@acms-subir/core 0.3.35 → 0.3.36

package/mobile-template/recipes/rsvp/files/components/RsvpPanel.tsx

@@ -0,0 +1,270 @@
+import { useEffect, useState } from 'react';
+import { ActivityIndicator, Platform, Pressable, Switch, Text, TextInput, View, type KeyboardTypeOptions } from 'react-native';
+import * as Crypto from 'expo-crypto';
+import * as SecureStore from 'expo-secure-store';
+import { isAcmsError, type FormField } from '@acms-subir/client';
+import { Button, answerProblems, seatChoices, useCancelBooking, useGuest, useManagedBooking, useRsvp, useRsvpStatus, useSite, useTheme } from '@acms-subir/native';
+
+// RSVP to one date of an event: <RsvpPanel slug={event.slug} start={occurrence.start} />,
+// with `start` exactly as useEvents returns it. Shows going and spots left,
+// seats, contact details and the event's questions, then the person's RSVP
+// with a way to cancel it; or why the date takes no RSVPs. Same rules as the
+// event's web page: open until the date ends, and the organiser may approve
+// each RSVP. useRsvp keeps one idempotency key per RSVP, so sending again
+// after a timeout can't register anyone twice.
+
+// The RSVP's private manage token, one per event date, lives only in secure
+// storage (never a URL or log). Keys allow letters, digits, ".", "-" and "_".
+// Web has no secure storage: there the confirmation email's link is the way back.
+const tokenKey = (eventId: string, start: string) => `rsvp.${eventId}.${start}`.replace(/[^A-Za-z0-9._-]/g, '_');
+const keychain = { keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY };
+const tokens = {
+  get: async (key: string) => (Platform.OS === 'web' ? null : SecureStore.getItemAsync(key, keychain).catch(() => null)),
+  set: async (key: string, token: string) => { if (Platform.OS !== 'web') await SecureStore.setItemAsync(key, token, keychain).catch(() => {}); },
+  remove: async (key: string) => { if (Platform.OS !== 'web') await SecureStore.deleteItemAsync(key, keychain).catch(() => {}); },
+};
+
+type Answers = Record<string, string | string[]>;
+const OTHER = '__other__';
+const problemText = (f: Pick<FormField, 'type'>, problem: 'required' | 'invalid') => problem === 'required' ? 'Please answer this.'
+  : f.type === 'email' ? 'Enter an email address.' : f.type === 'number' ? 'Enter a number.' : f.type === 'phone' ? 'Enter a phone number.'
+  : f.type === 'date' ? 'Use YYYY-MM-DD, for example 2026-10-05.' : 'Check this answer.';
+const keyboards: Partial<Record<FormField['type'], KeyboardTypeOptions>> = { email: 'email-address', phone: 'phone-pad', number: 'numeric', url: 'url' };
+// "Other" choices send the typed text instead
+const withOther = (f: FormField, value: string | string[] | undefined, other: string): string | string[] => {
+  if (f.type === 'checkboxes') { const list = Array.isArray(value) ? value : []; return list.includes(OTHER) ? [...list.filter((v) => v !== OTHER), other.trim()] : list; }
+  return value === OTHER ? other.trim() : (value ?? '');
+};
+const seatsText = (n: number) => (n === 1 ? '1 seat' : `${n} seats`);
+
+export function RsvpPanel({ slug, start }: { slug: string; start: string }) {
+  const t = useTheme();
+  const { data: site } = useSite();
+  const guest = useGuest();
+  const status = useRsvpStatus(slug, start);
+  const rsvp = useRsvp(slug, start, { createKey: Crypto.randomUUID });
+  const s = status.data;
+  const key = s ? tokenKey(s.event.id, s.start) : null;
+  // undefined until secure storage has answered
+  const [stored, setStored] = useState<string | null | undefined>(undefined);
+  const changes = site?.features.bookingChanges === true;
+  const managed = useManagedBooking(changes ? stored : null);
+  const cancel = useCancelBooking(stored);
+  const [confirming, setConfirming] = useState(false);
+  const [notice, setNotice] = useState('');
+  const [name, setName] = useState('');
+  const [email, setEmail] = useState('');
+  const [phone, setPhone] = useState('');
+  const [seats, setSeats] = useState(1);
+  const [values, setValues] = useState<Answers>({});
+  const [others, setOthers] = useState<Record<string, string>>({});
+  const [tried, setTried] = useState(false);
+
+  useEffect(() => {
+    if (!key) return;
+    let live = true;
+    void tokens.get(key).then((token) => { if (live) setStored(token); });
+    return () => { live = false; };
+  }, [key]);
+  // signed in for "My bookings": that's their email (guest sign-in knows no name)
+  useEffect(() => {
+    if (site?.features.guestSignIn && guest.email) setEmail((e) => e || guest.email!);
+  }, [site?.features.guestSignIn, guest.email]);
+  // cancelled (here, from the email link or by the organiser) or gone: forget the token
+  const gone = managed.data?.booking.status === 'cancelled' || (isAcmsError(managed.error) && managed.error.status === 404);
+  useEffect(() => {
+    if (!key || !stored || !gone) return;
+    void tokens.remove(key);
+    setStored(null);
+    setConfirming(false);
+    rsvp.reset();
+    if (managed.data?.booking.status === 'cancelled') setNotice('Your RSVP is cancelled.');
+  }, [key, stored, gone]);
+
+  if (!s) return status.isPending ? <ActivityIndicator color={t.colors.accent} /> : null;
+  const input = { borderWidth: 1, borderColor: t.colors.line, borderRadius: Math.min(t.radius, 10), padding: 12, fontSize: 16, color: t.colors.ink, backgroundColor: t.colors.panel } as const;
+  const chip = (on: boolean) => ({ paddingVertical: 10, paddingHorizontal: 12, borderRadius: Math.min(t.radius, 10), borderWidth: 1, borderColor: on ? t.colors.accent : t.colors.line, backgroundColor: on ? t.colors.soft : t.colors.panel });
+  const errorText = [t.styles.text.small, { color: t.colors.ink, fontWeight: '600' as const }];
+  const going = (
+    <Text style={t.styles.text.body}>
+      <Text style={{ fontWeight: '700' }}>{s.going}</Text> going
+      {s.left !== null && <> · <Text style={{ fontWeight: '700' }}>{s.left}</Text> {s.left === 1 ? 'spot' : 'spots'} left</>}
+    </Text>
+  );
+
+  // ---- their RSVP: just sent, or kept from before ----
+  const mine = managed.data && managed.data.booking.status !== 'cancelled' ? managed.data : null;
+  const made = rsvp.data?.booking;
+  if (stored === undefined || (stored && changes && managed.isPending && !made)) return <ActivityIndicator color={t.colors.accent} />;
+  // offline or busy: say so rather than offer a second RSVP
+  if (stored && changes && managed.error && !gone && !made) return (
+    <View style={[t.styles.card, { gap: 8 }]}>
+      <Text accessibilityRole="header" style={t.styles.text.heading}>Your RSVP</Text>
+      <Text style={t.styles.text.muted}>Couldn’t load it right now.</Text>
+      <Button label="Try again" variant="outline" onPress={() => void managed.refetch()} />
+    </View>
+  );
+  if ((stored && mine) || made) {
+    const state = mine?.booking.status ?? made!.status;
+    const who = mine?.booking.email ?? made!.email;
+    const thanks = mine ? mine.confirmation : made!.formResponse?.definition.confirmation || null;
+    const canCancel = !!stored && changes && (mine ? mine.can.cancel : false);
+    return (
+      <View style={[t.styles.card, { gap: 8 }]}>
+        <Text accessibilityRole="header" style={t.styles.text.heading}>{!made ? 'Your RSVP' : state === 'confirmed' ? 'Confirmed' : 'Request sent'}</Text>
+        <Text style={[t.styles.text.label, { color: t.colors.ink }]}>
+          {seatsText(mine?.booking.seats ?? made!.seats)} · {state === 'confirmed' ? 'Confirmed' : state === 'pending' ? 'Waiting for approval' : 'Not confirmed'}
+        </Text>
+        <Text style={t.styles.text.body}>
+          {state === 'confirmed' ? thanks || `A confirmation is on its way to ${who}.`
+            : state === 'pending' ? `We’ll email ${who} once it’s approved.` : 'Sorry, the organiser couldn’t confirm it.'}
+        </Text>
+        {state === 'declined' && <Button label="RSVP again" variant="outline" onPress={() => { if (key) void tokens.remove(key); setStored(null); rsvp.reset(); }} />}
+        {canCancel && state !== 'declined' && (confirming ? (
+          <View style={{ gap: 8 }}>
+            <Text style={t.styles.text.body}>Cancel your RSVP for {seatsText(mine!.booking.seats)}?</Text>
+            <View style={{ flexDirection: 'row', flexWrap: 'wrap', gap: 10 }}>
+              <Button label={cancel.isPending ? 'Cancelling…' : 'Yes, cancel it'} disabled={cancel.isPending} onPress={() => cancel.mutate()} />
+              <Button label="Keep it" variant="outline" disabled={cancel.isPending} onPress={() => setConfirming(false)} />
+            </View>
+          </View>
+        ) : <Button label="Cancel my RSVP" variant="outline" onPress={() => setConfirming(true)} />)}
+        {cancel.error && <Text style={errorText}>{isAcmsError(cancel.error) && cancel.error.status === 0 ? 'Check your connection and try again.' : cancel.error.message}</Text>}
+        {!canCancel && state !== 'declined' && <Text style={t.styles.text.small}>The confirmation email has a link to change or cancel it.</Text>}
+      </View>
+    );
+  }
+
+  if (s.reason === 'disabled') return null;
+  if (!s.open) return (
+    <View style={[t.styles.card, { gap: 6 }]}>
+      <Text accessibilityRole="header" style={t.styles.text.heading}>{s.reason === 'full' ? 'Full' : s.reason === 'cancelled' ? 'This date is cancelled' : 'RSVPs are closed'}</Text>
+      {s.reason === 'full' ? going : <Text style={t.styles.text.muted}>{s.reason === 'cancelled' ? 'Nobody needs to RSVP for it.' : 'This date has already happened.'}</Text>}
+    </View>
+  );
+
+  // ---- the form ----
+  const form = s.form;
+  const fields = form?.fields ?? [];
+  const answers: Answers = Object.fromEntries(fields.filter((f) => f.type !== 'heading').map((f) => [f.id, withOther(f, values[f.id], others[f.id] ?? '')]));
+  const problems = answerProblems(fields, answers);
+  const nameProblem = !name.trim() ? 'Add your name.' : '';
+  const emailProblem = !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email.trim()) ? 'Add a valid email address.' : '';
+  // the form may ask for a phone itself
+  const askPhone = !fields.some((f) => f.type === 'phone');
+  const chosen = Math.min(seats, s.maxSeats) || 1;
+  const submit = () => {
+    setTried(true);
+    setNotice('');
+    if (nameProblem || emailProblem || Object.keys(problems).length) return;
+    rsvp.mutate({ name, email, phone: askPhone ? phone : '', seats: chosen, answers }, {
+      onSuccess: (data) => { if (key) void tokens.set(key, data.manageToken); setStored(data.manageToken); },
+    });
+  };
+  const set = (id: string, v: string | string[]) => setValues((a) => ({ ...a, [id]: v }));
+  const label = (text: string, required: boolean) => (
+    <Text style={t.styles.text.label}>{text}{required ? <Text accessibilityLabel="required"> *</Text> : ''}</Text>
+  );
+  const text = (lbl: string, value: string, onChange: (v: string) => void, o: { required?: boolean; keyboard?: KeyboardTypeOptions; multiline?: boolean; auto?: 'name' | 'email' | 'tel'; placeholder?: string; help?: string; problem?: string } = {}) => (
+    <View key={lbl} style={{ gap: 6 }}>
+      {label(lbl, !!o.required)}
+      {!!o.help && <Text style={t.styles.text.small}>{o.help}</Text>}
+      <TextInput value={value} onChangeText={onChange} keyboardType={o.keyboard} multiline={o.multiline} autoComplete={o.auto} placeholder={o.placeholder}
+        autoCapitalize={o.auto === 'email' || o.keyboard === 'email-address' || o.keyboard === 'url' ? 'none' : 'sentences'} placeholderTextColor={t.colors.muted}
+        accessibilityLabel={lbl} accessibilityHint={o.problem}
+        style={[input, o.multiline && { minHeight: 96, textAlignVertical: 'top' }, !!o.problem && { borderColor: t.colors.ink }]} />
+      {!!o.problem && <Text style={errorText}>{o.problem}</Text>}
+    </View>
+  );
+  const field = (f: FormField) => {
+    const problem = tried && problems[f.id] ? problemText(f, problems[f.id]) : '';
+    if (f.type === 'heading') return (
+      <View key={f.id} style={{ gap: 2, paddingTop: 4 }}>
+        <Text accessibilityRole="header" style={t.styles.text.heading}>{f.label}</Text>
+        {!!f.help && <Text style={t.styles.text.muted}>{f.help}</Text>}
+      </View>
+    );
+    if (f.type === 'checkbox' || f.type === 'consent') return (
+      <View key={f.id} style={{ gap: 6 }}>
+        <View style={{ flexDirection: 'row', alignItems: 'center', justifyContent: 'space-between', gap: 12 }}>
+          <Text style={[t.styles.text.body, { flex: 1 }]}>{f.label}{f.required ? ' *' : ''}</Text>
+          <Switch accessibilityLabel={f.label} value={values[f.id] === 'yes'} onValueChange={(v) => set(f.id, v ? 'yes' : '')} trackColor={{ true: t.colors.accent }} />
+        </View>
+        {!!f.help && <Text style={t.styles.text.small}>{f.help}</Text>}
+        {!!problem && <Text style={errorText}>{problem}</Text>}
+      </View>
+    );
+    if (f.type === 'select' || f.type === 'radio' || f.type === 'checkboxes') {
+      const many = f.type === 'checkboxes';
+      const current = values[f.id];
+      const isOn = (o: string) => (many ? Array.isArray(current) && current.includes(o) : current === o);
+      const toggle = (o: string) => {
+        if (!many) return set(f.id, current === o && !f.required ? '' : o);
+        const list = Array.isArray(current) ? current : [];
+        set(f.id, list.includes(o) ? list.filter((x) => x !== o) : [...list, o]);
+      };
+      const choices = f.allowOther && f.type !== 'select' ? [...f.options, OTHER] : f.options;
+      return (
+        <View key={f.id} style={{ gap: 6 }}>
+          {label(f.label, f.required)}
+          {!!f.help && <Text style={t.styles.text.small}>{f.help}</Text>}
+          <View accessibilityRole={many ? undefined : 'radiogroup'} style={{ flexDirection: 'row', flexWrap: 'wrap', gap: 8 }}>
+            {choices.map((o) => (
+              <Pressable key={o} accessibilityRole={many ? 'checkbox' : 'radio'} accessibilityState={{ checked: isOn(o) }} onPress={() => toggle(o)} style={chip(isOn(o))}>
+                <Text style={[t.styles.text.body, isOn(o) && { fontWeight: '600' }]}>{o === OTHER ? 'Other' : o}</Text>
+              </Pressable>
+            ))}
+          </View>
+          {isOn(OTHER) && (
+            <TextInput value={others[f.id] ?? ''} onChangeText={(v) => setOthers((x) => ({ ...x, [f.id]: v }))} placeholder="Other" accessibilityLabel={`${f.label}: other`}
+              placeholderTextColor={t.colors.muted} style={input} />
+          )}
+          {!!problem && <Text style={errorText}>{problem}</Text>}
+        </View>
+      );
+    }
+    return text(f.label, String(values[f.id] ?? ''), (v) => set(f.id, v), {
+      required: f.required, help: f.help, problem, multiline: f.type === 'textarea', keyboard: keyboards[f.type],
+      placeholder: f.placeholder || (f.type === 'date' ? 'YYYY-MM-DD' : undefined), auto: f.type === 'email' ? 'email' : f.type === 'phone' ? 'tel' : undefined,
+    });
+  };
+
+  const error = rsvp.error;
+  return (
+    <View style={[t.styles.card, { gap: 16 }]}>
+      <View style={{ gap: 4 }}>
+        <Text accessibilityRole="header" style={t.styles.text.heading}>{form?.title || 'Save your seat'}</Text>
+        {going}
+        {!!notice && <Text style={t.styles.text.muted}>{notice}</Text>}
+        {!!form?.intro && <Text style={t.styles.text.muted}>{form.intro}</Text>}
+      </View>
+      {text('Your name', name, setName, { required: true, auto: 'name', problem: tried ? nameProblem : '' })}
+      {text('Email', email, setEmail, { required: true, keyboard: 'email-address', auto: 'email', problem: tried ? emailProblem : '' })}
+      {askPhone && text('Phone (optional)', phone, setPhone, { keyboard: 'phone-pad', auto: 'tel' })}
+      {s.maxSeats > 1 && (
+        <View style={{ gap: 6 }}>
+          {label('Seats', false)}
+          <View accessibilityRole="radiogroup" style={{ flexDirection: 'row', flexWrap: 'wrap', gap: 8 }}>
+            {seatChoices(s).map((n) => (
+              <Pressable key={n} accessibilityRole="radio" accessibilityLabel={seatsText(n)} accessibilityState={{ checked: n === chosen }} onPress={() => setSeats(n)} style={[chip(n === chosen), { minWidth: 48, alignItems: 'center' }]}>
+                <Text style={[t.styles.text.body, n === chosen && { fontWeight: '600' }]}>{n}</Text>
+              </Pressable>
+            ))}
+          </View>
+        </View>
+      )}
+      {fields.map(field)}
+      {error && (
+        <View style={{ backgroundColor: t.colors.soft, borderRadius: Math.min(t.radius, 10), padding: 12, gap: 4 }}>
+          <Text style={[t.styles.text.body, { fontWeight: '600' }]}>That didn’t go through.</Text>
+          <Text style={t.styles.text.muted}>
+            {isAcmsError(error) && error.status === 0 ? 'Check your connection and try again. You won’t be registered twice.' : error.message}
+          </Text>
+        </View>
+      )}
+      {tried && (nameProblem || emailProblem || Object.keys(problems).length > 0) && <Text style={errorText}>Check the answers marked above.</Text>}
+      <Button label={rsvp.isPending ? 'Sending…' : form?.submitLabel || (s.autoConfirm ? 'Confirm my seat' : 'Request a seat')} disabled={rsvp.isPending} onPress={submit} />
+      <Text style={t.styles.text.small}>Your details go only to the organiser of this event.</Text>
+    </View>
+  );
+}

package/mobile-template/recipes/rsvp/recipe.json

@@ -0,0 +1,15 @@
+{
+  "kind": "client",
+  "title": "RSVP",
+  "description": "An RSVP panel for an event date: going and spots left, seats, the event's questions with inline errors, then the person's RSVP with Cancel, or why the date is full or closed. Already part of the events recipe; add it to an event screen of your own.",
+  "packages": [
+    "expo-crypto",
+    "expo-secure-store"
+  ],
+  "routes": [],
+  "next": [
+    "Mount it on your event screen where the date is known: <RsvpPanel slug={occurrence.event.slug} start={occurrence.start} /> from '../../components/RsvpPanel', with start exactly as useEvents returns it (the UTC ISO string, e.g. pass o.start through router params), and only when occurrence.event.rsvp?.enabled",
+    "The screen should scroll and avoid the keyboard: wrap it in <KeyboardAvoidingView behavior={Platform.OS === 'ios' ? 'padding' : undefined}> with <ScrollView keyboardShouldPersistTaps=\"handled\">",
+    "RSVPs need only the calendar (useSite().data.features.rsvp). Each RSVP's private manage token stays in expo-secure-store (never a URL or log): the panel shows the person's RSVP and lets them cancel it; the confirmation email's link works too"
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.35",
+  "version": "0.3.36",
   "publishConfig": {
     "access": "public"
   },

package/src/layouts/Site.astro

@@ -179,6 +179,7 @@ const chrome: SiteChrome = {
   schemeToggle,
   liveHeader: Boolean(liveSignals?.header),
   headerStyle: String(tokens.header), footerStyle: String(tokens.footer),
+  lang: htmlLang, words,
 };
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const HeaderTpl = design.theme.HeaderTemplate as any;

package/src/lib/cache/policy.ts

@@ -31,8 +31,8 @@ function privatePrefixes() {
     ...(CALENDAR.enabled ? [CALENDAR.bookBase] : []),
   ];
 }
-// Public app API routes that are personal, transactional or write-only.
-const PRIVATE_API = /^\/api\/v1\/(?:admin|auth|guest|bookings|availability|devices|push|forms)(?:\/|$)/;
+// Public app API routes that are personal, transactional, live or write-only.
+const PRIVATE_API = /^\/api\/v1\/(?:admin|auth|guest|bookings|availability|devices|push|forms|events\/[^/]+\/rsvp)(?:\/|$)/;
 
 const under = (path: string, prefix: string) => path === prefix || path.startsWith(`${prefix}/`) || path.startsWith(`${prefix}.`);
 

package/src/lib/legal/app-privacy.ts

@@ -10,15 +10,17 @@ export interface AppPrivacyAnswers { rows: StoreRow[]; tracking: string; notes:
 
 export function appPrivacyAnswers(f: LegalFacts, privacyUrl: string): AppPrivacyAnswers {
   const rows: StoreRow[] = [];
-  const contact = [...(f.bookings ? ['bookings'] : []), ...(f.appForms ? ['forms'] : [])];
+  // apps can RSVP wherever the calendar is on; room bookings need bookings too
+  const contact = [...(f.bookings ? ['bookings'] : []), ...(f.calendar ? ['RSVPs'] : []), ...(f.appForms ? ['forms'] : [])];
+  const sends = contact.length > 1 ? `${contact.slice(0, -1).join(', ')} or ${contact.at(-1)}` : contact[0];
   if (contact.length) {
     rows.push({
-      data: 'Name, email address, phone number', when: `When someone sends ${contact.join(' or ')} from the app`,
+      data: 'Name, email address, phone number', when: `When someone sends ${sends} from the app`,
       apple: 'Contact Info → Name, Email Address, Phone Number. Purpose: App Functionality. Linked to the user. Not used for tracking.',
       google: 'Personal info → Name, Email address, Phone number. Collected, not shared. Purpose: App functionality. Optional (people choose to send it).',
     });
     rows.push({
-      data: 'Answers typed into a form or booking question', when: `When someone sends ${contact.join(' or ')} from the app`,
+      data: 'Answers typed into a form or booking question', when: `When someone sends ${sends} from the app`,
       apple: 'User Content → Other User Content. Purpose: App Functionality. Linked to the user. Not used for tracking.',
       google: 'App activity → Other user-generated content. Collected, not shared. Purpose: App functionality. Optional.',
     });

package/src/lib/legal/text-en.ts

@@ -82,6 +82,7 @@ export function privacyEn(f: LegalFacts, country: string): PolicySection[] {
     ...(app ? [f.announcements
       ? 'Our app may keep the content it last loaded on your phone so it works offline, and remembers there your notification choice and which announcements you’ve read or closed. That stays on your phone and is never sent to us.'
       : 'Our app may keep the content it last loaded on your phone so it works offline, and remembers your notification choice there.'] : []),
+    ...(app && f.calendar ? ['When you RSVP or book in the app, it keeps the private key that lets you see or cancel it in your phone’s secure storage, like the private link we email you.'] : []),
   ] });
   s.push({ id: 'sharing', title: 'Who receives your information', text: [
     `We don’t sell your personal information${pixels ? '' : ' or share it for advertising'}. These service providers process it on our behalf and only for the purposes above: ${list(processors(f))}. They must protect it at least as this notice describes. Some of them may store it outside your country, including in the United States.`,

package/src/lib/legal/text-es.ts

@@ -83,6 +83,7 @@ export function privacyEs(f: LegalFacts, country: string): PolicySection[] {
     ...(app ? [f.announcements
       ? 'Nuestra app puede guardar en su teléfono el contenido que cargó por última vez para funcionar sin conexión, y recuerda ahí su preferencia de notificaciones y qué anuncios leyó o cerró. Eso se queda en su teléfono y nunca se nos envía.'
       : 'Nuestra app puede guardar en su teléfono el contenido que cargó por última vez para funcionar sin conexión, y recuerda ahí su preferencia de notificaciones.'] : []),
+    ...(app && f.calendar ? ['Cuando confirma su asistencia o reserva en la app, esta guarda en el almacenamiento seguro de su teléfono la clave privada que le permite verla o cancelarla, igual que el enlace privado que le enviamos por correo.'] : []),
   ] });
   s.push({ id: 'sharing', title: 'Quién recibe sus datos', text: [
     `No vendemos sus datos personales${pixels ? '' : ' ni los compartimos con fines publicitarios'}. Estos proveedores los tratan por cuenta nuestra y solo para los fines descritos: ${list(processors(f))}. Deben protegerlos al menos como lo describe este aviso. Algunos pueden guardarlos fuera de su país, incluido Estados Unidos.`,

package/src/lib/mobile/bookings.ts

@@ -4,33 +4,38 @@ import type { Booking } from '../schema';
 import { ApiError, readJson } from '../api';
 import { sha256Hex } from '../api-keys';
 import { siteOrigin } from '../seo';
-import { eventIsPublic, expandEvents } from '../calendar/events';
 import { createResourceBooking, createRsvp, bookingJson } from '../booking/service';
 import { waitUntilFrom } from '../webhooks';
 import { requireCalendar } from './calendar';
+import { appAnswers, joinAnswers } from './forms';
+import { rsvpClosed, rsvpOccurrence, rsvpQuestions } from './rsvp';
 
 const common = {
   start: z.string().datetime({ offset: true }),
   name: z.string().trim().min(1).max(120), email: z.string().trim().email().max(200).transform(v => v.toLowerCase()),
   phone: z.string().trim().max(40).default(''),
+  answers: appAnswers.default({}),
 };
 export const bookingInput = z.union([
   z.object({ ...common, resource: z.string().min(1).max(200), link: z.string().min(1).max(200),
-    minutes: z.number().int().min(1).max(44640).optional(), answers: z.record(z.string().max(2000)).default({}),
+    minutes: z.number().int().min(1).max(44640).optional(),
   }).strict(),
-  z.object({ ...common, event: z.string().min(1).max(200), seats: z.number().int().min(1).max(1000).default(1), answers: z.record(z.string().max(2000)).default({}), formVersion: z.string().optional() }).strict(),
+  // formVersion: from GET /events/{slug}/rsvp; required when the event asks questions
+  z.object({ ...common, event: z.string().min(1).max(200), seats: z.number().int().min(1).max(1000).default(1), formVersion: z.string().max(100).optional() }).strict(),
 ]);
 function canonical(value: unknown): string {
   if (value && typeof value === 'object' && !Array.isArray(value)) return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k,v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(',')}}`;
   return JSON.stringify(value);
 }
 const bookingData = (booking: Booking) => ({ booking: bookingJson(booking), manageToken: booking.manageToken });
+// RSVPs need only the calendar (like the event's web page); room bookings need bookings too
 export async function submitBooking(repo: ContentRepository, request: Request, locals?: unknown) {
-  requireCalendar(true);
+  requireCalendar();
   const key = request.headers.get('idempotency-key') ?? '';
   // Treat the key as a secret receipt. Require a fresh UUID per user intent.
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(key)) throw new ApiError(400, 'Send a random UUID v4 in Idempotency-Key and reuse it only for retries.');
   const body = bookingInput.parse(await readJson(request, 50000));
+  if (!('event' in body)) requireCalendar(true);
   const idempotency = { keyHash: await sha256Hex(key.toLowerCase()), requestHash: await sha256Hex(canonical(body)) };
   const replay = async () => {
     const record = await repo.getBookingRequest(idempotency.keyHash);
@@ -46,21 +51,22 @@ export async function submitBooking(repo: ContentRepository, request: Request, l
     const settings = await repo.getSettings();
     const flow = { origin: siteOrigin(settings, new URL(request.url)), locals, waitUntil: waitUntilFrom(locals), idempotency };
     const start = Date.parse(body.start);
+    const booker = { ...body, answers: joinAnswers(body.answers) };
     let booking: Booking;
     if ('event' in body) {
-      const event = await repo.getEventBySlug(body.event) ?? await repo.getEvent(body.event);
-      const calendars = new Map((await repo.listCalendars()).map(c => [c.id, c]));
-      if (!event || !eventIsPublic(event, calendars)) throw new ApiError(404, 'Event not found.');
+      const occurrence = await rsvpOccurrence(repo, body.event, body.start);
+      const { event } = occurrence;
       if (body.seats > (event.rsvp.maxSeats || 1)) throw new ApiError(400, 'Too many seats for one RSVP.');
-      const occurrence = expandEvents([event], settings, { displayTz: settings.timezone || 'UTC', now: Date.now(), windowStartMs: start, windowEndMs: start + 1 }).find(o => o.start === start);
-      if (!occurrence) throw new ApiError(400, 'Start must match an event occurrence exactly.');
-      booking = await createRsvp(repo, { event, start, end: occurrence.end, seats: body.seats, booker: body, source: 'web' }, flow);
+      // the app must have seen the current questions: a changed form then answers 409, as on the website
+      // (closed dates fall through to createRsvp's own answer)
+      if (!body.formVersion && rsvpQuestions(event) && !rsvpClosed(occurrence)) throw new ApiError(400, 'This event asks questions. Send formVersion from GET /api/v1/events/{slug}/rsvp with the answers.');
+      booking = await createRsvp(repo, { event, start, end: occurrence.end, seats: body.seats, booker, source: 'app' }, flow);
     } else {
       const resource = await repo.getResourceBySlug(body.resource);
       const link = resource ? await repo.getBookingLinkBySlug(resource.id, body.link) : null;
       if (!resource || !link) throw new ApiError(404, 'Resource or booking link not found.');
       const minutes = body.minutes ?? (link.mode === 'day' ? 1440 : link.mode === 'range' ? link.lengths[0] ?? link.duration : link.duration);
-      booking = await createResourceBooking(repo, { resource, link, start, end: start + minutes * 60000, booker: body, source: 'web' }, flow);
+      booking = await createResourceBooking(repo, { resource, link, start, end: start + minutes * 60000, booker, source: 'app' }, flow);
     }
     return { data: bookingData(booking), replayed: false };
   } catch (error) {

package/src/lib/mobile/forms.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import type { ContentRepository } from '../repo/types';
-import type { SavedForm } from '../forms/schema';
+import type { FormDefinition, SavedForm } from '../forms/schema';
 import { collectResponse, formVersion } from '../forms/service';
 import { ApiError, readJson } from '../api';
 import { sha256Hex } from '../api-keys';
@@ -24,14 +24,11 @@ async function publishedForm(repo: ContentRepository, id: string): Promise<Saved
   return form;
 }
 
-export async function getForm(repo: ContentRepository, url: URL, id: string) {
-  z.object({}).strict().parse(queryParams(url));
-  await requireAccess(repo, 'forms');
-  const form = await publishedForm(repo, id);
-  const d = form.definition;
+/** A form's questions for apps; `version` is the one collectResponse accepts (also for event RSVPs). */
+export async function formJson(d: FormDefinition) {
   return {
-    id: form.id, version: await formVersion(d),
-    title: d.title || form.name, intro: d.intro, submitLabel: d.submitLabel || 'Submit', confirmation: d.confirmation,
+    version: await formVersion(d),
+    title: d.title, intro: d.intro, submitLabel: d.submitLabel, confirmation: d.confirmation,
     fields: d.fields.map((f) => ({
       id: f.id, type: f.type, label: f.label, required: f.required, help: f.help, options: f.options,
       placeholder: f.placeholder ?? '', width: f.width ?? 'full', allowOther: f.allowOther ?? false,
@@ -39,9 +36,22 @@ export async function getForm(repo: ContentRepository, url: URL, id: string) {
   };
 }
 
+export async function getForm(repo: ContentRepository, url: URL, id: string) {
+  z.object({}).strict().parse(queryParams(url));
+  await requireAccess(repo, 'forms');
+  const form = await publishedForm(repo, id);
+  const d = form.definition;
+  return { id: form.id, ...await formJson(d), title: d.title || form.name, submitLabel: d.submitLabel || 'Submit' };
+}
+
+// field id → answer; checkbox groups send a list. "Other" answers send the typed text.
+export const appAnswers = z.record(z.union([z.string().max(2000), z.array(z.string().max(2000)).max(51)]));
+/** lists become the stored newline-joined form */
+export const joinAnswers = (answers: z.infer<typeof appAnswers>): Record<string, string> =>
+  Object.fromEntries(Object.entries(answers).map(([k, v]) => [k, Array.isArray(v) ? v.map((x) => x.trim()).filter(Boolean).join('\n') : v]));
+
 export const formResponseInput = z.object({
-  // field id → answer; checkbox groups send a list. "Other" answers send the typed text.
-  answers: z.record(z.union([z.string().max(2000), z.array(z.string().max(2000)).max(51)])).refine((a) => Object.keys(a).length <= 30, 'Too many answers.'),
+  answers: appAnswers.refine((a) => Object.keys(a).length <= 30, 'Too many answers.'),
   // the version from GET /forms/{id}; a changed form answers 409 instead of saving
   version: z.string().max(100).optional(),
   // spam trap: apps leave it out or empty
@@ -57,7 +67,7 @@ export async function submitFormResponse(c: PublicContext) {
   if (body.website) throw new ApiError(400, 'Could not submit this form.');
   const form = await publishedForm(c.repo, id);
   if (!await c.repo.email.rateLimit(`forms:app:${await sha256Hex(`${form.id}:${c.address}`)}`, 10, 60_000)) throw new ApiError(429, 'Too many responses. Please try again in a minute.');
-  const answers = Object.fromEntries(Object.entries(body.answers).map(([k, v]) => [k, Array.isArray(v) ? v.map((x) => x.trim()).filter(Boolean).join('\n') : v]));
+  const answers = joinAnswers(body.answers);
   // the key is the stored response id: a retry of a saved response answers
   // as before and costs nothing (also after the form changed); the same key
   // with different answers is a 409

package/src/lib/mobile/manage.ts

@@ -63,6 +63,8 @@ function view(m: Managed, booking = m.booking) {
     // the web page for this booking (the same private link the emails carry)
     manageUrl: origin + manageUrl(booking.manageToken),
     can,
+    // the RSVP form as it was when they sent it (like the web page), else the booking type's message
+    confirmation: booking.formResponse?.definition.confirmation || link?.confirmMessage || null,
   };
 }
 const flow = (m: Managed, c: PublicContext) => ({ origin: m.origin, locals: c.locals, waitUntil: waitUntilFrom(c.locals) });

package/src/lib/mobile/openapi.ts

@@ -4,6 +4,7 @@ import type { ContentRepository } from '../repo/types';
 import { contentQuery, contentDetailQuery } from './content';
 import { eventsQuery, availabilityQuery } from './calendar';
 import { bookingInput } from './bookings';
+import { rsvpQuery } from './rsvp';
 import { pagesQuery } from './pages';
 import { searchQuery } from './search';
 import { manageAvailabilityQuery, rescheduleInput } from './manage';
@@ -33,7 +34,10 @@ const errors = Object.fromEntries([400, 404, 405, 429, 500].map(status => [statu
   ...(status === 429 ? { headers: { 'Retry-After': { description: 'Seconds to wait: 60 for per-minute limits, longer for hourly, daily and lockout limits.', schema: { type: 'string' } } } } : {}),
 }]));
 function parameters(query: z.AnyZodObject) {
-  return Object.entries(query.shape).map(([name, schema]) => ({ name, in: 'query', required: !(schema as z.ZodTypeAny).isOptional(), schema: jsonSchema(schema as z.ZodTypeAny) }));
+  return Object.entries(query.shape).map(([name, schema]) => {
+    const s = schema as z.ZodTypeAny;
+    return { name, in: 'query', required: !s.isOptional(), ...(s.description ? { description: s.description } : {}), schema: jsonSchema(s) };
+  });
 }
 export async function getOpenApi(_repo: ContentRepository, url: URL) {
   empty.parse(queryParams(url));
@@ -48,6 +52,7 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
     ['/search', 'Ranked matches across posts, pages and events (top limit per group); requires search', searchQuery, ref('SearchResults')],
     ['/events', 'Public event occurrences; requires calendar', eventsQuery, ref('Events')],
     ['/calendars', 'Public calendars; requires calendar', empty, ref('Calendars')],
+    ['/events/{slug}/rsvp', 'RSVP status of one date (start = the occurrence start exactly): open or why not, live seats, the questions and their version; never cached; requires calendar', rsvpQuery, ref('RsvpStatus'), false],
     ['/resources', 'Public resources and booking links; requires bookings', z.object(pageQuery).strict(), ref('Resources')],
     ['/availability', 'Current availability; requires bookings', availabilityQuery, ref('Availability'), false],
     ['/push/topics', 'Topics an app can offer as notification toggles, named in the requested language; requires push', localeOnlyQuery, ref('PushTopics')],
@@ -73,8 +78,8 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
   }
   paths['/api/v1/bookings'] = {
     post: {
-      summary: 'Create a guest booking or replay an existing request; requires bookings',
-      description: '20 attempts/minute/client address. JSON body up to 50,000 bytes. Responses use no-store. Reuse a random UUID v4 once per booking intent.',
+      summary: 'Create a guest booking or an RSVP, or replay an existing request; RSVPs require calendar, room bookings also bookings',
+      description: '20 attempts/minute/client address. JSON body up to 50,000 bytes. Responses use no-store. Reuse a random UUID v4 once per booking intent. Checkbox groups send a list of answers. An RSVP to an event with questions needs formVersion from GET /events/{slug}/rsvp; a changed form answers 409.',
       parameters: [{ name: 'Idempotency-Key', in: 'header', required: true, schema: { type: 'string', format: 'uuid', pattern: '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$' } }],
       requestBody: { required: true, content: media(jsonSchema(bookingInput)) },
       responses: { ...errors,

package/src/lib/mobile/rsvp.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+import type { ContentRepository } from '../repo/types';
+import type { CalEvent } from '../schema';
+import { ApiError } from '../api';
+import { answerFields } from '../forms/schema';
+import { eventIsPublic, expandEvents, type Occurrence } from '../calendar/events';
+import { seatsTaken } from '../booking/service';
+import { localizeDoc } from '../translations';
+import { queryParams } from './http';
+import { requireCalendar } from './calendar';
+import { formJson } from './forms';
+import { localeQuery, mobileLocale } from './locale';
+
+// RSVP status of one date of an event, for apps: whether it takes RSVPs now,
+// live seats and the questions with their version. The same rules as the
+// event's web page: open until the date ends, no deadline or waitlist.
+// Never cached; seats change with every RSVP. POST /bookings saves one.
+
+/** a public event (slug or id) and its occurrence starting exactly at `start` */
+export async function rsvpOccurrence(repo: ContentRepository, ref: string, start: string): Promise<Occurrence> {
+  const event = await repo.getEventBySlug(ref) ?? await repo.getEvent(ref);
+  const calendars = new Map((await repo.listCalendars()).map(c => [c.id, c]));
+  if (!event || !eventIsPublic(event, calendars)) throw new ApiError(404, 'Event not found.');
+  const settings = await repo.getSettings();
+  const at = Date.parse(start);
+  const occurrence = expandEvents([event], settings, { displayTz: settings.timezone || 'UTC', now: Date.now(), windowStartMs: at, windowEndMs: at + 1 }).find(o => o.start === at);
+  if (!occurrence) throw new ApiError(400, 'Start must match an event occurrence exactly.');
+  return occurrence;
+}
+/** the RSVP form when it asks something; apps must then send its version */
+export const rsvpQuestions = (e: CalEvent) => e.rsvp.form && answerFields(e.rsvp.form).length ? e.rsvp.form : null;
+/** why this date takes no RSVPs (seats aside), or null */
+export function rsvpClosed(o: Occurrence, now = Date.now()) {
+  if (!o.event.rsvp.enabled) return 'disabled' as const;
+  if (o.cancelled) return 'cancelled' as const;
+  if (o.end <= now) return 'ended' as const;
+  return null;
+}
+
+export const rsvpQuery = z.object({
+  start: z.string().datetime({ offset: true }).describe('The occurrence’s start exactly as GET /events returns it, a UTC ISO date-time such as 2026-10-05T14:00:00.000Z. A start that isn’t one of the event’s dates answers 400.'),
+  locale: localeQuery,
+}).strict();
+export async function getRsvpStatus(repo: ContentRepository, url: URL, slug: string) {
+  requireCalendar();
+  const q = rsvpQuery.parse(queryParams(url));
+  const locale = mobileLocale(q.locale);
+  const o = await rsvpOccurrence(repo, slug, q.start);
+  const { rsvp } = o.event;
+  // pending and confirmed RSVPs hold seats, as in the capacity check
+  const going = rsvp.enabled ? await seatsTaken(repo, o.event.id, o.start) : 0;
+  const left = rsvp.capacity ? Math.max(0, rsvp.capacity - going) : null;
+  const closed = rsvpClosed(o);
+  const reason = closed ?? (left === 0 ? 'full' as const : null);
+  const form = rsvpQuestions(o.event);
+  const title = localizeDoc(o.event, locale ?? undefined).title;
+  return {
+    event: { id: o.event.id, slug: o.event.slug, title },
+    start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(),
+    open: !reason, reason, going, left, capacity: rsvp.capacity,
+    // seats one RSVP may take right now
+    maxSeats: Math.min(rsvp.maxSeats || 1, left ?? Infinity), autoConfirm: rsvp.autoConfirm,
+    form: form ? { ...await formJson(form), submitLabel: form.submitLabel || (rsvp.autoConfirm ? 'Confirm my seat' : 'Request a seat') } : null,
+  };
+}