@acms-subir/core 0.3.39 → 0.3.40

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @acms-subir/core
 
+## 0.3.40
+
+### Patch Changes
+
+- b71f8c3: New `GET /api/v1/events/:slug` (or the event's id) returns one public event and its next date, or the date on `?on=YYYY-MM-DD` as the website's links use, however far ahead it is. Apps opening an event from a link, a push or an announcement no longer get "Not found" for events more than 30 days out. Drafts and events in private calendars answer 404.
+- 7fc0c3f: Each new RSVP, and each RSVP the person cancels with its link or in the app, now emails the event's hosts. Events without hosts email the contact address in Settings → Legal, or the owners when there isn't one. The email is in the site's main language: "New RSVP: Youth retreat, Fri Nov 7", then the person's name, email and phone, the date, the seats and status ("2 · Confirmed", or "2 · Waiting for your approval" when RSVPs need approving), their answers, how many seats are taken now ("30 of 40 seats taken"), a button to the RSVP in Bookings (or, for a host who can't manage bookings, such as a member who hosts a class, "Open in My events", their page for the event), and whether it came from the website, the app or staff. A cancellation says "RSVP cancelled: …" and how many seats it freed. Replying writes to the person. Staff cancelling, approving or declining an RSVP, a cancelled date or event, a second RSVP from the same email and app retries send no staff email. Each event has **Email the hosts** in its CTA card, on for every event including existing ones; **Staff notifications** in Email settings still turns off all staff emails. Editor documents carry the setting as `rsvp.notifyStaff`; the public event JSON and the app API leave it out. The privacy notice now says the event's hosts (or staff) get an email with RSVP details, so its "Last updated" date moves.
+
 ## 0.3.39
 
 ### Patch Changes

package/integration.mjs

@@ -835,6 +835,7 @@ export default function acms(options = {}) {
       ['/api/v1/events', 'api/v1/events.ts'],
       ['/api/v1/calendars', 'api/v1/calendars.ts'],
       // RSVPs from apps: a date's status, then POST /bookings (room bookings there need bookings on)
+      ['/api/v1/events/[slug]', 'api/v1/events/[slug]/index.ts'],
       ['/api/v1/events/[slug]/rsvp', 'api/v1/events/[slug]/rsvp.ts'],
       ['/api/v1/bookings', 'api/v1/bookings.ts'],
       ['/api/calendar/events', 'api/calendar/events/index.ts'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.39",
+  "version": "0.3.40",
   "publishConfig": {
     "access": "public"
   },

package/src/actions/index.ts

@@ -995,7 +995,7 @@ export const server = {
         calendarIds: z.array(z.string()).max(50).optional(),
         fields: z.record(z.string().max(2000)).optional(),
         rsvp: z.object({ enabled: z.boolean(), capacity: z.number().int().min(0).max(100000), autoConfirm: z.boolean(), maxSeats: z.number().int().min(1).max(50),
-          closesAt: z.string().max(40).nullable().optional(), closeBefore: z.number().int().min(0).max(86400).optional(), form: z.any().optional() }).optional(),
+          closesAt: z.string().max(40).nullable().optional(), closeBefore: z.number().int().min(0).max(86400).optional(), notifyStaff: z.boolean().optional(), form: z.any().optional() }).optional(),
         roomHold: z.object({ resourceIds: z.array(z.string()).max(50), span: z.enum(['event', 'day']), before: z.number().int().min(0).max(1440), after: z.number().int().min(0).max(1440), whileDraft: z.boolean(), keep: z.array(z.string()).max(500).default([]) }).optional(),
         scheduledAt: nullableTs.optional(),
       }),

package/src/components/editor/EventPanel.tsx

@@ -20,8 +20,9 @@ export interface EventMeta {
   cta: EventCta;
   calendarIds: string[];
   fields: Record<string, string>;
-  // closesAt: wall time like start; closeBefore: minutes before each date (0 = until it ends)
-  rsvp: { enabled: boolean; capacity: number; autoConfirm: boolean; maxSeats: number; closesAt?: string | null; closeBefore?: number; form?: FormDefinition };
+  // closesAt: wall time like start; closeBefore: minutes before each date (0 = until it ends);
+  // notifyStaff: the hosts get an email about each new or cancelled RSVP
+  rsvp: { enabled: boolean; capacity: number; autoConfirm: boolean; maxSeats: number; closesAt?: string | null; closeBefore?: number; notifyStaff?: boolean; form?: FormDefinition };
   roomHold: RoomHoldValue;
 }
 

package/src/components/editor/PostEditor.tsx

@@ -169,7 +169,7 @@ const NO_MAPS: MapsStatus = { enabled: false, provider: '', label: '', search: f
 const NO_EVENT: EventMeta = {
   start: '', end: '', allDay: false, timezone: '', rrule: '', exdates: [], cancelled: false,
   location: NO_LOCATION, cta: { label: '', href: '', style: 'primary' }, calendarIds: [], fields: {},
-  rsvp: { enabled: false, capacity: 0, autoConfirm: true, maxSeats: 4, closesAt: null, closeBefore: 0 },
+  rsvp: { enabled: false, capacity: 0, autoConfirm: true, maxSeats: 4, closesAt: null, closeBefore: 0, notifyStaff: true },
   roomHold: NO_HOLD,
 };
 

package/src/components/editor/event/RegistrationCard.tsx

@@ -73,6 +73,10 @@ export function RegistrationCard({ meta, onChange, eventId, title = '' }: { even
               <span><b>Confirm automatically</b><small>Off: RSVPs wait for your approval in Bookings</small></span>
               <input type="checkbox" role="switch" className="pe-switch" checked={meta.rsvp.autoConfirm} onChange={(e) => onChange({ rsvp: { ...meta.rsvp, autoConfirm: e.target.checked } })} />
             </label>
+            <label className="pe-switch-row">
+              <span><b>Email the hosts</b><small>About each new RSVP and cancellation. Without hosts, the contact email in Settings → Legal gets them</small></span>
+              <input type="checkbox" role="switch" className="pe-switch" checked={meta.rsvp.notifyStaff !== false} onChange={(e) => onChange({ rsvp: { ...meta.rsvp, notifyStaff: e.target.checked } })} />
+            </label>
           </div>
           <Deadline meta={meta} onChange={onChange} />
           <div className="pe-evr-form">

package/src/components/editor/event/registration.ts

@@ -9,7 +9,7 @@ export type RegistrationMode = 'none' | 'link' | 'rsvp';
 
 interface RegistrationData {
   cta: EventCta;
-  rsvp: { enabled: boolean; capacity: number; autoConfirm: boolean; maxSeats: number; closesAt?: string | null; closeBefore?: number };
+  rsvp: { enabled: boolean; capacity: number; autoConfirm: boolean; maxSeats: number; closesAt?: string | null; closeBefore?: number; notifyStaff?: boolean };
 }
 
 export function registrationMode({ cta, rsvp }: RegistrationData): RegistrationMode {

package/src/lib/booking/emails.ts

@@ -13,6 +13,7 @@ import { isExtraLocale } from '../translations';
 import { fill } from '../live/words';
 import { bookingStrings, mailCopy, type BookingStrings } from '../email/booking-words';
 import type { Mail } from '../email';
+import type { RsvpStaffNotice } from '../email/types';
 
 const esc = (s: string) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 
@@ -75,30 +76,36 @@ interface Ctx {
   allDay?: boolean;
   /** the words' language: the booking's for guest emails, the main one for staff */
   lang?: string;
+  /** staff RSVP emails: the date's short form, seats taken right after, why they get it and where the person did it */
+  rsvpStaff?: { date: string; taken: number; capacity: number; why: RsvpStaffNotice['why']; via: Booking['source'] };
+  /** manageUrl is the recipient's My events page (a host without Manage bookings) */
+  mineLink?: boolean;
 }
 
-function layout(heading: string, intro: string, c: Ctx, w: BookingStrings, button?: { href: string; label: string }): { html: string; text: string } {
-  const rows: [string, string][] = [[w.what, c.title], [w.when, c.when], ...(c.location ? [[w.where, c.location] as [string, string]] : [])];
-  if (c.booking.seats > 1) rows.push([w.seats, String(c.booking.seats)]);
-  const reference = fill(w.reference, { ref: c.booking.id.slice(0, 8).toUpperCase() });
+// own: a staff email's own rows and footer instead of the details and reference
+function layout(heading: string, intro: string, c: Ctx, w: BookingStrings, button?: { href: string; label: string }, own?: { rows: [string, string][]; footer: string }): { html: string; text: string } {
+  const rows: [string, string][] = own?.rows ?? [[w.what, c.title], [w.when, c.when], ...(c.location ? [[w.where, c.location] as [string, string]] : [])];
+  if (!own && c.booking.seats > 1) rows.push([w.seats, String(c.booking.seats)]);
+  const footer = own?.footer ?? fill(w.reference, { ref: c.booking.id.slice(0, 8).toUpperCase() });
   const html = `<!doctype html><html lang="${esc(c.lang || 'en')}"><body style="margin:0;background:#f6f5f2;font-family:-apple-system,Segoe UI,Inter,Arial,sans-serif;color:#1e1f24">
 <div style="max-width:520px;margin:0 auto;padding:28px 20px">
 <p style="font-size:13px;color:#6b6e78;margin:0 0 18px">${esc(c.siteTitle)}</p>
-<h1 style="font-size:22px;margin:0 0 8px">${esc(heading)}</h1>
-<p style="font-size:15px;line-height:1.55;margin:0 0 18px;color:#3d3f47">${esc(intro)}</p>
+<h1 style="font-size:22px;margin:0 0 ${intro ? 8 : 18}px">${esc(heading)}</h1>
+${intro ? `<p style="font-size:15px;line-height:1.55;margin:0 0 18px;color:#3d3f47">${esc(intro)}</p>` : ''}
 <table style="width:100%;border-collapse:collapse;background:#fff;border:1px solid #e5e3de;border-radius:10px">${rows
-    .map(([k, v]) => `<tr><td style="padding:10px 14px;font-size:13px;color:#6b6e78;width:70px;border-bottom:1px solid #eeece8">${esc(k)}</td><td style="padding:10px 14px;font-size:14px;border-bottom:1px solid #eeece8">${esc(v)}</td></tr>`)
+    .map(([k, v]) => `<tr><td style="padding:10px 14px;font-size:13px;color:#6b6e78;width:70px;border-bottom:1px solid #eeece8">${esc(k)}</td><td style="padding:10px 14px;font-size:14px;border-bottom:1px solid #eeece8">${esc(v).replace(/\n/g, '<br>')}</td></tr>`)
     .join('')}</table>
 ${c.message ? `<p style="font-size:14px;line-height:1.55;margin:18px 0 0">${esc(c.message)}</p>` : ''}
 ${button ? `<p style="margin:22px 0 0"><a href="${esc(button.href)}" style="display:inline-block;background:#1e1f24;color:#fff;text-decoration:none;font-weight:600;font-size:14px;padding:10px 16px;border-radius:8px">${esc(button.label)}</a></p>` : ''}
-<p style="font-size:12px;color:#8e919a;margin:26px 0 0">${esc(reference)}</p>
+<p style="font-size:12px;color:#8e919a;margin:26px 0 0">${esc(footer)}</p>
 </div></body></html>`;
-  const text = [heading, '', intro, '', ...rows.map(([k, v]) => `${k}: ${v}`), ...(c.message ? ['', c.message] : []), ...(button ? ['', `${button.label}: ${button.href}`] : []), '', reference].join('\n');
+  const text = [heading, '', ...(intro ? [intro, ''] : []), ...rows.map(([k, v]) => `${k}: ${v}`), ...(c.message ? ['', c.message] : []), ...(button ? ['', `${button.label}: ${button.href}`] : []), '', footer].join('\n');
   return { html, text };
 }
 
-// link: the booking's own link again, after someone tried to make it twice
-export type BookingEmail = 'received' | 'confirmed' | 'declined' | 'cancelled' | 'rescheduled' | 'updated' | 'reminder' | 'link' | 'staff-new';
+// link: the booking's own link again, after someone tried to make it twice.
+// staff-rsvp(-cancelled): the hosts hear about a new RSVP, or one the person cancelled
+export type BookingEmail = 'received' | 'confirmed' | 'declined' | 'cancelled' | 'rescheduled' | 'updated' | 'reminder' | 'link' | 'staff-new' | 'staff-rsvp' | 'staff-rsvp-cancelled';
 
 export function bookingEmail(kind: BookingEmail, c: Ctx): Mail {
   const w = bookingStrings(c.lang);
@@ -106,7 +113,7 @@ export function bookingEmail(kind: BookingEmail, c: Ctx): Mail {
   const manage = { href: c.manageUrl, label: rsvp ? w.rsvp.manage : w.manage };
   const ics = (method: 'REQUEST' | 'CANCEL' = 'REQUEST') => [{ filename: 'booking.ics', type: `text/calendar; charset=utf-8; method=${method === 'CANCEL' ? 'CANCEL' : c.organizer ? 'REQUEST' : 'PUBLISH'}`, content: bookingIcs(c.booking, c.title, c.location, c.manageUrl, c.host, method, { organizer: c.organizer, allDay: c.allDay, lang: c.lang }) }];
   // null: no button (nothing left to change)
-  const guest = (k: Exclude<BookingEmail, 'staff-new'>, extra: Partial<Ctx> = {}, button: { href: string; label: string } | null = manage) => {
+  const guest = (k: Exclude<BookingEmail, `staff-${string}`>, extra: Partial<Ctx> = {}, button: { href: string; label: string } | null = manage) => {
     const copy = mailCopy(w, k, rsvp);
     const vars = { name: c.booking.name || c.booking.email, title: c.title, when: c.when };
     return { to: c.booking.email, subject: fill(copy.subject, vars), ...layout(copy.heading, fill(copy.intro, vars), { ...c, ...extra }, w, button ?? undefined) };
@@ -128,5 +135,22 @@ export function bookingEmail(kind: BookingEmail, c: Ctx): Mail {
       const m = layout(pending ? w.staff.pending : w.staff.booked, `${who}${answers ? `\n${answers}` : ''}`, c, w, { href: c.manageUrl, label: pending ? w.staff.review : w.staff.open });
       return { to: [], subject: fill(pending ? w.staff.pendingSubject : w.staff.bookedSubject, vars), ...m, replyTo: c.booking.email || undefined };
     }
+    case 'staff-rsvp':
+    case 'staff-rsvp-cancelled': {
+      const r = w.rsvpStaff, s = c.rsvpStaff!, b = c.booking;
+      const cancelled = kind === 'staff-rsvp-cancelled', pending = !cancelled && b.status === 'pending';
+      const seats = String(b.seats), count = String(s.taken);
+      const answers = Object.entries(b.answers).map(([k, v]) => `${k}: ${v}`).join('\n');
+      const rows: [string, string][] = [
+        [r.name, b.name], [r.email, b.email], ...(b.phone ? [[r.phone, b.phone] as [string, string]] : []), [w.when, c.when],
+        [w.seats, fill(cancelled ? (b.seats === 1 ? r.seatFreed : r.seatsFreed) : pending ? r.pending : r.confirmed, { seats })],
+        ...(answers ? [[r.answers, answers] as [string, string]] : []),
+        [r.now, s.capacity ? fill(r.seatsTakenOf, { count, capacity: String(s.capacity) }) : fill(s.taken === 1 ? r.seatTaken : r.seatsTaken, { count })],
+      ];
+      const vars = { title: c.title, date: s.date };
+      const footer = `${r.via[s.via === 'web' || s.via === 'app' ? s.via : 'staff']} · ${s.why === 'hosts' ? r.hosts : r.noHosts}`;
+      const m = layout(fill(cancelled ? r.cancelledHeading : r.heading, vars), '', c, w, { href: c.manageUrl, label: c.mineLink ? r.openMine : pending ? w.staff.review : w.staff.open }, { rows, footer });
+      return { to: [], subject: fill(cancelled ? r.cancelledSubject : r.subject, vars), ...m, replyTo: b.email || undefined };
+    }
   }
 }

package/src/lib/booking/service.ts

@@ -9,6 +9,10 @@ import { loadFeed, expandVEvents } from '../calendar/ics';
 import { emitWebhook } from '../webhooks';
 import { parseFrom } from '../email/config';
 import { kickEmail } from '../email/service';
+import type { RsvpStaffNotice } from '../email/types';
+import { LEGAL } from '../legal/config';
+import { isRole } from '../roles';
+import { siteLocale } from '../dates';
 import { eventUrl } from '../calendar/config';
 import { eventTimeZone, locationLine, occurrenceKey, rsvpDeadline } from '../calendar/events';
 import { normalizePageLocale } from '../i18n';
@@ -18,6 +22,8 @@ import { bookingEmail, bookingLanguage, bookingManagePath, whenText, type Bookin
 import { holdOf, isBookable, resourceZone, spanEnd, type AvailabilityContext, type Interval } from './availability';
 import { decideStatus, linkApproval } from './approval';
 import { eventHolds } from './holds';
+import { MEMBERS, memberEventsPath } from '../calendar/members-config';
+import { principalCan } from '../permissions/access';
 
 export interface FlowOptions {
   origin: string;
@@ -88,7 +94,7 @@ async function describe(repo: ContentRepository, b: Booking, settings: Settings,
     const ev = raw && locale ? localizeDoc(raw, locale) : raw;
     const tz = ev ? eventTimeZone(ev, settings) : settings.timezone || 'UTC';
     return {
-      resource: null, link: null, event: ev,
+      resource: null, link: null, event: ev, tz,
       title: ev?.title ?? 'Event',
       location: ev ? locationLine(ev.location) : '',
       when: whenText(b, tz, settings, ev?.allDay),
@@ -97,7 +103,7 @@ async function describe(repo: ContentRepository, b: Booking, settings: Settings,
   const [resource, link] = await Promise.all([repo.getResource(b.resourceId), b.linkId ? repo.getBookingLink(b.linkId) : Promise.resolve(null)]);
   const tz = resource ? resourceZone(resource, settings.timezone) : settings.timezone || 'UTC';
   return {
-    resource, link, event: null as CalEvent | null,
+    resource, link, event: null as CalEvent | null, tz,
     title: [resource?.name, link?.name].filter(Boolean).join(' · ') || 'Booking',
     location: resource?.name ?? '',
     when: whenText(b, tz, settings, link?.mode === 'day'),
@@ -114,11 +120,17 @@ export function bookingJson(b: Booking, extra: { title?: string; resourceSlug?:
   };
 }
 
-// snapshot.locale: the language to use instead of the booking's (a link sent again)
-export async function bookingMail(repo: ContentRepository, b: Booking, kind: BookingEmail, origin: string, from = '', snapshot?: { message?: string; eventTitle?: string; eventLocation?: string; eventAllDay?: number; locale?: string }) {
+// the booking in the admin; an RSVP among its event's (a cancelled one under Cancelled)
+const adminBookingUrl = (origin: string, b: Booking, kind: BookingEmail) =>
+  `${origin}/admin/calendar/bookings?${b.eventId ? `event=${encodeURIComponent(b.eventId)}&` : ''}${kind === 'staff-rsvp-cancelled' ? 'tab=cancelled&' : ''}b=${b.id}`;
+
+// snapshot.locale: the language to use instead of the booking's (a link sent
+// again); taken/why/via: a staff RSVP email's job (rsvpStaffJobs)
+export async function bookingMail(repo: ContentRepository, b: Booking, kind: BookingEmail, origin: string, from = '', snapshot?: { message?: string; eventTitle?: string; eventLocation?: string; eventAllDay?: number; locale?: string; taken?: number; why?: RsvpStaffNotice['why']; via?: Booking['source'] }, recipient = '') {
   const site = await repo.getSettings();
+  const staff = kind.startsWith('staff-');
   // the guest hears in the language they booked in; staff in the main one
-  const language = bookingLanguage(kind === 'staff-new' ? { locale: '' } : typeof snapshot?.locale === 'string' ? { locale: snapshot.locale } : b, site);
+  const language = bookingLanguage(staff ? { locale: '' } : typeof snapshot?.locale === 'string' ? { locale: snapshot.locale } : b, site);
   const settings = language.settings;
   const d = await describe(repo,b,settings,language.locale);
   if (b.kind === 'rsvp' && !d.event && snapshot?.eventTitle) {
@@ -126,10 +138,42 @@ export async function bookingMail(repo: ContentRepository, b: Booking, kind: Boo
     try { d.location = locationLine(JSON.parse(snapshot.eventLocation || '{}')); } catch { d.location = ''; }
     d.when = whenText(b,b.timezone || settings.timezone || 'UTC',settings,!!snapshot.eventAllDay);
   }
+  // "Fri Nov 7": the subject's date, in the event's zone
+  const counts = kind === 'staff-rsvp' || kind === 'staff-rsvp-cancelled' ? {
+    date: new Intl.DateTimeFormat(siteLocale(settings), { weekday: 'short', month: 'short', day: 'numeric', timeZone: d.tz }).format(b.start).replace(/,/g, ''),
+    taken: snapshot?.taken ?? await seatsTaken(repo, b.eventId, b.start), capacity: d.event?.rsvp.capacity ?? 0,
+    why: snapshot?.why ?? 'hosts', via: snapshot?.via ?? b.source,
+  } : undefined;
+  // a host without Manage bookings (a member who hosts) gets their My events
+  // page for the event instead of an admin page they can't open
+  const mine = counts && d.event && recipient ? await memberHostPath(repo, d.event, recipient) : '';
   return bookingEmail(kind, { booking:b,resource:d.resource,link:d.link,title:d.title,location:d.location,when:d.when,
-    manageUrl:kind === 'staff-new' ? `${origin}/admin/calendar/bookings?b=${b.id}` : origin + bookingManagePath({ manageToken: b.manageToken, locale: language.locale }),
+    manageUrl:mine ? origin + mine : staff ? adminBookingUrl(origin, b, kind) : origin + bookingManagePath({ manageToken: b.manageToken, locale: language.locale }),
+    mineLink: !!mine,
     siteTitle:settings.siteTitle,host:new URL(origin).host,organizer:parseFrom(from)?.email,message:snapshot?.message,
-    allDay:d.link?.mode==='day'||!!d.event?.allDay||(!d.event&&!!snapshot?.eventAllDay), lang:language.lang });
+    allDay:d.link?.mode==='day'||!!d.event?.allDay||(!d.event&&!!snapshot?.eventAllDay), lang:language.lang, rsvpStaff: counts });
+}
+
+/** The member's My events page for an event they host, when they can't manage bookings in the admin ('' otherwise). */
+async function memberHostPath(repo: ContentRepository, e: CalEvent, email: string): Promise<string> {
+  const user = (await repo.listUsers()).find((u) => u.email && u.email.trim().toLowerCase() === email.trim().toLowerCase());
+  if (!user || !MEMBERS.enabled || !e.hostIds.includes(user.id)) return '';
+  return (await principalCan(repo, { user }, 'schedule.bookings')) ? '' : `${memberEventsPath()}/${encodeURIComponent(e.id)}`;
+}
+
+/**
+ * Who hears about an event's RSVPs (rsvp.notifyStaff): its hosts, else the
+ * contact email in Settings → Legal (then acms({ legal }), as legalOperator
+ * reads it), else the owners. Accounts that were removed, or whose role the
+ * site no longer has, are skipped. via: where the person did it.
+ */
+export async function rsvpStaff(repo: ContentRepository, e: CalEvent, settings: Settings, via: Booking['source']): Promise<RsvpStaffNotice | undefined> {
+  if (!e.rsvp.notifyStaff) return undefined;
+  const contact = settings.legal.contactEmail || LEGAL.contactEmail;
+  const users = e.hostIds.length || !contact ? (await repo.listUsers()).filter((u) => u.email && isRole(u.role)) : [];
+  const hosts = users.filter((u) => e.hostIds.includes(u.id)).map((u) => u.email);
+  const to = hosts.length ? hosts : contact ? [contact] : users.filter((u) => u.role === 'owner').map((u) => u.email);
+  return { to: [...new Set(to.map((a) => a.trim().toLowerCase()))].filter(Boolean), why: hosts.length ? 'hosts' : 'contact', via };
 }
 async function notify(repo: ContentRepository, _b: Booking, _kinds: BookingEmail[], opts: FlowOptions, _message?: string) {
   // Repository mutations already committed their outbox jobs atomically.
@@ -205,12 +249,15 @@ export function guestChanges(b: Booking, link: BookingLink | null, now = Date.no
   };
 }
 
-export async function guestCancel(repo: ContentRepository, b: Booking, opts: FlowOptions): Promise<Booking> {
+// via: where they cancelled (the manage page, or an app)
+export async function guestCancel(repo: ContentRepository, b: Booking, opts: FlowOptions, via: Booking['source'] = 'web'): Promise<Booking> {
   const link = b.linkId ? await repo.getBookingLink(b.linkId) : null;
   if (b.status === 'cancelled') return b;
   const can = guestChanges(b, link, opts.now);
   if (!can.cancel) throw new BookingError(409, can.closed ? `Changes close ${can.cutoffHours} hours before the start. Please contact us to cancel.` : 'This booking can’t be cancelled.');
-  return setBookingStatus(repo, b, 'cancelled', opts);
+  // the person cancelled an RSVP: its hosts hear about it (staff cancelling never emails staff)
+  const event = b.kind === 'rsvp' && b.eventId ? await repo.getEvent(b.eventId) : null;
+  return setBookingStatus(repo, b, 'cancelled', opts, undefined, event ? await rsvpStaff(repo, event, await repo.getSettings(), via) : undefined);
 }
 
 /** the link as a guest moving a booking sees it: no new time inside the change cutoff */
@@ -294,11 +341,13 @@ export async function createRsvp(
   if (formResponse) booker.answers = displayAnswers(formResponse);
   // one RSVP per address and date on public channels; staff may add more
   const once = args.source !== 'admin';
+  const source = args.source ?? 'web';
+  // the hosts' email is queued with the RSVP: a duplicate or a replay inserts nothing, so it emails no one
   const b = await repo.createBooking({
     kind: 'rsvp', resourceId: '', linkId: '', eventId: e.id, status: e.rsvp.autoConfirm ? 'confirmed' : 'pending',
     start: args.start, end: args.end, holdStart: args.start, holdEnd: args.end, timezone: e.timezone, ...booker, seats,
-    formResponse, notes: '', manageToken: token(), source: args.source ?? 'web', locale: normalizePageLocale(args.booker.locale ?? ''),
-  }, { capacity: e.rsvp.capacity, oncePerEmail: once, idempotency: opts.idempotency });
+    formResponse, notes: '', manageToken: token(), source, locale: normalizePageLocale(args.booker.locale ?? ''),
+  }, { capacity: e.rsvp.capacity, oncePerEmail: once, idempotency: opts.idempotency, staff: await rsvpStaff(repo, e, settings, source) });
   if (!b) {
     // a retry of a request that just committed: the caller replays that one
     const retry = opts.idempotency ? await repo.getBookingRequest(opts.idempotency.keyHash) : null;
@@ -310,7 +359,7 @@ export async function createRsvp(
     }
     throw new BookingError(409, e.rsvp.capacity ? 'Sorry — that’s more seats than are left.' : 'Couldn’t save your RSVP.');
   }
-  await notify(repo, b, [b.status === 'confirmed' ? 'confirmed' : 'received'], opts);
+  await notify(repo, b, [b.status === 'confirmed' ? 'confirmed' : 'received', 'staff-rsvp'], opts);
   await hook(repo, 'booking.created', b, opts);
   if (b.status === 'confirmed') await hook(repo, 'booking.confirmed', b, opts);
   return b;
@@ -332,7 +381,8 @@ const TRANSITIONS: Record<BookingStatus, BookingStatus[]> = {
   cancelled: ['confirmed'],
 };
 
-export async function setBookingStatus(repo: ContentRepository, b: Booking, status: BookingStatus, opts: FlowOptions, message?: string): Promise<Booking> {
+// staff: who to tell that the person cancelled (guestCancel); staff changes tell no one
+export async function setBookingStatus(repo: ContentRepository, b: Booking, status: BookingStatus, opts: FlowOptions, message?: string, staff?: RsvpStaffNotice): Promise<Booking> {
   if (b.status === status) return b;
   if (!TRANSITIONS[b.status].includes(status)) throw new BookingError(409, `A ${b.status} booking can’t become ${status}.`);
   // re-confirming a declined/cancelled booking must re-check the slot
@@ -341,7 +391,7 @@ export async function setBookingStatus(repo: ContentRepository, b: Booking, stat
       .some((x) => x.id !== b.id && x.kind !== 'rsvp' && x.holdStart < b.holdEnd && x.holdEnd > b.holdStart);
     if (clash) throw new BookingError(409, 'That time has been booked since — it can’t be restored.');
   }
-  await repo.updateBooking(b.id, { status, notificationMessage: message });
+  await repo.updateBooking(b.id, { status, notificationMessage: message, staff });
   const next = (await repo.getBooking(b.id))!;
   if (!next || next.status !== status) throw new BookingError(409, 'This booking changed. Refresh and try again.');
   if (b.kind !== 'block') {

package/src/lib/calendar/api.ts

@@ -27,7 +27,8 @@ export interface EventJson {
   cancelledDates: string[];
   location: CalEvent['location'];
   cta: CalEvent['cta'];
-  rsvp?: CalEvent['rsvp'];
+  // notifyStaff (whether the hosts get RSVP emails) only for staff callers
+  rsvp?: Omit<CalEvent['rsvp'], 'notifyStaff'> & Partial<Pick<CalEvent['rsvp'], 'notifyStaff'>>;
   image: string;
   imageAlt: string;
   tags: string[];
@@ -59,7 +60,7 @@ export function eventToJson(e: CalEvent, origin: string, calendars: Map<string,
     cancelledDates: e.cancelledDates ?? [],
     location: e.location,
     cta: e.cta,
-    rsvp: e.rsvp,
+    rsvp: opts.includePrivate ? e.rsvp : (({ notifyStaff: _, ...rsvp }) => rsvp)(e.rsvp),
     image: e.cover ? abs(origin, e.cover) : '',
     imageAlt: e.coverAlt,
     tags: e.tags.filter((t) => !t.startsWith('#')),

package/src/lib/calendar/members-config.ts

@@ -0,0 +1,5 @@
+import { userConfig } from 'virtual:acms-config';
+
+/** where the built-in member pages live (acms({ members })); `notify` hears about new requests */
+export const MEMBERS: { enabled: boolean; base: string; notify: string[] } = { enabled: false, base: '/members', notify: [], ...(userConfig.members ?? {}) };
+export const memberEventsPath = () => `${MEMBERS.base}/events`;

package/src/lib/calendar/requests.ts

@@ -1,4 +1,3 @@
-import { userConfig } from 'virtual:acms-config';
 import type { ContentRepository } from '../repo/types';
 import type { CalEvent, EventRequest } from '../schema';
 import { EventLocation } from '../schema';
@@ -20,9 +19,10 @@ import { kickEmail } from '../email/service';
 // Everything here checks who is acting, so the built-in member pages and a
 // site's own pages (through @acms-subir/core/server) share the same rules.
 
-/** where the built-in member pages live (acms({ members })); `notify` hears about new requests */
-export const MEMBERS: { enabled: boolean; base: string; notify: string[] } = { enabled: false, base: '/members', notify: [], ...(userConfig.members ?? {}) };
-export const memberEventsPath = () => `${MEMBERS.base}/events`;
+// acms({ members }) and the My events path live on their own, so booking
+// emails (which this code depends on) can read them without an import cycle
+export { MEMBERS, memberEventsPath } from './members-config';
+import { MEMBERS, memberEventsPath } from './members-config';
 
 /** who is acting: currentUser() from @acms-subir/core/server fits */
 export interface Actor { id: string; can(permission: string): boolean }

package/src/lib/content-service.ts

@@ -37,10 +37,10 @@ export type PageSave = Omit<Parameters<ContentRepository['updatePage']>[1], 'blo
 // location (see mergeLocationInput) — older clients send name/address/url only
 // cancelledDates is left out: single dates are cancelled at once through
 // cancelOccurrence/restoreOccurrence (lib/calendar/schedule.ts), never staged
-// rsvp may leave out the deadline (older clients): the current one stays
+// rsvp may leave out the deadline and notifyStaff (older clients): the current ones stay
 export type EventSave = Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt' | 'sourceUid' | 'publishedAt' | 'location' | 'cancelledDates' | 'rsvp'>> & {
   location?: Partial<EventLocation>;
-  rsvp?: Omit<CalEvent['rsvp'], 'closesAt' | 'closeBefore'> & Partial<Pick<CalEvent['rsvp'], 'closesAt' | 'closeBefore'>>;
+  rsvp?: Omit<CalEvent['rsvp'], 'closesAt' | 'closeBefore' | 'notifyStaff'> & Partial<Pick<CalEvent['rsvp'], 'closesAt' | 'closeBefore' | 'notifyStaff'>>;
 };
 type EventClean = Omit<EventSave, 'location' | 'rsvp'> & { location?: EventLocation; rsvp?: CalEvent['rsvp'] };
 
@@ -136,9 +136,11 @@ export async function cleanEventInput(repo: ContentRepository, data: EventSave,
   const out: EventClean = { ...rest };
   if (rsvp) {
     // Older editor clients resend the original RSVP shape. Omission must not
-    // erase questions or a deadline that were authored in a newer editor.
+    // erase questions, a deadline or the staff emails setting that were
+    // authored in a newer editor.
     const previous = mergeEventDraft(before).rsvp;
-    const next: CalEvent['rsvp'] = { ...rsvp, closesAt: rsvp.closesAt === undefined ? previous.closesAt ?? null : rsvp.closesAt || null, closeBefore: rsvp.closeBefore ?? previous.closeBefore ?? 0 };
+    const next: CalEvent['rsvp'] = { ...rsvp, closesAt: rsvp.closesAt === undefined ? previous.closesAt ?? null : rsvp.closesAt || null, closeBefore: rsvp.closeBefore ?? previous.closeBefore ?? 0,
+      notifyStaff: rsvp.notifyStaff ?? previous.notifyStaff ?? true };
     if (!Object.hasOwn(rsvp, 'form') && previous.form) next.form = previous.form;
     if (next.form !== undefined) {
       const form = FormDefinition.safeParse(next.form);
@@ -153,6 +155,7 @@ export async function cleanEventInput(repo: ContentRepository, data: EventSave,
     if (!Number.isInteger(next.closeBefore) || next.closeBefore < 0 || next.closeBefore > 60 * 1440) {
       throw new ApiError(400, 'The RSVP deadline can be at most 60 days before each date (closeBefore: 0–86400 minutes).');
     }
+    if (typeof next.notifyStaff !== 'boolean') throw new ApiError(400, 'rsvp.notifyStaff must be true or false.');
     out.rsvp = next;
   }
   if (location !== undefined) out.location = mergeLocationInput(mergeEventDraft(before).location, location);

package/src/lib/drafts.ts

@@ -52,8 +52,8 @@ export function pickEventDraft(draft: Record<string, unknown>): Partial<Pick<Cal
     const loc = EventLocation.safeParse(out.location);
     if (loc.success) out.location = loc.data; else delete out.location;
   }
-  // and before RSVP deadlines: none
-  if (out.rsvp) out.rsvp = { ...out.rsvp, closesAt: out.rsvp.closesAt ?? null, closeBefore: out.rsvp.closeBefore ?? 0 };
+  // and before RSVP deadlines: none; before staff RSVP emails: on
+  if (out.rsvp) out.rsvp = { ...out.rsvp, closesAt: out.rsvp.closesAt ?? null, closeBefore: out.rsvp.closeBefore ?? 0, notifyStaff: out.rsvp.notifyStaff ?? true };
   return out;
 }
 export function pickPageDraft(draft: Record<string, unknown>): Partial<Pick<Page, PageDraftKey>> {

package/src/lib/editor/documents.ts

@@ -160,9 +160,10 @@ export const EventFields = z.object({ ...common, excerpt: text(1000), tags: z.ar
   }).partial({ lat: true, lng: true, placeId: true, showMap: true, mapImage: true, mapImageDark: true }).strict(),
   cta: z.object({ label: text(120), href: text(1000), style: z.enum(['primary', 'outline']) }).strict(),
   calendarIds: z.array(text(100)).max(50), fields: z.record(text(2000)),
-  // closesAt: wall time in the event's zone ('YYYY-MM-DDTHH:mm'); closeBefore: minutes before each date. Left out = kept
+  // closesAt: wall time in the event's zone ('YYYY-MM-DDTHH:mm'); closeBefore: minutes before each date;
+  // notifyStaff: the hosts get an email about each new or cancelled RSVP. Left out = kept
   rsvp: z.object({ enabled: z.boolean(), capacity: z.number().int().min(0).max(100000), autoConfirm: z.boolean(), maxSeats: z.number().int().min(1).max(50),
-    closesAt: text(40).nullable().optional(), closeBefore: z.number().int().min(0).max(86400).optional(), form: FormDefinition.optional() }).strict(),
+    closesAt: text(40).nullable().optional(), closeBefore: z.number().int().min(0).max(86400).optional(), notifyStaff: z.boolean().optional(), form: FormDefinition.optional() }).strict(),
 }).partial().strict();
 export const SaveInput = z.object({ revision: z.string().max(60), fields: z.record(z.unknown()) }).strict();
 

package/src/lib/editor/schemas.ts

@@ -47,7 +47,7 @@ export const EditorDocument = EditorDocumentSummary.extend({
   event: z.object({
     start: str, end: str, allDay: bool, timezone: str, rrule: str, exdates: z.array(str), cancelled: bool,
     location: z.object({ name: str, address: str, url: str, lat: num.nullable(), lng: num.nullable(), placeId: str, showMap: bool, mapImage: str, mapImageDark: str }), cta: z.object({ label: str, href: str, style: z.enum(['primary', 'outline']) }),
-    calendarIds: z.array(str), fields: z.record(str), rsvp: z.object({ enabled: bool, capacity: num, autoConfirm: bool, maxSeats: num, closesAt: str.nullable(), closeBefore: num, form: FormDefinition.optional() }),
+    calendarIds: z.array(str), fields: z.record(str), rsvp: z.object({ enabled: bool, capacity: num, autoConfirm: bool, maxSeats: num, closesAt: str.nullable(), closeBefore: num, notifyStaff: bool, form: FormDefinition.optional() }),
   }).nullable(),
   languages: z.array(str),
 });

package/src/lib/email/booking-words.ts

@@ -25,6 +25,22 @@ export interface BookingStrings {
   /** a pending booking nobody answered in time, declined automatically */
   lateDecline: string;
   staff: { pending: string; booked: string; review: string; open: string; pendingSubject: string; bookedSubject: string };
+  /**
+   * the hosts' email about an RSVP (or the contact address's, for an event
+   * without hosts): a new one, or one the person cancelled. {seats}, {count}
+   * and {capacity} are numbers, {date} the date's short form ("Fri Nov 7");
+   * the footer is `via` · `hosts` or `noHosts`.
+   */
+  rsvpStaff: {
+    subject: string; cancelledSubject: string; heading: string; cancelledHeading: string;
+    name: string; email: string; phone: string; answers: string; now: string;
+    confirmed: string; pending: string; seatFreed: string; seatsFreed: string;
+    seatTaken: string; seatsTaken: string; seatsTakenOf: string;
+    via: Record<'web' | 'app' | 'staff', string>;
+    hosts: string; noHosts: string;
+    /** the button for a host without Manage bookings: their My events page */
+    openMine: string;
+  };
   /** a room booking's own page: what differs from an RSVP's (rsvp-words.ts) */
   page: {
     untitled: string;
@@ -60,6 +76,14 @@ const STRINGS: Record<string, BookingStrings> = {
     what: 'What', when: 'When', where: 'Where', seats: 'Seats', reference: 'Reference {ref}', icsManage: 'Manage: {url}',
     lateDecline: 'We weren’t able to confirm this booking in time. Please pick another time.',
     staff: { pending: 'New request to approve', booked: 'New booking', review: 'Review in the admin', open: 'Open in the admin', pendingSubject: 'Approve: {title} — {when}', bookedSubject: 'New booking: {title} — {when}' },
+    rsvpStaff: {
+      subject: 'New RSVP: {title}, {date}', cancelledSubject: 'RSVP cancelled: {title}, {date}', heading: 'New RSVP for {title}', cancelledHeading: 'RSVP cancelled for {title}',
+      name: 'Name', email: 'Email', phone: 'Phone', answers: 'Answers', now: 'Now',
+      confirmed: '{seats} · Confirmed', pending: '{seats} · Waiting for your approval', seatFreed: '{seats} freed', seatsFreed: '{seats} freed',
+      seatTaken: '{count} seat taken', seatsTaken: '{count} seats taken', seatsTakenOf: '{count} of {capacity} seats taken',
+      via: { web: 'Sent from the website', app: 'Sent from the app', staff: 'Added by staff' }, openMine: 'Open in My events',
+      hosts: 'You get these because you host this event.', noHosts: 'You get these because no one hosts this event.',
+    },
     page: {
       untitled: 'Booking', booked: 'You’re booked', yours: 'Your booking', moved: 'Booking moved', notAvailable: 'Not available', cancelledTitle: 'Booking cancelled',
       declined: 'Sorry — this time couldn’t be confirmed. You’re welcome to pick another.', cancelledText: 'This booking is cancelled.',
@@ -93,6 +117,14 @@ const STRINGS: Record<string, BookingStrings> = {
     what: 'Qué', when: 'Cuándo', where: 'Dónde', seats: 'Lugares', reference: 'Referencia {ref}', icsManage: 'Ver o cambiar: {url}',
     lateDecline: 'No pudimos confirmar esta reservación a tiempo. Por favor, elija otro horario.',
     staff: { pending: 'Nueva solicitud por aprobar', booked: 'Nueva reservación', review: 'Revisar en el panel', open: 'Abrir en el panel', pendingSubject: 'Por aprobar: {title} — {when}', bookedSubject: 'Nueva reservación: {title} — {when}' },
+    rsvpStaff: {
+      subject: 'Nueva confirmación: {title}, {date}', cancelledSubject: 'Confirmación cancelada: {title}, {date}', heading: 'Nueva confirmación para {title}', cancelledHeading: 'Confirmación cancelada para {title}',
+      name: 'Nombre', email: 'Correo', phone: 'Teléfono', answers: 'Respuestas', now: 'Ahora',
+      confirmed: '{seats} · Confirmado', pending: '{seats} · Esperando su aprobación', seatFreed: '{seats} liberado', seatsFreed: '{seats} liberados',
+      seatTaken: '{count} lugar ocupado', seatsTaken: '{count} lugares ocupados', seatsTakenOf: '{count} de {capacity} lugares ocupados',
+      via: { web: 'Enviado desde el sitio web', app: 'Enviado desde la app', staff: 'Agregado por el equipo' }, openMine: 'Abrir en Mis eventos',
+      hosts: 'Recibe estos correos porque usted organiza este evento.', noHosts: 'Recibe estos correos porque este evento no tiene organizadores.',
+    },
     page: {
       untitled: 'Reservación', booked: 'Tu reservación está confirmada', yours: 'Tu reservación', moved: 'Tu reservación cambió de horario', notAvailable: 'No disponible', cancelledTitle: 'Reservación cancelada',
       declined: 'Lo sentimos, no se pudo confirmar este horario. Puedes elegir otro.', cancelledText: 'Esta reservación se canceló.',
@@ -126,6 +158,14 @@ const STRINGS: Record<string, BookingStrings> = {
     what: 'Quoi', when: 'Quand', where: 'Où', seats: 'Places', reference: 'Référence {ref}', icsManage: 'Gérer : {url}',
     lateDecline: 'Nous n’avons pas pu confirmer cette réservation à temps. Veuillez choisir un autre horaire.',
     staff: { pending: 'Nouvelle demande à valider', booked: 'Nouvelle réservation', review: 'Examiner dans l’administration', open: 'Ouvrir dans l’administration', pendingSubject: 'À valider : {title} — {when}', bookedSubject: 'Nouvelle réservation : {title} — {when}' },
+    rsvpStaff: {
+      subject: 'Nouvelle inscription : {title}, {date}', cancelledSubject: 'Inscription annulée : {title}, {date}', heading: 'Nouvelle inscription à {title}', cancelledHeading: 'Inscription à {title} annulée',
+      name: 'Nom', email: 'E-mail', phone: 'Téléphone', answers: 'Réponses', now: 'Maintenant',
+      confirmed: '{seats} · Confirmée', pending: '{seats} · En attente de votre validation', seatFreed: '{seats} libérée', seatsFreed: '{seats} libérées',
+      seatTaken: '{count} place prise', seatsTaken: '{count} places prises', seatsTakenOf: '{count} sur {capacity} places prises',
+      via: { web: 'Envoyée depuis le site', app: 'Envoyée depuis l’app', staff: 'Ajoutée par l’équipe' }, openMine: 'Ouvrir dans Mes événements',
+      hosts: 'Vous recevez ces e-mails parce que vous organisez cet événement.', noHosts: 'Vous recevez ces e-mails parce que cet événement n’a pas d’organisateur.',
+    },
     page: {
       untitled: 'Réservation', booked: 'Votre réservation est confirmée', yours: 'Votre réservation', moved: 'Réservation déplacée', notAvailable: 'Indisponible', cancelledTitle: 'Réservation annulée',
       declined: 'Désolés, ce créneau n’a pas pu être confirmé. N’hésitez pas à en choisir un autre.', cancelledText: 'Cette réservation est annulée.',
@@ -159,6 +199,14 @@ const STRINGS: Record<string, BookingStrings> = {
     what: 'Was', when: 'Wann', where: 'Wo', seats: 'Plätze', reference: 'Referenz {ref}', icsManage: 'Verwalten: {url}',
     lateDecline: 'Wir konnten diese Buchung nicht rechtzeitig bestätigen. Bitte wählen Sie einen anderen Termin.',
     staff: { pending: 'Neue Anfrage zur Freigabe', booked: 'Neue Buchung', review: 'In der Verwaltung prüfen', open: 'In der Verwaltung öffnen', pendingSubject: 'Freigeben: {title} — {when}', bookedSubject: 'Neue Buchung: {title} — {when}' },
+    rsvpStaff: {
+      subject: 'Neue Anmeldung: {title}, {date}', cancelledSubject: 'Anmeldung storniert: {title}, {date}', heading: 'Neue Anmeldung für {title}', cancelledHeading: 'Anmeldung für {title} storniert',
+      name: 'Name', email: 'E-Mail', phone: 'Telefon', answers: 'Antworten', now: 'Jetzt',
+      confirmed: '{seats} · Bestätigt', pending: '{seats} · Wartet auf Ihre Freigabe', seatFreed: '{seats} frei geworden', seatsFreed: '{seats} frei geworden',
+      seatTaken: '{count} Platz belegt', seatsTaken: '{count} Plätze belegt', seatsTakenOf: '{count} von {capacity} Plätzen belegt',
+      via: { web: 'Über die Website gesendet', app: 'Über die App gesendet', staff: 'Vom Team eingetragen' }, openMine: 'In Meine Veranstaltungen öffnen',
+      hosts: 'Sie erhalten diese E-Mails, weil Sie diese Veranstaltung betreuen.', noHosts: 'Sie erhalten diese E-Mails, weil niemand diese Veranstaltung betreut.',
+    },
     page: {
       untitled: 'Buchung', booked: 'Ihre Buchung ist bestätigt', yours: 'Ihre Buchung', moved: 'Buchung verschoben', notAvailable: 'Nicht verfügbar', cancelledTitle: 'Buchung storniert',
       declined: 'Leider konnte dieser Termin nicht bestätigt werden. Wählen Sie gern einen anderen.', cancelledText: 'Diese Buchung ist storniert.',
@@ -192,6 +240,14 @@ const STRINGS: Record<string, BookingStrings> = {
     what: 'O quê', when: 'Quando', where: 'Onde', seats: 'Vagas', reference: 'Referência {ref}', icsManage: 'Gerenciar: {url}',
     lateDecline: 'Não conseguimos confirmar esta reserva a tempo. Por favor, escolha outro horário.',
     staff: { pending: 'Novo pedido para aprovar', booked: 'Nova reserva', review: 'Revisar no painel', open: 'Abrir no painel', pendingSubject: 'Aprovar: {title} — {when}', bookedSubject: 'Nova reserva: {title} — {when}' },
+    rsvpStaff: {
+      subject: 'Nova inscrição: {title}, {date}', cancelledSubject: 'Inscrição cancelada: {title}, {date}', heading: 'Nova inscrição em {title}', cancelledHeading: 'Inscrição cancelada em {title}',
+      name: 'Nome', email: 'E-mail', phone: 'Telefone', answers: 'Respostas', now: 'Agora',
+      confirmed: '{seats} · Confirmada', pending: '{seats} · Aguardando sua aprovação', seatFreed: '{seats} liberada', seatsFreed: '{seats} liberadas',
+      seatTaken: '{count} vaga ocupada', seatsTaken: '{count} vagas ocupadas', seatsTakenOf: '{count} de {capacity} vagas ocupadas',
+      via: { web: 'Enviada pelo site', app: 'Enviada pelo app', staff: 'Adicionada pela equipe' }, openMine: 'Abrir em Meus eventos',
+      hosts: 'Você recebe estes e-mails porque organiza este evento.', noHosts: 'Você recebe estes e-mails porque este evento não tem organizadores.',
+    },
     page: {
       untitled: 'Reserva', booked: 'Sua reserva está confirmada', yours: 'Sua reserva', moved: 'Reserva remarcada', notAvailable: 'Indisponível', cancelledTitle: 'Reserva cancelada',
       declined: 'Desculpe, não foi possível confirmar este horário. Fique à vontade para escolher outro.', cancelledText: 'Esta reserva foi cancelada.',

package/src/lib/email/service.ts

@@ -22,7 +22,7 @@ async function render(repo: ContentRepository, job: EmailJob, locals?: unknown,
     const b = await repo.getBooking(payload.bookingId);
     if (!b || (b.notificationVersion ?? 0) !== payload.version) return null;
     if (payload.kind === 'reminder' && (b.status !== 'confirmed' || b.start <= Date.now())) return null;
-    const mail = await bookingMail(repo, b, payload.kind, origin, from, payload);
+    const mail = await bookingMail(repo, b, payload.kind, origin, from, payload, job.recipient);
     return { ...mail, to: job.recipient };
   }
   if (job.kind === 'auth') {

package/src/lib/email/store.ts

@@ -1,5 +1,5 @@
 import type { SqlDriver, SqlStatement } from '../repo/sql';
-import type { ConfigRecord, EmailConfig, EmailJob, Invitation, NewEmailJob, SendResult } from './types';
+import type { ConfigRecord, EmailConfig, EmailJob, Invitation, NewEmailJob, RsvpStaffNotice, SendResult } from './types';
 const record = (r: Record<string, unknown>): ConfigRecord => ({ version: Number(r.version), config: JSON.parse(String(r.config)), encrypted: String(r.encrypted), createdAt: Number(r.created_at) });
 function job(r: Record<string, unknown>): EmailJob {
   return { id: String(r.id), dedupe: String(r.dedupe), kind: String(r.kind), recipient: String(r.recipient), payload: String(r.payload), configVersion: Number(r.config_version), state: r.state as EmailJob['state'], attempts: Number(r.attempts), nextAt: Number(r.next_at), expiresAt: r.expires_at == null ? null : Number(r.expires_at), createdAt: Number(r.created_at), lease: String(r.lease), leaseUntil: r.lease_until == null ? null : Number(r.lease_until), provider: String(r.provider), providerId: String(r.provider_id), error: String(r.error), acceptedAt: r.accepted_at == null ? null : Number(r.accepted_at), updatedAt: Number(r.updated_at), fingerprint: String(r.fingerprint), rendered: String(r.rendered || '') };
@@ -25,6 +25,22 @@ export function bookingJobs(id: string, kind: string, version?: number, staff =
   });
   return [select('b.email', 'bookings b', kind), ...(staff ? [select('j.value', 'bookings b JOIN resources r ON r.id = b.resource_id, json_each(r.notify_emails) j', 'staff-new')] : [])];
 }
+// Staff hear about an RSVP (new, or cancelled by the person) at the addresses
+// the caller picked, in the same batch and only if the change landed.
+// `taken` is the date's seat count right after it.
+export function rsvpStaffJobs(id: string, kind: 'staff-rsvp' | 'staff-rsvp-cancelled', notice: RsvpStaffNotice | undefined, version: number, mutation = ''): SqlStatement[] {
+  if (!notice?.to.length) return [];
+  const now = Date.now();
+  return [{
+    sql: `INSERT OR IGNORE INTO email_jobs (id,dedupe,kind,recipient,payload,config_version,next_at,expires_at,created_at,updated_at)
+      SELECT lower(hex(randomblob(16))), b.id || ':' || b.notification_version || ':' || ? || ':' || lower(j.value), 'booking', lower(j.value),
+      json_object('bookingId',b.id,'version',b.notification_version,'kind',?,'why',?,'via',?,
+        'taken',(SELECT COALESCE(SUM(seats),0) FROM bookings WHERE kind='rsvp' AND event_id=b.event_id AND start_at=b.start_at AND status IN ('pending','confirmed'))),
+      COALESCE((SELECT MAX(version) FROM email_configs),0), ?, NULL, ?, ?
+      FROM bookings b, json_each(?) j WHERE b.id = ? AND b.kind = 'rsvp' AND j.value != '' AND b.notification_version = ? ${mutation ? 'AND b.email_mutation = ?' : ''}`,
+    args: [kind, kind, notice.why, notice.via, now, now, now, JSON.stringify(notice.to), id, version, ...(mutation ? [mutation] : [])],
+  }];
+}
 export class EmailStore {
   constructor(private getDriver: () => Promise<SqlDriver>) {}
   async config(version?: number): Promise<ConfigRecord | null> {

package/src/lib/email/types.ts

@@ -1,4 +1,4 @@
-import type { Role } from '../schema';
+import type { Booking, Role } from '../schema';
 export type Provider = 'resend' | 'mailgun' | 'ses' | 'cloudflare';
 export type ProviderChoice = Provider | 'auto' | 'none';
 export interface Attachment { filename: string; type: string; content: string }
@@ -19,6 +19,8 @@ export interface EmailJob {
   acceptedAt: number | null; updatedAt: number; fingerprint: string;
   rendered: string;
 }
+/** staff to tell about an RSVP (booking/service.ts rsvpStaff): to its hosts, else the contact address; via: where the person did it */
+export interface RsvpStaffNotice { to: string[]; why: 'hosts' | 'contact'; via: Booking['source'] }
 export interface NewEmailJob { id?: string; dedupe: string; kind: string; recipient: string; payload: string; configVersion: number; nextAt?: number; expiresAt?: number }
 export type SendResult = { state: 'accepted'; providerId: string } | { state: 'retrying' | 'failed' | 'unknown'; error: string; retryAfter?: number };
 export interface Invitation { id: string; email: string; name: string; role: Role; state: string; expiresAt: number; createdAt: number; invitedBy: string }

package/src/lib/legal/text-en.ts

@@ -42,7 +42,7 @@ export function privacyEn(f: LegalFacts, country: string): PolicySection[] {
     ] },
   ];
   if (f.calendar) s.push({ id: 'bookings', title: f.bookings ? 'Bookings and RSVPs' : 'Event RSVPs', text: [
-    `When you ${f.bookings ? 'book a time or ' : ''}RSVP to an event, we store your name, email address, any phone number and answers you give, the date and time, the number of seats and the status. We use them to manage your request, prevent duplicate submissions, and email you confirmations, changes and a reminder. Staff who manage the calendar can see them${f.bookings ? ', and the people a room or service notifies receive new bookings by email' : ''}.`,
+    `When you ${f.bookings ? 'book a time or ' : ''}RSVP to an event, we store your name, email address, any phone number and answers you give, the date and time, the number of seats and the status. We use them to manage your request, prevent duplicate submissions, and email you confirmations, changes and a reminder. Staff who manage the calendar can see them${f.bookings ? ', and the people a room or service notifies receive new bookings by email' : ''}. When you RSVP or cancel an RSVP, the event’s hosts (or our staff) get an email with your RSVP details.`,
     'Each booking has a private link to see, change or cancel it. Keep it private: anyone with the link can use it.',
   ] });
   s.push({ id: 'forms', title: 'Forms', text: [

package/src/lib/legal/text-es.ts

@@ -43,7 +43,7 @@ export function privacyEs(f: LegalFacts, country: string): PolicySection[] {
     ] },
   ];
   if (f.calendar) s.push({ id: 'bookings', title: f.bookings ? 'Reservaciones y registros' : 'Registros a eventos', text: [
-    `Cuando ${f.bookings ? 'reserva un horario o ' : ''}se registra a un evento, guardamos su nombre, su correo electrónico, el teléfono y las respuestas que nos dé, la fecha y hora, el número de lugares y el estado. Los usamos para gestionar su solicitud, evitar envíos duplicados y enviarle por correo confirmaciones, cambios y un recordatorio. El personal que administra el calendario puede verlos${f.bookings ? ', y las personas a las que avisa una sala o un servicio reciben las reservaciones nuevas por correo' : ''}.`,
+    `Cuando ${f.bookings ? 'reserva un horario o ' : ''}se registra a un evento, guardamos su nombre, su correo electrónico, el teléfono y las respuestas que nos dé, la fecha y hora, el número de lugares y el estado. Los usamos para gestionar su solicitud, evitar envíos duplicados y enviarle por correo confirmaciones, cambios y un recordatorio. El personal que administra el calendario puede verlos${f.bookings ? ', y las personas a las que avisa una sala o un servicio reciben las reservaciones nuevas por correo' : ''}. Cuando se registra a un evento o cancela su registro, los organizadores del evento (o nuestro personal) reciben un correo con los datos de su registro.`,
     'Cada reservación tiene un enlace privado para verla, cambiarla o cancelarla. Manténgalo en privado: cualquiera que lo tenga puede usarlo.',
   ] });
   s.push({ id: 'forms', title: 'Formularios', text: [

package/src/lib/mobile/calendar.ts

@@ -4,7 +4,7 @@ import { publicTags, tagFilter, type BookingLink, type CalEvent, type Calendar,
 import { ApiError } from '../api';
 import { CALENDAR, bookingsEnabled, resourceUrl, bookingLinkUrl, publicEventFields } from '../calendar/config';
 import { calendarToJson, eventToJson } from '../calendar/api';
-import { eventIsListed, eventIsPublic, expandEvents } from '../calendar/events';
+import { eventIsListed, eventIsPublic, expandEvents, featuredOccurrence } from '../calendar/events';
 import { availabilityContext } from '../booking/service';
 import { addDaysYmd, describeLink, linkLengths, localMidnight, slotsForDay, ymd } from '../booking/availability';
 import { siteOrigin } from '../seo';
@@ -65,6 +65,28 @@ export async function listEvents(repo: ContentRepository, url: URL) {
     pagination: { page: q.page, limit: q.limit, nextPage: occurrences.length > start + q.limit ? q.page + 1 : null },
   };
 }
+// one event by slug (or id), whatever its date: apps open it from a link, a
+// push or an announcement, often weeks ahead. `on` ('YYYY-MM-DD', like the
+// website's ?on=) picks that day's occurrence; otherwise the next one, or the
+// most recent when it's over.
+export const eventDetailQuery = z.object({ locale: localeQuery, on: isoDay.optional() }).strict();
+export async function getEventDetail(repo: ContentRepository, url: URL, ref: string) {
+  requireCalendar();
+  const q = eventDetailQuery.parse(queryParams(url));
+  const locale = mobileLocale(q.locale);
+  const [settings, calendars] = await Promise.all([repo.getSettings(), repo.listCalendars()]);
+  const found = ref && ref.length <= 200 ? await repo.getEventBySlug(ref) ?? await repo.getEvent(ref) : null;
+  const all = new Map(calendars.map(c => [c.id, c]));
+  if (!found || !eventIsPublic(found, all)) throw new ApiError(404, 'Event not found.');
+  const e = localizeDoc(found, locale ?? undefined);
+  const o = featuredOccurrence(e, settings, Date.now(), q.on);
+  const publicCalendars = new Map(calendars.filter(c => c.visibility === 'public').map(c => [c.id, c]));
+  return {
+    locale,
+    occurrence: o ? { id: `${e.id}:${o.start}`, start: new Date(o.start).toISOString(), end: new Date(o.end).toISOString(), allDay: o.allDay, cancelled: o.cancelled } : null,
+    event: publicEventDto(e, siteOrigin(settings, url), publicCalendars, settings, locale),
+  };
+}
 // e is already localized; publicCalendars limits which calendars are named
 export function publicEventDto(e: CalEvent, origin: string, publicCalendars: Map<string, Calendar>, settings: Settings, locale: string | null) {
   const event = eventToJson(e, origin, publicCalendars, settings.timezone);

package/src/lib/mobile/manage.ts

@@ -75,7 +75,7 @@ export const getManaged = async (c: PublicContext) => view(await managed(c));
 
 export async function cancelManaged(c: PublicContext) {
   const m = await managed(c);
-  return view(m, await guestCancel(c.repo, m.booking, flow(m, c)));
+  return view(m, await guestCancel(c.repo, m.booking, flow(m, c), 'app'));
 }
 
 export const manageAvailabilityQuery = z.object({

package/src/lib/mobile/openapi.ts

@@ -2,7 +2,7 @@ import { z } from 'zod';
 import { zodToJsonSchema } from 'zod-to-json-schema';
 import type { ContentRepository } from '../repo/types';
 import { contentQuery, contentDetailQuery } from './content';
-import { eventsQuery, availabilityQuery } from './calendar';
+import { eventsQuery, eventDetailQuery, availabilityQuery } from './calendar';
 import { bookingInput } from './bookings';
 import { rsvpQuery } from './rsvp';
 import { pagesQuery } from './pages';
@@ -51,6 +51,7 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
     ['/content/{id}', 'Published content detail', contentDetailQuery, ref('Content')],
     ['/search', 'Ranked matches across posts, pages and events (top limit per group); requires search', searchQuery, ref('SearchResults')],
     ['/events', 'Public event occurrences; requires calendar', eventsQuery, ref('Events')],
+    ['/events/{slug}', 'One public event by slug or id, whatever its date, with its next occurrence (or the one on `on`, YYYY-MM-DD; the most recent once it is over); requires calendar', eventDetailQuery, ref('EventDetail')],
     ['/calendars', 'Public calendars; requires calendar', empty, ref('Calendars')],
     ['/events/{slug}/rsvp', 'RSVP status of one date (start = the occurrence start exactly): open or why not, live seats, the questions and their version; never cached; requires calendar', rsvpQuery, ref('RsvpStatus'), false],
     ['/resources', 'Public resources and booking links; requires bookings', z.object(pageQuery).strict(), ref('Resources')],

package/src/lib/mobile/schemas.ts

@@ -30,7 +30,7 @@ export const Page = ContentSummary.extend({
 export const Event = CalEvent.pick({
   id: true, slug: true, title: true, excerpt: true, status: true, cancelled: true, featured: true, start: true, end: true,
   allDay: true, timezone: true, rrule: true, exdates: true, cancelledDates: true, location: true, cta: true, tags: true, fields: true,
-}).extend({ rsvp: CalEvent.shape.rsvp.optional(), url: str, icsUrl: str, repeats: str, image: str, imageAlt: str, updatedAt: date,
+}).extend({ rsvp: CalEvent.shape.rsvp.removeDefault().omit({ notifyStaff: true }).default({}).optional(), url: str, icsUrl: str, repeats: str, image: str, imageAlt: str, updatedAt: date,
   calendars: z.array(z.object({ id: str, slug: str, name: str, color: str })),
   // push topics told about date, time or place changes (Admin → Mobile app → When an event changes); [] = none
   notify: z.object({ changes: strings }),
@@ -40,6 +40,7 @@ export const Events = z.object({ locale, timezone: str, from: date, to: date, pa
 });
 const Snippet = z.object({ text: str, highlights: z.array(z.object({ start: z.number().int(), end: z.number().int() })) });
 const ContentHit = ContentSummary.extend({ snippet: Snippet });
+export const EventDetail = z.object({ locale, occurrence: z.object({ id: str, start: date, end: date, allDay: bool, cancelled: bool }).nullable(), event: Event });
 export const SearchResults = z.object({ locale, query: str,
   posts: z.array(ContentHit), pages: z.array(ContentHit),
   events: z.array(z.object({ snippet: Snippet, occurrence: z.object({ start: date, end: date, allDay: bool, cancelled: bool }).nullable(), event: Event })),

package/src/lib/repo/sql.ts

@@ -11,7 +11,7 @@ import { PermissionStore } from '../permissions/store';
 import { BackupStore } from '../backup/store';
 import { LiveConfig } from '../live/types';
 import { ApiError } from '../api';
-import { EmailStore, bookingJobs } from '../email/store';
+import { EmailStore, bookingJobs, rsvpStaffJobs } from '../email/store';
 import type { ContentRepository, DesignVersion, EventUpdate, ImportRecord, ImportRecordKind, ImportRun, SearchResults, Stats } from './types';
 import { DocTranslations, Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Calendar, CalEvent, ApiKey, Webhook, WebhookDelivery, Resource, BookingLink, Booking, Place, EventLocation, EventRequest, isInternalTag, normalizeRedirectPath, publicTags, slugify, type WidgetInstance } from '../schema';
 import { designSnapshot, draftNavItems, pickDesignDraft, pickEventDraft, pickPageDraft, pickPostDraft } from '../drafts';
@@ -1241,7 +1241,7 @@ export class SqlRepository implements ContentRepository {
         SELECT ?,?,id,? FROM bookings WHERE id=?`, args: [keyHash, requestHash, now, b.id] });
     }
     // Booking, retry ledger and email outbox commit together on D1 and libSQL.
-    await this.driver.batch([write, ...ledger, ...bookingJobs(b.id, b.status === 'confirmed' ? 'confirmed' : 'received', 0, true)]);
+    await this.driver.batch([write, ...ledger, ...bookingJobs(b.id, b.status === 'confirmed' ? 'confirmed' : 'received', 0, true), ...rsvpStaffJobs(b.id, 'staff-rsvp', guard.staff, 0)]);
     return this.getBooking(b.id);
   }
   async moveBooking(id: string, t: { start: number; end: number; holdStart: number; holdEnd: number }) {
@@ -1278,7 +1278,8 @@ export class SqlRepository implements ContentRepository {
     args.push(id);
     const kind = data.status === 'confirmed' ? 'confirmed' : data.status === 'declined' ? 'declined' : data.status === 'pending' ? 'received' : 'cancelled';
     await this.driver.batch([{sql:`UPDATE bookings SET ${sets.join(', ')} WHERE id = ? AND notification_version = ?`,args:[...args,current.notificationVersion]},
-      ...(changed ? bookingJobs(id,kind,current.notificationVersion+1,false,mutation,data.notificationMessage) : [])]);
+      ...(changed ? bookingJobs(id,kind,current.notificationVersion+1,false,mutation,data.notificationMessage) : []),
+      ...(changed && data.status === 'cancelled' ? rsvpStaffJobs(id,'staff-rsvp-cancelled',data.staff,current.notificationVersion+1,mutation) : [])]);
   }
   async deleteBooking(id: string) {
     await this.ready;

package/src/lib/repo/types.ts

@@ -7,6 +7,7 @@ import type { SavedForm, FormSubmission } from '../forms/schema';
 import type { LiveStore } from '../live/store';
 import type { BookingRequest } from '../backup/content';
 import type { EmailStore } from '../email/store';
+import type { RsvpStaffNotice } from '../email/types';
 import type { PushStore } from '../push/store';
 import type { AnnouncementStore } from '../announcements/store';
 import type { Announcement } from '../announcements/types';
@@ -189,7 +190,8 @@ export interface ContentRepository {
   // write that can fail on a race: it inserts atomically only if the held
   // range is still free (resource bookings) or seats remain (RSVPs; with
   // oncePerEmail, and the address has no active RSVP for that date), and
-  // returns null when it lost.
+  // returns null when it lost. staff: who hears about a new RSVP (queued with
+  // it, so a lost race or a replay emails no one).
   /** from/to: overlaps the window; endedBy: ended at or before; default order start ascending, at most 5000 rows */
   listBookings(filter?: { resourceId?: string; eventId?: string; email?: string; from?: number; to?: number; endedBy?: number; statuses?: BookingStatus[]; kinds?: Booking['kind'][]; newestFirst?: boolean; limit?: number; offset?: number }): Promise<Booking[]>;
   getBooking(id: string): Promise<Booking | null>;
@@ -199,11 +201,12 @@ export interface ContentRepository {
   // locale: the booker's language; '' (the main language) when left out
   createBooking(
     data: Omit<Booking, 'id' | 'createdAt' | 'updatedAt' | 'reminderSentAt' | 'notificationVersion' | 'locale'> & { locale?: string },
-    guard?: { capacity?: number; oncePerEmail?: boolean; idempotency?: { keyHash: string; requestHash: string } }
+    guard?: { capacity?: number; oncePerEmail?: boolean; idempotency?: { keyHash: string; requestHash: string }; staff?: RsvpStaffNotice }
   ): Promise<Booking | null>;
   // moves a booking only if the new held range is free (reschedule)
   moveBooking(id: string, times: { start: number; end: number; holdStart: number; holdEnd: number }): Promise<boolean>;
-  updateBooking(id: string, data: Partial<Pick<Booking, 'status' | 'notes' | 'name' | 'email' | 'phone' | 'answers' | 'reminderSentAt'>> & { notificationMessage?: string }): Promise<void>;
+  // staff: who hears that the person cancelled their RSVP (status → cancelled only)
+  updateBooking(id: string, data: Partial<Pick<Booking, 'status' | 'notes' | 'name' | 'email' | 'phone' | 'answers' | 'reminderSentAt'>> & { notificationMessage?: string; staff?: RsvpStaffNotice }): Promise<void>;
   deleteBooking(id: string): Promise<void>;
   // confirmed bookings starting in [from, to) that haven't had a reminder
   listDueReminders(from: number, to: number): Promise<Booking[]>;

package/src/lib/schema.ts

@@ -417,7 +417,9 @@ export const CalEvent = z.object({
   // RSVP: seats per occurrence (0 = unlimited) and whether RSVPs confirm at
   // once; RSVPs are stored as bookings of kind 'rsvp'. They close at closesAt
   // (wall time in the event's zone, like start; every date), else closeBefore
-  // minutes before each date's start, else when the date ends.
+  // minutes before each date's start, else when the date ends. notifyStaff:
+  // the hosts (else the church's contact email) hear about each new RSVP and
+  // each one the person cancels (lib/booking/service.ts rsvpStaff).
   rsvp: z.object({
     enabled: z.boolean().default(false),
     capacity: z.number().int().default(0),
@@ -425,6 +427,7 @@ export const CalEvent = z.object({
     maxSeats: z.number().int().default(4),
     closesAt: z.string().nullable().default(null),
     closeBefore: z.number().int().default(0),
+    notifyStaff: z.boolean().default(true),
     form: FormDefinition.optional(),
   }).default({}),
   // rooms/people this event uses: they can't be booked while it happens (or

package/src/pages/api/v1/events/[slug]/index.ts

@@ -0,0 +1,8 @@
+import { getEventDetail } from '../../../../../lib/mobile/calendar';
+import { readRoute } from '../../../../../lib/mobile/route';
+import { methodNotAllowed } from '../../../../../lib/mobile/http';
+export { preflight as OPTIONS } from '../../../../../lib/mobile/http';
+// the next occurrence moves with the clock: not timeless
+export const GET = readRoute(getEventDetail, true);
+export const HEAD = GET;
+export const ALL = () => methodNotAllowed();