@acms-subir/core 0.3.9 → 0.3.11

package/src/pages/api/v1/forms/[id]/index.ts

@@ -0,0 +1,7 @@
+import { getForm } from '../../../../../lib/mobile/forms';
+import { readRoute } from '../../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const GET = readRoute(getForm, true);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/forms/[id]/responses.ts

@@ -0,0 +1,6 @@
+import { submitFormResponse } from '../../../../../lib/mobile/forms';
+import { privateRoute } from '../../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+export const POST = privateRoute(submitFormResponse, { write: true, status: 201 });
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/guest/bookings.ts

@@ -0,0 +1,6 @@
+import { myBookings } from '../../../../lib/mobile/guest';
+import { privateRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const GET = privateRoute(myBookings);
+export const ALL = () => methodNotAllowed('GET, OPTIONS');

package/src/pages/api/v1/guest/code.ts

@@ -0,0 +1,6 @@
+import { requestCode } from '../../../../lib/mobile/guest';
+import { privateRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const POST = privateRoute(requestCode, { write: true, status: 202 });
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/guest/revoke.ts

@@ -0,0 +1,6 @@
+import { revokeGuest } from '../../../../lib/mobile/guest';
+import { privateRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const POST = privateRoute(revokeGuest, { write: true });
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/guest/token.ts

@@ -0,0 +1,6 @@
+import { exchangeCode } from '../../../../lib/mobile/guest';
+import { privateRoute } from '../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../lib/mobile/http';
+export const POST = privateRoute(exchangeCode, { write: true });
+export const ALL = () => methodNotAllowed('POST, OPTIONS');

package/src/pages/api/v1/links.ts

@@ -0,0 +1,7 @@
+import { getLinks } from '../../../lib/mobile/links';
+import { readRoute } from '../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../lib/mobile/http';
+export const GET = readRoute(getLinks, true, false, { timeless: true });
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/openapi.json.ts

@@ -2,6 +2,6 @@ import { getOpenApi } from '../../../lib/mobile/openapi';
 import { readRoute } from '../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../lib/mobile/http';
-export const GET = readRoute(getOpenApi, true, true);
+export const GET = readRoute(getOpenApi, true, true, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/push/topics.ts

@@ -2,6 +2,6 @@ import { listPushTopics } from '../../../../lib/push/api';
 import { readRoute } from '../../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../../lib/mobile/http';
-export const GET = readRoute(listPushTopics, true);
+export const GET = readRoute(listPushTopics, true, false, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/resources.ts

@@ -2,6 +2,6 @@ import { listResources } from '../../../lib/mobile/calendar';
 import { readRoute } from '../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../lib/mobile/http';
-export const GET = readRoute(listResources, true);
+export const GET = readRoute(listResources, true, false, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/search.ts

@@ -0,0 +1,7 @@
+import { search } from '../../../lib/mobile/search';
+import { readRoute } from '../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../lib/mobile/http';
+export const GET = readRoute(search, true);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();

package/src/pages/api/v1/theme.ts

@@ -2,6 +2,6 @@ import { getThemeTokens } from '../../../lib/mobile/site';
 import { readRoute } from '../../../lib/mobile/route';
 import { methodNotAllowed } from '../../../lib/mobile/http';
 export { preflight as OPTIONS } from '../../../lib/mobile/http';
-export const GET = readRoute(getThemeTokens);
+export const GET = readRoute(getThemeTokens, true, false, { timeless: true });
 export const HEAD = GET;
 export const ALL = () => methodNotAllowed();

package/src/pages/blog/[slug].astro

@@ -8,7 +8,7 @@ import { expandDynamicBlocks, extractToc } from '../../lib/dynamicBlocks';
 import TagLabel from '../../components/site/TagLabel.astro';
 import PostCard from '../../components/site/PostCard.astro';
 import { highlightCodeHtml } from '../../lib/highlightCode';
-import { validateSession, SESSION_COOKIE } from '../../lib/auth';
+import { validateRequestSession } from '../../lib/auth/request';
 import { slugify, authorSlug, publicTags } from '../../lib/schema';
 import { resolveDesign } from '../../lib/theme';
 import { effectiveSettings } from '../../lib/designPreview';
@@ -27,7 +27,7 @@ const locale = requestLocale(Astro.url, Astro.locals);
 const rawPost = slug ? await repo.getPostBySlug(slug, col.key) : null;
 const post = rawPost ? localizeDoc(rawPost, locale) : null;
 
-const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const isAdmin = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 if (!post || (post.status !== 'published' && !isAdmin)) {
   return new Response(null, { status: 404, statusText: 'Not found' });
 }
@@ -111,6 +111,7 @@ const shareLi = `https://www.linkedin.com/sharing/share-offsite/?url=${encodeURI
 ---
 
 <Site
+  staffPreview={!!isAdmin && post.status !== 'published'}
   title={post.seoTitle || post.title}
   exactTitle={Boolean(post.seoTitle)}
   description={post.seoDesc || post.excerpt || undefined}

package/src/pages/book/[resource]/[link].astro

@@ -3,7 +3,7 @@ import Site from '../../../layouts/Site.astro';
 import BookingFlow from '../../../components/booking/BookingFlow.astro';
 import { getRepo } from '../../../lib/repo';
 import { bookingsEnabled, manageUrl, resourceUrl } from '../../../lib/calendar/config';
-import { availabilityContext, createResourceBooking, rescheduleBooking, BookingError } from '../../../lib/booking/service';
+import { availabilityContext, createResourceBooking, guestMoveLink, guestReschedule, BookingError } from '../../../lib/booking/service';
 import { siteOrigin } from '../../../lib/seo';
 import { waitUntilFrom } from '../../../lib/webhooks';
 
@@ -36,7 +36,7 @@ if (Astro.request.method === 'POST') {
     if (token) {
       const b = await repo.getBookingByToken(token);
       if (!b || b.linkId !== link.id) throw new BookingError(404, 'That booking can’t be found.');
-      await rescheduleBooking(repo, b, start, end, flow);
+      await guestReschedule(repo, b, start, end, flow);
       return Astro.redirect(`${manageUrl(b.manageToken)}?moved=1`);
     }
     const answers: Record<string, string> = {};
@@ -59,7 +59,7 @@ if (Astro.request.method === 'POST') {
     Astro.response.status = err instanceof BookingError ? err.status : 500;
   }
 }
-const ctx = await availabilityContext(repo, resource, link, settings, Date.now(), reschedule?.id);
+const ctx = await availabilityContext(repo, resource, reschedule ? guestMoveLink(link) : link, settings, Date.now(), reschedule?.id);
 ---
 
 <Site title={`${link.name} · ${resource.name}`} description={link.description || `Book ${resource.name}.`} noindex={link.visibility === 'unlisted' || resource.visibility === 'unlisted'}>

package/src/pages/book/manage/[token].astro

@@ -2,7 +2,7 @@
 import Site from '../../../layouts/Site.astro';
 import { getRepo } from '../../../lib/repo';
 import { CALENDAR, bookingLinkUrl, bookingsEnabled, eventUrl, resourceUrl } from '../../../lib/calendar/config';
-import { setBookingStatus, BookingError } from '../../../lib/booking/service';
+import { guestCancel, guestChanges, BookingError } from '../../../lib/booking/service';
 import { bookingIcs, whenText } from '../../../lib/booking/emails';
 import { resourceZone } from '../../../lib/booking/availability';
 import { eventTimeZone, locationLine } from '../../../lib/calendar/events';
@@ -38,7 +38,7 @@ if (Astro.request.method === 'POST') {
   const form = await Astro.request.formData();
   if (form.get('op') === 'cancel' && (booking.status === 'pending' || booking.status === 'confirmed')) {
     try {
-      current = await setBookingStatus(repo, booking, 'cancelled', { origin, locals: Astro.locals, waitUntil: waitUntilFrom(Astro.locals) });
+      current = await guestCancel(repo, booking, { origin, locals: Astro.locals, waitUntil: waitUntilFrom(Astro.locals) });
     } catch (err) {
       error = err instanceof BookingError ? err.message : 'Couldn’t cancel — please try again.';
     }
@@ -48,6 +48,7 @@ const tz = event ? eventTimeZone(event, settings) : resource ? resourceZone(reso
 const when = whenText(current, tz, settings, link?.mode === 'day' || event?.allDay);
 const active = current.status === 'pending' || current.status === 'confirmed';
 const upcoming = current.end > Date.now();
+const can = guestChanges(current, link);
 const isNew = Astro.url.searchParams.has('new');
 const moved = Astro.url.searchParams.has('moved');
 const heading = current.status === 'cancelled' ? 'Booking cancelled'
@@ -91,15 +92,18 @@ const googleUrl = `https://calendar.google.com/calendar/render?${new URLSearchPa
             </div>
           </details>
         )}
-        {resource && link && current.kind === 'booking' && (
+        {resource && link && can.reschedule && (
           <a class="pc-manage-btn" href={`${bookingLinkUrl(resource.slug, link.slug)}?reschedule=${encodeURIComponent(current.manageToken)}`}>Reschedule</a>
         )}
-        <form method="post" onsubmit="return confirm('Cancel this booking?')">
-          <input type="hidden" name="op" value="cancel" />
-          <button class="pc-manage-btn is-danger" type="submit">Cancel {current.kind === 'rsvp' ? 'RSVP' : 'booking'}</button>
-        </form>
+        {can.cancel && (
+          <form method="post" onsubmit="return confirm('Cancel this booking?')">
+            <input type="hidden" name="op" value="cancel" />
+            <button class="pc-manage-btn is-danger" type="submit">Cancel {current.kind === 'rsvp' ? 'RSVP' : 'booking'}</button>
+          </form>
+        )}
       </div>
     )}
+    {can.closed && <p class="pc-manage-note">Changes close {can.cutoffHours} hours before the start. Please contact us to change or cancel.</p>}
     <p class="pc-bk-foot">
       {event ? <a href={eventUrl(event.slug)}>Back to {event.title}</a> : resource ? <a href={resourceUrl(resource.slug)}>Back to {resource.name}</a> : null}
     </p>

package/src/pages/events/[slug].astro

@@ -12,7 +12,7 @@ import EventPage from '../../components/EventPage.astro';
 import { getRepo } from '../../lib/repo';
 import { expandDynamicBlocks } from '../../lib/dynamicBlocks';
 import { highlightCodeHtml } from '../../lib/highlightCode';
-import { validateSession, SESSION_COOKIE } from '../../lib/auth';
+import { validateRequestSession } from '../../lib/auth/request';
 import { effectiveSettings } from '../../lib/designPreview';
 import { resolveDesign } from '../../lib/theme';
 import { siteOrigin } from '../../lib/seo';
@@ -34,7 +34,7 @@ const rawEvent = await repo.getEventBySlug(Astro.params.slug ?? '');
 const event = rawEvent ? localizeDoc(rawEvent, locale) : null;
 const [rawSettings, allCalendars] = await Promise.all([repo.getSettings(), repo.listCalendars()]);
 const calMap = new Map(allCalendars.map((c) => [c.id, c]));
-const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const isAdmin = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 if (!event || (!eventIsPublic(event, calMap) && !isAdmin)) return new Response(null, { status: 404, statusText: 'Not found' });
 
 const baseSettings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
@@ -81,6 +81,7 @@ const props = { event, occurrence, settings, calendars, html, upcoming, origin,
 ---
 
 <Site
+  staffPreview={!!isAdmin && !eventIsPublic(event, calMap)}
   title={event.seoTitle || event.title}
   exactTitle={Boolean(event.seoTitle)}
   description={event.seoDesc || event.excerpt || undefined}

package/src/pages/preview/[type]/[id].astro

@@ -6,7 +6,7 @@ import { renderMarkdown } from '../../../lib/markdown';
 import { verifyPreviewToken } from '../../../lib/preview';
 import { expandDynamicBlocks } from '../../../lib/dynamicBlocks';
 import { highlightCodeHtml } from '../../../lib/highlightCode';
-import { validateSession, SESSION_COOKIE } from '../../../lib/auth';
+import { validateRequestSession } from '../../../lib/auth/request';
 import { mergeEventDraft, mergePageDraft, mergePostDraft } from '../../../lib/drafts';
 import EventPage from '../../../components/EventPage.astro';
 import { featuredOccurrence } from '../../../lib/calendar/events';
@@ -19,7 +19,7 @@ import { siteOrigin } from '../../../lib/seo';
 const { type, id } = Astro.params;
 if (type !== 'post' && type !== 'page' && type !== 'event') return new Response(null, { status: 404 });
 
-const isAdmin = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const isAdmin = (await validateRequestSession(Astro.request, Astro.cookies, Astro.locals));
 const token = Astro.url.searchParams.get('token') ?? undefined;
 if (!isAdmin && !verifyPreviewToken(type, id!, token)) {
   return new Response(null, { status: 404 });
@@ -53,7 +53,7 @@ const fmt = (ts: number | null) =>
   ts ? new Date(ts).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' }) : '';
 ---
 
-<Site title={post?.title ?? event?.title ?? page?.seoTitle ?? page?.title}>
+<Site title={post?.title ?? event?.title ?? page?.seoTitle ?? page?.title} staffPreview={!!isAdmin}>
   {event && eventView?.occurrence && (
     <EventPage event={event} occurrence={eventView.occurrence} settings={eventView.settings} calendars={eventView.calendars} html={eventView.html} upcoming={[]} origin={eventView.origin} preview />
   )}

package/src/styles/admin.css

@@ -757,6 +757,25 @@ dialog.modal[open] { animation: modal-in 0.16s ease-out; }
 .btn.block { width: 100%; justify-content: center; min-height: 38px; }
 .login-note { margin-top: 14px; }
 .login-for-app { text-align: center; margin: -8px 0 14px; color: var(--muted); }
+.login-card.is-clerk { max-width: 420px; }
+.login-mount { min-height: 180px; }
+.login-mount[hidden] { display: none; }
+.login-loading { display: flex; align-items: center; justify-content: center; gap: 10px; min-height: 180px; margin: 0; color: var(--muted); font-size: 13px; }
+.login-spinner { width: 16px; height: 16px; border-radius: 50%; border: 2px solid var(--line-strong); border-top-color: var(--accent); animation: login-spin 0.8s linear infinite; }
+@keyframes login-spin { to { transform: rotate(360deg); } }
+@media (prefers-reduced-motion: reduce) { .login-spinner { animation-duration: 2.4s; } }
+.login-clerk [data-clerk-error] { display: flex; align-items: center; justify-content: space-between; gap: 10px; flex-wrap: wrap; }
+.login-clerk [data-clerk-error][hidden] { display: none; }
+.login-state { text-align: center; }
+.login-state h1 { font-size: 19px; letter-spacing: -0.02em; margin: 10px 0 6px; }
+.login-state p { color: var(--text-2); margin: 0 0 10px; overflow-wrap: anywhere; }
+.login-state .hint { margin-bottom: 18px; line-height: 1.5; }
+.login-state-icon { display: inline-grid; place-items: center; width: 40px; height: 40px; border-radius: var(--r-md); background: var(--sel); color: var(--text-2); }
+.login-state-icon svg { width: 20px; height: 20px; }
+.login-state-icon.is-warn { background: var(--amber-soft); color: var(--amber); }
+.login-state-icon.is-error { background: var(--red-soft); color: var(--red); }
+.login-actions { display: grid; gap: 8px; }
+[data-clerk-profile][hidden] { display: none; }
 
 /* editor-app sign-in (consent) — same paper card as login, a little wider */
 .consent-wrap { align-items: start; padding-top: max(8vh, 20px); }
@@ -1238,19 +1257,72 @@ input.mono { font-family: ui-monospace, 'SF Mono', monospace; font-size: 12.5px;
 .grow-text { flex: 1; min-width: 220px; }
 .grow-text .hint { margin-left: 6px; }
 .hint.tight { margin: 2px 0 0; }
-.user-form { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
-.user-form-row { display: flex; gap: 8px; flex-wrap: wrap; width: 100%; align-items: center; }
-.user-form .w-name { width: 150px; }
-.user-form .w-role { width: 100px; }
-.user-form .w-pass { width: 180px; }
-.user-form .w-slug { width: 140px; }
-.user-form .w-grow { flex: 1; min-width: 220px; }
-.user-form .w-full { width: 100%; }
-.user-email { min-width: 180px; }
 .td-actions { text-align: right; width: 80px; }
-@media (max-width: 767px) {
-  .user-form .w-name, .user-form .w-role, .user-form .w-pass, .user-form .w-slug, .user-form .w-grow { width: 100%; min-width: 0; flex: 1 1 100%; }
-}
+/* Users: sign-in strip, tabs, member table, profile drawer */
+.auth-strip { display: flex; align-items: center; gap: 12px; padding: 12px 16px; margin-bottom: 18px; }
+.auth-mark { flex: none; display: grid; place-items: center; width: 32px; height: 32px; border-radius: var(--r-md); background: var(--sel); color: var(--text-2); }
+.auth-mark svg { width: 17px; height: 17px; }
+.auth-main { flex: 1; min-width: 0; }
+.auth-main h2 { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; font-size: 13.5px; margin: 0 0 2px; }
+.auth-main .hint { margin: 0; line-height: 1.5; }
+.auth-where { flex: none; margin: 0; font-size: 12px; }
+.users-tabs { margin-bottom: 12px; }
+.users-tabs .count { font-size: 11px; font-weight: 600; color: var(--muted); background: var(--panel-2); border-radius: var(--r-full); padding: 0 6px; min-width: 18px; text-align: center; }
+.users-tabs [aria-selected='true'] .count { color: var(--text-2); background: var(--sel); }
+.users-panel[hidden] { display: none; }
+.users-panel.devices-card { margin-top: 0; }
+.users-panel-hint { margin: 0; padding: 14px 18px 4px; }
+.users-table tr[data-user-row] { cursor: pointer; }
+.users-table td { padding-top: 10px; padding-bottom: 10px; }
+.user-cell { display: flex; align-items: center; gap: 11px; min-width: 0; }
+.avatar.user-av { width: 32px; height: 32px; font-size: 11px; }
+.user-who { display: flex; flex-direction: column; min-width: 0; line-height: 1.35; }
+.user-who .t-title, .user-who .t-sub { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.user-you { margin-left: 7px; font-size: 10.5px; font-weight: 600; letter-spacing: 0.04em; text-transform: uppercase; color: var(--faint); }
+dialog.modal.drawer {
+  margin: 0 0 0 auto; width: min(440px, 100vw); height: 100dvh; max-height: 100dvh; max-width: 100vw;
+  border-radius: var(--r-lg) 0 0 var(--r-lg); border-left: 1px solid var(--line-strong);
+  flex-direction: column; overflow: hidden;
+}
+dialog.modal.drawer[open] { display: flex; animation: drawer-in 0.2s ease-out; }
+@keyframes drawer-in { from { opacity: 0.4; transform: translateX(28px); } }
+.drawer-head { display: flex; align-items: center; gap: 12px; padding: 18px 20px 16px; border-bottom: 1px solid var(--line); }
+.avatar.drawer-av { width: 46px; height: 46px; font-size: 15px; }
+.drawer-title { flex: 1; min-width: 0; }
+.drawer-title h2 { font-size: 16px; margin: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.drawer-title a { font-size: 12px; color: var(--muted); text-decoration: none; }
+.drawer-title a:hover { color: var(--accent-deep); }
+.drawer-body { flex: 1; overflow-y: auto; padding: 4px 20px 8px; }
+.drawer-body > .flash { margin: 14px 0 0; }
+.drawer-sec { padding: 16px 0 6px; border-bottom: 1px solid var(--line); }
+.drawer-sec:last-child { border-bottom: 0; }
+.drawer-sec h3 { margin: 0 0 10px; font-size: 11px; font-weight: 600; letter-spacing: 0.07em; text-transform: uppercase; color: var(--faint); }
+.drawer-kv { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-bottom: 12px; font-size: 13px; }
+.drawer-kv .k { color: var(--muted); flex: none; }
+.drawer-kv .v { display: flex; align-items: center; gap: 8px; min-width: 0; }
+.drawer-email { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.drawer-link { display: flex; gap: 8px; flex-wrap: wrap; margin-bottom: 12px; }
+.drawer-link input { flex: 1; min-width: 0; font-family: ui-monospace, 'SF Mono', Menlo, Consolas, monospace; font-size: 12px; }
+.drawer-link .hint { flex-basis: 100%; margin: 0; }
+label.field > .slug-wrap { display: flex; margin: 0; font-size: inherit; font-weight: inherit; color: var(--text); }
+.drawer-sec .slug-wrap input { flex: 1; min-width: 0; }
+.drawer-foot { display: flex; align-items: center; gap: 8px; padding: 12px 20px; border-top: 1px solid var(--line); background: var(--panel-2); }
+.drawer-foot .spacer { flex: 1; }
+input.is-readonly { background: transparent; border-style: dashed; color: var(--text-2); }
+.callout { margin: 0 0 12px; padding: 10px 12px; border-radius: var(--r-md); background: var(--blue-soft); color: var(--blue); font-size: 12.5px; line-height: 1.5; }
+.callout.warn { background: var(--amber-soft); color: var(--amber); }
+@media (max-width: 640px) {
+  dialog.modal.drawer { width: 100vw; border-radius: 0; border-left: 0; }
+  .auth-strip { flex-wrap: wrap; }
+  .auth-where { flex-basis: 100%; margin-left: 44px; }
+  .users-table th:nth-child(3), .users-table td:nth-child(3) { display: none; }
+}
+/* Users: flash messages + Clerk re-verification */
+.users-flash { display: flex; align-items: center; justify-content: space-between; gap: 10px; flex-wrap: wrap; }
+.users-flash-actions { display: inline-flex; gap: 6px; flex-wrap: wrap; }
+.reverify-text { margin: 0 0 8px; font-size: 14px; line-height: 1.5; }
+.reverify-dialog .hint { margin: 0; }
+[data-acms-reverify][hidden] { display: none; }
 .sheet:focus, .sheet:focus-visible { outline: none; }
 
 /* ---- calendar module (events list, calendars) --------------------------- */
@@ -1511,10 +1583,6 @@ a.bk-row:hover, .bk-row.is-sel { background: var(--hover); }
   .dm-status-actions { margin-left: 0; width: 100%; }
 }
 
-/* role: marker + text (no badges) */
-.role-mark { display: inline-flex; align-items: center; gap: 6px; font-size: 12.5px; font-weight: 600; color: var(--text-2); }
-.role-mark i { width: 7px; height: 7px; border-radius: 2px; background: var(--blue); }
-.role-mark i.is-owner { background: var(--accent); }
 
 /* Users → Signed-in apps */
 .devices-card { margin-top: 20px; }
@@ -1590,3 +1658,88 @@ a.bk-row:hover, .bk-row.is-sel { background: var(--hover); }
 /* Bookings → Day view: a room held by an event (tinted, dashed; links to the event) */
 .bk-blk.is-hold { background: color-mix(in srgb, var(--accent) 10%, var(--panel)); border: 1px dashed var(--accent-ring); z-index: 0; }
 .bk-blk:not(.is-hold) { z-index: 1; }
+/* Admin → Mobile app → App access: plain rows, square switches (no pills) */
+.acc { display: grid; gap: 16px; margin-bottom: 24px; }
+.acc .card { margin: 0; }
+.acc-row { display: flex; align-items: center; justify-content: space-between; gap: 16px; padding: 12px 0; border-top: 1px solid var(--line); }
+.acc .card-head + .acc-row { border-top: 0; }
+.acc-row > div:first-child { min-width: 0; }
+.acc-row b { display: block; font-size: 14px; }
+.acc-row small { display: block; color: var(--muted); font-size: 12.5px; margin-top: 2px; }
+.acc-row small.acc-warn { color: var(--amber); }
+.acc-actions { display: flex; align-items: center; gap: 10px; flex: none; }
+.acc-switch { width: 38px; height: 22px; border-radius: 7px; border: 0; padding: 0; background: var(--line-strong); position: relative; flex: none; cursor: pointer; }
+.acc-switch i { position: absolute; top: 3px; left: 3px; width: 16px; height: 16px; border-radius: 5px; background: #fff; box-shadow: 0 1px 2px rgb(0 0 0 / 25%); transition: left 0.15s; }
+.acc-switch.on { background: var(--accent); }
+.acc-switch.on i { left: 19px; }
+.acc-switch:focus-visible { outline: 2px solid var(--accent-ring); outline-offset: 2px; }
+.acc-switch:disabled { opacity: 0.5; cursor: not-allowed; }
+.acc-row input.acc-num { width: 96px; flex: none; text-align: right; }
+@media (max-width: 640px) {
+  /* switches and numbers stay beside their label; the role picker takes its own line */
+  .acc-row { flex-wrap: wrap; }
+  .acc-row > div:first-child { flex: 1 1 180px; }
+  .acc-row .seg { width: 100%; }
+  .acc-row .seg > * { flex: 1; }
+}
+
+/* Settings → Monitoring (Uptime Kuma) */
+.mon { display: grid; gap: 16px; }
+.mon .flash { margin: 0; }
+.mon-dot { display: inline-block; width: 9px; height: 9px; border-radius: 3px; margin-right: 8px; vertical-align: 1px; background: var(--faint); }
+.mon-dot.up { background: var(--green); }
+.mon-dot.down { background: var(--red); }
+.mon-dot.pending, .mon-dot.maintenance { background: var(--amber); }
+.mon-self { display: flex; flex-wrap: wrap; align-items: center; gap: 6px 18px; font-size: 13px; color: var(--text-2); padding: 12px 14px; background: var(--panel-2); border-radius: var(--r-md); }
+.mon-self b { color: var(--text); }
+.mon-self a { margin-left: auto; color: var(--muted); font-size: 12.5px; }
+.mon-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 10px; }
+.mon-tile { background: var(--panel); border: 1px solid var(--line); border-radius: var(--r-md); padding: 12px 14px; min-width: 0; }
+.mon-tile.is-down { background: var(--red-soft); border-color: rgb(192 59 59 / 25%); }
+.mon-name { font-weight: 600; font-size: 14px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.mon-sub { color: var(--muted); font-size: 12.5px; margin-top: 2px; }
+.mon-sub .nw { white-space: nowrap; }
+.mon-msg { color: var(--red); font-size: 12.5px; margin-top: 4px; overflow-wrap: anywhere; }
+.mon-beats { display: flex; gap: 2px; margin-top: 10px; height: 14px; }
+.mon-beats i { flex: 1; max-width: 8px; border-radius: 2px; background: var(--green); opacity: 0.75; }
+.mon-beats i.down { background: var(--red); opacity: 1; }
+.mon-beats i.pending, .mon-beats i.maintenance { background: var(--amber); }
+.mon-empty { border: 1px dashed var(--line-strong); border-radius: var(--r-md); padding: 14px 16px; }
+.mon-empty p { margin: 4px 0 0; color: var(--text-2); font-size: 13px; }
+.mon-cmd { display: block; margin: 8px 0; padding: 8px 10px; overflow-x: auto; white-space: nowrap; font-size: 12.5px; }
+.mon-fields { display: grid; gap: 14px; }
+.mon-field { display: grid; gap: 6px; font-size: 13px; }
+.mon-field > span { font-weight: 600; color: var(--text); }
+.mon-field > span small { font-weight: 400; color: var(--muted); margin-left: 6px; }
+.mon-field > small { color: var(--muted); }
+.mon-field input { width: 100%; min-width: 0; }
+.mon-inline { display: flex; gap: 8px; }
+.mon-inline input { flex: 1; }
+.mon-inline .btn { flex: none; }
+.mon-actions { display: flex; justify-content: flex-end; gap: 8px; }
+@media (max-width: 640px) {
+  .mon-self a { margin-left: 0; }
+  .mon-field > span small { display: block; margin: 2px 0 0; }
+  .mon-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 8px; }
+  .mon-tile { padding: 10px 12px; }
+  .mon-sub { font-size: 12px; }
+}
+
+/* Design → Export / Import theme (ThemeTransfer) */
+.tt-muted { color: var(--muted); }
+.tt-small { font-size: 12px; margin: 10px 0 0; }
+.check-row .tt-muted { font-size: 12px; margin-left: 2px; }
+.tt-note { font-size: 12.5px; color: var(--text-2); background: var(--panel-2); border-radius: var(--r-md); padding: 9px 11px; margin: 10px 0 0; }
+.tt-note.warn { background: var(--amber-soft); color: var(--amber); }
+.tt-drop { display: flex; align-items: center; justify-content: center; border: 1.5px dashed var(--line-strong); border-radius: var(--r-md); padding: 26px 12px; cursor: pointer; color: var(--text-2); }
+.tt-drop:hover { border-color: var(--accent); color: var(--text); }
+.tt-drop input { position: absolute; width: 1px; height: 1px; opacity: 0; }
+.tt-drop:focus-within { box-shadow: 0 0 0 3px var(--accent-ring); }
+.tt-pkg { border: 1px solid var(--line); border-radius: var(--r-md); background: var(--panel); padding: 10px 12px; margin-bottom: 12px; }
+.tt-pkg small { display: block; color: var(--muted); font-size: 12px; }
+.tt-list { list-style: none; margin: 0; padding: 0; }
+.tt-list li { padding: 9px 0; border-top: 1px solid var(--line); font-size: 13px; }
+.tt-list li:first-child { border-top: 0; }
+.tt-list small { display: block; color: var(--muted); font-size: 12px; }
+.tt-list .check-row { margin: 0; }
+.tt-list .imp-mark { font-size: 11px; font-weight: 600; color: var(--green); background: var(--green-soft); border-radius: 999px; padding: 1px 7px; margin-left: 4px; }

package/src/styles/email-settings.css

@@ -63,6 +63,12 @@
 .ems-note { background: var(--amber-soft); color: var(--text-2); border-radius: var(--r-md); padding: 9px 13px; margin: 0 0 12px; font-size: 13px; }
 .ems-pw { max-width: 340px; margin-top: 4px; }
 .ems-pw .hint { display: block; margin-top: 4px; }
+.ems-verify { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; margin-top: 4px; padding: 10px 12px; background: var(--panel-2); border: 1px solid var(--line); border-radius: var(--r-md); }
+.ems-verify p { flex: 1; min-width: 200px; margin: 0; font-size: 12.5px; color: var(--muted); line-height: 1.45; }
+.ems-verify p b { color: var(--text-2); font-weight: 600; }
+.ems-verify-mark { flex: none; display: grid; place-items: center; width: 28px; height: 28px; border-radius: var(--r-sm); background: var(--sel); color: var(--text-2); }
+.ems-verify-mark svg { width: 16px; height: 16px; }
+.ems-verify-actions { display: inline-flex; gap: 6px; }
 .ems-actions { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
 .ems-row { display: flex; gap: 8px; align-items: flex-end; flex-wrap: wrap; margin-bottom: 12px; }
 .ems-row .field { margin-bottom: 0; }

package/src/virtual.d.ts

@@ -3,6 +3,7 @@
 declare module 'virtual:acms-config' {
   export const userConfig: {
     coreVersion: string;
+    auth?: { provider: 'builtin' | 'clerk' };
     brand: { name?: string; version?: string; stack?: string };
     seed: { siteTitle?: string; tagline?: string; heroHeading?: string; heroSub?: string };
     // resolved (defaults applied + validated) by integration.mjs; `posts`

package/src/worker.ts

@@ -3,6 +3,7 @@ import { App } from 'astro/app';
 import { handle } from '@astrojs/cloudflare/handler';
 import { D1Repository, type D1Database } from './lib/repo/d1';
 import { runScheduledTasks } from './lib/scheduler';
+import { EXECUTION_CONTEXT } from './lib/cache/purge';
 
 // Custom Workers entrypoint (wired via the adapter's workerEntryPoint
 // option): identical fetch behavior to the stock entry, plus a cron-driven
@@ -19,11 +20,16 @@ export function createExports(manifest: SSRManifest) {
   return {
     default: {
       async fetch(request: HandleRequest, env: HandleEnv, context: HandleContext) {
+        // the adapter's locals.runtime.ctx has no `cache`; the middleware
+        // reads Workers Cache from here (lib/cache/purge.ts)
+        Reflect.set(request, EXECUTION_CONTEXT, context);
         return handle(manifest, app, request, env, context);
       },
       async scheduled(_controller: unknown, env: HandleEnv, context: HandleContext) {
         const repo = new D1Repository(env.DB as D1Database);
-        context.waitUntil(runScheduledTasks(repo, { runtime: { env } }).then(report => {
+        // ctx carries Workers Cache (ctx.cache) for the purge job; `scheduled`
+        // tells it a missing ctx.cache here doesn't mean caching is off
+        context.waitUntil(runScheduledTasks(repo, { runtime: { env, ctx: context, scheduled: true } }).then(report => {
           if (!report.ok) throw new Error('Scheduled maintenance failed; see authenticated operations status.');
         }));
       },