@acms-subir/core 0.3.9 → 0.3.11

package/src/lib/editor/site-data.ts

@@ -0,0 +1,110 @@
+import { z } from 'zod';
+import type { Link } from '../schema';
+import { LinkKind } from '../schema';
+import { ApiError } from '../api';
+import { displayAnswers } from '../forms/service';
+import type { EditorContext } from './http';
+import { isAdmin, requireAdmin } from './roles';
+
+// Forms and the links page from editor apps. Any staff account sees which
+// forms exist and how many responses they have; reading responses (personal
+// details) takes an administrator or owner. The links page is editable by
+// staff, except raw HTML blocks and inline SVG icons, which run on the
+// public page and so need an administrator or owner.
+
+const iso = (n: number | null) => (n === null ? null : new Date(n).toISOString());
+
+export async function listFormsFor(c: EditorContext) {
+  const [forms, stats] = await Promise.all([c.repo.forms.list(), c.repo.forms.stats()]);
+  return {
+    canReadResponses: isAdmin(c.who),
+    forms: forms.filter((f) => f.kind === 'form').map((f) => ({
+      id: f.id, name: f.name, title: f.definition.title || f.name, purpose: f.purpose, status: f.status, hasDraft: Boolean(f.draft),
+      responses: stats.get(f.id)?.count ?? 0, lastResponseAt: iso(stats.get(f.id)?.last ?? null), updatedAt: iso(f.updatedAt),
+    })),
+  };
+}
+
+export const ResponsesQuery = z.object({
+  q: z.string().max(100).optional(), since: z.string().datetime({ offset: true }).optional(),
+  page: z.coerce.number().int().min(1).max(10000).default(1), limit: z.coerce.number().int().min(1).max(100).default(25),
+}).strict();
+export async function formResponsesFor(c: EditorContext, id: string, q: z.infer<typeof ResponsesQuery>) {
+  requireAdmin(c.who, 'read form responses');
+  const form = await c.repo.forms.get(id);
+  if (!form || form.kind !== 'form') throw new ApiError(404, 'Form not found.');
+  const rows = await c.repo.forms.searchSubmissions(id, { q: q.q, since: q.since ? Date.parse(q.since) : undefined, limit: q.limit + 1, offset: (q.page - 1) * q.limit });
+  return {
+    form: { id: form.id, name: form.name },
+    items: rows.slice(0, q.limit).map((s) => ({
+      id: s.id, createdAt: iso(s.createdAt)!,
+      // labelled answers from the questions as they were when submitted
+      answers: Object.entries(displayAnswers(s.response)).map(([label, value]) => ({ label, value })),
+    })),
+    pagination: { page: q.page, limit: q.limit, nextPage: rows.length > q.limit ? q.page + 1 : null },
+  };
+}
+
+// ---- links page ----------------------------------------------------------------
+
+const linkView = (l: Link) => ({ id: l.id, kind: l.kind, label: l.label, url: l.url, icon: l.icon, html: l.html, meta: l.meta, clicks: l.clicks });
+
+export async function getLinksFor(c: EditorContext) {
+  // revision first: a change landing between the reads leaves it stale (the
+  // next save gets a 409), never newer than the blocks it is sent with
+  const revision = await c.repo.linksRevision();
+  const [settings, links] = await Promise.all([c.repo.getSettings(), c.repo.listLinks()]);
+  return { revision, name: settings.linksName, bio: settings.linksBio, avatar: settings.linksAvatar, canEditHtml: isAdmin(c.who), items: links.map(linkView) };
+}
+
+const Item = z.object({
+  // omit for a new block; an existing id keeps its click count
+  id: z.string().max(100).optional(),
+  kind: LinkKind.default('link'), label: z.string().max(200).default(''), url: z.string().max(2000).default(''),
+  icon: z.string().max(5000).default(''), html: z.string().max(20_000).default(''),
+  meta: z.record(z.unknown()).default({}).refine((m) => JSON.stringify(m).length <= 4000, 'Block settings are too large.'),
+}).strict();
+export const LinksPut = z.object({
+  // from GET /admin/links; a stale revision is a 409 and nothing is saved
+  revision: z.number().int().min(0),
+  name: z.string().max(120).optional(), bio: z.string().max(500).optional(),
+  avatar: z.string().max(1000).refine((v) => !v || /^(https?:\/\/|\/)/.test(v), 'Use an http(s) or site path image.').optional(),
+  // the whole page in display order; blocks left out are removed
+  items: z.array(Item).max(200),
+}).strict();
+
+const urlKinds = new Set(['link']);
+function checkItem(i: z.infer<typeof Item>) {
+  const url = i.url.trim();
+  // http(s) or a path on this site; "//host" and "/\\host" would leave it (open redirect through /go)
+  if (urlKinds.has(i.kind) && url && !/^https?:\/\//i.test(url) && !/^\/(?![\/\\])/.test(url)) throw new ApiError(400, `“${i.label || 'Link'}” needs an http(s) address.`);
+}
+// inline SVG icons render as markup on the public page, exactly like HTML blocks
+const isMarkup = (icon: string) => icon.trim().toLowerCase().startsWith('<svg');
+
+export async function putLinksFor(c: EditorContext, body: z.infer<typeof LinksPut>) {
+  const current = await c.repo.listLinks();
+  const byId = new Map(current.map((l) => [l.id, l]));
+  const admin = isAdmin(c.who);
+  const markupChanged = (i: z.infer<typeof Item>) => {
+    const old = i.id ? byId.get(i.id) : undefined;
+    const html = i.kind === 'html' && (!old || old.kind !== 'html' || old.html !== i.html);
+    const svg = isMarkup(i.icon) && (!old || old.icon !== i.icon);
+    return html || svg;
+  };
+  const ids = body.items.map((i) => i.id).filter(Boolean);
+  if (new Set(ids).size !== ids.length) throw new ApiError(400, 'Each block can appear once.');
+  for (const i of body.items) {
+    if (i.id && !byId.has(i.id)) throw new ApiError(409, 'The links page changed since you opened it. Reload and try again.');
+    checkItem(i);
+    if (!admin && markupChanged(i)) requireAdmin(c.who, 'add or change HTML blocks or SVG icons');
+  }
+  // one atomic write: a failure leaves the page as it was. Blocks left out
+  // are removed (fine for anyone, even HTML: it only takes code away); a
+  // block whose kind changed is replaced
+  await c.repo.replaceLinks(body.revision, body.items.map((i) => {
+    const old = i.id ? byId.get(i.id) : undefined;
+    return { kind: i.kind, label: i.label, url: i.url, icon: i.icon, html: i.html, meta: i.meta, keep: old && old.kind === i.kind ? old.id : undefined };
+  }), { linksName: body.name, linksBio: body.bio, linksAvatar: body.avatar });
+  return getLinksFor(c);
+}

package/src/lib/editor/store.ts

@@ -4,10 +4,12 @@ import type { SqlDriver } from '../repo/sql';
 type Row = Record<string, unknown>;
 
 export interface EditorDevice {
+  authProvider?: string;
   id: string; userId: string; name: string; clientId: string; sessionVersion: number;
   createdAt: number; lastUsedAt: number; revokedAt: number | null; revokedReason: string;
 }
 export interface EditorCode {
+  authProvider?: string;
   hash: string; userId: string; clientId: string; redirectUri: string; challenge: string;
   deviceName: string; sessionVersion: number; createdAt: number; expiresAt: number; usedAt: number | null; deviceId: string | null;
 }
@@ -19,11 +21,11 @@ export interface EditorAccess {
 export interface EditorActivity { id: string; createdAt: number; userId: string; deviceId: string; action: string; target: string }
 
 function device(r: Row): EditorDevice {
-  return { id: String(r.id), userId: String(r.user_id), name: String(r.name), clientId: String(r.client_id), sessionVersion: Number(r.session_version),
+  return { authProvider: String(r.auth_provider ?? 'builtin'), id: String(r.id), userId: String(r.user_id), name: String(r.name), clientId: String(r.client_id), sessionVersion: Number(r.session_version),
     createdAt: Number(r.created_at), lastUsedAt: Number(r.last_used_at), revokedAt: r.revoked_at == null ? null : Number(r.revoked_at), revokedReason: String(r.revoked_reason ?? '') };
 }
 function code(r: Row): EditorCode {
-  return { hash: String(r.hash), userId: String(r.user_id), clientId: String(r.client_id), redirectUri: String(r.redirect_uri), challenge: String(r.challenge),
+  return { authProvider: String(r.auth_provider ?? 'builtin'), hash: String(r.hash), userId: String(r.user_id), clientId: String(r.client_id), redirectUri: String(r.redirect_uri), challenge: String(r.challenge),
     deviceName: String(r.device_name), sessionVersion: Number(r.session_version), createdAt: Number(r.created_at), expiresAt: Number(r.expires_at),
     usedAt: r.used_at == null ? null : Number(r.used_at), deviceId: r.device_id == null ? null : String(r.device_id) };
 }
@@ -38,8 +40,12 @@ export class EditorStore {
 
   // ---- authorization codes ----
   async createCode(c: Omit<EditorCode, 'usedAt' | 'deviceId' | 'createdAt'>, now: number) {
-    await this.run(`INSERT INTO editor_codes (hash,user_id,client_id,redirect_uri,challenge,device_name,session_version,created_at,expires_at,used_at,device_id)
-      VALUES (?,?,?,?,?,?,?,?,?,NULL,NULL)`, [c.hash, c.userId, c.clientId, c.redirectUri, c.challenge, c.deviceName, c.sessionVersion, now, c.expiresAt]);
+    await this.run(`INSERT INTO editor_codes (hash,user_id,client_id,redirect_uri,challenge,device_name,session_version,created_at,expires_at,used_at,device_id,auth_provider)
+      VALUES (?,?,?,?,?,?,?,?,?,NULL,NULL,?)`, [c.hash, c.userId, c.clientId, c.redirectUri, c.challenge, c.deviceName, c.sessionVersion, now, c.expiresAt, c.authProvider ?? 'builtin']);
+  }
+  async getCode(hash: string): Promise<EditorCode | null> {
+    const rows = await this.all('SELECT * FROM editor_codes WHERE hash=?', [hash]);
+    return rows[0] ? code(rows[0]) : null;
   }
   /**
    * Burn a code (single use, even when the rest of the exchange fails).
@@ -55,10 +61,10 @@ export class EditorStore {
 
   // ---- devices + tokens ----
   /** a new device and its first token pair, atomically */
-  async createDevice(d: Pick<EditorDevice, 'id' | 'userId' | 'name' | 'clientId' | 'sessionVersion'>, tokens: { access: string; accessExpires: number; refresh: string; refreshExpires: number }, now: number) {
+  async createDevice(d: Pick<EditorDevice, 'id' | 'userId' | 'name' | 'clientId' | 'sessionVersion' | 'authProvider'>, tokens: { access: string; accessExpires: number; refresh: string; refreshExpires: number }, now: number) {
     await (await this.driver()).batch([
-      { sql: `INSERT INTO editor_devices (id,user_id,name,client_id,session_version,created_at,last_used_at,revoked_at,revoked_reason) VALUES (?,?,?,?,?,?,?,NULL,'')`,
-        args: [d.id, d.userId, d.name, d.clientId, d.sessionVersion, now, now] },
+      { sql: `INSERT INTO editor_devices (id,user_id,name,client_id,session_version,created_at,last_used_at,revoked_at,revoked_reason,auth_provider) VALUES (?,?,?,?,?,?,?,NULL,'',?)`,
+        args: [d.id, d.userId, d.name, d.clientId, d.sessionVersion, now, now, d.authProvider ?? 'builtin'] },
       ...this.tokenRows(d.id, tokens, now),
     ]);
   }

package/src/lib/editor/token-route.ts

@@ -40,6 +40,7 @@ const address = (context: APIContext) => { try { return context.clientAddress ||
 function oauthFailure(error: unknown) {
   if (error instanceof OAuthError) return reply({ error: error.error, error_description: error.message }, error.status);
   if (error instanceof ApiError) {
+    if (error.status === 503) return reply({ error: 'temporarily_unavailable', error_description: error.message }, 503, { 'Retry-After': '10' });
     if (error.status === 429) return reply({ error: 'rate_limited', error_description: error.message }, 429, { 'Retry-After': '60' });
     if (error.status === 404) return reply({ error: 'not_found', error_description: error.message }, 404);
     return reply({ error: 'invalid_request', error_description: error.message }, error.status);
@@ -54,7 +55,7 @@ export async function tokenRoute(context: APIContext) {
     if (context.url.search) throw new OAuthError(400, 'invalid_request', 'Send parameters in the request body, not the URL.');
     const repo = await getRepo(context.locals);
     if (!await repo.email.rateLimit(`editor:token:${await sha256Hex(address(context))}`, 30, 60_000)) throw new ApiError(429, 'Too many requests. Try again in a minute.');
-    return reply(await tokenGrant(repo, await readForm(context.request)));
+    return reply(await tokenGrant(repo, await readForm(context.request), Date.now(), context.locals));
   } catch (error) { return oauthFailure(error); }
 }
 

package/src/lib/email/accounts.ts

@@ -1,3 +1,4 @@
+import { AUTH } from '../auth/config';
 import type { Role } from '../schema';
 import { randomBytes } from 'node:crypto';
 import type { ContentRepository } from '../repo/types';
@@ -23,12 +24,14 @@ export async function accountForm(request: Request): Promise<URLSearchParams> {
 }
 
 export async function reauthenticate(repo:ContentRepository, userId:string, password:string) {
+  if (AUTH.provider !== 'builtin') return false;
   if (!password || password.length>1024) return false;
   if (userId===OWNER_ENV) return checkPassword(password);
   const user=await repo.getUser(userId); if(!user)return false;
   const auth=await repo.getUserAuth(user.email);return !!auth && verifyPassword(password,auth.passHash);
 }
 export async function issueAccountToken(repo:ContentRepository, data:{purpose:'invite'|'reset';email:string;name?:string;role?:Role;expiresDays?:number}, locals?:unknown) {
+  if (AUTH.provider !== 'builtin') throw new Error('Account access is managed by Clerk.');
   const email=data.email.trim().toLowerCase();
   if(!validAddress(email))throw new Error('Enter a valid email address.');
   const auth=await repo.getUserAuth(email);
@@ -45,6 +48,7 @@ export async function issueAccountToken(repo:ContentRepository, data:{purpose:'i
   await repo.email.saveToken(token,job);
 }
 export async function redeemAccountToken(repo:ContentRepository,raw:string,password:string,purpose:'invite'|'reset'):Promise<boolean> {
+  if (AUTH.provider !== 'builtin') return false;
   if(!/^[a-zA-Z0-9_-]{43}$/.test(raw))return false;
   if(password.length<12||password.length>128)throw new Error('Use a password between 12 and 128 characters.');
   const token=await repo.email.tokenByHash(sha256(raw));

package/src/lib/email/service.ts

@@ -1,13 +1,20 @@
 import type { ContentRepository } from '../repo/types';
 import { resolveConfig, decrypt, encrypt, runtimeValue } from './config';
 import { sendWithProvider } from './providers';
-import { accountMail, canonicalOrigin, EmailLinkError } from './templates';
+import { accountMail, canonicalOrigin, guestCodeMail, EmailLinkError } from './templates';
 import { bookingMail } from '../booking/service';
 import type { EmailJob, Mail } from './types';
 
 async function render(repo: ContentRepository, job: EmailJob, locals?: unknown, from = ''): Promise<Mail | null> {
   const settings = await repo.getSettings();
   if (job.kind === 'test') return accountMail('test', job.recipient, settings.siteTitle);
+  if (job.kind === 'guest-code') {
+    // only the latest, unexpired code is worth sending
+    const payload = JSON.parse(job.payload) as { issuedAt: number; code: string };
+    const current = await repo.guests.code(job.recipient);
+    if (!current || current.createdAt !== payload.issuedAt || current.expiresAt <= Date.now()) return null;
+    return guestCodeMail(job.recipient, settings.siteTitle, decrypt<string>(payload.code, `guest-code:${job.dedupe}`, locals));
+  }
   const origin = canonicalOrigin(settings.siteUrl);
   if (job.kind === 'booking') {
     const payload = JSON.parse(job.payload);
@@ -25,6 +32,7 @@ async function render(repo: ContentRepository, job: EmailJob, locals?: unknown,
     return accountMail(payload.purpose, job.recipient, settings.siteTitle, `${origin}/account/${payload.purpose}?token=${encodeURIComponent(raw)}`);
   }
   if (job.kind === 'welcome' || job.kind === 'password-changed') return accountMail(job.kind, job.recipient, settings.siteTitle, `${origin}/admin/login`);
+  if (job.kind === 'email-changed') return accountMail(job.kind, job.recipient, settings.siteTitle);
   return null;
 }
 export async function dispatchEmail(repo: ContentRepository, locals?: unknown, limit = 10): Promise<number> {

package/src/lib/email/store.ts

@@ -112,9 +112,19 @@ export class EmailStore {
       count=CASE WHEN expires_at <= ? THEN 1 ELSE count+1 END, expires_at=CASE WHEN expires_at <= ? THEN ? ELSE expires_at END RETURNING count`, [key,now+windowMs,now,now,now+windowMs]);
     return Number(rows[0].count) <= max;
   }
+  /** true when key's current window already holds max hits (checks without counting) */
+  async rateLimited(key: string, max: number): Promise<boolean> {
+    const rows = await (await this.getDriver()).all('SELECT count FROM email_rate_limits WHERE key=? AND expires_at > ?', [key, Date.now()]);
+    return rows.length > 0 && Number(rows[0].count) >= max;
+  }
   async recordScheduler(report: { startedAt: number; finishedAt: number; ok: boolean; jobs: Record<string, { ok: boolean; count?: number }> }) {
     await (await this.getDriver()).run("INSERT INTO email_meta(key,value) VALUES ('scheduler-heartbeat',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value", [JSON.stringify(report)]);
   }
+  /** mail that should have gone out before `before` but is still waiting (a stuck queue) */
+  async stuckJobs(before: number): Promise<number> {
+    const rows = await (await this.getDriver()).all("SELECT COUNT(*) AS n FROM email_jobs WHERE state IN ('queued','retrying') AND next_at < ?", [before]);
+    return Number(rows[0]?.n ?? 0);
+  }
   async schedulerStatus(): Promise<{ startedAt: number; finishedAt: number; ok: boolean; jobs: Record<string, { ok: boolean; count?: number }> } | null> {
     const rows = await (await this.getDriver()).all("SELECT value FROM email_meta WHERE key='scheduler-heartbeat'");
     return rows[0] ? JSON.parse(String(rows[0].value)) : null;

package/src/lib/email/templates.ts

@@ -1,16 +1,23 @@
 import type { Mail } from './types';
 export const escape = (s: string) => s.replace(/[&<>"']/g, (c) => ({ '&':'&amp;', '<':'&lt;', '>':'&gt;', '"':'&quot;', "'":'&#39;' }[c]!));
-export function accountMail(kind: 'invite'|'reset'|'welcome'|'password-changed'|'test', to: string, site: string, url = ''): Mail {
+export function accountMail(kind: 'invite'|'reset'|'welcome'|'password-changed'|'email-changed'|'test', to: string, site: string, url = ''): Mail {
   const copy = {
     invite: ['You’re invited', `You’ve been invited to join ${site}. Choose your own password to accept.`, 'Accept invitation'],
     reset: ['Reset your password', 'Use this single-use link within 30 minutes to choose a new password. If you did not request this, ignore this message.', 'Choose a new password'],
     welcome: ['Welcome', `Your account at ${site} is ready.`, 'Sign in'],
     'password-changed': ['Your password changed', 'Your password was changed and previous sessions were signed out. If this was not you, contact the site owner.', 'Sign in'],
+    'email-changed': ['Your sign-in email changed', `The email for your account at ${site} was changed to a new address, and previous sessions were signed out. If this was not expected, contact the site owner.`, ''],
     test: ['Email connection test', `This is a transactional email test from ${site}.`, ''],
   }[kind];
   return { to, subject: `${copy[0]} · ${site}`, text: [copy[0], '', copy[1], ...(url ? ['',`${copy[2]}: ${url}`] : [])].join('\n'),
     html: `<!doctype html><html><body style="margin:0;background:#f6f5f2;color:#24211c;font:16px/1.6 system-ui,sans-serif"><div style="max-width:520px;margin:auto;padding:32px 24px"><p style="color:#7d776e">${escape(site)}</p><h1 style="font-size:24px">${escape(copy[0])}</h1><p>${escape(copy[1])}</p>${url ? `<p><a style="display:inline-block;background:#ee5d20;color:#fff;padding:10px 18px;border-radius:8px;text-decoration:none" href="${escape(url)}">${escape(copy[2])}</a></p>` : ''}</div></body></html>` };
 }
+/** a guest's app sign-in code; no link, so it works on any device */
+export function guestCodeMail(to: string, site: string, code: string): Mail {
+  const intro = `Enter this code in the ${site} app to see your bookings. It expires in 10 minutes. If you did not ask for it, ignore this message.`;
+  return { to, subject: `${code} is your sign-in code · ${site}`, text: ['Your sign-in code', '', code, '', intro].join('\n'),
+    html: `<!doctype html><html><body style="margin:0;background:#f6f5f2;color:#24211c;font:16px/1.6 system-ui,sans-serif"><div style="max-width:520px;margin:auto;padding:32px 24px"><p style="color:#7d776e">${escape(site)}</p><h1 style="font-size:24px">Your sign-in code</h1><p style="font:700 32px/1.2 ui-monospace,Menlo,monospace;letter-spacing:.2em">${escape(code)}</p><p>${escape(intro)}</p></div></body></html>` };
+}
 export class EmailLinkError extends Error {}
 export function canonicalOrigin(value: string): string {
   const raw = value.trim();

package/src/lib/email/types.ts

@@ -23,6 +23,7 @@ export interface NewEmailJob { id?: string; dedupe: string; kind: string; recipi
 export type SendResult = { state: 'accepted'; providerId: string } | { state: 'retrying' | 'failed' | 'unknown'; error: string; retryAfter?: number };
 export interface Invitation { id: string; email: string; name: string; role: Role; state: string; expiresAt: number; createdAt: number }
 export interface PublicEmailSettings {
+  authProvider?: 'builtin' | 'clerk';
   version: number; config: EmailConfig; provider: Provider | 'none'; configured: boolean; error: string;
   encryptionAvailable: boolean; environmentLocked: boolean; credentialFields: string[];
   linksReady: boolean; linkError: string;

package/src/lib/forms/store.ts

@@ -25,6 +25,11 @@ export class FormStore {
   async submissions(formId?: string, limit = 100, offset = 0) {
     return (await (await this.driver()).all(`SELECT * FROM form_submissions ${formId ? 'WHERE form_id=?' : ''} ORDER BY created_at DESC LIMIT ? OFFSET ?`, [...(formId ? [formId] : []), limit, offset])).map(r => FormSubmission.parse({ id: r.id, formId: r.form_id, response: JSON.parse(String(r.response)), createdAt: r.created_at }));
   }
+  /** the response this request id already saved to this form, if any (as stored JSON) */
+  async receipt(formId: string, requestId: string) {
+    const r = (await (await this.driver()).all('SELECT response FROM form_submissions WHERE id=? AND form_id=?', [requestId, formId]))[0];
+    return r ? String(r.response) : null;
+  }
   async submit(formId: string, response: FormResponse, requestId: string) {
     response = FormResponse.parse(response);
     const db = await this.driver();

package/src/lib/mobile/access-admin.ts

@@ -0,0 +1,34 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import { MobileAccess } from '../schema';
+import { CALENDAR, bookingsEnabled } from '../calendar/config';
+import { encryptionAvailable, resolveConfig } from '../email/config';
+import { GUEST_IDLE_MS } from './guest-store';
+
+// Admin → Mobile app → App access (owner only): switches and limits for the
+// public app routes, plus "Sign out all" for guest sessions.
+
+export async function appAccessState(repo: ContentRepository, locals?: unknown) {
+  const settings = await repo.getSettings();
+  const email = resolveConfig(await repo.email.config(), locals);
+  const emailReady = !email.error && email.provider !== 'none' && email.config.enabled;
+  return {
+    access: settings.mobileAccess,
+    modules: { calendar: CALENDAR.enabled, bookings: bookingsEnabled() },
+    // why guest sign-in can't run yet, if it can't
+    guestSignIn: {
+      blocker: !CALENDAR.enabled ? 'calendar' as const : !emailReady ? 'email' as const : !encryptionAvailable(locals) ? 'encryption' as const : null,
+      devices: await repo.guests.count(Date.now() - GUEST_IDLE_MS),
+    },
+  };
+}
+export type AppAccessState = Awaited<ReturnType<typeof appAccessState>>;
+
+export const AppAccessInput = z.discriminatedUnion('action', [
+  z.object({ action: z.literal('save'), access: MobileAccess.partial().strict() }).strict(),
+  z.object({ action: z.literal('signOutGuests') }).strict(),
+]);
+export async function appAccessAction(repo: ContentRepository, input: z.infer<typeof AppAccessInput>) {
+  if (input.action === 'signOutGuests') { await repo.guests.deleteAll(); return; }
+  await repo.patchMobileAccess(input.access);
+}

package/src/lib/mobile/access.ts

@@ -0,0 +1,28 @@
+import type { ContentRepository } from '../repo/types';
+import type { MobileAccess, Settings } from '../schema';
+import { ApiError } from '../api';
+import { sha256Hex } from '../api-keys';
+
+type Switch = Exclude<{ [K in keyof MobileAccess]: MobileAccess[K] extends boolean ? K : never }[keyof MobileAccess], undefined>;
+
+/** Owner switch (Admin → Mobile app → App access); off answers 404 like a disabled module. */
+export async function requireAccess(repo: ContentRepository, key: Switch): Promise<Settings> {
+  const settings = await repo.getSettings();
+  if (!settings.mobileAccess[key]) throw new ApiError(404, 'This feature is turned off.');
+  return settings;
+}
+
+/**
+ * Lockout for secret guessing: only failures count, per client address.
+ * `check` before the lookup (already locked → 429), `miss` after a failure.
+ */
+export async function failureLock(repo: ContentRepository, scope: string, address: string, max = 20, windowMs = 10 * 60_000) {
+  const key = `lock:${scope}:${await sha256Hex(address)}`;
+  // without a real client address everyone would share one bucket, and a few
+  // junk requests would lock every visitor out; per-target limits still apply
+  if (!address || address === 'unknown') return { async check() {}, async miss() {} };
+  return {
+    async check() { if (await repo.email.rateLimited(key, max)) throw new ApiError(429, 'Too many failed attempts. Try again in a few minutes.', windowMs / 1000); },
+    async miss() { await repo.email.rateLimit(key, max, windowMs); },
+  };
+}

package/src/lib/mobile/calendar.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import type { ContentRepository } from '../repo/types';
+import type { BookingLink, CalEvent, Calendar, Resource, Settings } from '../schema';
 import { ApiError } from '../api';
 import { CALENDAR, bookingsEnabled, resourceUrl, bookingLinkUrl } from '../calendar/config';
 import { calendarToJson, eventToJson } from '../calendar/api';
@@ -27,7 +28,10 @@ export async function listEvents(repo: ContentRepository, url: URL) {
   requireCalendar();
   const q = eventsQuery.parse(queryParams(url));
   const locale = mobileLocale(q.locale);
-  const [settings, calendars, events] = await Promise.all([repo.getSettings(), repo.listCalendars(), repo.listPublishedEvents()]);
+  const term = q.q?.trim() ?? '';
+  const [settings, calendars, events, indexed] = await Promise.all([repo.getSettings(), repo.listCalendars(), repo.listPublishedEvents(),
+    // the search index's matches (body text, word prefixes), so "more" from /search continues here
+    term ? repo.searchPublished(term, { limit: 200, collections: [] }).then((r) => new Set(r.events.map(({ doc }) => doc.id))) : null]);
   // days are the site's calendar days (a New York site's "today" starts at midnight there, not UTC)
   const tz = settings.timezone || 'UTC';
   // a plain day is the site's midnight; a date-time is that exact instant
@@ -41,25 +45,30 @@ export async function listEvents(repo: ContentRepository, url: URL) {
   if (q.calendar && !cal) throw new ApiError(404, 'Calendar not found.');
   const publicCalendars = new Map(calendars.filter(c => c.visibility === 'public' || c.id === cal?.id).map(c => [c.id, c]));
   const visible = events.map(e => localizeDoc(e, locale ?? undefined)).filter(e => (cal ? e.calendarIds.includes(cal.id) && eventIsPublic(e, all) : eventIsListed(e, all))
-    && (!q.q || `${e.title} ${e.excerpt} ${e.location.name}`.toLowerCase().includes(q.q.toLowerCase())));
+    && (!term || indexed!.has(e.id) || `${e.title} ${e.excerpt} ${e.location.name}`.toLowerCase().includes(term.toLowerCase())));
   const occurrences = expandEvents(visible, settings, { displayTz: settings.timezone || 'UTC', now: Date.now(), windowStartMs: from, windowEndMs: to });
   occurrences.sort((a, b) => a.start - b.start || (a.event.id < b.event.id ? -1 : a.event.id > b.event.id ? 1 : 0));
   const start = (q.page - 1) * q.limit;
   const origin = siteOrigin(settings, url);
   return {
     locale, timezone: settings.timezone || 'UTC', from: new Date(from).toISOString(), to: new Date(to).toISOString(),
-    occurrences: occurrences.slice(start, start + q.limit).map(o => {
-      const event = eventToJson(o.event, origin, publicCalendars, settings.timezone);
-      event.url = localizedUrl(event.url, origin, locale);
-      // Only configured public event fields; no undeclared imported metadata.
-      event.fields = Object.fromEntries(CALENDAR.eventFields.filter(f => Object.hasOwn(o.event.fields, f.key)).map(f => [f.key, o.event.fields[f.key]]));
-      event.image = safeUrl(o.event.cover, origin);
-      event.cta = { ...event.cta, href: localizedUrl(safeUrl(event.cta.href, origin, true), origin, locale) };
-      return { id: `${o.event.id}:${o.start}`, start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(), allDay: o.allDay, event };
-    }),
+    occurrences: occurrences.slice(start, start + q.limit).map(o => ({
+      id: `${o.event.id}:${o.start}`, start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(), allDay: o.allDay,
+      event: publicEventDto(o.event, origin, publicCalendars, settings.timezone, locale),
+    })),
     pagination: { page: q.page, limit: q.limit, nextPage: occurrences.length > start + q.limit ? q.page + 1 : null },
   };
 }
+// e is already localized; publicCalendars limits which calendars are named
+export function publicEventDto(e: CalEvent, origin: string, publicCalendars: Map<string, Calendar>, siteTz: string, locale: string | null) {
+  const event = eventToJson(e, origin, publicCalendars, siteTz);
+  event.url = localizedUrl(event.url, origin, locale);
+  // Only configured public event fields; no undeclared imported metadata.
+  event.fields = Object.fromEntries(CALENDAR.eventFields.filter(f => Object.hasOwn(e.fields, f.key)).map(f => [f.key, e.fields[f.key]]));
+  event.image = safeUrl(e.cover, origin);
+  event.cta = { ...event.cta, href: localizedUrl(safeUrl(event.cta.href, origin, true), origin, locale) };
+  return event;
+}
 export async function listResources(repo: ContentRepository, url: URL) {
   requireCalendar(true);
   const q = z.object(pageQuery).strict().parse(queryParams(url));
@@ -85,8 +94,12 @@ export async function getAvailability(repo: ContentRepository, url: URL) {
   const resource = await repo.getResourceBySlug(q.resource);
   const link = resource ? await repo.getBookingLinkBySlug(resource.id, q.link) : null;
   if (!resource || !link || !link.active) throw new ApiError(404, 'Resource or booking link not found.');
-  const settings = await repo.getSettings();
-  const ctx = await availabilityContext(repo, resource, link, settings);
+  return availabilityFor(repo, resource, link, await repo.getSettings(), q);
+}
+/** open slots for a link; excludeBookingId frees that booking's own time (moving it) */
+export async function availabilityFor(repo: ContentRepository, resource: Resource, link: BookingLink, settings: Settings,
+  q: { from?: string; days: number; minutes?: number }, excludeBookingId?: string) {
+  const ctx = await availabilityContext(repo, resource, link, settings, Date.now(), excludeBookingId);
   const timezone = resource.timezone || settings.timezone || 'UTC';
   const from = q.from ?? ymd(Date.now(), timezone);
   return { timezone, mode: link.mode, lengths: linkLengths(link), autoConfirm: confirmsInstantly(linkApproval(link, settings)),

package/src/lib/mobile/content.ts

@@ -4,7 +4,8 @@ import type { ContentRepository } from '../repo/types';
 import type { Page, Post } from '../schema';
 import { publicTags } from '../schema';
 import { CONTENT, collectionUrl } from '../content';
-import { I18N, localeHomeUrl } from '../i18n';
+import { I18N, localeHomeUrl, normalizePageLocale } from '../i18n';
+import { SEARCH } from '../search-config';
 import { siteOrigin } from '../seo';
 import { renderMarkdown } from '../markdown';
 import { blocksToHtml } from '../blocksToHtml';
@@ -16,6 +17,7 @@ import { localeQuery, mobileLocale, localizedUrl } from './locale';
 export const contentQuery = z.object({
   ...pageQuery, kind: z.enum(['post', 'page']).optional(),
   collection: z.string().min(1).max(80).optional(), locale: localeQuery,
+  q: z.string().max(100).optional(),
 }).strict();
 export function safeUrl(value: string, origin: string, link = false): string {
   if (!value) return '';
@@ -61,12 +63,30 @@ export function contentDto(raw: Page | Post, kind: 'page' | 'post', origin: stri
 function visible(doc: Page | Post, kind: 'page' | 'post') {
   return doc.status === 'published' && (kind === 'page' || Object.hasOwn(CONTENT.collections, (doc as Post).collection));
 }
+// most matches a search can page through, per kind
+export const SEARCH_WINDOW = 200;
 export async function listContent(repo: ContentRepository, url: URL) {
   const q = contentQuery.parse(queryParams(url));
   if (q.collection && !Object.hasOwn(CONTENT.collections, q.collection)) throw new ApiError(400, 'Unknown collection.');
   if (q.collection && q.kind === 'page') throw new ApiError(400, 'Pages do not belong to post collections.');
   const locale = mobileLocale(q.locale);
   const origin = siteOrigin(await repo.getSettings(), url);
+  const term = q.q?.trim();
+  if (term) {
+    if (!SEARCH.enabled) throw new ApiError(400, 'Search is disabled on this site.');
+    // ranked matches, posts before pages; deep pages stop at SEARCH_WINDOW
+    const end = q.page * q.limit;
+    if (end - q.limit >= SEARCH_WINDOW) return { locale, items: [], pagination: { page: q.page, limit: q.limit, nextPage: null } };
+    const found = await repo.searchPublished(term, { locale: normalizePageLocale(locale ?? ''), limit: Math.min(end + 1, SEARCH_WINDOW), collections: q.collection ? [q.collection] : Object.keys(CONTENT.collections) });
+    const hits = [
+      ...(q.kind === 'page' ? [] : found.posts.map(({ doc }) => ({ doc, kind: 'post' as const }))),
+      ...(q.kind === 'post' || q.collection ? [] : found.pages.map(({ doc }) => ({ doc, kind: 'page' as const }))),
+    ];
+    return {
+      locale, items: hits.slice(end - q.limit, end).map(({ doc, kind }) => contentDto(doc, kind, origin, false, locale)),
+      pagination: { page: q.page, limit: q.limit, nextPage: hits.length > end && end < SEARCH_WINDOW ? q.page + 1 : null },
+    };
+  }
   const rows = await repo.listPublicContent({ ...q, locale: undefined, collections: Object.keys(CONTENT.collections), defaultLocale: I18N.defaultLocale });
   const items = await Promise.all(rows.slice(0, q.limit).map(async (r) => {
     const doc = r.kind === 'post' ? await repo.getPost(r.id) : await repo.getPage(r.id);

package/src/lib/mobile/forms.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import type { SavedForm } from '../forms/schema';
+import { collectResponse, formVersion } from '../forms/service';
+import { ApiError, readJson } from '../api';
+import { sha256Hex } from '../api-keys';
+import { queryParams } from './http';
+import { requireAccess } from './access';
+import type { PublicContext } from './route';
+
+// Published general forms for apps: read the questions, send answers. The
+// same validation and storage as the web form (/forms/<id>), plus app
+// limits: an Idempotency-Key per response (retries never duplicate), 10
+// responses per address per form per minute, and a per-form daily ceiling
+// from Admin → Mobile app so one form can't be flooded.
+
+const UUID4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+async function publishedForm(repo: ContentRepository, id: string): Promise<SavedForm> {
+  // ids are UUIDs; anything else can't be a form
+  const form = id && id.length <= 100 ? await repo.forms.get(id) : null;
+  if (!form || form.kind !== 'form' || form.purpose !== 'general' || form.status === 'draft') throw new ApiError(404, 'Form not found.');
+  if (form.status === 'archived') throw new ApiError(410, 'This form is no longer accepting responses.');
+  return form;
+}
+
+export async function getForm(repo: ContentRepository, url: URL, id: string) {
+  z.object({}).strict().parse(queryParams(url));
+  await requireAccess(repo, 'forms');
+  const form = await publishedForm(repo, id);
+  const d = form.definition;
+  return {
+    id: form.id, version: await formVersion(d),
+    title: d.title || form.name, intro: d.intro, submitLabel: d.submitLabel || 'Submit', confirmation: d.confirmation,
+    fields: d.fields.map((f) => ({
+      id: f.id, type: f.type, label: f.label, required: f.required, help: f.help, options: f.options,
+      placeholder: f.placeholder ?? '', width: f.width ?? 'full', allowOther: f.allowOther ?? false,
+    })),
+  };
+}
+
+export const formResponseInput = z.object({
+  // field id → answer; checkbox groups send a list. "Other" answers send the typed text.
+  answers: z.record(z.union([z.string().max(2000), z.array(z.string().max(2000)).max(51)])).refine((a) => Object.keys(a).length <= 30, 'Too many answers.'),
+  // the version from GET /forms/{id}; a changed form answers 409 instead of saving
+  version: z.string().max(100).optional(),
+  // spam trap: apps leave it out or empty
+  website: z.string().max(200).optional(),
+}).strict();
+
+export async function submitFormResponse(c: PublicContext) {
+  const settings = await requireAccess(c.repo, 'forms');
+  const id = c.params.id ?? '';
+  const key = c.request.headers.get('idempotency-key') ?? '';
+  if (!UUID4.test(key)) throw new ApiError(400, 'Send a random UUID v4 in Idempotency-Key and reuse it only for retries.');
+  const body = formResponseInput.parse(await readJson(c.request, 50_000));
+  if (body.website) throw new ApiError(400, 'Could not submit this form.');
+  const form = await publishedForm(c.repo, id);
+  if (!await c.repo.email.rateLimit(`forms:app:${await sha256Hex(`${form.id}:${c.address}`)}`, 10, 60_000)) throw new ApiError(429, 'Too many responses. Please try again in a minute.');
+  const answers = Object.fromEntries(Object.entries(body.answers).map(([k, v]) => [k, Array.isArray(v) ? v.map((x) => x.trim()).filter(Boolean).join('\n') : v]));
+  // the key is the stored response id: a retry of a saved response answers
+  // as before and costs nothing (also after the form changed); the same key
+  // with different answers is a 409
+  const prior = await c.repo.forms.receipt(form.id, key.toLowerCase());
+  if (prior) {
+    const unchanged = JSON.stringify((JSON.parse(prior) as { definition: unknown }).definition) === JSON.stringify(form.definition);
+    if (unchanged && JSON.stringify(await collectResponse(form.definition, answers, body.version)) !== prior)
+      throw new ApiError(409, 'This request was already submitted with different answers. Reload to send a new response.');
+    return { received: true as const, confirmation: form.definition.confirmation };
+  }
+  const response = await collectResponse(form.definition, answers, body.version);
+  // only valid new responses count toward the daily ceiling
+  const cap = settings.mobileAccess.responsesPerFormDay;
+  if (cap && !await c.repo.email.rateLimit(`forms:day:${form.id}`, cap, 86_400_000)) throw new ApiError(429, 'This form has had a lot of responses today. Please try again tomorrow.', 86_400);
+  await c.repo.forms.submit(form.id, response, key.toLowerCase());
+  return { received: true as const, confirmation: form.definition.confirmation };
+}