context: APIContext, next: MiddlewareNext): Promise<Response> {
   const { pathname } = context.url;
+  bindAuthEnvironment(context.request, context.locals);
+  bindExecutionContext(context.request, context.locals);
 
   // one canonical URL per page: trailing-slash variants 301 to the bare path.
   // GET pages only — the astro:actions client POSTs to /_actions/<name>/ with
@@ -77,21 +89,31 @@ export const onRequest = defineMiddleware(async (context, next) => {
     }
   }
 
+  const auth = AUTH.provider === 'clerk' && shouldResolveClerk(context.request) ? await getRequestAuth(context.request, context.cookies, context.locals) : null;
+  if (auth?.headers.get('location') && context.request.method === 'GET' && !pathname.startsWith('/api/')) {
+    const headers = new Headers(auth.headers); headers.set('Cache-Control', 'no-store');
+    return new Response(null, { status: 307, headers });
+  }
+
+  if (pathname.startsWith('/api/') && (auth?.error === 'unavailable' || auth?.error === 'configuration')) {
+    return withClerkHeaders(Response.json({ error: 'Sign-in is temporarily unavailable. Please retry.' }, { status: 503 }), auth, context.request);
+  }
+
   // design preview links (?designPreview=1, ?designVersion=, ?preview=<token>,
   // ?preview=off) become a cookie, then the clean URL — so every link clicked
   // afterwards stays in preview mode
   const previewTo = await previewParamRedirect(context.url, context.request.method, context.cookies, async () =>
-    Boolean(await validateSession(context.cookies.get(SESSION_COOKIE)?.value, context.locals)));
-  if (previewTo) return context.redirect(previewTo, 302);
+    Boolean(await validateRequestSession(context.request, context.cookies, context.locals)));
+  if (previewTo) return withClerkHeaders(context.redirect(previewTo, 302), auth, context.request);
 
-  if (pathname.startsWith('/admin') && pathname !== '/admin/login') {
-    const token = context.cookies.get(SESSION_COOKIE)?.value;
-    if (!(await validateSession(token, context.locals))) {
+  if (pathname.startsWith('/admin') && pathname !== '/admin/login' && pathname !== '/admin/logout') {
+    if (auth?.error === 'configuration' || auth?.error === 'unavailable') return new Response('Sign-in is temporarily unavailable. Check the authentication configuration or try again later.', { status: 503, headers: { 'Cache-Control': 'no-store' } });
+    if (!(await validateRequestSession(context.request, context.cookies, context.locals))) {
       // editor-app sign-in comes back here after login (see login.astro's next)
       if (pathname === '/admin/app-auth' && context.request.method === 'GET') {
-        return context.redirect(`/admin/login?next=${encodeURIComponent(pathname + context.url.search)}`);
+        return withClerkHeaders(context.redirect(`/admin/login?next=${encodeURIComponent(pathname + context.url.search)}`), auth, context.request);
       }
-      return context.redirect('/admin/login');
+      return withClerkHeaders(context.redirect('/admin/login'), auth, context.request);
     }
   }
 
@@ -121,12 +143,16 @@ export const onRequest = defineMiddleware(async (context, next) => {
       const push = runPushJobs(repo, { locals: context.locals, fallbackOrigin: context.url.origin, now })
         .catch((e) => console.error('acms push: scheduled jobs failed', e));
       if (wait) wait(push);
+      // a purge that failed or was throttled after an earlier write
+      // (Node: detached — the process outlives the request)
+      const purge = syncCachePurge(repo, context.locals).catch((e) => console.error('acms cache: purge failed', e));
+      if (wait) wait(purge);
     } catch {
       // never let the publish sweep break a request
     }
   }
 
-  const response = await next();
+  const response = withClerkHeaders(await next(), auth, context.request);
 
   // Database writes enqueue publication/media notifications atomically.
   // Flush after mutations (including Astro actions), once their transaction
@@ -142,6 +168,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
         .catch((e) => console.error('acms push: queue flush failed', e));
       if (wait) wait(push);
     }
+    // content changed → clear shared caches (the scheduler retries failures)
+    const purge = getRepo(context.locals).then(repo => syncCachePurge(repo, context.locals))
+      .catch((e) => console.error('acms cache: purge failed', e));
+    if (wait) wait(purge);
   }
 
   // a preview render must never be cached where a visitor could get it
@@ -169,7 +199,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
   }
 
   return response;
-});
+}
 
 let redirectCache: { at: number; map: Map<string, { toPath: string; code: 301 | 302 }> } | null = null;
 

package/src/pages/[...slug].astro

@@ -3,7 +3,7 @@ import ThemeSections from '../components/ThemeSections.astro';
 import Site from '../layouts/Site.astro';
 import WidgetRenderer from '../components/WidgetRenderer.astro';
 import { getRepo } from '../lib/repo';
-import { validateSession, SESSION_COOKIE } from '../lib/auth';
+import { validateRequestSession } from '../lib/auth/request';
 import { expandDynamicBlocks } from '../lib/dynamicBlocks';
 import { highlightCodeHtml } from '../lib/highlightCode';
 import { resolveDesign } from '../lib/theme';
@@ -18,7 +18,7 @@ const rawPage = slug ? await repo.getPageBySlug(slug) : null;
 const page = rawPage ? localizeDoc(rawPage, locale) : null;
 
 // Drafts are visible only to a logged-in admin (doubles as draft preview).
-const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const isAdmin = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 if (!page || (page.status !== 'published' && !isAdmin)) {
   return new Response(null, { status: 404, statusText: 'Not found' });
 }
@@ -37,6 +37,7 @@ const PageTemplate = (page.template && settings.sectionPages?.[page.id]?.mode !=
 ---
 
 <Site
+  staffPreview={!!isAdmin && page.status !== 'published'}
   title={page.seoTitle || page.title}
   exactTitle={Boolean(page.seoTitle)}
   description={page.seoDesc || undefined}

package/src/pages/account/[action].astro

@@ -5,10 +5,16 @@ import { sha256 } from '../../lib/email/config';
 import { dispatchEmail, kickEmail } from '../../lib/email/service';
 import { waitUntilFrom } from '../../lib/webhooks';
 import { SESSION_COOKIE } from '../../lib/auth';
+import { AUTH } from '../../lib/auth/config';
 import '../../styles/admin.css';
 const action=Astro.params.action||'';
 if(!['invite','reset','forgot'].includes(action))return new Response('Not found',{status:404});
 Astro.response.headers.set('Cache-Control','no-store');
+// Clerk handles invitations and recovery; local links are never redeemed.
+if(AUTH.provider==='clerk'){
+  if(Astro.request.method!=='GET'&&Astro.request.method!=='HEAD')return new Response('Account access is managed by the sign-in provider.',{status:403,headers:{'Cache-Control':'no-store'}});
+  return new Response(null,{status:303,headers:{Location:'/admin/login','Cache-Control':'no-store','Referrer-Policy':'no-referrer'}});
+}
 Astro.response.headers.set('Referrer-Policy','no-referrer');
 Astro.response.headers.set('X-Robots-Tag','noindex');
 const repo=await getRepo(Astro.locals);

package/src/pages/admin/app-auth.astro

@@ -7,7 +7,10 @@ import { roleLabels } from '../../lib/roles';
 // return address and the PKCE challenge, then returns to the app.
 import { getRepo } from '../../lib/repo';
 import { BRAND } from '../../lib/brand';
-import { validateSession, OWNER_ENV, SESSION_COOKIE } from '../../lib/auth';
+import { OWNER_ENV } from '../../lib/auth';
+import { AUTH } from '../../lib/auth/config';
+import { getRequestAuth, requestSessionBinding } from '../../lib/auth/request';
+import ClerkSession from '../../components/auth/ClerkSession.astro';
 import { EDITOR } from '../../lib/editor/config';
 import { checkAuthorize, checkConsentTicket, consentTicket, issueCode, redirectWith } from '../../lib/editor/auth';
 import { bookingsEnabled } from '../../lib/calendar/config';
@@ -26,8 +29,10 @@ if (!EDITOR.enabled) return new Response(null, { status: 404 });
 
 const leave = (to: string) => new Response(null, { status: 303, headers: { Location: to, 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer' } });
 const repo = await getRepo(Astro.locals);
-const session = Astro.cookies.get(SESSION_COOKIE)?.value ?? '';
-const userId = await validateSession(session, Astro.locals);
+const auth = await getRequestAuth(Astro.request, Astro.cookies, Astro.locals);
+const userId = auth.userId;
+// consent tickets are bound to this browser session (built-in cookie or Clerk session)
+const session = await requestSessionBinding(Astro.request, Astro.cookies, Astro.locals);
 if (!userId) return Astro.redirect(`/admin/login?next=${encodeURIComponent(Astro.url.pathname + Astro.url.search)}`);
 
 const check = checkAuthorize(Astro.url.searchParams);
@@ -41,7 +46,10 @@ const envOwner = userId === OWNER_ENV;
 const user = envOwner ? null : await repo.getUser(userId);
 const settings = await repo.getSettings();
 const appName = EDITOR.name || params?.clientId || 'An app';
-const switchUrl = `/admin/logout?next=${encodeURIComponent(Astro.url.pathname + Astro.url.search)}`;
+const here = Astro.url.pathname + Astro.url.search;
+const switchUrl = `/admin/logout?next=${encodeURIComponent(here)}`;
+// Clerk sign-out only accepts a same-origin POST; built-in sign-out is a link
+const postLogout = AUTH.provider === 'clerk';
 
 let error = '';
 if (Astro.request.method === 'POST' && params && user) {
@@ -56,7 +64,7 @@ if (Astro.request.method === 'POST' && params && user) {
       const version = await repo.email.sessionVersion(user.id);
       if (version === null) error = 'Your account changed. Sign in again.';
       else {
-        const code = await issueCode(repo, { id: user.id, sessionVersion: version }, params, String(form.get('device_name') ?? ''));
+        const code = await issueCode(repo, { id: user.id, sessionVersion: version }, params, String(form.get('device_name') ?? ''), Date.now(), auth.clerk ?? undefined);
         return leave(redirectWith(params.redirectUri, { code, state: params.state, iss }));
       }
     }
@@ -85,8 +93,10 @@ const can = [
     <title>Sign in to {appName} · {settings.siteTitle}</title>
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet" />
+    <ClerkSession keepAlive signedOutUrl={`/admin/login?next=${encodeURIComponent(here)}`} />
   </head>
   <body>
+    {postLogout && <form id="switch-account" method="post" action={switchUrl} hidden></form>}
     <main class="login-wrap consent-wrap">
       <div class="card consent-card">
         <div class="consent-site">
@@ -110,7 +120,9 @@ const can = [
           <div class="consent-body">
             <h1>Use your own account</h1>
             <p class="consent-lead"><b>{appName}</b> signs in as a person, so each phone can be signed out on its own. You’re signed in with the owner password, which has no account to connect.</p>
-            <a class="btn primary block" href={switchUrl}>Sign in with an account</a>
+            {postLogout
+              ? <button class="btn primary block" type="submit" form="switch-account">Sign in with an account</button>
+              : <a class="btn primary block" href={switchUrl}>Sign in with an account</a>}
             <p class="hint consent-foot">Owners create accounts in Users.</p>
           </div>
         )}
@@ -150,7 +162,9 @@ const can = [
               <div><dt>Returns to</dt><dd><code>{returnTo}</code></dd></div>
               <div><dt>App ID</dt><dd><code>{params.clientId}</code></dd></div>
             </dl>
-            <p class="hint consent-foot">Not you? <a href={switchUrl}>Switch account</a></p>
+            <p class="hint consent-foot">Not you? {postLogout
+              ? <button class="linklike" type="submit" form="switch-account">Switch account</button>
+              : <a href={switchUrl}>Switch account</a>}</p>
           </form>
         )}
       </div>

package/src/pages/admin/calendar/resources/link.astro

@@ -80,6 +80,7 @@ if (Astro.request.method === 'POST') {
     minNotice: int(form.get('minNoticeH'), 0, 24 * 60, 2) * 60,
     maxAdvance: int(form.get('maxAdvance'), 1, 730, 90),
     perDayCap: int(form.get('perDayCap'), 0, 100, 0),
+    changeCutoff: int(form.get('changeCutoff'), 0, 8760, 0),
     hours: form.get('customHours') ? hoursFromForm(form, 'lh') : null,
     approval, approvalRules,
     // legacy flag for older API readers; approval is what decides
@@ -183,6 +184,7 @@ const effective = linkApproval(view, settings).mode;
           <label class="field"><span>Max per day <em class="hint">0 = no limit</em></span><input type="number" name="perDayCap" min="0" max="100" value={view.perDayCap} /></label>
           <label class="field"><span>Book at least (hours ahead)</span><input type="number" name="minNoticeH" min="0" max="1440" value={Math.round(view.minNotice / 60)} /></label>
           <label class="field"><span>Book up to (days ahead)</span><input type="number" name="maxAdvance" min="1" max="730" value={view.maxAdvance} /></label>
+          <label class="field"><span>Guests can change until (hours before) <em class="hint">0 = any time</em></span><input type="number" name="changeCutoff" min="0" max="8760" value={view.changeCutoff} /></label>
         </div>
       </section>
 

package/src/pages/admin/design.astro

@@ -3,7 +3,7 @@ import Admin from '../../layouts/Admin.astro';
 import { getRepo } from '../../lib/repo';
 import { env } from '../../lib/env';
 import DesignManager from '../../components/DesignManager';
-import { listThemes, FONT_PAIRINGS, getTheme } from '../../lib/theme';
+import { listThemes, FONT_PAIRINGS, getTheme, isProjectTheme } from '../../lib/theme';
 import { diffDesign } from '../../lib/designDiff';
 import { mergeDesignDraft } from '../../lib/drafts';
 import { postUrl } from '../../lib/content';
@@ -31,6 +31,7 @@ const themes = listThemes().map((t) => ({
   version: t.version,
   templateCount: Number(Boolean(t.HomeTemplate)) + Number(Boolean(t.EventTemplate)) + Object.keys(t.postTemplates).length + Object.keys(t.pageTemplates).length,
   sectionCount: Object.keys(t.sections).length,
+  project: isProjectTheme(t.slug),
 }));
 const unsplashEnabled = Boolean(env('UNSPLASH_ACCESS_KEY'));
 ---

package/src/pages/admin/import.astro

@@ -1,16 +1,18 @@
 ---
 import Admin from '../../layouts/Admin.astro';
 import ImportExport from '../../components/import/ImportExport';
+import { AUTH } from '../../lib/auth/config';
 import { getRepo } from '../../lib/repo';
-import { validateSession, OWNER_ENV, SESSION_COOKIE } from '../../lib/auth';
+import { OWNER_ENV } from '../../lib/auth';
+import { validateRequestSession } from '../../lib/auth/request';
 
 // owner-only: an import can create accounts and change site settings
 const repo = await getRepo(Astro.locals);
-const sessionUserId = await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals);
+const sessionUserId = await validateRequestSession(Astro.request, Astro.cookies, Astro.locals);
 const sessionUser = sessionUserId && sessionUserId !== OWNER_ENV ? await repo.getUser(sessionUserId) : null;
 if (sessionUserId !== OWNER_ENV && sessionUser?.role !== 'owner') return Astro.redirect('/admin/settings');
 const tab = Astro.url.searchParams.get('tab');
 ---
 <Admin title="Import & export" section="settings" wide>
-  <ImportExport client:load initialTab={tab === 'export' || tab === 'history' ? tab : 'import'} />
+  <ImportExport client:load initialTab={tab === 'export' || tab === 'history' ? tab : 'import'} clerk={AUTH.provider === 'clerk'} />
 </Admin>

package/src/pages/admin/index.astro

@@ -3,13 +3,14 @@ import Admin from '../../layouts/Admin.astro';
 import { getRepo } from '../../lib/repo';
 import { userConfig } from 'virtual:acms-config';
 import { CONTENT } from '../../lib/content';
-import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../lib/auth';
+import { OWNER_ENV } from '../../lib/auth';
+import { validateRequestSession } from '../../lib/auth/request';
 import { getTraffic, umamiReadEnabled } from '../../lib/umami';
 import { collectionUrl } from '../../lib/content';
 
 const coreVersion = userConfig.coreVersion;
 const repo = await getRepo(Astro.locals);
-const sessionUserId = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const sessionUserId = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 const [stats, pages, posts, links, settings, nav, users] = await Promise.all([
   repo.getStats(),
   repo.listPages(),

package/src/pages/admin/integrations.astro

@@ -3,7 +3,8 @@ import Admin from '../../layouts/Admin.astro';
 import Modal from '../../components/Modal.astro';
 import { getRepo } from '../../lib/repo';
 import { API_SCOPES, WEBHOOK_EVENTS, type ApiScope } from '../../lib/schema';
-import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../lib/auth';
+import { OWNER_ENV } from '../../lib/auth';
+import { validateRequestSession } from '../../lib/auth/request';
 import { CALENDAR, bookingsEnabled } from '../../lib/calendar/config';
 import { issueApiKey } from '../../lib/api-keys';
 import { attemptDelivery, generateWebhookSecret, validateWebhookUrl } from '../../lib/webhooks';
@@ -15,7 +16,7 @@ import { PROVIDERS } from '../../lib/maps/providers';
 // Site-wide integrations. Owners manage keys and webhook subscriptions;
 // calendar-specific feeds and API help appear only when enabled.
 const repo = await getRepo(Astro.locals);
-const sessionId = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const sessionId = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 const me = sessionId && sessionId !== OWNER_ENV ? await repo.getUser(sessionId) : null;
 const isOwner = sessionId === OWNER_ENV || me?.role === 'owner';
 const settings = await repo.getSettings();