@acms-subir/core 0.3.55 → 0.3.56

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @acms-subir/core
 
+## 0.3.56
+
+### Patch Changes
+
+- 191830f: Anyone can now ask for an event, or for a change to one, without an account. Turn it on with `acms({ requests: true })`; it needs the calendar.
+
+  - **On the website**, a form at `/request` (and `/es/request` and so on), in the visitor's language and themed through the site's tokens. It asks what they're planning, the kind, date and times, how it repeats, rooms (or "Not sure"), how many people, and anything else. "Change to an event" asks which event, optionally which date, and what should change. A live line says whether the chosen rooms look free then (free or busy only). `requests: { path: '/ask' }` moves it; `requests: { page: false }` drops it but keeps the rest, and a site file at the path replaces it.
+  - **In apps**, `GET /api/v1/requests/options` (open or closed, the kinds and requestable rooms, the reply time, notice and office phone, in the asked language) and `POST /api/v1/requests` (Idempotency-Key; returns `{ id }`; refusals carry a code such as `title`, `past`, `room`, `closed` or `busy`). `site.features.requests` says the site has it. 10 requests a minute and 20 a day per address, 5 a day per email address, plus the site's daily cap.
+  - **Calendar → Requests** lists requests from the app, the website and hosts on My events (new events, suggested changes and date moves, each answered there) in one place, with Pending, Approved and Declined tabs and, on each new request, what takes its rooms then (12 weeks for weekly ones). **Approve** makes a draft that's already filled in: title, times, weekly when asked, the kind's tag and calendar, and the rooms held while it's a draft. The person's details stay on the request, never on the event. Approving a change opens the event, or that date's Move… form. **Reply** and **Decline** (with an optional reason) email the person in the language they asked in. **Delete as spam** removes one without an email. The list shows 50 at a time. Reading the list needs "Create and edit content"; answering needs "Publish content".
+  - **Settings** on that page (needs "Manage rooms and calendars"): open or closed (closed forms and apps say so and show the office phone, and never disappear), the kinds with their label in each language, tag and calendar, the reply time and opening notice in each language, the office phone, who hears about new requests (else `members.notify`, else the owners), an optional push to their linked phones, the daily cap (100) and how long requests are kept (180 days after the answer, or after they arrive if nobody answers). Rooms marked **Anyone can check if it's free** are the ones people can choose.
+  - **Emails:** the person gets "We got your request" in their language. It never repeats what they typed, so the form can't be used to send someone else a message, and each address gets at most 3 a day. Staff get every detail, with Reply-To set to the person, and only while the request still waits.
+  - **Privacy:** the generated privacy notice gets an "Event requests" section (what's kept, why, and when it's deleted), and the app store answers list event requests under contact info and user content. Requests are in backups.
+  - **Server API** (`@acms-subir/core/server`): `requestOptions`, `submitRequest` (for a site's own form), `listRequests`, `approveRequest`, `declineRequest` and `replyToRequest`. See `npx acms docs calendar` and `npx acms docs server`.
+
+  Requests use the `event_requests` table that came with hosts' date moves (migration 68); this release adds no migration. After updating, a site that wants requests adds `requests: true`, marks the rooms people may ask for as **Anyone can check if it's free**, and sets the kinds, reply time and office phone in Calendar → Requests → Settings. Update the privacy notice and the app's store answers, which now include requests.
+
 ## 0.3.55
 
 ### Patch Changes

package/docs/calendar.md

@@ -1,6 +1,7 @@
-# Calendar: repeats, single dates, rooms and clashes
+# Calendar: repeats, single dates, rooms, clashes and requests
 
-How events repeat, how one date of a series is changed, and how events hold rooms.
+How events repeat, how one date of a series is changed, how events hold rooms, and
+how people ask for events.
 Read it with `npx acms docs calendar`. The functions named here come from
 `@acms-subir/core/server` (`npx acms docs server` has their signatures), and the app
 API is in `docs/mobile-api-v1.md` in the framework repository.
@@ -315,3 +316,75 @@ calendars in step, both ways, within a few minutes. The full guide is
   until "from this date on" exists.
 - Site code can read an event's Google copies with `googleCopies(repo, eventId)`, and
   Recent changes with `googleSyncHistory(repo)`.
+
+## Requests without an account
+
+`acms({ requests: true })` lets anyone ask for a new event, or for a change to one,
+without an account:
+
+- from the website's form at `/request` (and `/es/request` and so on);
+- from an app (`GET /api/v1/requests/options`, `POST /api/v1/requests`);
+- from the site's own form, through `submitRequest`.
+
+Staff answer them on **Calendar → Requests**. That one list also shows hosts'
+requests from My events. `requests: { path: '/ask' }` moves the form, and
+`requests: { page: false }` drops it but keeps the API and the admin. A site file at
+the form's path replaces it.
+
+Each request is a row of its own (`RequestRecord`), not an event:
+
+- `kind`:
+  - `'new'`: `data` has `type`, `title`, `start`, `end`, `repeat` (`once`, `weekly`
+    or `other` with `repeatText`), `roomIds`, `roomsUnsure` and `people`;
+  - `'change'`: `eventId`, plus `key` for one date (`''` = every date).
+- `state`: `pending`, `approved`, `declined` or `withdrawn`.
+- `source`: `app`, `web` or `member`.
+- `requester`: `{ name, email, phone, locale }`, for a person without an account.
+- `note`: their own words to staff.
+- `reply`: staff's last answer.
+
+Hosts' date moves (C3/C4) use the same table with kinds `move` and `from-date`.
+
+**Settings** (Calendar → Requests → Settings, in `settings.calendar.requests`):
+
+- **Open or closed.** Closed forms and apps say so and show the office phone; they never
+  disappear.
+- **Kinds.** Each has a label per language, plus the tag and calendar an approved
+  draft gets.
+- **Reply time and notice**, per language.
+- **Office phone.**
+- **Who hears about new requests.** Their email, else `members.notify`, else the owners.
+  Optionally a push to their linked phones, without names.
+- **A daily cap** on new requests (100), on top of 10 a minute and 20 a day per
+  address and 5 a day per email address.
+- **How long requests are kept** (180 days) after their answer, or after they
+  arrived if nobody answered. The scheduler deletes them then.
+
+**Rooms** people can choose are the ones marked **Anyone can check if it’s free**
+(`requestable`). The form's live "free then" line uses `GET /api/v1/rooms/free`, which
+says free or busy, never what or who.
+
+**Answering** (needs **Publish content**; reading the list needs **Create and edit
+content**):
+
+- **Approve** a new request: makes a draft that's already filled in. It has the
+  title and times, `FREQ=WEEKLY` when asked, the kind's tag and calendar (else the
+  default calendar), and the rooms held while it's a draft. The draft opens in the
+  editor. The person's details stay on the request, never on the event.
+- **Approve** a change: opens the event, or that date's Move… form
+  (`/admin/calendar/events/<id>?move=<key>`).
+- Both email the person, with an optional message, unless you untick it.
+- **Decline**, with an optional reason, and **Reply** email the person in the
+  language they asked in. A reply leaves the request as it is. **Delete as spam**
+  removes a request from the app or the website without emailing anyone.
+- Each row shows what takes its rooms then. Weekly requests are checked for 12
+  weeks.
+
+**Emails.** The person gets "We got your request" in their language. It never
+repeats what they typed (the title or message), so the form can't be used to send
+someone else a message, and each address gets at most 3 a day. Staff get every
+detail in the site's main language, with Reply-To set to the person.
+
+**Privacy.** The generated privacy notice gets an "Event requests" section, and
+the store answers list event requests under contact info and user content.
+Requests are in backups.

package/docs/mobile.md

@@ -114,7 +114,7 @@ Read the app's `AGENTS.md` too: it holds the same rules, next to the code.
 
 | Hook | For |
 | --- | --- |
-| `useSite()` | name, menu, languages, features (`calendar`, `bookings`, `rsvp`, `blog`, `search`, `bookingChanges`, `guestSignIn`, `forms`, `links`, `live`) |
+| `useSite()` | name, menu, languages, features (`calendar`, `bookings`, `rsvp`, `blog`, `search`, `bookingChanges`, `guestSignIn`, `forms`, `links`, `live`, `announcements`, `requests`) |
 | `usePage(slug)` | a published page: `mode` (`sections`/`content`), `sections`, `body.html`; 404 when missing |
 | `usePosts({ collection, limit, q })` / `usePost(slug)` | posts (infinite: `items`, `fetchNextPage`); `q` gives ranked search matches |
 | `useSearch(text, { types, collection, limit })` | site-wide search: `data.posts`, `data.pages`, `data.events` (each with `snippet.text` + `snippet.highlights`), `data.more`; debounced, blank text fetches nothing |
@@ -128,6 +128,7 @@ Read the app's `AGENTS.md` too: it holds the same rules, next to the code.
 | `useLive()` | live video: `snapshot`, `status` (`live`/`upcoming`/`offline`), `isLive`, localized `view` text, the owner's `display` choices (`style`, `bar`, `header`, `dock`). Polls every 30 s only in the foreground, rechecks on resume, drops an expired "live" even offline; idle while `features.live` is false. Render `<LiveCard>` / `<LiveTag>` |
 | `useResources()` / `useAvailability({ resource, link })` / `useBooking()` | bookings |
 | `useRoomFree({ room, start, end })` | bookings: is a requestable room free (no names) |
+| `useRequestOptions()` / `useSubmitRequest()` | event requests without an account (`features.requests`): the form's kinds, rooms, words and office phone (`open: false` = say so and show the phone, never hide the screen), and sending one with its own Idempotency-Key; `problem` and `field` say what to fix |
 | `useLocale()`, `useTheme()`, `useLayout()`, `useRefresh()`, `useOpenLink()` | language, tokens, layout, refresh, links |
 | `usePushRegistration({ topics })` / `usePushTopics()` / `useNewPushTopics()` / `useNotificationTaps()` | push notifications (see Push notifications); topic names come in the app's language |
 | `useAnnouncements({ kind, pinned })` / `useAnnouncement(id)` / `useAnnouncementState()` | announcements up right now; unread and closed banners kept on the phone (a dot, never a number); idle while `features.announcements` is false |
@@ -150,6 +151,7 @@ npx acms mobile recipe add news      # posts list, article
 npx acms mobile recipe add booking   # resources → slots → form → confirmation  (expo-crypto)
 npx acms mobile recipe add push      # notifications: turn on, topic toggles, taps open the page  (expo-notifications, expo-device)
 npx acms mobile recipe add announcements  # list with kind tabs and unread dots, detail, home banners (site needs announcements on)
+npx acms mobile recipe add event-request  # "Request an event" screen, a More row and an events-list link, no account (site needs requests on; expo-crypto, expo-secure-store)
 ```
 
 Each prints the `npx expo install …` line for its packages: run it (doctor

package/docs/server.md

@@ -66,6 +66,16 @@ withdrawDateRequest(repo: Repo, who: ServerUser | null, requestId: string): Prom
 approveDateRequest(repo: Repo, who: ServerUser | null, requestId: string, ctx: WriteContext, seen?: number): Promise<{ request: RequestRecord; moved: MoveResult }>
 declineDateRequest(repo: Repo, who: ServerUser | null, requestId: string, reply: string, ctx: WriteContext, seen?: number): Promise<RequestRecord>
 
+// requests without an account (acms({ requests })): asking needs no account; listing needs
+// content.edit, answering content.publish
+requestOptions(repo: Repo, locale?: string): Promise<{ open: boolean; types: { id: string; label: string }[]; rooms: { slug: string; name: string; color: string }[]; replyTime: string; notice: string; phone: string; timezone: string; events: { slug: string; title: string; dates: string[] }[] }>
+submitRequest(repo: Repo, input: RequestInput, opts: { key: string; address: string; context: WriteContext }): Promise<{ id: string; created: boolean }>
+listRequests(repo: Repo, who: ServerUser | null, q?: { states?: RequestState[]; kinds?: RequestKind[]; sources?: RequestSource[]; eventId?: string; userId?: string; order?: 'oldest' | 'newest' | 'decided'; limit?: number; offset?: number }): Promise<RequestRecord[]>
+approveRequest(repo: Repo, who: ServerUser | null, id: string, ctx: WriteContext, seen?: number, opts?: { message?: string; email?: boolean }): Promise<{ request: RequestRecord; event: CalEvent | null; next: string }>
+declineRequest(repo: Repo, who: ServerUser | null, id: string, reason: string, ctx: WriteContext, seen?: number, opts?: { email?: boolean }): Promise<RequestRecord>
+deleteRequest(repo: Repo, who: ServerUser | null, id: string): Promise<void>
+replyToRequest(repo: Repo, who: ServerUser | null, id: string, message: string, ctx: WriteContext): Promise<RequestRecord>
+
 type Role = 'owner' | 'administrator' | 'editor' | 'author' | 'contributor' | (string & {})
 interface ServerUser { id: string; email: string; name: string; role: Role; staff: boolean; can(permission: string): boolean }
 interface Occurrence { event: CalEvent; start: number; end: number; allDay: boolean; days: number; key: string; cancelled: boolean; roomIds: string[]; moved?: { from: { start: number; end: number }; note: string; location?: EventLocation } }
@@ -460,3 +470,44 @@ if (Astro.request.method === 'POST') {
 
 `/classes/mine` would list `listMyEvents(repo, me)` and show `e.request?.state`
 (`'pending'`, `'declined'` with `e.request.reply`, or no request once approved).
+
+## Requests without an account
+
+With `acms({ requests })`, anyone can ask for an event or a change to one (see `npx
+acms docs calendar`). The built-in form at `/request` and `POST /api/v1/requests` use
+these functions, and so can a site's own form:
+
+- **`requestOptions(repo, locale)`**: whether requests are open, the kinds, requestable
+  rooms and the events a change can be about (with their next dates), and the site's
+  reply time, notice and phone, in that language.
+- **`submitRequest(repo, input, { key, address, context })`**: `input` is the same as
+  the API body (`kind: 'new'` or `'change'`, `name`, `email`…). `key` is a random UUID v4
+  your page keeps for this form, so a double submit stores one request. `address` is
+  `Astro.clientAddress`, for the 10-a-minute limit. Refusals throw with a `status` and a
+  `code` (`RequestRefusal`: `title`, `start`, `past`, `room`, `email`, `closed`,
+  `busy`…). Show your own words for each code.
+- **`listRequests(repo, who, q)`**: for staff (`content.edit`). `states: ['pending']`
+  comes oldest first.
+- **`approveRequest`**, **`declineRequest`** and **`replyToRequest`** answer one (`content.publish`) and
+  email the person in their language (approve and decline take `email: false` to stay quiet).
+  **`deleteRequest`** removes spam from the app or the website without an email. Pass `seen` (the `updatedAt` you showed) and an
+  edited request answers 409 instead.
+
+```astro
+---
+// src/pages/ask.astro: the site's own request form
+import { getRepo, submitRequest } from '@acms-subir/core/server';
+const repo = await getRepo(Astro.locals);
+let done = false, problem = '';
+if (Astro.request.method === 'POST') {
+  const f = await Astro.request.formData();
+  try {
+    await submitRequest(repo, {
+      kind: 'new', title: String(f.get('title')), start: `${f.get('date')}T${f.get('from')}`, end: String(f.get('to')),
+      name: String(f.get('name')), email: String(f.get('email')),
+    }, { key: String(f.get('key')), address: Astro.clientAddress, context: { url: Astro.url, locals: Astro.locals } });
+    done = true;
+  } catch (e) { problem = (e as { code?: string }).code ?? 'failed'; }
+}
+---
+```

package/integration.mjs

@@ -448,6 +448,20 @@ function resolveMembers(members, calendar) {
   // the built-in pages are "My events": they need the calendar
   return { enabled: calendar.enabled, base, notify: notify.map((e) => e.trim().toLowerCase()), hostMoves };
 }
+function resolveRequests(requests, calendar, reserved) {
+  if (requests === undefined || requests === false) return { enabled: false, path: '/request', page: true };
+  if (requests === true) requests = {};
+  if (!requests || typeof requests !== 'object' || Array.isArray(requests)) throw new Error('acms: requests must be true, false or an object');
+  unknownKeys('requests', requests, ['path', 'page']);
+  const path = requests.path ?? '/request';
+  if (typeof path !== 'string' || !/^\/[a-z0-9-]+(\/[a-z0-9-]+)*$/.test(path)) {
+    throw new Error(`acms: requests.path must start with "/" and use lowercase letters, digits, and hyphens (no trailing slash) — got "${path}"`);
+  }
+  if (RESERVED_BASES.has(path) || reserved.includes(path)) throw new Error(`acms: requests.path "${path}" collides with another route — pick another path`);
+  if (requests.page !== undefined && typeof requests.page !== 'boolean') throw new Error('acms: requests.page must be true or false');
+  // requests become calendar events: they need the calendar
+  return { enabled: calendar.enabled, path, page: requests.page ?? true };
+}
 function resolveAnnouncements(announcements, reserved) {
   if (announcements === undefined || announcements === false) return { enabled: false, base: '/announcements', pages: true, topics: {} };
   if (announcements === true) announcements = {};
@@ -713,6 +727,14 @@ function acmsVitePlugin(userConfig) {
  *   `topics` picks the push topic each kind starts with in the composer, e.g.
  *   `{ registration: 'registrations', help: 'help' }` (otherwise a topic named
  *   after the kind, such as `events` or `help`, else everyone).
+ * @param {boolean | {path?: string, page?: boolean}} [options.requests]
+ *   Event requests without an account (off by default; needs the calendar):
+ *   anyone asks for a new event or a change to one from the app
+ *   (GET /api/v1/requests/options, POST /api/v1/requests) or the website's
+ *   form (default path '/request', also under each language's prefix). Staff
+ *   answer them on Calendar → Requests, where approving makes a filled-in
+ *   draft event. `page: false` keeps the API and the admin but drops the
+ *   built-in form, so a site can build its own on the same server API.
  * @param {string[]} [options.signedRoutes]
  *   The site's own routes that receive posts from another server and check
  *   its signature themselves (an SMS or payment provider's webhook), as route
@@ -741,6 +763,7 @@ export default function acms(options = {}) {
     if (clash) throw new Error(`acms: members.base "${members.base}" collides with another configured path — pick another`);
   }
   const announcements = resolveAnnouncements(options.announcements, [...contentBases.keys(), ...(calendar.enabled ? [calendar.base, calendar.eventsBase, calendar.bookBase] : []), ...(members.enabled ? [members.base] : [])]);
+  const requests = resolveRequests(options.requests, calendar, [...contentBases.keys(), ...(calendar.enabled ? [calendar.base, calendar.eventsBase, calendar.bookBase] : []), ...(members.enabled ? [members.base] : []), ...(announcements.enabled ? [announcements.base] : [])]);
   const roles = resolveRoles(options.roles, members);
   const permissions = resolvePermissions(options.permissions, roles);
   const maps = resolveMaps(options.maps);
@@ -771,6 +794,7 @@ export default function acms(options = {}) {
     permissions,
     members,
     announcements,
+    requests,
   };
   const routes = [...ROUTES,
     ['/api/v1/site', 'api/v1/site.ts'],
@@ -942,6 +966,16 @@ export default function acms(options = {}) {
     );
     if (announcements.pages) routes.push([announcements.base, 'announcements/index.astro'], [`${announcements.base}/[id]`, 'announcements/[id].astro']);
   }
+  // event requests from people without an account (acms({ requests })): the
+  // app API, Calendar → Requests and, unless page: false, the public form
+  if (requests.enabled) {
+    routes.push(
+      ['/admin/calendar/requests', 'admin/calendar/requests.astro'],
+      ['/api/v1/requests', 'api/v1/requests/index.ts'],
+      ['/api/v1/requests/options', 'api/v1/requests/options.ts'],
+    );
+    if (requests.page) routes.push([requests.path, 'request/index.astro']);
+  }
   // "My events" for signed-in members (acms({ members })): thin pages over
   // lib/calendar/requests.ts. A site file at any of these paths replaces that
   // page; `members: false` drops them all (members.enabled needs the calendar).

package/mobile-template/client/AGENTS.md

@@ -78,6 +78,7 @@ npx acms mobile recipe add news      # posts list and article
 npx acms mobile recipe add booking   # resources → slots → form → confirmation
 npx acms mobile recipe add push      # notifications: turn on, topics, taps (site needs push on)
 npx acms mobile recipe add announcements  # list, detail, home banners (site needs announcements on)
+npx acms mobile recipe add event-request  # Request an event: screen, More row, events-list link (site needs requests on)
 ```
 
 Each recipe prints the extra Expo packages to install (`npx expo install ...`).

package/mobile-template/client/README.md

@@ -28,7 +28,7 @@ site) and `.env.local` (written by `acms mobile dev`, not committed).
 ## Add screens
 
 ```sh
-npx acms mobile recipe add events   # also: news, booking, push, rsvp, announcements
+npx acms mobile recipe add events   # also: news, booking, push, rsvp, announcements, event-request
 ```
 
 Build your own with the hooks from `@acms-subir/native`. `AGENTS.md` has the

package/mobile-template/recipes/event-request/files/app/request.tsx

@@ -0,0 +1,305 @@
+import { useEffect, useState, type ReactNode } from 'react';
+import { ActivityIndicator, KeyboardAvoidingView, Linking, Platform, Pressable, ScrollView, Text, TextInput, View, type KeyboardTypeOptions } from 'react-native';
+import { Stack, router } from 'expo-router';
+import * as Crypto from 'expo-crypto';
+import * as SecureStore from 'expo-secure-store';
+import type { RequestInput } from '@acms-subir/client';
+import { Button, ErrorView, fill, formatClock, formatEventDate, localDay, parseClock, requestEnd, requestProblemText, requestProblems, requestSummary, siteInstant, useDebounced, useGuest, useLayout, useLocale, useRequestOptions, useRoomFree, useSite, useStrings, useSubmitRequest, useTheme, type RequestField, type RequestProblem } from '@acms-subir/native';
+import { DayPicker } from '../components/DayPicker';
+
+// Request an event, without an account: something new (what, kind, when,
+// how it repeats, rooms with a live "looks free" line, people) or a change
+// to one of the site's events, then how to reach them. Staff answer in the
+// site's Calendar → Requests; nothing is on the calendar until they approve
+// it. While the site isn't taking requests the screen still opens and says
+// so, with the office phone: keep the More row that leads here, so App Review
+// always finds it. useSubmitRequest keeps one idempotency key per request, so
+// sending again after a timeout never asks twice. Words: useStrings(), in the
+// app's language (the website's form says the same).
+
+// Name, email and phone stay on this phone for next time: secure storage,
+// this device only, never sent anywhere but the site. Web keeps nothing.
+const CONTACT_KEY = 'acms.request.contact';
+const keychain = { keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY };
+type Contact = { name: string; email: string; phone: string };
+const contact = {
+  get: async (): Promise<Contact | null> => {
+    if (Platform.OS === 'web') return null;
+    try {
+      const v = JSON.parse((await SecureStore.getItemAsync(CONTACT_KEY, keychain)) ?? 'null');
+      return v && typeof v.name === 'string' && typeof v.email === 'string' ? { name: v.name, email: v.email, phone: typeof v.phone === 'string' ? v.phone : '' } : null;
+    } catch { return null; }
+  },
+  set: async (c: Contact) => { if (Platform.OS !== 'web') await SecureStore.setItemAsync(CONTACT_KEY, JSON.stringify(c), keychain).catch(() => {}); },
+};
+
+const call = (phone: string) => { Linking.openURL(`tel:${phone.replace(/[^\d+]/g, '')}`).catch(() => {}); };
+type Repeat = 'once' | 'weekly' | 'other';
+const UNSURE = '__unsure__';
+
+export default function RequestScreen() {
+  const t = useTheme();
+  const words = useStrings();
+  const { locale } = useLocale();
+  const { gutter } = useLayout();
+  const { data: site } = useSite();
+  const guest = useGuest();
+  const options = useRequestOptions();
+  const send = useSubmitRequest({ createKey: Crypto.randomUUID });
+  const o = options.data;
+  const tz = o?.timezone ?? 'UTC';
+  const [kind, setKind] = useState<'new' | 'change'>('new');
+  const [title, setTitle] = useState('');
+  const [type, setType] = useState('');
+  const [date, setDate] = useState('');
+  const [starts, setStarts] = useState('');
+  const [ends, setEnds] = useState('');
+  const [repeat, setRepeat] = useState<Repeat>('once');
+  const [repeatText, setRepeatText] = useState('');
+  const [rooms, setRooms] = useState<string[]>([]);
+  const [unsure, setUnsure] = useState(false);
+  const [people, setPeople] = useState('');
+  const [message, setMessage] = useState('');
+  const [event, setEvent] = useState('');
+  const [eventDate, setEventDate] = useState('');
+  const [change, setChange] = useState('');
+  const [name, setName] = useState('');
+  const [email, setEmail] = useState('');
+  const [phone, setPhone] = useState('');
+  const [tried, setTried] = useState(false);
+
+  // details from last time, else the email they signed in with for "My bookings"
+  useEffect(() => {
+    let live = true;
+    void contact.get().then((c) => {
+      if (!live || !c) return;
+      setName((v) => v || c.name); setEmail((v) => v || c.email); setPhone((v) => v || c.phone);
+    });
+    return () => { live = false; };
+  }, []);
+  useEffect(() => {
+    if (site?.features.guestSignIn && guest.email) setEmail((v) => v || guest.email!);
+  }, [site?.features.guestSignIn, guest.email]);
+
+  // ---- what goes out ----
+  const startTime = parseClock(starts), endTime = parseClock(ends);
+  const count = people.replace(/\D/g, '');
+  const input: RequestInput = kind === 'new'
+    ? { kind, type: type || undefined, title, start: date && startTime ? `${date}T${startTime}` : '', end: endTime ?? '', repeat, repeatText,
+      rooms: unsure ? [] : rooms, roomsUnsure: unsure, people: count ? Number(count) : null, message, name, email, phone }
+    : { kind, event, date: eventDate || undefined, message: change, name, email, phone };
+  const local = requestProblems(input, o);
+  // the site's answer shows by its field until the next send
+  const problems: Partial<Record<RequestField, RequestProblem>> = tried ? { ...local, ...(send.field && send.problem ? { [send.field]: send.problem } : {}) } : {};
+  const invalid = tried && Object.keys(problems).length > 0;
+
+  // the live "looks free" line (needs bookings on the site): the first date's times as instants, since rooms/free needs a zone
+  const check = input.kind === 'new' && !local.start && !local.end && !unsure && rooms.length > 0 && site?.features.bookings === true;
+  const from = check ? siteInstant(input.start, tz) : null, to = check ? siteInstant(requestEnd(input.start, input.end), tz) : null;
+  const span = from && to ? `${from}|${to}` : '';
+  // asked once typing settles (30 checks a minute per address)
+  const checked = useDebounced(span, 400);
+
+  const submit = () => {
+    setTried(true);
+    if (Object.keys(local).length) return;
+    send.mutate(input, { onSuccess: () => { void contact.set({ name: name.trim(), email: email.trim(), phone: phone.trim() }); } });
+  };
+  const startOver = () => {
+    send.reset(); setTried(false);
+    setTitle(''); setType(''); setDate(''); setStarts(''); setEnds(''); setRepeat('once'); setRepeatText(''); setRooms([]); setUnsure(false);
+    setPeople(''); setMessage(''); setEvent(''); setEventDate(''); setChange('');
+  };
+
+  const screen = (children: ReactNode) => (
+    <KeyboardAvoidingView style={{ flex: 1, backgroundColor: t.colors.bg }} behavior={Platform.OS === 'ios' ? 'padding' : undefined}>
+      <Stack.Screen options={{ title: words.requestEvent }} />
+      <ScrollView keyboardShouldPersistTaps="handled" contentContainerStyle={{ padding: gutter, gap: 20, width: '100%', maxWidth: 640, alignSelf: 'center' }}>{children}</ScrollView>
+    </KeyboardAvoidingView>
+  );
+  const officePhone = o?.phone ?? '';
+  const phoneLink = (text: string) => (
+    <Pressable accessibilityRole="link" onPress={() => call(officePhone)} style={{ minHeight: 44, justifyContent: 'center' }}>
+      <Text style={t.styles.text.link}>{text}</Text>
+    </Pressable>
+  );
+
+  // ---- loading, off or closed, sent ----
+  if (!site || (site.features.requests && options.isPending && !options.off)) return screen(<ActivityIndicator style={{ marginTop: 32 }} color={t.colors.accent} />);
+  if (options.error && !options.off && !o) return screen(<ErrorView error={options.error} retry={() => void options.refetch()} />);
+  if (options.off || o?.open === false || send.problem === 'closed') return screen(
+    <View style={[t.styles.card, { gap: 8 }]}>
+      <Text accessibilityRole="header" style={t.styles.text.heading}>{words.requestClosed}</Text>
+      {!!officePhone && phoneLink(fill(words.requestCall, { phone: officePhone }))}
+    </View>,
+  );
+  if (send.data && send.variables) {
+    const sent = send.variables;
+    const eventTitle = sent.kind === 'change' ? o?.events.find((e) => e.slug === sent.event)?.title : undefined;
+    const lines = requestSummary(sent, words, { options: o, locale, eventTitle });
+    const to = sent.email.trim();
+    return screen(<>
+      <View style={{ gap: 8 }}>
+        <Text accessibilityRole="header" style={t.styles.text.display}>{words.requestSentTitle}</Text>
+        <Text style={t.styles.text.body}>{o?.replyTime ? fill(words.requestAnswerWithin, { time: o.replyTime, email: to }) : fill(words.requestAnswerBy, { email: to })}</Text>
+      </View>
+      <View style={[t.styles.card, { gap: 4 }]}>
+        <Text style={t.styles.text.label}>{words.requestYours}</Text>
+        {lines.map((line, i) => <Text key={i} style={i ? t.styles.text.muted : t.styles.text.heading}>{line}</Text>)}
+      </View>
+      <View style={{ gap: 4 }}>
+        <Text style={t.styles.text.muted}>{words.requestNotYet}</Text>
+        {!!officePhone && phoneLink(fill(words.requestSooner, { phone: officePhone }))}
+      </View>
+      <View style={{ gap: 10 }}>
+        <Button label={words.requestDone} onPress={() => { if (router.canGoBack()) router.back(); else startOver(); }} />
+        <Button label={words.requestAnother} variant="outline" onPress={startOver} />
+      </View>
+    </>);
+  }
+
+  // ---- the form ----
+  const radius = Math.min(t.radius, 10);
+  const field = { borderWidth: 1, borderColor: t.colors.line, borderRadius: radius, padding: 12, fontSize: 16, color: t.colors.ink, backgroundColor: t.colors.panel } as const;
+  const chip = (on: boolean) => ({ paddingVertical: 10, paddingHorizontal: 12, minHeight: 44, justifyContent: 'center' as const, borderRadius: radius, borderWidth: 1, borderColor: on ? t.colors.accent : t.colors.line, backgroundColor: on ? t.colors.soft : t.colors.panel });
+  const errorText = [t.styles.text.small, { color: t.colors.ink, fontWeight: '600' as const }];
+  const problem = (f: RequestField) => (problems[f] ? <Text style={errorText}>{requestProblemText(problems[f]!, words)}</Text> : null);
+  const label = (text: string, optional = false) => (
+    <Text style={t.styles.text.label}>{text}{optional ? <Text style={{ fontWeight: '400' }}> · {words.requestOptional}</Text> : null}</Text>
+  );
+  const text = (lbl: string, value: string, onChange: (v: string) => void, f: RequestField | null, x: { optional?: boolean; keyboard?: KeyboardTypeOptions; multiline?: boolean; auto?: 'name' | 'email' | 'tel'; placeholder?: string; onBlur?: () => void } = {}) => (
+    <View style={{ gap: 6 }}>
+      {label(lbl, x.optional)}
+      <TextInput value={value} onChangeText={onChange} onBlur={x.onBlur} keyboardType={x.keyboard} multiline={x.multiline} autoComplete={x.auto} placeholder={x.placeholder}
+        autoCapitalize={x.auto === 'email' ? 'none' : 'sentences'} autoCorrect={x.auto !== 'email'} placeholderTextColor={t.colors.muted}
+        accessibilityLabel={lbl} accessibilityHint={f && problems[f] ? requestProblemText(problems[f]!, words) : undefined}
+        style={[field, x.multiline && { minHeight: 96, textAlignVertical: 'top' }, !!f && !!problems[f] && { borderColor: t.colors.ink }]} />
+      {f && problem(f)}
+    </View>
+  );
+  const choices = <V extends string>(lbl: string, list: { value: V; label: string }[], isOn: (v: V) => boolean, toggle: (v: V) => void, many = false) => (
+    <View accessibilityRole={many ? undefined : 'radiogroup'} accessibilityLabel={lbl} style={{ flexDirection: 'row', flexWrap: 'wrap', gap: 8 }}>
+      {list.map((c) => (
+        <Pressable key={c.value} accessibilityRole={many ? 'checkbox' : 'radio'} accessibilityState={{ checked: isOn(c.value) }} onPress={() => toggle(c.value)} style={chip(isOn(c.value))}>
+          <Text style={[t.styles.text.body, isOn(c.value) && { fontWeight: '600' }]}>{c.label}</Text>
+        </Pressable>
+      ))}
+    </View>
+  );
+  // times show back in the app's format once typed ("18:30" → "6:30 PM")
+  const tidy = (raw: string, set: (v: string) => void) => () => { const v = parseClock(raw); if (v) set(formatClock(v, locale)); };
+  const today = localDay(new Date().toISOString(), tz);
+  // the change picker: the site's public events, each with its next dates (the site's days)
+  const choosable = o?.events ?? [];
+  const chosen = choosable.find((e) => e.slug === event);
+  const showDay = (d: string) => formatEventDate({ start: `${d}T00:00:00.000Z`, allDay: true }, locale);
+
+  return screen(<>
+    <Text style={t.styles.text.muted}>{o?.notice || words.requestNotice}</Text>
+    <View accessibilityRole="radiogroup" style={{ flexDirection: 'row', borderWidth: 1, borderColor: t.colors.line, borderRadius: radius, overflow: 'hidden' }}>
+      {(['new', 'change'] as const).map((k, i) => (
+        <Pressable key={k} accessibilityRole="radio" accessibilityState={{ checked: kind === k }} onPress={() => { setKind(k); setTried(false); if (send.error) send.reset(); }}
+          style={{ flex: 1, minHeight: 44, paddingHorizontal: 8, alignItems: 'center', justifyContent: 'center', backgroundColor: kind === k ? t.colors.soft : t.colors.panel, borderLeftWidth: i ? 1 : 0, borderLeftColor: t.colors.line }}>
+          <Text style={[t.styles.text.body, { textAlign: 'center' }, kind === k && { fontWeight: '600' }]}>{k === 'new' ? words.requestNew : words.requestChange}</Text>
+        </Pressable>
+      ))}
+    </View>
+
+    {kind === 'new' ? (<>
+      {text(words.requestWhat, title, setTitle, 'title')}
+      {!!o?.types.length && (
+        <View style={{ gap: 6 }}>
+          {label(words.requestKind)}
+          {choices(words.requestKind, o.types.map((x) => ({ value: x.id, label: x.label })), (v) => v === type, (v) => setType(v === type ? '' : v))}
+          {problem('type')}
+        </View>
+      )}
+      <View style={{ gap: 6 }}>
+        {label(words.requestDate)}
+        <DayPicker value={date} onChange={setDate} min={today} max={`${Number(today.slice(0, 4)) + 2}${today.slice(4)}`} />
+      </View>
+      {/* no time picker in the template: typed times, read forgivingly ("6:30 pm", "18:30", "18h30") */}
+      <View style={{ flexDirection: 'row', gap: 12 }}>
+        <View style={{ flex: 1 }}>{text(words.requestStarts, starts, setStarts, 'start', { keyboard: 'numbers-and-punctuation', placeholder: formatClock('18:00', locale), onBlur: tidy(starts, setStarts) })}</View>
+        <View style={{ flex: 1 }}>{text(words.requestEnds, ends, setEnds, 'end', { keyboard: 'numbers-and-punctuation', placeholder: formatClock('20:00', locale), onBlur: tidy(ends, setEnds) })}</View>
+      </View>
+      <View style={{ gap: 6 }}>
+        {label(words.requestRepeats)}
+        {choices<Repeat>(words.requestRepeats, [{ value: 'once', label: words.requestOnce }, { value: 'weekly', label: words.requestWeekly }, { value: 'other', label: words.requestRepeatOther }], (v) => v === repeat, setRepeat)}
+        {repeat === 'other' && (
+          <TextInput value={repeatText} onChangeText={setRepeatText} placeholder={words.requestRepeatHint} accessibilityLabel={words.requestRepeatHint} placeholderTextColor={t.colors.muted}
+            style={[field, !!problems.repeat && { borderColor: t.colors.ink }]} />
+        )}
+        {problem('repeat')}
+      </View>
+      {!!o?.rooms.length && (
+        <View style={{ gap: 6 }}>
+          {label(words.requestRoom)}
+          {/* rooms, or Not sure (not both) */}
+          {choices(words.requestRoom, [...o.rooms.map((r) => ({ value: r.slug, label: r.name })), { value: UNSURE, label: words.requestNotSure }],
+            (v) => (v === UNSURE ? unsure : !unsure && rooms.includes(v)),
+            (v) => { if (v === UNSURE) { setUnsure(!unsure); return; } setUnsure(false); setRooms(rooms.includes(v) ? rooms.filter((x) => x !== v) : [...rooms, v]); }, true)}
+          {problem('room')}
+          {!!checked && checked === span && rooms.map((slug) => (
+            <RoomLine key={slug} room={slug} name={o.rooms.find((r) => r.slug === slug)?.name ?? slug} start={checked.split('|')[0]} end={checked.split('|')[1]} />
+          ))}
+        </View>
+      )}
+      <View style={{ maxWidth: 200 }}>{text(words.requestPeople, people, (v) => setPeople(v.replace(/\D/g, '')), 'people', { optional: true, keyboard: 'number-pad' })}</View>
+      {text(words.requestMessage, message, setMessage, null, { optional: true, multiline: true })}
+    </>) : (<>
+      <View style={{ gap: 6 }}>
+        {label(words.requestWhichEvent)}
+        {!choosable.length ? <Text style={t.styles.text.muted}>{words.requestNoEvents}</Text> : (
+          <View accessibilityRole="radiogroup" accessibilityLabel={words.requestPickEvent} style={[t.styles.card, { paddingVertical: 4, paddingHorizontal: 0 }]}>
+            {choosable.map((e, i) => (
+              <Pressable key={e.slug} accessibilityRole="radio" accessibilityState={{ checked: e.slug === event }} onPress={() => { setEvent(e.slug); setEventDate(''); }}
+                style={{ flexDirection: 'row', alignItems: 'center', gap: 12, minHeight: 48, paddingHorizontal: 16, borderTopWidth: i ? 1 : 0, borderTopColor: t.colors.line, backgroundColor: e.slug === event ? t.colors.soft : undefined }}>
+                <Text style={[t.styles.text.body, { flex: 1 }, e.slug === event && { fontWeight: '600' }]}>{e.title}</Text>
+                {e.slug === event && <Text style={[t.styles.text.body, { color: t.colors.accent }]} importantForAccessibility="no" accessibilityElementsHidden>✓</Text>}
+              </Pressable>
+            ))}
+          </View>
+        )}
+        {problem('event')}
+      </View>
+      {!!chosen && (
+        <View style={{ gap: 6 }}>
+          {label(words.requestWhichDate)}
+          {choices(words.requestWhichDate, [{ value: '', label: words.requestEveryDate }, ...chosen.dates.slice(0, 12).map((d) => ({ value: d, label: showDay(d) }))], (v) => v === eventDate, setEventDate)}
+          {problem('date')}
+        </View>
+      )}
+      {text(words.requestWhatChange, change, setChange, 'what', { multiline: true })}
+    </>)}
+
+    <View style={{ gap: 12 }}>
+      <Text accessibilityRole="header" style={t.styles.text.heading}>{words.requestContact}</Text>
+      {text(words.requestName, name, setName, 'name', { auto: 'name' })}
+      {text(words.requestEmail, email, setEmail, 'email', { auto: 'email', keyboard: 'email-address' })}
+      {text(words.requestPhone, phone, setPhone, 'phone', { auto: 'tel', keyboard: 'phone-pad', optional: true })}
+      <Text style={t.styles.text.small}>
+        {words.requestContactWhy}
+        {!!site.legal.privacy && <> <Text accessibilityRole="link" style={[t.styles.text.small, { color: t.colors.accent, textDecorationLine: 'underline' }]} onPress={() => { Linking.openURL(site.legal.privacy!).catch(() => {}); }}>{words.requestPrivacy}</Text></>}
+      </Text>
+    </View>
+
+    {!!send.problem && !send.field && (
+      <View accessibilityRole="alert" style={{ backgroundColor: t.colors.soft, borderRadius: radius, padding: 12, gap: 4 }}>
+        <Text style={[t.styles.text.body, { fontWeight: '600' }]}>{requestProblemText(send.problem, words)}</Text>
+      </View>
+    )}
+    {invalid && <Text accessibilityRole="alert" style={errorText}>{words.requestCheck}</Text>}
+    <Button label={send.isPending ? words.sending : words.requestSend} disabled={send.isPending} onPress={submit} />
+  </>);
+}
+
+// "Hall looks free then." for one chosen room, over the first date's times (free or busy only, never what)
+function RoomLine({ room, name, start, end }: { room: string; name: string; start: string; end: string }) {
+  const t = useTheme();
+  const words = useStrings();
+  const free = useRoomFree({ room, start, end });
+  // nothing while it loads, or when the site can't say (an error, too many checks)
+  if (!free.data) return null;
+  return <Text style={t.styles.text.small}>{fill(free.data.free ? words.requestRoomFree : words.requestRoomTaken, { room: name })}</Text>;
+}