@acms-subir/core 0.2.0 → 0.3.0

package/src/pages/blog/index.astro

@@ -1,8 +1,12 @@
 ---
 import Site from '../../layouts/Site.astro';
+import PostCard from '../../components/site/PostCard.astro';
+import Pager from '../../components/site/Pager.astro';
 import { getRepo } from '../../lib/repo';
-import { publicTags, slugify } from '../../lib/schema';
+import { publicTags, slugify, authorSlug } from '../../lib/schema';
 import { formatDate } from '../../lib/dates';
+import { resolveDesign } from '../../lib/theme';
+import { effectiveSettings } from '../../lib/designPreview';
 import { collectionFromPath, collectionUrl, tagUrl } from '../../lib/content';
 
 // One file serves every collection's index — injectRoute can't pass props,
@@ -10,42 +14,103 @@ import { collectionFromPath, collectionUrl, tagUrl } from '../../lib/content';
 const col = collectionFromPath(Astro.url.pathname);
 if (!col) return new Response(null, { status: 404, statusText: 'Not found' });
 
-const PAGE_SIZE = 10;
+const PAGE_SIZE = 12;
 const repo = await getRepo(Astro.locals);
-const [allPosts, tags, users, settings] = await Promise.all([repo.listPublishedPosts(col.key), repo.listTags(), repo.listUsers(), repo.getSettings()]);
+const [allPosts, tags, users, rawSettings] = await Promise.all([repo.listPublishedPosts(col.key), repo.listTags(), repo.listUsers(), repo.getSettings()]);
+const settings = await effectiveSettings(rawSettings, Astro.url, Astro.cookies, Astro.locals);
+const design = resolveDesign(settings);
 
-const pageCount = Math.max(1, Math.ceil(allPosts.length / PAGE_SIZE));
+// page 1 leads with the featured post (if any) as a big split card; it's
+// pulled out of the grid so it never shows twice
+const featured = allPosts.find((p) => p.featured) ?? null;
+const rest = featured ? allPosts.filter((p) => p.id !== featured.id) : allPosts;
+const pageCount = Math.max(1, Math.ceil(rest.length / PAGE_SIZE));
 const pageNum = Math.min(pageCount, Math.max(1, Number(Astro.url.searchParams.get('page')) || 1));
-const posts = allPosts.slice((pageNum - 1) * PAGE_SIZE, pageNum * PAGE_SIZE);
+const posts = rest.slice((pageNum - 1) * PAGE_SIZE, pageNum * PAGE_SIZE);
+const lead = pageNum === 1 ? featured : null;
+
+// 'auto' picks cards when at least half the posts have covers — a text-first
+// blog gets honest list rows instead of a grid of generated tiles
+const withCover = allPosts.filter((p) => p.cover).length;
+const layout = design.tokens.blogLayout === 'auto'
+  ? (allPosts.length && withCover / allPosts.length >= 0.5 ? 'cards' : 'list')
+  : design.tokens.blogLayout;
 
 const tagSlug = (name: string) =>
   tags.find((t) => t.name.toLowerCase() === name.toLowerCase())?.slug ?? slugify(name);
-const authorName = (id: string | null) => (id ? users.find((u) => u.id === id)?.name : undefined);
-const fmt = (ts: number | null) =>
-  formatDate(ts, settings, 'short');
+const tagLinks = (names: string[]) => publicTags(names).map((n) => ({ name: n, href: tagUrl(tagSlug(n)) }));
+const readMins = (p: (typeof allPosts)[number]) =>
+  Math.max(1, Math.round((p.bodyHtml || p.body).replace(/<[^>]+>/g, ' ').split(/\s+/).filter(Boolean).length / 220));
+const authorOf = (p: (typeof allPosts)[number]) => {
+  const id = p.authorIds[0] ?? p.authorId;
+  const u = id ? users.find((x) => x.id === id) : undefined;
+  return u ? { name: u.name, avatar: u.avatar || undefined, href: `/author/${authorSlug(u)}` } : null;
+};
+
+// filter tabs: the collection's most-used public tags, with counts
+// (case-insensitive: "Product" and "product" are one tag, first spelling wins)
+const counts = new Map<string, [string, number]>();
+for (const p of allPosts) for (const t of publicTags(p.tags)) {
+  const k = t.toLowerCase();
+  counts.set(k, [counts.get(k)?.[0] ?? t, (counts.get(k)?.[1] ?? 0) + 1]);
+}
+const topTags = [...counts.values()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, 6);
+const iso = (ts: number | null) => (ts ? new Date(ts).toISOString() : undefined);
 ---
 
 <Site title={col.plural}>
-  <h1>{col.plural}</h1>
-  {posts.length === 0 && <p>No {col.plural.toLowerCase()} yet.</p>}
-  <ul class="post-list">
-    {posts.map((p) => (
-      <li>
-        <a href={collectionUrl(col.key, p.slug)}>{p.title}</a>
-        <div class="post-meta">
-          {fmt(p.publishedAt)}
-          {authorName(p.authorId) && <span class="byline">· {authorName(p.authorId)}</span>}
-          {publicTags(p.tags).map((t) => <a class="tag" href={tagUrl(tagSlug(t))}>{t}</a>)}
-        </div>
-        {p.excerpt && <p class="post-excerpt">{p.excerpt}</p>}
-      </li>
-    ))}
-  </ul>
-  {pageCount > 1 && (
-    <nav class="pager" aria-label="Pagination">
-      {pageNum > 1 ? <a href={pageNum === 2 ? col.base : `${col.base}?page=${pageNum - 1}`}>← Newer</a> : <span />}
-      <span class="pager-status">Page {pageNum} of {pageCount}</span>
-      {pageNum < pageCount ? <a href={`${col.base}?page=${pageNum + 1}`}>Older →</a> : <span />}
-    </nav>
-  )}
+  <div class="wide blog-index">
+    <header class="page-head">
+      <h1>{col.plural}</h1>
+      {settings.tagline && <p class="page-lede">{settings.tagline}</p>}
+    </header>
+    {topTags.length > 1 && (
+      <nav class="filter-tabs" aria-label="Filter by tag">
+        <a href={col.base} aria-current="page">All <small>{allPosts.length}</small></a>
+        {topTags.map(([name, n]) => <a href={tagUrl(tagSlug(name))}>{name} <small>{n}</small></a>)}
+      </nav>
+    )}
+    {allPosts.length === 0 && (
+      <div class="empty-state">
+        <span class="empty-icon" aria-hidden="true"><svg viewBox="0 0 24 24" width="22" height="22" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 13 6.5 5h11L20 13v5a1.5 1.5 0 0 1-1.5 1.5h-13A1.5 1.5 0 0 1 4 18v-5Z" /><path d="M4 13h4.5l1 2h5l1-2H20" /></svg></span>
+        <b>No {col.plural.toLowerCase()} yet</b>
+        <span>New {col.plural.toLowerCase()} will show up here.</span>
+      </div>
+    )}
+    {lead && (
+      <PostCard
+        variant="feature"
+        headingLevel={2}
+        href={collectionUrl(col.key, lead.slug)}
+        title={lead.title}
+        excerpt={lead.excerpt}
+        cover={lead.cover}
+        coverAlt={lead.coverAlt}
+        date={formatDate(lead.publishedAt, settings, 'short')}
+        datetime={iso(lead.publishedAt)}
+        readMins={readMins(lead)}
+        tags={tagLinks(lead.tags)}
+        featured
+        author={authorOf(lead)}
+      />
+    )}
+    <div class:list={['post-grid', `is-${layout}`]}>
+      {posts.map((p) => (
+        <PostCard
+          variant={layout === 'cards' ? 'card' : 'row'}
+          headingLevel={2}
+          href={collectionUrl(col.key, p.slug)}
+          title={p.title}
+          excerpt={p.excerpt}
+          cover={p.cover}
+          coverAlt={p.coverAlt}
+          date={formatDate(p.publishedAt, settings, 'short')}
+          datetime={iso(p.publishedAt)}
+          readMins={readMins(p)}
+          tags={tagLinks(p.tags)}
+        />
+      ))}
+    </div>
+    <Pager base={col.base} page={pageNum} count={pageCount} />
+  </div>
 </Site>

package/src/pages/blog/tag/[slug].astro

@@ -1,14 +1,17 @@
 ---
 import Site from '../../../layouts/Site.astro';
+import PostCard from '../../../components/site/PostCard.astro';
+import Pager from '../../../components/site/Pager.astro';
 import { getRepo } from '../../../lib/repo';
-import { isInternalTag } from '../../../lib/schema';
+import { tagColor } from '../../../lib/tagColor';
+import { isInternalTag, publicTags, slugify } from '../../../lib/schema';
 import { formatDate } from '../../../lib/dates';
 import { CONTENT, collectionUrl, postsIndexUrl, tagUrl } from '../../../lib/content';
 
-const PAGE_SIZE = 10;
+const PAGE_SIZE = 12;
 const { slug } = Astro.params;
 const repo = await getRepo(Astro.locals);
-const [tag, settings] = await Promise.all([slug ? repo.getTagBySlug(slug) : Promise.resolve(null), repo.getSettings()]);
+const [tag, settings, tags] = await Promise.all([slug ? repo.getTagBySlug(slug) : Promise.resolve(null), repo.getSettings(), repo.listTags()]);
 // internal (#-prefixed) tags never get a public archive
 if (!tag || isInternalTag(tag.name)) return new Response(null, { status: 404, statusText: 'Not found' });
 
@@ -40,44 +43,46 @@ const fmt = (ts: number | null) =>
   formatDate(ts, settings, 'short');
 const readMins = (p: (typeof posts)[number]) =>
   Math.max(1, Math.round((p.bodyHtml || p.body).replace(/<[^>]+>/g, ' ').split(/\s+/).filter(Boolean).length / 220));
+const tagSlug = (name: string) =>
+  tags.find((t) => t.name.toLowerCase() === name.toLowerCase())?.slug ?? slugify(name);
+// the archive's own tag is implied, so cards show the post's other tags
+const tagLinks = (names: string[]) =>
+  publicTags(names).filter((n) => n.toLowerCase() !== tag.name.toLowerCase()).map((n) => ({ name: n, href: tagUrl(tagSlug(n)) }));
+const layout = allPosts.length && allPosts.filter((p) => p.cover).length / allPosts.length >= 0.5 ? 'cards' : 'list';
+const iso = (ts: number | null) => (ts ? new Date(ts).toISOString() : undefined);
 ---
 
 <Site title={tag.name} description={tag.description || `Tagged ${tag.name}`}>
-  <header class="tag-hero">
-    <p class="tag-kicker">Collection · {allPosts.length} {countNoun}</p>
-    <h1>{tag.name}</h1>
-    {tag.description && <p class="tag-desc">{tag.description}</p>}
-  </header>
-  {posts.length === 0 && <p>Nothing with this tag yet.</p>}
-  {groups.map((g) => (
-    <>
-      {multi && <h2 class="tag-group">{g.plural}</h2>}
-      <ul class="post-list">
-        {g.posts.map((p) => (
-          <li class="post-item">
-            {p.cover && (
-              <a class="post-thumb" href={collectionUrl(p.collection, p.slug)}><img src={p.cover} alt={p.coverAlt} loading="lazy" /></a>
-            )}
-            <div>
-              <a href={collectionUrl(p.collection, p.slug)}>{p.title}</a>
-              <div class="post-meta">{fmt(p.publishedAt)} · {readMins(p)} min read</div>
-              {p.excerpt && <p class="post-excerpt">{p.excerpt}</p>}
-            </div>
-          </li>
-        ))}
-      </ul>
-    </>
-  ))}
-  {pageCount > 1 && (
-    <nav class="pager" aria-label="Pagination">
-      {pageNum > 1 ? <a href={pageNum === 2 ? base : `${base}?page=${pageNum - 1}`}>← Newer</a> : <span />}
-      <span class="pager-status">Page {pageNum} of {pageCount}</span>
-      {pageNum < pageCount ? <a href={`${base}?page=${pageNum + 1}`}>Older →</a> : <span />}
-    </nav>
-  )}
-  <p style="margin-top:28px"><a href={postsIndexUrl()}>← All {CONTENT.posts.plural.toLowerCase()}</a></p>
+  <div class="wide archive">
+    <header class="page-head">
+      <p class="page-kicker"><span class="tag" style={`--tc:${tagColor(tag.name)}`}>Tag</span> <span>{allPosts.length} {countNoun}</span></p>
+      <h1>{tag.name}</h1>
+      {tag.description && <p class="page-lede">{tag.description}</p>}
+    </header>
+    {posts.length === 0 && <p class="muted-note">Nothing with this tag yet.</p>}
+    {groups.map((g) => (
+      <>
+        {multi && <h2 class="archive-group">{g.plural}</h2>}
+        <div class:list={['post-grid', `is-${layout}`]}>
+          {g.posts.map((p) => (
+            <PostCard
+              variant={layout === 'cards' ? 'card' : 'row'}
+              headingLevel={multi ? 3 : 2}
+              href={collectionUrl(p.collection, p.slug)}
+              title={p.title}
+              excerpt={p.excerpt}
+              cover={p.cover}
+              coverAlt={p.coverAlt}
+              date={fmt(p.publishedAt)}
+              datetime={iso(p.publishedAt)}
+              readMins={readMins(p)}
+              tags={tagLinks(p.tags)}
+            />
+          ))}
+        </div>
+      </>
+    ))}
+    <Pager base={base} page={pageNum} count={pageCount} />
+    <p class="archive-back"><a href={postsIndexUrl()}>← All {CONTENT.posts.plural.toLowerCase()}</a></p>
+  </div>
 </Site>
-
-<style>
-  .tag-group { font-size: 1.05rem; margin: 1.6rem 0 0.2rem; color: var(--muted, inherit); }
-</style>

package/src/pages/book/[resource]/[link].astro

@@ -0,0 +1,70 @@
+---
+import Site from '../../../layouts/Site.astro';
+import BookingFlow from '../../../components/booking/BookingFlow.astro';
+import { getRepo } from '../../../lib/repo';
+import { bookingsEnabled, manageUrl, resourceUrl } from '../../../lib/calendar/config';
+import { availabilityContext, createResourceBooking, rescheduleBooking, BookingError } from '../../../lib/booking/service';
+import { siteOrigin } from '../../../lib/seo';
+import { waitUntilFrom } from '../../../lib/webhooks';
+
+// One booking link: pick → answer → done. POSTs create the booking (or move
+// one when ?reschedule=<token>) and land on the manage page.
+if (!bookingsEnabled()) return new Response(null, { status: 404 });
+const repo = await getRepo(Astro.locals);
+const resource = await repo.getResourceBySlug(Astro.params.resource ?? '');
+const link = resource ? await repo.getBookingLinkBySlug(resource.id, Astro.params.link ?? '') : null;
+if (!resource || !link || !link.active) return new Response(null, { status: 404, statusText: 'Not found' });
+const settings = await repo.getSettings();
+const origin = siteOrigin(settings, Astro.url);
+const flow = { origin, locals: Astro.locals, waitUntil: waitUntilFrom(Astro.locals) };
+const rescheduleToken = Astro.url.searchParams.get('reschedule') ?? '';
+const reschedule = rescheduleToken ? await repo.getBookingByToken(rescheduleToken) : null;
+if (reschedule && reschedule.linkId !== link.id) return Astro.redirect(manageUrl(reschedule.manageToken));
+
+let error = '';
+let values: Record<string, string> = {};
+// after a failed submit, re-open the form on the time that was chosen
+const flowUrl = new URL(Astro.url);
+if (Astro.request.method === 'POST') {
+  const form = await Astro.request.formData();
+  values = Object.fromEntries([...form.entries()].map(([k, v]) => [k, String(v)]));
+  const start = Number(form.get('start'));
+  const end = Number(form.get('end'));
+  try {
+    if (!Number.isFinite(start) || !Number.isFinite(end) || end <= start) throw new BookingError(400, 'Pick a time first.');
+    const token = String(form.get('reschedule') || '');
+    if (token) {
+      const b = await repo.getBookingByToken(token);
+      if (!b || b.linkId !== link.id) throw new BookingError(404, 'That booking can’t be found.');
+      await rescheduleBooking(repo, b, start, end, flow);
+      return Astro.redirect(`${manageUrl(b.manageToken)}?moved=1`);
+    }
+    const answers: Record<string, string> = {};
+    for (const qn of link.questions) answers[qn.id] = String(form.get(`q_${qn.id}`) ?? '');
+    const b = await createResourceBooking(repo, {
+      resource, link, start, end,
+      booker: { name: String(form.get('name') ?? ''), email: String(form.get('email') ?? ''), phone: String(form.get('phone') ?? ''), answers },
+    }, flow);
+    if (link.redirectUrl && /^https?:\/\//.test(link.redirectUrl)) return Astro.redirect(link.redirectUrl);
+    return Astro.redirect(`${manageUrl(b.manageToken)}?new=1`);
+  } catch (err) {
+    error = err instanceof BookingError ? err.message : 'Something went wrong. Please try again.';
+    if (Number.isFinite(start)) {
+      const tz = resource.timezone || settings.timezone || 'UTC';
+      flowUrl.searchParams.set('start', String(start));
+      flowUrl.searchParams.set('date', new Intl.DateTimeFormat('en-CA', { timeZone: tz, year: 'numeric', month: '2-digit', day: '2-digit' }).format(start));
+      if (link.mode !== 'slots') flowUrl.searchParams.set('len', String(Math.round((end - start) / 60_000)));
+    }
+    if (!(err instanceof BookingError)) console.error(err);
+    Astro.response.status = err instanceof BookingError ? err.status : 500;
+  }
+}
+const ctx = await availabilityContext(repo, resource, link, settings, Date.now(), reschedule?.id);
+---
+
+<Site title={`${link.name} · ${resource.name}`} description={link.description || `Book ${resource.name}.`} noindex={link.visibility === 'unlisted' || resource.visibility === 'unlisted'}>
+  <div class="pc-bkpage">
+    <BookingFlow resource={resource} link={link} ctx={ctx} settings={settings} url={flowUrl} error={error} values={values} reschedule={reschedule} />
+    <p class="pc-bk-foot"><a href={resourceUrl(resource.slug)}>Other ways to book {resource.name}</a></p>
+  </div>
+</Site>

package/src/pages/book/[resource]/index.astro

@@ -0,0 +1,63 @@
+---
+import Site from '../../../layouts/Site.astro';
+import { getRepo } from '../../../lib/repo';
+import { bookingLinkUrl, bookingsEnabled, CALENDAR } from '../../../lib/calendar/config';
+import { availabilityContext } from '../../../lib/booking/service';
+import { describeLink, nextOpenings } from '../../../lib/booking/availability';
+import { fmt } from '../../../lib/booking/view';
+
+// A room (or person, or van) and its booking links (mockup C): each link is a
+// card with its rules, an Instant / Approval badge, and its next openings —
+// tap one to jump into the flow with the time filled in.
+if (!bookingsEnabled()) return new Response(null, { status: 404 });
+const repo = await getRepo(Astro.locals);
+const resource = await repo.getResourceBySlug(Astro.params.resource ?? '');
+if (!resource) return new Response(null, { status: 404, statusText: 'Not found' });
+const settings = await repo.getSettings();
+const links = (await repo.listBookingLinks(resource.id)).filter((l) => l.active && l.visibility === 'public');
+const now = Date.now();
+const tz = resource.timezone || settings.timezone || 'UTC';
+const f = fmt(settings, tz);
+const cards = await Promise.all(links.map(async (link) => {
+  const ctx = await availabilityContext(repo, resource, link, settings, now);
+  return { link, next: nextOpenings(ctx, 3) };
+}));
+const chip = (start: number, link: (typeof links)[number]) => {
+  const d = new Intl.DateTimeFormat('en-CA', { timeZone: tz, year: 'numeric', month: '2-digit', day: '2-digit' }).format(start);
+  const today = new Intl.DateTimeFormat('en-CA', { timeZone: tz, year: 'numeric', month: '2-digit', day: '2-digit' }).format(now);
+  const tomorrow = new Intl.DateTimeFormat('en-CA', { timeZone: tz, year: 'numeric', month: '2-digit', day: '2-digit' }).format(now + 86_400_000);
+  const day = d === today ? 'Today' : d === tomorrow ? 'Tomorrow' : f.day.format(start);
+  return link.mode === 'slots' ? `${day} ${f.time.format(start)}` : day;
+};
+const facts = [resource.capacity ? `Up to ${resource.capacity}` : '', ...resource.amenities].filter(Boolean);
+---
+
+<Site title={resource.name} description={resource.description || `Book ${resource.name}.`} image={resource.photo || undefined} noindex={resource.visibility === 'unlisted'}>
+  <div class="pc-res">
+    <div class="pc-res-about">
+      {resource.photo ? <img class="pc-res-photo" src={resource.photo} alt="" /> : null}
+      <span class="pc-res-kind">{resource.kind}</span>
+      <h1 class="pc-res-title">{resource.name}</h1>
+      {facts.length > 0 && <ul class="pc-res-facts">{facts.map((x) => <li>{x}</li>)}</ul>}
+      {resource.description && <p class="pc-res-desc">{resource.description}</p>}
+    </div>
+    <div class="pc-res-links">
+      {cards.length === 0 && <p class="pc-bk-empty">Online booking isn’t open for {resource.name} right now.</p>}
+      {cards.map(({ link, next }) => (
+        <article class="pc-res-link">
+          <div class="pc-res-linkhead">
+            <h2><a href={bookingLinkUrl(resource.slug, link.slug)}>{link.name}</a></h2>
+            <span class={`pc-res-badge${link.autoConfirm ? ' is-instant' : ''}`}>{link.autoConfirm ? 'Instant' : 'Approval'}</span>
+          </div>
+          <p>{[describeLink(link), link.description].filter(Boolean).join(' · ')}</p>
+          <div class="pc-res-next">
+            {next.map((s) => <a href={`${bookingLinkUrl(resource.slug, link.slug)}?date=${new Intl.DateTimeFormat('en-CA', { timeZone: tz, year: 'numeric', month: '2-digit', day: '2-digit' }).format(s.start)}&start=${s.start}&len=${s.minutes}`}>{chip(s.start, link)}</a>)}
+            {next.length === 0 && <span class="pc-res-none">No openings soon</span>}
+            <a class="pc-res-more" href={bookingLinkUrl(resource.slug, link.slug)}>{next.length ? 'More times ›' : 'See calendar ›'}</a>
+          </div>
+        </article>
+      ))}
+      <p class="pc-bk-foot"><a href={CALENDAR.bookBase}>All rooms and people</a></p>
+    </div>
+  </div>
+</Site>

package/src/pages/book/[resource].ics.ts

@@ -0,0 +1,38 @@
+import type { APIRoute } from 'astro';
+import { timingSafeEqual } from 'node:crypto';
+import { getRepo } from '../../lib/repo';
+import { bookingsEnabled } from '../../lib/calendar/config';
+import { siteOrigin } from '../../lib/seo';
+import { escapeText, foldLine } from '../../lib/calendar/ics-write';
+
+// Staff feed of a resource's bookings (names included), for Google/Apple/
+// Outlook subscriptions: /book/<slug>.ics?t=<secret from the admin>.
+const same = (a: string, b: string) => a.length === b.length && a.length > 0 && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+const utc = (ms: number) => new Date(ms).toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
+
+export const GET: APIRoute = async ({ params, url, locals }) => {
+  if (!bookingsEnabled()) return new Response(null, { status: 404 });
+  const repo = await getRepo(locals);
+  const resource = await repo.getResourceBySlug(params.resource ?? '');
+  if (!resource || !same(url.searchParams.get('t') ?? '', resource.feedToken)) return new Response(null, { status: 404 });
+  const settings = await repo.getSettings();
+  const origin = siteOrigin(settings, url);
+  const host = new URL(origin).host;
+  const [bookings, links] = await Promise.all([
+    repo.listBookings({ resourceId: resource.id, from: Date.now() - 60 * 86_400_000, statuses: ['pending', 'confirmed'] }),
+    repo.listBookingLinks(resource.id),
+  ]);
+  const linkName = new Map(links.map((l) => [l.id, l.name]));
+  const lines = ['BEGIN:VCALENDAR', 'VERSION:2.0', 'PRODID:-//acms-subir//Bookings//EN', 'METHOD:PUBLISH',
+    `X-WR-CALNAME:${escapeText(`${resource.name} bookings`)}`, 'REFRESH-INTERVAL;VALUE=DURATION:PT15M'];
+  for (const b of bookings) {
+    const title = b.kind === 'block' ? `Blocked${b.notes ? ` · ${b.notes}` : ''}` : `${b.status === 'pending' ? '[Pending] ' : ''}${b.name}${b.linkId ? ` · ${linkName.get(b.linkId) ?? ''}` : ''}`;
+    const desc = [b.email, b.phone, ...Object.entries(b.answers).map(([k, v]) => `${k}: ${v}`), `${origin}/admin/calendar/bookings?b=${b.id}`].filter(Boolean).join('\n');
+    lines.push('BEGIN:VEVENT', `UID:booking-${b.id}@${host}`, `DTSTAMP:${utc(Date.now())}`, `DTSTART:${utc(b.start)}`, `DTEND:${utc(b.end)}`,
+      `SUMMARY:${escapeText(title)}`, `DESCRIPTION:${escapeText(desc)}`, `STATUS:${b.status === 'pending' ? 'TENTATIVE' : 'CONFIRMED'}`, 'END:VEVENT');
+  }
+  lines.push('END:VCALENDAR');
+  return new Response(lines.map(foldLine).join('\r\n') + '\r\n', {
+    headers: { 'Content-Type': 'text/calendar; charset=utf-8', 'Cache-Control': 'private, no-store' },
+  });
+};

package/src/pages/book/index.astro

@@ -0,0 +1,47 @@
+---
+import Site from '../../layouts/Site.astro';
+import { getRepo } from '../../lib/repo';
+import { CALENDAR, bookingsEnabled, resourceUrl, bookingLinkUrl } from '../../lib/calendar/config';
+
+// Directory of everything bookable: public resources grouped by kind, each
+// with its public booking links.
+if (!bookingsEnabled()) return new Response(null, { status: 404 });
+const repo = await getRepo(Astro.locals);
+const [settings, resources, links] = await Promise.all([repo.getSettings(), repo.listResources(), repo.listBookingLinks()]);
+const listed = resources.filter((r) => r.visibility === 'public');
+const byKind = new Map<string, typeof listed>();
+for (const r of listed) byKind.set(r.kind, [...(byKind.get(r.kind) ?? []), r]);
+const linksOf = (id: string) => links.filter((l) => l.resourceId === id && l.active && l.visibility === 'public');
+const plural = (k: string) => (k.endsWith('s') ? k : k.endsWith('y') ? `${k.slice(0, -1)}ies` : `${k}s`);
+---
+
+<Site title="Book" description={`Book rooms and time at ${settings.siteTitle}.`}>
+  <div class="pc-dir">
+    <header class="pc-calpage-head"><h1>Book</h1><p>Reserve a room or time with {settings.siteTitle}.</p></header>
+    {listed.length === 0 && (
+      <div class="empty-state">
+        <span class="empty-icon" aria-hidden="true"><svg viewBox="0 0 24 24" width="22" height="22" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><rect x="3.5" y="5" width="17" height="15" rx="3" /><path d="M3.5 10h17M8 3v4M16 3v4" /></svg></span>
+        <b>Nothing to book yet</b>
+        <span>When rooms or appointments open up, they'll show here.</span>
+        {CALENDAR.enabled && <a class="btn secondary sm" href={CALENDAR.base}>See the calendar</a>}
+      </div>
+    )}
+    {[...byKind.entries()].map(([kind, list]) => (
+      <section class="pc-dir-group">
+        {byKind.size > 1 && <h2>{plural(kind)}</h2>}
+        <div class="pc-dir-grid">
+          {list.map((r) => (
+            <article class="pc-dir-card">
+              <a class="pc-dir-media" href={resourceUrl(r.slug)} tabindex="-1" aria-hidden="true">{r.photo ? <img src={r.photo} alt="" loading="lazy" /> : <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M3 21V9l9-5 9 5v12M9 21v-6h6v6" /></svg>}</a>
+              <div class="pc-dir-body">
+                <h3><a href={resourceUrl(r.slug)}>{r.name}</a></h3>
+                <p>{[r.capacity ? `Up to ${r.capacity}` : '', ...r.amenities.slice(0, 3)].filter(Boolean).join(' · ')}</p>
+                <div class="pc-dir-links">{linksOf(r.id).map((l) => <a href={bookingLinkUrl(r.slug, l.slug)}>{l.name}</a>)}</div>
+              </div>
+            </article>
+          ))}
+        </div>
+      </section>
+    ))}
+  </div>
+</Site>

package/src/pages/book/manage/[token].astro

@@ -0,0 +1,108 @@
+---
+import Site from '../../../layouts/Site.astro';
+import { getRepo } from '../../../lib/repo';
+import { bookingLinkUrl, bookingsEnabled, eventUrl, resourceUrl } from '../../../lib/calendar/config';
+import { setBookingStatus, BookingError } from '../../../lib/booking/service';
+import { bookingIcs, whenText } from '../../../lib/booking/emails';
+import { resourceZone } from '../../../lib/booking/availability';
+import { eventTimeZone, locationLine } from '../../../lib/calendar/events';
+import { siteOrigin } from '../../../lib/seo';
+import { waitUntilFrom } from '../../../lib/webhooks';
+
+// The booker's own page, reached from the confirmation and every email: see
+// the status, add it to a calendar, move it or cancel it. The token in the
+// URL is the only credential — it's long and random, and never listed.
+if (!bookingsEnabled()) return new Response(null, { status: 404 });
+const repo = await getRepo(Astro.locals);
+const booking = await repo.getBookingByToken(Astro.params.token ?? '');
+if (!booking) return new Response(null, { status: 404, statusText: 'Not found' });
+const settings = await repo.getSettings();
+const origin = siteOrigin(settings, Astro.url);
+const [resource, link, event] = await Promise.all([
+  booking.resourceId ? repo.getResource(booking.resourceId) : Promise.resolve(null),
+  booking.linkId ? repo.getBookingLink(booking.linkId) : Promise.resolve(null),
+  booking.eventId ? repo.getEvent(booking.eventId) : Promise.resolve(null),
+]);
+const title = event ? event.title : [resource?.name, link?.name].filter(Boolean).join(' · ') || 'Booking';
+const location = event ? locationLine(event.location) : resource?.name ?? '';
+const url = origin + Astro.url.pathname;
+
+if (Astro.url.searchParams.get('ics')) {
+  return new Response(bookingIcs(booking, title, location, url, new URL(origin).host), {
+    headers: { 'Content-Type': 'text/calendar; charset=utf-8', 'Content-Disposition': 'inline; filename="booking.ics"', 'Cache-Control': 'private, no-store' },
+  });
+}
+let error = '';
+let current = booking;
+if (Astro.request.method === 'POST') {
+  const form = await Astro.request.formData();
+  if (form.get('op') === 'cancel' && (booking.status === 'pending' || booking.status === 'confirmed')) {
+    try {
+      current = await setBookingStatus(repo, booking, 'cancelled', { origin, locals: Astro.locals, waitUntil: waitUntilFrom(Astro.locals) });
+    } catch (err) {
+      error = err instanceof BookingError ? err.message : 'Couldn’t cancel — please try again.';
+    }
+  }
+}
+const tz = event ? eventTimeZone(event, settings) : resource ? resourceZone(resource, settings.timezone) : settings.timezone || 'UTC';
+const when = whenText(current, tz, settings, link?.mode === 'day' || event?.allDay);
+const active = current.status === 'pending' || current.status === 'confirmed';
+const upcoming = current.end > Date.now();
+const isNew = Astro.url.searchParams.has('new');
+const moved = Astro.url.searchParams.has('moved');
+const heading = current.status === 'cancelled' ? 'Booking cancelled'
+  : current.status === 'declined' ? 'Not available'
+  : current.status === 'pending' ? (isNew ? 'Request sent' : 'Waiting for approval')
+  : moved ? 'Booking moved' : isNew ? 'You’re booked' : 'Your booking';
+const lede = current.status === 'pending' ? `We’ll email ${current.email} once it’s approved.`
+  : current.status === 'confirmed' ? (link?.confirmMessage || `A confirmation is on its way to ${current.email}.`)
+  : current.status === 'declined' ? 'Sorry — this time couldn’t be confirmed. You’re welcome to pick another.'
+  : 'This booking is cancelled.';
+const googleUrl = `https://calendar.google.com/calendar/render?${new URLSearchParams({ action: 'TEMPLATE', text: title, dates: `${new Date(current.start).toISOString().replace(/[-:]|\.\d{3}/g, '')}/${new Date(current.end).toISOString().replace(/[-:]|\.\d{3}/g, '')}`, details: url, location })}`;
+---
+
+<Site title={heading} noindex>
+  <div class="pc-manage">
+    <div class={`pc-manage-icon is-${current.status}`} aria-hidden="true">
+      {current.status === 'confirmed' ? <svg viewBox="0 0 24 24"><path d="M5 12l5 5L19 7" /></svg>
+        : current.status === 'pending' ? <svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="8" /><path d="M12 8v4l3 2" /></svg>
+        : <svg viewBox="0 0 24 24"><path d="M7 7l10 10M17 7 7 17" /></svg>}
+    </div>
+    <h1>{heading}</h1>
+    <p class="pc-manage-lede">{lede}</p>
+    {error && <p class="pc-bk-error">{error}</p>}
+    <dl class="pc-manage-card">
+      <div><dt>What</dt><dd>{title}</dd></div>
+      <div><dt>When</dt><dd>{when}</dd></div>
+      {location && <div><dt>Where</dt><dd>{location}</dd></div>}
+      {current.seats > 1 && <div><dt>Seats</dt><dd>{current.seats}</dd></div>}
+      <div><dt>Status</dt><dd class={`pc-manage-status is-${current.status}`}>{current.status[0].toUpperCase() + current.status.slice(1)}</dd></div>
+      <div><dt>Reference</dt><dd class="mono">{current.id.slice(0, 8).toUpperCase()}</dd></div>
+    </dl>
+    {active && upcoming && (
+      <div class="pc-manage-actions">
+        {current.status === 'confirmed' && (
+          <details class="pc-ev-add">
+            <summary>Add to calendar</summary>
+            <div class="pc-ev-add-menu">
+              <a href={googleUrl} target="_blank" rel="noopener">Google Calendar</a>
+              <a href="?ics=1">Apple Calendar</a>
+              <a href="?ics=1" download="booking.ics">Download .ics</a>
+            </div>
+          </details>
+        )}
+        {resource && link && current.kind === 'booking' && (
+          <a class="pc-manage-btn" href={`${bookingLinkUrl(resource.slug, link.slug)}?reschedule=${encodeURIComponent(current.manageToken)}`}>Reschedule</a>
+        )}
+        <form method="post" onsubmit="return confirm('Cancel this booking?')">
+          <input type="hidden" name="op" value="cancel" />
+          <button class="pc-manage-btn is-danger" type="submit">Cancel {current.kind === 'rsvp' ? 'RSVP' : 'booking'}</button>
+        </form>
+      </div>
+    )}
+    <p class="pc-bk-foot">
+      {event ? <a href={eventUrl(event.slug)}>Back to {event.title}</a> : resource ? <a href={resourceUrl(resource.slug)}>Back to {resource.name}</a> : null}
+    </p>
+    <p class="pc-manage-note">Keep this link — anyone with it can change this booking.</p>
+  </div>
+</Site>

package/src/pages/calendar/[slug].ics.ts

@@ -0,0 +1,27 @@
+import type { APIRoute } from 'astro';
+import { timingSafeEqual } from 'node:crypto';
+import { getRepo } from '../../lib/repo';
+import { siteOrigin } from '../../lib/seo';
+import { CALENDAR } from '../../lib/calendar/config';
+import { feedFor, icsResponse } from '../../lib/calendar/feeds';
+
+// One calendar's subscribe feed. Public and unlisted calendars are open;
+// private ones need the secret ?t= token from Calendars → Copy link (staff
+// subscriptions). A wrong token looks exactly like a missing calendar.
+const sameToken = (a: string, b: string) =>
+  a.length === b.length && a.length > 0 && timingSafeEqual(Buffer.from(a), Buffer.from(b));
+
+export const GET: APIRoute = async ({ locals, url, params }) => {
+  if (!CALENDAR.enabled) return new Response(null, { status: 404 });
+  const repo = await getRepo(locals);
+  const calendar = await repo.getCalendarBySlug(params.slug ?? '');
+  if (!calendar || calendar.kind !== 'native') return new Response(null, { status: 404 });
+  const isPrivate = calendar.visibility === 'private';
+  if (isPrivate && !sameToken(url.searchParams.get('t') ?? '', calendar.feedToken)) return new Response(null, { status: 404 });
+  const settings = await repo.getSettings();
+  const { body } = await feedFor(repo, settings, siteOrigin(settings, url), { calendar, allowPrivate: isPrivate });
+  // private feeds must never sit in shared caches
+  const res = icsResponse(body, `${calendar.slug}.ics`, isPrivate ? 0 : 300);
+  if (isPrivate) res.headers.set('Cache-Control', 'private, no-store');
+  return res;
+};

package/src/pages/calendar/feed.ics.ts

@@ -0,0 +1,15 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../lib/repo';
+import { siteOrigin } from '../../lib/seo';
+import { CALENDAR } from '../../lib/calendar/config';
+import { feedFor, icsResponse } from '../../lib/calendar/feeds';
+
+// Every public calendar in one subscribe feed (/calendar.ics). Feed
+// calendars are not re-published — subscribers can add those at the source.
+export const GET: APIRoute = async ({ locals, url }) => {
+  if (!CALENDAR.enabled) return new Response(null, { status: 404 });
+  const repo = await getRepo(locals);
+  const settings = await repo.getSettings();
+  const { body } = await feedFor(repo, settings, siteOrigin(settings, url), {});
+  return icsResponse(body, 'calendar.ics');
+};