@acms-subir/core 0.3.52 → 0.3.54

package/src/lib/forms/fields.ts

@@ -1,13 +1,18 @@
 import { hasOther, isHalf, type FormDefinition, type FormField } from './schema';
 import { OTHER } from './validate';
+import { formStrings, type FormStrings } from './words';
+import { fill } from '../live/words';
 export const escapeForm = (s: string) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
 const e = escapeForm;
-const inputType: Partial<Record<FormField['type'], string>> = { phone: 'tel', email: 'email', number: 'number', date: 'date' };
+const inputType: Partial<Record<FormField['type'], string>> = { phone: 'tel', email: 'email', number: 'number', date: 'date', time: 'time' };
 // Websites use a text box so "example.org" can be typed; the server adds https://.
 const autocomplete: Partial<Record<FormField['type'], string>> = { email: 'email', phone: 'tel', url: 'url' };
+// Questions arrive in the page's language already (localize.ts localizeForm);
+// `w` is the form's own words around them (words.ts), English by default.
+const english = formStrings('en');
 
 /** The answer control alone (input, select, textarea or option list). The builder canvas reuses it under editable labels. */
-export function renderControl(f: FormField, value: string, id: string): string {
+export function renderControl(f: FormField, value: string, id: string, w: FormStrings = english): string {
   const describe = f.help ? ` aria-describedby="${e(id)}-help"` : '';
   const attrs = `id="${e(id)}" name="q_${e(f.id)}"${f.required ? ' required' : ''}${describe}`;
   const ph = f.placeholder ? ` placeholder="${e(f.placeholder)}"` : '';
@@ -17,31 +22,31 @@ export function renderControl(f: FormField, value: string, id: string): string {
     // A required checkbox group can't be enforced natively; the server checks it.
     const req = radio && f.required ? ' required' : '';
     const option = (o: string, i: number) => `<label class="pc-bk-option"><input type="${radio ? 'radio' : 'checkbox'}" id="${e(id)}-${i}" name="q_${e(f.id)}" value="${e(o)}"${req}${chosen.includes(o) ? ' checked' : ''}/><span>${e(o)}</span></label>`;
-    const other = hasOther(f) ? `<label class="pc-bk-option pc-bk-other"><input type="${radio ? 'radio' : 'checkbox'}" name="q_${e(f.id)}" value="${OTHER}"${req}${extra ? ' checked' : ''}/><span>Other</span><input type="text" name="o_${e(f.id)}" maxlength="200" aria-label="Other answer for ${e(f.label)}" placeholder="${e(f.placeholder || 'Type your answer')}" value="${e(extra)}"/></label>` : '';
+    const other = hasOther(f) ? `<label class="pc-bk-option pc-bk-other"><input type="${radio ? 'radio' : 'checkbox'}" name="q_${e(f.id)}" value="${OTHER}"${req}${extra ? ' checked' : ''}/><span>${e(w.other)}</span><input type="text" name="o_${e(f.id)}" maxlength="200" aria-label="${e(fill(w.otherAnswer, { label: f.label }))}" placeholder="${e(f.placeholder || w.typeAnswer)}" value="${e(extra)}"/></label>` : '';
     return `<div class="pc-bk-options">${f.options.map(option).join('')}${other}</div>`;
   }
   if (f.type === 'textarea') return `<textarea ${attrs}${ph} maxlength="2000" rows="3">${e(value)}</textarea>`;
-  if (f.type === 'select') return `<select ${attrs}><option value="">${e(f.placeholder || 'Choose…')}</option>${f.options.map(o => `<option value="${e(o)}" ${o === value ? 'selected' : ''}>${e(o)}</option>`).join('')}</select>`;
+  if (f.type === 'select') return `<select ${attrs}><option value="">${e(f.placeholder || w.choose)}</option>${f.options.map(o => `<option value="${e(o)}" ${o === value ? 'selected' : ''}>${e(o)}</option>`).join('')}</select>`;
   const ac = (autocomplete[f.type] ? ` autocomplete="${autocomplete[f.type]}"` : '') + (f.type === 'url' ? ' inputmode="url" spellcheck="false"' : '');
   return `<input ${attrs}${ph}${ac} type="${inputType[f.type] ?? 'text'}"${f.type === 'number' ? ' step="any"' : ''} maxlength="${f.type === 'phone' ? 40 : 2000}" value="${e(value)}"/>`;
 }
 
-export function renderField(f: FormField, value: string, prefix: string): string {
+export function renderField(f: FormField, value: string, prefix: string, w: FormStrings = english): string {
   const id = `${prefix}-${f.id}`, half = isHalf(f) ? ' is-half' : '';
   const help = f.help ? `<small id="${e(id)}-help">${e(f.help)}</small>` : '';
   const label = `${e(f.label)}${f.required ? ' *' : ''}`;
   if (f.type === 'heading') return `<div class="pc-form-heading" id="${e(id)}"><h3>${e(f.label)}</h3>${f.help ? `<p>${e(f.help)}</p>` : ''}</div>`;
   if (f.type === 'checkbox' || f.type === 'consent') return `<label class="pc-bk-check${half}" for="${e(id)}"><input type="checkbox" id="${e(id)}" name="q_${e(f.id)}" ${f.required ? 'required' : ''} ${f.help ? `aria-describedby="${e(id)}-help"` : ''} value="yes" ${value === 'yes' ? 'checked' : ''}/><span>${label}${help}</span></label>`;
-  if (f.type === 'radio' || f.type === 'checkboxes') return `<fieldset class="pc-bk-field pc-bk-choices${half}"${f.help ? ` aria-describedby="${e(id)}-help"` : ''}><legend>${label}</legend>${renderControl(f, value, id)}${help}</fieldset>`;
-  return `<label class="pc-bk-field${half}" for="${e(id)}"><span>${label}</span>${renderControl(f, value, id)}${help}</label>`;
+  if (f.type === 'radio' || f.type === 'checkboxes') return `<fieldset class="pc-bk-field pc-bk-choices${half}"${f.help ? ` aria-describedby="${e(id)}-help"` : ''}><legend>${label}</legend>${renderControl(f, value, id, w)}${help}</fieldset>`;
+  return `<label class="pc-bk-field${half}" for="${e(id)}"><span>${label}</span>${renderControl(f, value, id, w)}${help}</label>`;
 }
 
 /** Two consecutive half-width questions share a `.pc-form-row` (side by side when there's room). */
-export function renderFields(definition: FormDefinition, values: Record<string, string> = {}, prefix = 'form'): string {
+export function renderFields(definition: FormDefinition, values: Record<string, string> = {}, prefix = 'form', w: FormStrings = english): string {
   const out: string[] = []; let row: string[] = [];
   const flush = () => { if (row.length) out.push(`<div class="pc-form-row">${row.join('')}</div>`); row = []; };
   for (const f of definition.fields) {
-    const html = renderField(f, values[f.id] ?? '', prefix);
+    const html = renderField(f, values[f.id] ?? '', prefix, w);
     if (isHalf(f)) { row.push(html); if (row.length === 2) flush(); }
     else { flush(); out.push(html); }
   }

package/src/lib/forms/localize.ts

@@ -0,0 +1,68 @@
+// A form in one of the site's other languages (schema.ts `translations`):
+// the translated words laid over the main ones, word by word, so anything
+// not translated yet stays in the main language. Pure (the builder uses it
+// too); the caller picks the locale.
+import type { FormDefinition, FormField } from './schema';
+
+type Choices = Pick<FormField, 'options' | 'translations'>;
+const pick = (v: string | undefined, fallback: string) => (v && v.trim() ? v : fallback);
+
+/** A question's choices in one language, in the main order; untranslated ones stay as they are. */
+export const choicesIn = (f: Choices, locale: string | null | undefined): string[] => {
+  const t = locale ? f.translations?.[locale]?.options : undefined;
+  return f.options.map((o, i) => t?.[i]?.trim() || o);
+};
+
+/** The main-language choice an answer stands for: itself, or the choice a translation of it sits in for. Undefined when it's neither. */
+export function mainChoice(f: Choices, value: string): string | undefined {
+  if (f.options.includes(value)) return value;
+  for (const t of Object.values(f.translations ?? {})) {
+    const i = t.options?.findIndex(o => o.trim() === value) ?? -1;
+    if (i >= 0 && i < f.options.length) return f.options[i];
+  }
+  return undefined;
+}
+
+/** A language in which a choice reads the same as a different choice (in any language), with that text; null when every text means one choice. */
+export function choiceClash(f: Choices): { locale: string; text: string } | null {
+  const seen = new Map(f.options.map((o, i) => [o.trim(), i]));
+  for (const locale of Object.keys(f.translations ?? {})) {
+    for (const [i, text] of choicesIn(f, locale).entries()) {
+      const at = seen.get(text.trim());
+      if (at !== undefined && at !== i) return { locale, text };
+      seen.set(text.trim(), i);
+    }
+  }
+  return null;
+}
+
+/** The form as visitors in `locale` see it (main-language words where it has none), without any translations. */
+export function localizeForm(d: FormDefinition, locale: string | null | undefined): FormDefinition {
+  const t = locale ? d.translations?.[locale] : undefined;
+  const { translations: _, ...rest } = d;
+  return {
+    ...rest,
+    title: pick(t?.title, d.title), intro: pick(t?.intro, d.intro),
+    submitLabel: pick(t?.submitLabel, d.submitLabel), confirmation: pick(t?.confirmation, d.confirmation),
+    fields: d.fields.map((f) => {
+      const w = locale ? f.translations?.[locale] : undefined;
+      const { translations: _, ...field } = f;
+      const placeholder = pick(w?.placeholder, f.placeholder ?? '');
+      return { ...field, label: pick(w?.label, f.label), help: pick(w?.help, f.help), options: choicesIn(f, locale), ...(placeholder ? { placeholder } : {}) };
+    }),
+  };
+}
+
+/**
+ * What a form's version is made of (service.ts formVersion): the questions,
+ * and the choices in each language (an answer names one), but none of the
+ * other words. A form without translated choices hashes as it always did.
+ */
+export function withoutWords(d: FormDefinition): FormDefinition {
+  const { translations: _, ...rest } = d;
+  return { ...rest, fields: d.fields.map(({ translations, ...f }) => {
+    const choices = Object.entries(translations ?? {}).filter(([, t]) => t.options?.some((o) => o.trim())).map(([l, t]) => [l, t.options!] as const);
+    return choices.length ? { ...f, choiceWords: Object.fromEntries(choices) } as FormField : f;
+  }) };
+}
+

package/src/lib/forms/render.ts

@@ -1,11 +1,17 @@
 import type { FormDefinition } from './schema';
 import { formVersion } from './service';
 import { escapeForm, renderFields } from './fields';
+import { localizeForm } from './localize';
+import { formStrings } from './words';
 export { escapeForm, renderFields } from './fields';
 export function hiddenFields(version: string, requestId: string) {
   return `<input type="hidden" name="formVersion" value="${escapeForm(version)}"><input type="hidden" name="requestId" value="${escapeForm(requestId)}"><div class="pc-form-trap" aria-hidden="true"><label>Leave empty<input name="website" tabindex="-1" autocomplete="off"></label></div>`;
 }
-export async function renderForm(id: string, definition: FormDefinition, values: Record<string, string> = {}, error = '', requestId: string = crypto.randomUUID(), embed = false) {
+// locale: the form's language (its translations, '' = the main one); lang:
+// the language of the page's own words; action: where it posts (/es/forms/<id>)
+export async function renderForm(id: string, definition: FormDefinition, values: Record<string, string> = {}, error = '', requestId: string = crypto.randomUUID(), embed = false, o: { locale?: string; lang?: string; action?: string } = {}) {
   const e = escapeForm;
-  return `<section class="pc-simple-form">${definition.title ? `<h2>${e(definition.title)}</h2>` : ''}${definition.intro ? `<p>${e(definition.intro)}</p>` : ''}<form method="post" action="/forms/${e(id)}${embed ? '?embed=1' : ''}">${error ? `<p class="pc-bk-error" role="alert">${e(error)}</p>` : ''}${hiddenFields(await formVersion(definition), requestId)}${renderFields(definition, values, `f-${id}`)}<button type="submit" class="pc-bk-submit">${e(definition.submitLabel || 'Submit')}</button></form></section>`;
+  const d = localizeForm(definition, o.locale), w = formStrings(o.lang);
+  const action = (o.action ?? `/forms/${encodeURIComponent(id)}`) + (embed ? '?embed=1' : '');
+  return `<section class="pc-simple-form">${d.title ? `<h2>${e(d.title)}</h2>` : ''}${d.intro ? `<p>${e(d.intro)}</p>` : ''}<form method="post" action="${e(action)}">${error ? `<p class="pc-bk-error" role="alert">${e(error)}</p>` : ''}${hiddenFields(await formVersion(definition), requestId)}${renderFields(d, values, `f-${id}`, w)}<button type="submit" class="pc-bk-submit">${e(d.submitLabel || w.submit)}</button></form></section>`;
 }

package/src/lib/forms/schema.ts

@@ -1,11 +1,34 @@
 import { z } from 'zod';
+import { choiceClash } from './localize';
 
 // `checkbox` and `consent` both mean "must tick to agree" (consent is what the
 // builder inserts; checkbox stays valid for existing data). `heading` has no
 // answer: it is a section title (label) with an optional description (help).
-export const FIELD_TYPES = ['text', 'textarea', 'email', 'phone', 'number', 'select', 'checkbox', 'date', 'radio', 'checkboxes', 'url', 'consent', 'heading'] as const;
+// `time` is stored as 24-hour HH:mm, like `date` as YYYY-MM-DD.
+export const FIELD_TYPES = ['text', 'textarea', 'email', 'phone', 'number', 'select', 'checkbox', 'date', 'radio', 'checkboxes', 'url', 'consent', 'heading', 'time'] as const;
 export const CHOICE_TYPES: readonly string[] = ['select', 'radio', 'checkboxes'];
 export const FIELD_ID = /^[a-zA-Z][a-zA-Z0-9_-]{0,79}$/;
+// The site's other languages (lib/i18n.ts), by locale like DocTranslations:
+//   question: translations: { es: { label, help, placeholder, options } }
+//   form:     translations: { es: { title, intro, submitLabel, confirmation } }
+// Every word is optional; a blank or missing one shows the main language's
+// (lib/forms/localize.ts). A translated choice is the choice at the same
+// position, and answers always store the main-language one, so Responses,
+// CSV and alerts read the same whatever language someone answered in.
+const byLocale = <T extends z.ZodTypeAny>(words: T) =>
+  z.record(z.string().regex(/^[a-z]{2,3}(-[a-z0-9]{2,8})?$/), words).refine(r => Object.keys(r).length <= 20, 'Too many languages.');
+export const FieldWords = z.object({
+  label: z.string().trim().max(200).optional(), help: z.string().max(300).optional(),
+  placeholder: z.string().max(120).optional(),
+  // by position; '' = this choice isn't translated yet
+  options: z.array(z.string().trim().max(200).regex(/^[^\r\n]*$/, 'Each choice must be one line.')).max(50).optional(),
+});
+export type FieldWords = z.infer<typeof FieldWords>;
+export const FormWords = z.object({
+  title: z.string().max(120).optional(), intro: z.string().max(1000).optional(),
+  submitLabel: z.string().max(80).optional(), confirmation: z.string().max(1000).optional(),
+});
+export type FormWords = z.infer<typeof FormWords>;
 export const FormField = z.object({
   id: z.string().regex(FIELD_ID),
   type: z.enum(FIELD_TYPES), label: z.string().trim().min(1).max(200),
@@ -18,15 +41,21 @@ export const FormField = z.object({
   placeholder: z.string().max(120).optional(),
   width: z.enum(['full', 'half']).optional(),
   allowOther: z.boolean().optional(),
+  translations: byLocale(FieldWords).optional(),
 });
 export type FormField = z.infer<typeof FormField>;
+/** a new form's thank-you; untouched, it shows in the page's language (words.ts thanksText) */
+export const DEFAULT_THANKS = 'Thank you. Your response has been received.';
 export const FormDefinition = z.object({
   title: z.string().max(120).default(''), intro: z.string().max(1000).default(''),
-  submitLabel: z.string().max(80).default(''), confirmation: z.string().max(1000).default('Thank you. Your response has been received.'),
+  submitLabel: z.string().max(80).default(''), confirmation: z.string().max(1000).default(DEFAULT_THANKS),
   fields: z.array(FormField).max(30).default([]),
+  translations: byLocale(FormWords).optional(),
 }).superRefine((d, ctx) => {
   if (new Set(d.fields.map(f => f.id)).size !== d.fields.length) ctx.addIssue({ code: 'custom', message: 'Field IDs must be unique.' });
   for (const f of d.fields) if (CHOICE_TYPES.includes(f.type) && (!f.options.length || new Set(f.options).size !== f.options.length)) ctx.addIssue({ code: 'custom', message: `“${f.label}” needs unique choices.` });
+  // one text, one choice: a translated answer must map back to a single choice
+  for (const f of d.fields) if (CHOICE_TYPES.includes(f.type) && choiceClash(f)) ctx.addIssue({ code: 'custom', message: `“${f.label}” has a translated choice that reads the same as another choice.` });
 });
 export type FormDefinition = z.infer<typeof FormDefinition>;
 export const isHalf = (f: Pick<FormField, 'width' | 'type'>) => f.width === 'half' && f.type !== 'heading';

package/src/lib/forms/service.ts

@@ -2,8 +2,16 @@ import { ApiError } from '../api';
 import { sha256Hex } from '../api-keys';
 import { FormDefinition, answerFields, type FormResponse } from './schema';
 import { AnswerError, checkAnswer } from './validate';
+import { withoutWords } from './localize';
 
-export const formVersion = (definition: FormDefinition) => sha256Hex(JSON.stringify(FormDefinition.parse(definition)));
+// The version is the questions and their choices in each language, not the
+// other translated words: rewording a label, help or title doesn't change
+// what's asked, so a page or app that loaded the form before still sends its
+// answers (no 409). A choice is answered in any language and stored as the
+// main-language one, so rewording a translated choice does change the
+// version: an answer in the old words gets the 409 and a reload, never a
+// wrong answer. Definitions without translated choices hash as before.
+export const formVersion = (definition: FormDefinition) => sha256Hex(JSON.stringify(withoutWords(FormDefinition.parse(definition))));
 export async function collectResponse(definition: FormDefinition, input: Record<string, string>, version?: string): Promise<FormResponse> {
   definition = FormDefinition.parse(definition);
   const current = await formVersion(definition);

package/src/lib/forms/validate.ts

@@ -1,6 +1,7 @@
 // Pure answer reading + validation, shared by the server (collectResponse,
 // readAnswers) and the builder's preview. No server imports here.
 import { answerFields, hasOther, type FormDefinition, type FormField } from './schema';
+import { mainChoice } from './localize';
 
 /** Value of the "Other" radio/checkbox; its text arrives as `o_<field id>`. */
 export const OTHER = '__other__';
@@ -28,12 +29,19 @@ export function answersFrom(getAll: (name: string) => unknown[], definition: Pic
   return answers;
 }
 
-/** Validates one answer and returns its stored form. Throws AnswerError with a visitor-facing message. */
+/** HH:mm, 24-hour (an hour without its leading zero is fine: "9:05" is stored "09:05"). */
+const TIME = /^([01]?\d|2[0-3]):([0-5]\d)$/;
+
+/**
+ * Validates one answer and returns its stored form. Throws AnswerError with a
+ * visitor-facing message. A choice may come in any of the form's languages;
+ * it's stored as the main-language choice.
+ */
 export function checkAnswer(f: FormField, raw: unknown): string {
   if (typeof raw !== 'string' || raw.length > 2000) throw new AnswerError(`“${f.label}” is too long.`);
   if (f.type === 'heading') return '';
   if (f.type === 'checkboxes') {
-    const items = raw.split('\n').map(s => s.trim()).filter(Boolean);
+    const items = raw.split('\n').map(s => s.trim()).filter(Boolean).map(s => mainChoice(f, s) ?? s);
     const extra = items.filter(i => !f.options.includes(i));
     if (f.required && !items.length) throw new AnswerError(`Please answer “${f.label}”.`);
     if (new Set(items).size !== items.length || extra.length > (hasOther(f) ? 1 : 0) || extra.some(e => e.length > 200)) throw invalid(f);
@@ -48,8 +56,12 @@ export function checkAnswer(f: FormField, raw: unknown): string {
   if (f.type === 'email') valid = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
   if (f.type === 'number') valid = /^[-+]?(?:\d+\.?\d*|\.\d+)(?:e[-+]?\d+)?$/i.test(value) && Number.isFinite(Number(value));
   if (f.type === 'date') valid = /^\d{4}-\d{2}-\d{2}$/.test(value) && Number.isFinite(Date.parse(value)) && new Date(value).toISOString().slice(0, 10) === value;
-  if (f.type === 'select') valid = f.options.includes(value);
-  if (f.type === 'radio') valid = f.options.includes(value) || (hasOther(f) && value.length <= 200 && !value.includes('\n'));
+  if (f.type === 'time') { const m = TIME.exec(value); valid = Boolean(m); if (m) value = `${m[1].padStart(2, '0')}:${m[2]}`; }
+  if (f.type === 'select' || f.type === 'radio') {
+    const main = mainChoice(f, value);
+    if (main !== undefined) value = main;
+    else valid = f.type === 'radio' && hasOther(f) && value.length <= 200 && !value.includes('\n');
+  }
   if (agree) valid = value === 'yes';
   if (f.type === 'phone') valid = value.length <= 40 && /^[+\d().\s-]+$/.test(value);
   if (f.type === 'url') {

package/src/lib/forms/words.ts

@@ -0,0 +1,32 @@
+// The public form's own words, around the ones its author wrote: the button
+// and the thank-you when the form has none, the dropdown's empty choice,
+// "Other" with its text box, and "Send another response". In the page's
+// language (/forms/<id> and /es/forms/<id>, an event's RSVP questions); the
+// author's own words come from the form and its translations. {label}: the
+// question (live/words.ts `fill`). Other languages fall back to English.
+import { DEFAULT_THANKS } from './schema';
+
+export interface FormStrings {
+  submit: string;
+  thanks: string;
+  choose: string;
+  other: string;
+  typeAnswer: string;
+  /** read out for the "Other" text box */
+  otherAnswer: string;
+  sendAnother: string;
+}
+
+const STRINGS: Record<string, FormStrings> = {
+  en: { submit: 'Submit', thanks: 'Thank you. Your response has been received.', choose: 'Choose…', other: 'Other', typeAnswer: 'Type your answer', otherAnswer: 'Other answer for {label}', sendAnother: 'Send another response' },
+  es: { submit: 'Enviar', thanks: 'Gracias. Recibimos tu respuesta.', choose: 'Elige…', other: 'Otro', typeAnswer: 'Escribe tu respuesta', otherAnswer: 'Otra respuesta para {label}', sendAnother: 'Enviar otra respuesta' },
+  fr: { submit: 'Envoyer', thanks: 'Merci. Votre réponse a bien été reçue.', choose: 'Choisir…', other: 'Autre', typeAnswer: 'Saisissez votre réponse', otherAnswer: 'Autre réponse pour {label}', sendAnother: 'Envoyer une autre réponse' },
+  de: { submit: 'Senden', thanks: 'Danke. Ihre Antwort ist eingegangen.', choose: 'Auswählen…', other: 'Andere', typeAnswer: 'Ihre Antwort', otherAnswer: 'Andere Antwort für {label}', sendAnother: 'Weitere Antwort senden' },
+  pt: { submit: 'Enviar', thanks: 'Obrigado. Recebemos sua resposta.', choose: 'Escolha…', other: 'Outro', typeAnswer: 'Digite sua resposta', otherAnswer: 'Outra resposta para {label}', sendAnother: 'Enviar outra resposta' },
+};
+
+export const formStrings = (locale: string | null | undefined): FormStrings =>
+  STRINGS[(locale || 'en').toLowerCase().split('-')[0]] ?? STRINGS.en;
+
+/** The form's thank-you, or the page's own words when it has none (or still has the default one). */
+export const thanksText = (confirmation: string, w: FormStrings) => (confirmation.trim() && confirmation !== DEFAULT_THANKS ? confirmation : w.thanks);

package/src/lib/mobile/forms.ts

@@ -3,17 +3,24 @@ import type { ContentRepository } from '../repo/types';
 import type { FormDefinition, SavedForm } from '../forms/schema';
 import { collectResponse, formVersion } from '../forms/service';
 import { saveResponse } from '../forms/alerts';
+import { localizeForm } from '../forms/localize';
+import { formStrings, thanksText } from '../forms/words';
 import { ApiError, readJson } from '../api';
 import { sha256Hex } from '../api-keys';
+import { I18N } from '../i18n';
+import { isExtraLocale } from '../translations';
+import { siteLang } from '../dates';
 import { queryParams } from './http';
 import { requireAccess } from './access';
+import { localeOnlyQuery, mobileLocale } from './locale';
 import type { PublicContext } from './route';
 
-// Published general forms for apps: read the questions, send answers. The
-// same validation and storage as the web form (/forms/<id>), plus app
-// limits: an Idempotency-Key per response (retries never duplicate), 10
-// responses per address per form per minute, and a per-form daily ceiling
-// from Admin → Mobile app so one form can't be flooded.
+// Published general forms for apps: read the questions (in the app's
+// language with ?locale=), send answers. The same validation and storage as
+// the web form (/forms/<id>), plus app limits: an Idempotency-Key per
+// response (retries never duplicate), 10 responses per address per form per
+// minute, and a per-form daily ceiling from Admin → Mobile app so one form
+// can't be flooded.
 
 const UUID4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
@@ -25,10 +32,15 @@ async function publishedForm(repo: ContentRepository, id: string): Promise<Saved
   return form;
 }
 
-/** A form's questions for apps; `version` is the one collectResponse accepts (also for event RSVPs). */
-export async function formJson(d: FormDefinition) {
+/**
+ * A form's questions for apps, in `locale` (the main-language words where it
+ * has none; never the translations themselves); `version` is the one
+ * collectResponse accepts (also for event RSVPs), the same in every language.
+ */
+export async function formJson(definition: FormDefinition, locale?: string | null) {
+  const d = localizeForm(definition, isExtraLocale(locale) ? locale : '');
   return {
-    version: await formVersion(d),
+    version: await formVersion(definition),
     title: d.title, intro: d.intro, submitLabel: d.submitLabel, confirmation: d.confirmation,
     fields: d.fields.map((f) => ({
       id: f.id, type: f.type, label: f.label, required: f.required, help: f.help, options: f.options,
@@ -37,12 +49,26 @@ export async function formJson(d: FormDefinition) {
   };
 }
 
+/** the language a request asks for (`?locale=`), or the site's main one */
+function formLocale(url: URL, read: boolean) {
+  if (read) return mobileLocale(localeOnlyQuery.parse(queryParams(url)).locale);
+  // sending answers never fails over the language: one the site doesn't
+  // have gets the main language's thank-you (the response is the same)
+  const locale = url.searchParams.get('locale');
+  return locale && I18N.locales.includes(locale) ? locale : I18N.defaultLocale || null;
+}
+// the button and thank-you when the form has none, in the request's language (else the site's)
+async function ownWords(repo: ContentRepository, locale: string | null) {
+  return formStrings(locale ?? siteLang(await repo.getSettings()));
+}
+
 export async function getForm(repo: ContentRepository, url: URL, id: string) {
-  z.object({}).strict().parse(queryParams(url));
+  const locale = formLocale(url, true);
   await requireAccess(repo, 'forms');
   const form = await publishedForm(repo, id);
-  const d = form.definition;
-  return { id: form.id, ...await formJson(d), title: d.title || form.name, submitLabel: d.submitLabel || 'Submit' };
+  const json = await formJson(form.definition, locale);
+  const w = await ownWords(repo, locale);
+  return { id: form.id, ...json, title: json.title || form.name, submitLabel: json.submitLabel || w.submit, confirmation: thanksText(json.confirmation, w) };
 }
 
 // field id → answer; checkbox groups send a list. "Other" answers send the typed text.
@@ -60,6 +86,7 @@ export const formResponseInput = z.object({
 }).strict();
 
 export async function submitFormResponse(c: PublicContext) {
+  const locale = formLocale(c.url, false);
   const settings = await requireAccess(c.repo, 'forms');
   const id = c.params.id ?? '';
   const key = c.request.headers.get('idempotency-key') ?? '';
@@ -77,12 +104,17 @@ export async function submitFormResponse(c: PublicContext) {
     const unchanged = JSON.stringify((JSON.parse(prior) as { definition: unknown }).definition) === JSON.stringify(form.definition);
     if (unchanged && JSON.stringify(await collectResponse(form.definition, answers, body.version)) !== prior)
       throw new ApiError(409, 'This request was already submitted with different answers. Reload to send a new response.');
-    return { received: true as const, confirmation: form.definition.confirmation };
+    return receipt(c.repo, form, locale);
   }
   const response = await collectResponse(form.definition, answers, body.version);
   // only valid new responses count toward the daily ceiling
   const cap = settings.mobileAccess.responsesPerFormDay;
   if (cap && !await c.repo.email.rateLimit(`forms:day:${form.id}`, cap, 86_400_000)) throw new ApiError(429, 'This form has had a lot of responses today. Please try again tomorrow.', 86_400);
   await saveResponse(c.repo, form, response, key.toLowerCase(), { via: 'app', locals: c.locals });
-  return { received: true as const, confirmation: form.definition.confirmation };
+  return receipt(c.repo, form, locale);
+}
+// the thank-you in the app's language (?locale=), as the web form shows it
+async function receipt(repo: ContentRepository, form: SavedForm, locale: string | null) {
+  const d = localizeForm(form.definition, isExtraLocale(locale) ? locale : '');
+  return { received: true as const, confirmation: thanksText(d.confirmation, await ownWords(repo, locale)) };
 }

package/src/lib/mobile/openapi.ts

@@ -61,7 +61,7 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
     ['/announcements/{id}', 'One announcement that is up, in the requested language; requires announcements', localeOnlyQuery, ref('AnnouncementDetail')],
     ['/links', 'The links page: profile, socials and visible blocks in order (owner switch: links)', empty, ref('Links')],
     ['/live', 'Live video status: the current broadcast (or null), server time and the owner’s display choices; never cached; 404 while live video is off', empty, ref('LiveStatus'), false],
-    ['/forms/{id}', 'A published form’s questions; 410 when it stopped accepting responses (owner switch: forms)', empty, ref('Form')],
+    ['/forms/{id}', 'A published form’s questions, in the requested language (locale: its labels, help, choices, button and thank-you there; words it has no translation for stay in the main language; version is the same in every language); 410 when it stopped accepting responses (owner switch: forms)', localeOnlyQuery, ref('Form')],
     ['/openapi.json', 'OpenAPI 3.1 document (no v1 envelope)', empty, { type: 'object', required: ['openapi', 'info', 'paths', 'components'] }],
   ];
   for (const [path, summary, query, schema, cache = true] of reads) {
@@ -114,8 +114,8 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
   paths['/api/v1/bookings/manage/ics'] = { get: { summary: 'Calendar file for the booking (text/calendar, no v1 envelope)', parameters: [bookingToken],
     responses: { ...errors, 200: { description: 'An iCalendar file.', content: { 'text/calendar': { schema: { type: 'string' } } } } } }, ...cors };
   paths['/api/v1/forms/{id}/responses'] = { post: { ...priv('Send a response to a published form', ref('FormReceipt'), { body: formResponseInput, write: true, status: 201,
-    description: 'Same validation as the web form. Idempotency-Key (UUID v4) is the response id: retries never duplicate. 10 responses per address per form per minute, plus the owner’s daily ceiling per form (429). version from GET /forms/{id}: a changed form answers 409. Leave website empty (spam trap).' }),
-    parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }, { name: 'Idempotency-Key', in: 'header', required: true, schema: { type: 'string', format: 'uuid' } }] }, ...cors };
+    description: 'Same validation as the web form. Idempotency-Key (UUID v4) is the response id: retries never duplicate. 10 responses per address per form per minute, plus the owner’s daily ceiling per form (429). version from GET /forms/{id}: a changed form answers 409 (a translation alone doesn’t change it). A choice may be sent as shown in the requested language or in the main one; it is stored as the main-language choice. A time answer is HH:mm (24-hour). locale: the confirmation in that language (one the site doesn’t have gets the main language’s). Leave website empty (spam trap).' }),
+    parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }, { name: 'locale', in: 'query', required: false, schema: { type: 'string', minLength: 1, maxLength: 35 } }, { name: 'Idempotency-Key', in: 'header', required: true, schema: { type: 'string', format: 'uuid' } }] }, ...cors };
   const guestNote = 'Guest sign-in needs the calendar, working email, EMAIL_ENCRYPTION_KEY and the owner switch guestSignIn (site.features.guestSignIn); 404 otherwise.';
   paths['/api/v1/guest/code'] = { post: priv('Email a 6-digit sign-in code (always answers the same, whether or not the address has bookings)', ref('GuestCodeSent'), { body: codeInput, write: true, status: 202,
     description: `${guestNote} Codes last 10 minutes; a new request voids the old code. 3 codes per address and 20 per client address per 15 minutes.` }), ...cors };

package/src/lib/mobile/rsvp.ts

@@ -61,7 +61,9 @@ export async function getRsvpStatus(repo: ContentRepository, url: URL, slug: str
   const closed = rsvpClosed(o, settings);
   const deadline = rsvp.enabled ? rsvpDeadline(o, settings) : null;
   const reason = closed ?? (left === 0 ? 'full' as const : null);
-  const form = rsvpQuestions(o.event);
+  const questions = rsvpQuestions(o.event);
+  // the questions in the app's language, where the form has its words
+  const form = questions ? await formJson(questions, locale) : null;
   const title = localizeDoc(o.event, locale ?? undefined).title;
   // the built-in button speaks the app's language (the site's own without languages set up)
   let submitLabel = form?.submitLabel ?? '';
@@ -79,6 +81,6 @@ export async function getRsvpStatus(repo: ContentRepository, url: URL, slug: str
     maxSeats: Math.min(rsvp.maxSeats || 1, left ?? Infinity), autoConfirm: rsvp.autoConfirm,
     // a full date takes places in line: how many people wait, for how many seats, and the most one may ask for
     waitlist: { enabled: waitlistOn(o.event), waiting: line.length, seats: line.reduce((n, b) => n + b.seats, 0), maxSeats: rsvp.maxSeats || 1 },
-    form: form ? { ...await formJson(form), submitLabel } : null,
+    form: form ? { ...form, submitLabel } : null,
   };
 }

package/src/lib/mobile/schemas.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { CalEvent, Booking, Calendar, BookingQuestion, LinksAvatarShape, LinksAvatarFit, LinksAvatarScale } from '../schema';
+import { FIELD_TYPES } from '../forms/schema';
 
 const str = z.string(), bool = z.boolean(), strings = z.array(str);
 const date = str.datetime(), locale = str.nullable();
@@ -73,7 +74,8 @@ export const Links = z.object({
 export const Form = z.object({
   id: str, version: str, title: str, intro: str, submitLabel: str, confirmation: str,
   fields: z.array(z.object({
-    id: str, type: z.enum(['text', 'textarea', 'email', 'phone', 'number', 'select', 'checkbox', 'date', 'radio', 'checkboxes', 'url', 'consent', 'heading']),
+    // time: 24-hour HH:mm. An app that doesn't know a type can ask it as short text; the site checks the answer
+    id: str, type: z.enum(FIELD_TYPES),
     label: str, required: bool, help: str, options: strings, placeholder: str, width: z.enum(['full', 'half']), allowOther: bool,
   })),
 });

package/src/lib/repo/migrations.ts

@@ -11,6 +11,7 @@ import { ROLES_MIGRATION } from '../permissions/migration';
 import { SYNC_MIGRATION } from '../sync/migration';
 import { ANNOUNCEMENT_TABLE, ANNOUNCEMENT_VISIBLE_COLUMNS } from '../announcements/migration';
 import { SCREENS_MIGRATION } from '../display/store';
+import { REQUEST_TABLE } from '../calendar/request-migration';
 // Versioned schema migrations shared by the two SQLite-dialect adapters
 // (D1 and libSQL). Applied versions are recorded in the `migrations` table;
 // each adapter's runner applies whatever is newer, in order, at startup.
@@ -730,6 +731,9 @@ export const MIGRATIONS: Migration[] = [
   MOVED_DATES_MIGRATION(contentVersionTriggers('events', [...CONTENT_VERSION_COLUMNS.events, 'cancelled_dates', 'moved_dates'])[2]),
   // saved TV screens (Admin → Calendar → Screens, lib/display/store.ts)
   SCREENS_MIGRATION,
+  // calendar requests on their own rows (RequestRecord): new events and
+  // changes asked for without an account, and hosts' date moves
+  { version: 68, statements: REQUEST_TABLE },
 ];
 
 // Current cache coverage; keep earlier migration inputs frozen for upgrade compatibility.

package/src/lib/repo/sql.ts

@@ -7,6 +7,7 @@ import { LiveStore } from '../live/store';
 import { PushStore } from '../push/store';
 import { AnnouncementStore, announcementInsert } from '../announcements/store';
 import { ScreenStore, screenInsert, screenKey } from '../display/store';
+import { RequestStore, requestInsert } from '../calendar/request-store';
 import { EditorStore } from '../editor/store';
 import { PermissionStore } from '../permissions/store';
 import { BackupStore } from '../backup/store';
@@ -294,6 +295,7 @@ export class SqlRepository implements ContentRepository {
   readonly live: LiveStore;
   readonly push: PushStore;
   readonly announcements: AnnouncementStore;
+  readonly requests: RequestStore;
   readonly editor: EditorStore;
   readonly backups: BackupStore;
   readonly permissions: PermissionStore;
@@ -307,6 +309,7 @@ export class SqlRepository implements ContentRepository {
     this.live = new LiveStore(async () => { await this.ready; return this.driver; });
     this.push = new PushStore(async () => { await this.ready; return this.driver; });
     this.announcements = new AnnouncementStore(async () => { await this.ready; return this.driver; });
+    this.requests = new RequestStore(async () => { await this.ready; return this.driver; });
     this.editor = new EditorStore(async () => { await this.ready; return this.driver; });
     this.backups = new BackupStore(async () => { await this.ready; return this.driver; });
     this.auth = new AuthStore(async () => { await this.ready; return this.driver; });
@@ -1023,6 +1026,8 @@ export class SqlRepository implements ContentRepository {
       ...notifications,
       { sql: 'DELETE FROM events WHERE id = ?', args: [id] },
       { sql: "DELETE FROM search_index WHERE kind = 'event' AND ref_id = ?", args: [id] },
+      // requests about it can't be answered any more: withdrawn (so they're pruned like answered ones)
+      { sql: "UPDATE event_requests SET state = 'withdrawn', reviewed_at = ?, updated_at = MAX(?, updated_at + 1) WHERE event_id = ? AND state = 'pending'", args: [Date.now(), Date.now(), id] },
     ]);
   }
 
@@ -1943,6 +1948,8 @@ export class SqlRepository implements ContentRepository {
       ...(content.announcements ? [{ sql: 'DELETE FROM announcements' }, ...content.announcements.map(announcementInsert)] : []),
       // screens come back with new keys (backups never hold them): each TV needs its new link
       ...(content.screens ? [{ sql: 'DELETE FROM display_screens' }, ...content.screens.map((s) => screenInsert({ ...s, key: screenKey(), lastSeenAt: null }))] : []),
+      // calendar requests (a backup made before them leaves the current ones)
+      ...(content.eventRequests ? [{ sql: 'DELETE FROM event_requests' }, ...content.eventRequests.map(requestInsert)] : []),
       ...(content.forms ?? []).map(formInsert),
       ...(content.formSubmissions ?? []).map(submissionInsert),
       ...(content.resources ?? []).map((r) => this.resourceInsert(r)),

package/src/lib/repo/types.ts

@@ -10,6 +10,7 @@ import type { EmailStore } from '../email/store';
 import type { RsvpStaffNotice } from '../email/types';
 import type { PushStore } from '../push/store';
 import type { AnnouncementStore } from '../announcements/store';
+import type { RequestStore } from '../calendar/request-store';
 import type { Announcement } from '../announcements/types';
 import type { EditorStore } from '../editor/store';
 import type { PermissionStore } from '../permissions/store';
@@ -19,7 +20,7 @@ export type ImportRecordKind = 'post' | 'page' | 'user' | 'tag' | 'media' | 'red
 export interface ImportRecord { runId: string; kind: ImportRecordKind; sourceId: string; acmsId: string; action: 'created' | 'updated'; stamp: number }
 export interface DesignVersion { id: string; createdAt: number; author: string; summary: string; snapshot: Record<string, unknown> }
 
-import type { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Role, WidgetInstance, Calendar, CalEvent, ApiKey, ApiScope, Webhook, WebhookDelivery, Resource, BookingLink, Booking, BookingStatus, Place, EventLocation, EventRequest } from '../schema';
+import type { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Role, WidgetInstance, Calendar, CalEvent, ApiKey, ApiScope, Webhook, WebhookDelivery, Resource, BookingLink, Booking, BookingStatus, Place, EventLocation, EventRequest, RequestRecord } from '../schema';
 
 export interface Stats {
   publishedPages: number;
@@ -82,6 +83,8 @@ export interface ContentRepository {
   readonly live: LiveStore;
   readonly push: PushStore;
   readonly announcements: AnnouncementStore;
+  // calendar requests on their own rows (lib/calendar/request-store.ts)
+  readonly requests: RequestStore;
   readonly editor: EditorStore;
   readonly permissions: PermissionStore;
   readonly screens: ScreenStore;
@@ -372,6 +375,8 @@ export interface ContentRepository {
     // saved TV screens, without their keys (each gets a new one); a backup
     // without them leaves the current ones
     screens?: Screen[];
+    // added with calendar requests; a backup without them leaves the current ones
+    eventRequests?: RequestRecord[];
   }, authRecovery?: { issuer: string; subject: string; userId: string }): Promise<void>;
 
   // imports (lib/import/apply.ts drives these). writeImported is the