@acms-subir/core 0.3.55 → 0.3.56

package/mobile-template/recipes/event-request/files/components/DayPicker.tsx

@@ -0,0 +1,66 @@
+import { useState } from 'react';
+import { Pressable, Text, View } from 'react-native';
+import { useLocale, useTheme } from '@acms-subir/native';
+
+// One month to pick a day from (YYYY-MM-DD), with no native date picker to
+// install: ‹ › change the month, and days before `min` or after `max` can't
+// be picked. Days are plain calendar days (the site's, for requests), so
+// everything here is UTC and never shifts with the phone's time zone.
+const pad = (n: number) => String(n).padStart(2, '0');
+const iso = (y: number, m: number, d: number) => new Date(Date.UTC(y, m - 1, d)).toISOString().slice(0, 10);
+
+export function DayPicker({ value, onChange, min, max }: { value: string; onChange: (day: string) => void; min: string; max?: string }) {
+  const t = useTheme();
+  const { locale } = useLocale();
+  const [month, setMonth] = useState(() => (value || min).slice(0, 7));
+  const [y, m] = month.split('-').map(Number);
+  const f = (o: Intl.DateTimeFormatOptions) => {
+    try { return new Intl.DateTimeFormat(locale, { ...o, timeZone: 'UTC' }); } catch { return new Intl.DateTimeFormat(undefined, { ...o, timeZone: 'UTC' }); }
+  };
+  const monthName = f({ month: 'long', year: 'numeric' });
+  const at = (n: number) => new Date(Date.UTC(y, m - 1 + n, 1));
+  const shift = (n: number) => setMonth(`${at(n).getUTCFullYear()}-${pad(at(n).getUTCMonth() + 1)}`);
+  const earlier = month > min.slice(0, 7), later = !max || month < max.slice(0, 7);
+  const length = new Date(Date.UTC(y, m, 0)).getUTCDate();
+  // weeks start on Sunday
+  const cells = [...Array<string | null>(at(0).getUTCDay()).fill(null), ...Array.from({ length }, (_, i) => iso(y, m, i + 1))];
+  const weekday = f({ weekday: 'short' });
+  const fullDay = f({ weekday: 'long', month: 'long', day: 'numeric', year: 'numeric' });
+  const radius = Math.min(t.radius, 10);
+  const arrow = (n: number, on: boolean, glyph: string) => (
+    // read out as the month it goes to ("December 2026"), so it needs no words of its own
+    <Pressable accessibilityRole="button" accessibilityLabel={monthName.format(at(n))} accessibilityState={{ disabled: !on }} disabled={!on} onPress={() => shift(n)}
+      style={{ minWidth: 44, minHeight: 44, alignItems: 'center', justifyContent: 'center', opacity: on ? 1 : 0.3 }}>
+      <Text style={[t.styles.text.heading, { color: t.colors.accent }]}>{glyph}</Text>
+    </Pressable>
+  );
+  return (
+    <View style={[t.styles.card, { padding: 8, gap: 4 }]}>
+      <View style={{ flexDirection: 'row', alignItems: 'center' }}>
+        {arrow(-1, earlier, '‹')}
+        <Text accessibilityRole="header" style={[t.styles.text.body, { flex: 1, textAlign: 'center', fontWeight: '600' }]}>{monthName.format(at(0))}</Text>
+        {arrow(1, later, '›')}
+      </View>
+      <View style={{ flexDirection: 'row' }} importantForAccessibility="no-hide-descendants" accessibilityElementsHidden>
+        {/* 2026-01-04 was a Sunday */}
+        {Array.from({ length: 7 }, (_, i) => (
+          <Text key={i} style={[t.styles.text.small, { width: `${100 / 7}%`, textAlign: 'center' }]}>{weekday.format(new Date(Date.UTC(2026, 0, 4 + i)))}</Text>
+        ))}
+      </View>
+      <View style={{ flexDirection: 'row', flexWrap: 'wrap' }}>
+        {cells.map((d, i) => {
+          if (!d) return <View key={`_${i}`} style={{ width: `${100 / 7}%`, height: 44 }} />;
+          const off = d < min || (!!max && d > max), on = d === value;
+          return (
+            <Pressable key={d} accessibilityRole="button" accessibilityLabel={fullDay.format(new Date(`${d}T00:00:00Z`))} accessibilityState={{ selected: on, disabled: off }}
+              disabled={off} onPress={() => onChange(d)} style={{ width: `${100 / 7}%`, height: 44, padding: 2 }}>
+              <View style={{ flex: 1, alignItems: 'center', justifyContent: 'center', borderRadius: radius, backgroundColor: on ? t.colors.accent : undefined }}>
+                <Text style={[t.styles.text.body, { color: on ? t.colors.onAccent : off ? t.colors.line : t.colors.ink }, on && { fontWeight: '600' }]}>{Number(d.slice(8))}</Text>
+              </View>
+            </Pressable>
+          );
+        })}
+      </View>
+    </View>
+  );
+}

package/mobile-template/recipes/event-request/files/components/RequestEventLink.tsx

@@ -0,0 +1,19 @@
+import { Pressable, Text, type StyleProp, type ViewStyle } from 'react-native';
+import { Link } from 'expo-router';
+import { useStrings, useTheme } from '@acms-subir/native';
+
+// "Planning something? Request an event" for the end of the events list,
+// e.g. ListFooterComponent={<RequestEventLink />} in app/events/index.tsx.
+export function RequestEventLink({ style }: { style?: StyleProp<ViewStyle> }) {
+  const t = useTheme();
+  const words = useStrings();
+  return (
+    <Link href="/request" asChild>
+      <Pressable accessibilityRole="link" style={({ pressed }) => [{ minHeight: 44, paddingVertical: 16, justifyContent: 'center', opacity: pressed ? 0.7 : 1 }, style]}>
+        <Text style={[t.styles.text.muted, { textAlign: 'center' }]}>
+          {words.requestPlanning} <Text style={{ color: t.colors.accent, fontWeight: '600' }}>{words.requestEvent}</Text>
+        </Text>
+      </Pressable>
+    </Link>
+  );
+}

package/mobile-template/recipes/event-request/files/components/RequestEventRow.tsx

@@ -0,0 +1,20 @@
+import { Pressable, Text, type StyleProp, type ViewStyle } from 'react-native';
+import { Link } from 'expo-router';
+import { useStrings, useTheme } from '@acms-subir/native';
+
+// The More tab's row that opens /request: "Request an event" ("Solicitar un
+// evento"). Always shown, even while the site isn't taking requests: the
+// screen then says so and gives the office phone. Hiding it would hide a
+// feature from App Review, so don't wrap it in a check.
+export function RequestEventRow({ style }: { style?: StyleProp<ViewStyle> }) {
+  const t = useTheme();
+  const words = useStrings();
+  return (
+    <Link href="/request" asChild>
+      <Pressable accessibilityRole="button" style={({ pressed }) => [{ flexDirection: 'row', alignItems: 'center', gap: 12, minHeight: 52, paddingVertical: 12, opacity: pressed ? 0.7 : 1 }, style]}>
+        <Text style={[t.styles.text.body, { flex: 1 }]}>{words.requestEvent}</Text>
+        <Text style={[t.styles.text.heading, { color: t.colors.muted }]} importantForAccessibility="no" accessibilityElementsHidden>›</Text>
+      </Pressable>
+    </Link>
+  );
+}

package/mobile-template/recipes/event-request/recipe.json

@@ -0,0 +1,21 @@
+{
+  "kind": "client",
+  "title": "Event requests",
+  "description": "Request an event without an account: something new (what, kind, date and times, repeats, rooms with a live \"looks free\" line, people) or a change to an event, then name, email and phone, and Request sent with the reply time. When the site isn't taking requests the screen still opens and says so, with the office phone. Includes a row for the More tab and a link for the end of the events list. Needs requests turned on for the site.",
+  "packages": [
+    "expo-crypto",
+    "expo-secure-store"
+  ],
+  "routes": [
+    "/request"
+  ],
+  "next": [
+    "Turn requests on for the site: acms({ requests: true }) in astro.config.mjs (needs the calendar), then restart or deploy. Set the notice, reply time, office phone, kinds and the rooms people may ask for in Admin → Calendar → Requests; staff answer requests there",
+    "Add the row to your More tab: import { RequestEventRow } from '../../components/RequestEventRow' in app/(tabs)/more.tsx (or '../components/RequestEventRow' from a screen in app/) and render <RequestEventRow /> in its list. Keep it there even while requests are closed: the screen says so and gives the office phone, and App Review looks for it",
+    "Optional, at the end of the events list: ListFooterComponent={<RequestEventLink />} in app/events/index.tsx (from '../../components/RequestEventLink')",
+    "Open the screen from site links: in onNavigate, send '/request' (or your acms({ requests: { path } }); '/es/request' in Spanish) to router.push('/request')",
+    "The live \"looks free\" line under the rooms needs bookings on the site (it uses GET /api/v1/rooms/free, free or busy only); without them the screen works the same, without that line",
+    "App Store Connect → App Review Information → Notes: \"Request an event: open the More tab and tap Request an event. No sign-in is needed. The screen asks for a name, an email address, an optional phone number and details or a message about the event (something new, or a change to an existing event). Staff review every request on the website before anything goes on the calendar, and answer by email. If you send a test request, please write App Review in the message so staff can decline it.\"",
+    "App Privacy (App Store Connect) and Data safety (Google Play) for what the screen sends: Contact Info → Name, Email Address, Phone Number (Play: Personal info → Name, Email address, Phone number) and User Content → Other User Content (Play: App activity → Other user-generated content). Purpose: App Functionality; linked to the person; not used for tracking; not shared; optional (people choose to send it). Name, email and phone also stay on the phone in secure storage for next time"
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.55",
+  "version": "0.3.56",
   "publishConfig": {
     "access": "public"
   },

package/src/components/MobileApp.tsx

@@ -38,7 +38,7 @@ function ago(ms: number, now: number) {
     : d.toLocaleDateString([], { month: 'short', day: 'numeric', ...(d.getFullYear() !== new Date(now).getFullYear() ? { year: 'numeric' } : {}) });
 }
 
-const SOURCE: Record<PushNotification['source'], string> = { manual: 'Sent by', post: 'New post', event: 'New event', soon: 'Starting soon', live: 'We’re live', announcement: 'Announcement by', change: 'Event changed', test: 'Test by', form: 'New form response' };
+const SOURCE: Record<PushNotification['source'], string> = { manual: 'Sent by', post: 'New post', event: 'New event', soon: 'Starting soon', live: 'We’re live', announcement: 'Announcement by', change: 'Event changed', test: 'Test by', form: 'New form response', request: 'New event request' };
 
 export default function MobileApp() {
   const [state, setState] = useState<AdminPushState | null>(null);
@@ -462,7 +462,7 @@ function DeliveryLog({ log, topicLabel }: { log: PushNotification[]; topicLabel:
                     {n.body && <div className="ma-body">{n.body}</div>}
                     {n.url && <div className="t-sub ma-url">{n.url}</div>}
                   </td>
-                  <td data-l="Audience" className="ma-aud">{n.source === 'test' ? 'Their test phones' : n.source === 'form' ? 'Staff on the form’s alert list' : n.topics.map(topicLabel).join(', ')}</td>
+                  <td data-l="Audience" className="ma-aud">{n.source === 'test' ? 'Their test phones' : n.source === 'form' ? 'Staff on the form’s alert list' : n.source === 'request' ? 'Staff on the requests alert list' : n.topics.map(topicLabel).join(', ')}</td>
                   <td data-l="From">{SOURCE[n.source]}{(n.source === 'manual' || n.source === 'test') && n.author ? ` ${n.author}` : n.source === 'manual' || n.source === 'test' ? ' an owner' : ''}</td>
                   <td data-l="Delivered" className="num ma-result">
                     {n.status === 'sending' ? <span className="ma-st" data-tone="info">Sending…</span>

package/src/components/editor/event/SingleDates.tsx

@@ -28,12 +28,22 @@ export function SingleDates({ eventId, repeats }: { eventId: string; repeats: bo
   };
   useEffect(() => { if (eventId && repeats) void load(); }, [eventId, repeats, limit]);
 
-  if (!eventId || !repeats || !data || !data.dates.length) return null;
-
   const open = (d: DateRow) => {
     setNote(null);
     setForm({ key: d.key, day: datePart(d.start), endDay: datePart(d.end), from: timePart(d.start), to: timePart(d.end), roomIds: d.roomIds, note: d.moved?.note ?? '' });
   };
+  // ?move=<key> (approving a request to change one date, Calendar → Requests)
+  // opens that date's Move…, looking further ahead when it isn't in the first few
+  const [wanted, setWanted] = useState(() => (typeof location === 'undefined' ? '' : new URLSearchParams(location.search).get('move') ?? ''));
+  useEffect(() => {
+    if (!wanted || !data) return;
+    const d = data.dates.find((x) => x.key === wanted);
+    if (d) { open(d); setWanted(''); requestAnimationFrame(() => document.getElementById('ev-dates')?.scrollIntoView({ block: 'start' })); }
+    else if (limit < 52) setLimit(52);
+    else setWanted('');
+  }, [data, wanted]);
+
+  if (!eventId || !repeats || !data || !data.dates.length) return null;
   const run = async (key: string, work: () => Promise<{ error?: { message: string }; data?: object }>, done: string) => {
     setBusy(key);
     const r = await work();

package/src/layouts/Admin.astro

@@ -5,6 +5,7 @@ import { BRAND } from '../lib/brand';
 import { CONTENT } from '../lib/content';
 import { CALENDAR, bookingsEnabled } from '../lib/calendar/config';
 import { ANNOUNCEMENTS } from '../lib/announcements/config';
+import { REQUESTS } from '../lib/calendar/request-config';
 import { OWNER_ENV } from '../lib/auth';
 import { validateRequestSession } from '../lib/auth/request';
 import { accessFor } from '../lib/permissions/access';
@@ -36,6 +37,8 @@ const [pages, posts, links, home, settings, sessionUser] = await Promise.all([
 ]);
 // pending booking requests, shown as a count on the Bookings nav item
 const pendingBookings = CALENDAR.enabled ? (await repo.listBookings({ from: Date.now(), statuses: ['pending'], ...(!bookingsEnabled() ? { kinds: ['rsvp'] as const as ['rsvp'] } : {}) })).length : 0;
+// event requests waiting for staff (acms({ requests })): a count on Requests
+const pendingAsks = REQUESTS.enabled ? await repo.requests.count({ states: ['pending'] }) : 0;
 const me = {
   name: sessionUser?.name || 'Admin',
   role: roleLabel(sessionUserId === OWNER_ENV ? 'owner' : sessionUser?.role ?? 'editor'),
@@ -74,6 +77,7 @@ const icons: Record<string, string> = {
   user: 'M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8zM4 21a8 8 0 0 1 16 0',
   shield: 'M12 3l7 3v5c0 4.5-3 8.3-7 10-4-1.7-7-5.5-7-10V6zM9 12l2 2 4-4',
   calendar: 'M3 5.5h18v15H3zM3 10h18M8 3v4M16 3v4',
+  inbox: 'M3 13h5l1.5 3h5L16 13h5M5.5 5h13L21 13v6H3v-6z',
   calendars: 'M4 6h.01M4 12h.01M4 18h.01M8 6h12M8 12h12M8 18h12',
   bookings: 'M12 21a9 9 0 1 0 0-18 9 9 0 0 0 0 18zM12 7v5l3 2',
   resources: 'M3 21V9l9-5 9 5v12M9 21v-6h6v6',
@@ -130,6 +134,9 @@ const groups: { id: string; label: string; items: Item[] }[] = [
             : []),
           // TV screens: saved display links (lib/display), with private details behind their key
           ...(can('schedule.manage') ? [{ key: 'calendar:screens', label: 'Screens', href: '/admin/calendar/screens', icon: icons.monitor, count: null }] : []),
+          ...(REQUESTS.enabled && can('content.edit')
+            ? [{ key: 'calendar:requests', label: 'Requests', href: '/admin/calendar/requests', icon: icons.inbox, count: pendingAsks || null, attention: pendingAsks > 0 }]
+            : []),
         ],
       }]
     : []),

package/src/lib/calendar/request-admin.ts

@@ -0,0 +1,211 @@
+import type { ContentRepository } from '../repo/types';
+import { RequestSettings, slugify, type CalEvent, type RequestRecord, type Settings } from '../schema';
+import { ApiError } from '../api';
+import { validAddress } from '../email/config';
+import { extraLocales, localeName } from '../i18n';
+import { siteLocale } from '../dates';
+import { mergeEventDraft } from '../drafts';
+import { eventClashes } from '../booking/holds';
+import { featuredOccurrence, formatOccurrence } from './events';
+import { requestWhen } from './request-mail';
+import { requestClashes, requestSettings, type NewEventDetails } from './request-service';
+import { pendingRequests } from './requests';
+import { dateRequestClashes, dateRequestWhen } from './host-requests';
+import { MEMBERS } from './members-config';
+
+// Calendar → Requests (pages/admin/calendar/requests.astro): one list of
+// requests from the app, the website and hosts (rows of their own, plus
+// members' requests staged on events), each with what takes its rooms then,
+// and the settings form. Staff see who asked; the public never does.
+
+export type RequestTab = 'pending' | 'approved' | 'declined';
+
+export interface RequestRow {
+  /** 'r:<id>' for request rows, 'e:<eventId>' for members' requests on an event */
+  key: string;
+  /** the same as an HTML id ('r-<id>', 'e-<eventId>'): a request's id is the sender's key, so it can't share a namespace with event ids */
+  dom: string;
+  id: string;
+  kind: RequestRecord['kind'] | 'member-new' | 'member-changes';
+  /** "New event · from the app · 2h ago" */
+  head: string;
+  title: string;
+  line: string;
+  who: string;
+  /** where Reply goes ('' = nowhere to write) */
+  email: string;
+  note: string;
+  /** "Sanctuary is free then" / "Sanctuary on Wed, Dec 2: Advent rehearsal 4:30 – 6:00 PM" */
+  clash: { text: string; taken: boolean } | null;
+  /** staff's answer, for decided ones: "Approved by Ana · 2d ago" and their words */
+  answer: string;
+  reply: string;
+  /** the event it's about, or the draft it became */
+  href: string;
+  /** the version staff are looking at (the `seen` guard) */
+  at: number;
+  canReply: boolean;
+}
+
+const ago = (now: number, ts: number) => {
+  const s = Math.max(0, Math.floor((now - ts) / 1000));
+  if (s < 60) return 'just now';
+  if (s < 3600) return `${Math.floor(s / 60)}m ago`;
+  if (s < 86400) return `${Math.floor(s / 3600)}h ago`;
+  return `${Math.floor(s / 86400)}d ago`;
+};
+const SOURCE = { app: 'from the app', web: 'from the website', member: 'from a host' } as const;
+const KIND = { new: 'New event', change: 'Change', move: 'Move a date', 'from-date': 'Change from a date on' } as const;
+
+function fmt(settings: Settings) {
+  const tz = settings.timezone || 'UTC', locale = siteLocale(settings);
+  const f = (o: Intl.DateTimeFormatOptions) => {
+    try { return new Intl.DateTimeFormat(locale, { ...o, timeZone: tz }); }
+    catch { return new Intl.DateTimeFormat('en-US', { ...o, timeZone: 'UTC' }); }
+  };
+  const day = f({ weekday: 'short', month: 'short', day: 'numeric' });
+  const time = f({ hour: 'numeric', minute: '2-digit' });
+  return { locale, tz, slot: (s: number, e: number) => `${day.format(s)}: ${time.formatRange(s, e)}`, key: (k: string) => {
+    try { return new Intl.DateTimeFormat(locale, { weekday: 'short', month: 'short', day: 'numeric', timeZone: 'UTC' }).format(new Date(`${k.slice(0, 10)}T12:00:00Z`)); }
+    catch { return k.slice(0, 10); }
+  } };
+}
+
+export const ROWS_PER_PAGE = 50;
+
+/**
+ * One page of a tab (ROWS_PER_PAGE), newest answers first; pending ones oldest
+ * first (first come, first answered). `more`: there's a next page. Members'
+ * requests come on the first page.
+ */
+export async function requestRows(repo: ContentRepository, settings: Settings, tab: RequestTab, now = Date.now(), page = 1): Promise<{ rows: RequestRow[]; more: boolean }> {
+  const f = fmt(settings);
+  const [found, users, rooms, events] = await Promise.all([
+    repo.requests.list({ states: tab === 'pending' ? ['pending'] : [tab], order: tab === 'pending' ? 'oldest' : 'decided', limit: ROWS_PER_PAGE + 1, offset: (page - 1) * ROWS_PER_PAGE }),
+    repo.listUsers(), repo.listResources(), repo.listEvents(),
+  ]);
+  const userName = new Map(users.map((u) => [u.id, u.name || u.email]));
+  const roomName = new Map(rooms.map((r) => [r.id, r.name]));
+  const eventById = new Map(events.map((e) => [e.id, e]));
+  const types = requestSettings(settings).types;
+  const records = found.slice(0, ROWS_PER_PAGE);
+  const rows: (RequestRow & { sort: number })[] = [];
+  for (const q of records) {
+    const who = q.requester
+      ? [q.requester.name, q.requester.email, q.requester.phone, q.requester.locale ? localeName(q.requester.locale) : ''].filter(Boolean).join(' · ')
+      : userName.get(q.userId) ?? 'A member';
+    const e = q.eventId ? eventById.get(q.eventId) : undefined;
+    let title = '', line = '', clash: RequestRow['clash'] = null;
+    if (q.kind === 'new') {
+      const d = q.data as unknown as NewEventDetails;
+      const type = types.find((t) => t.id === d.type);
+      title = d.title;
+      line = [requestWhen(d.start, d.end, settings, f.locale), d.repeat === 'weekly' ? 'every week' : d.repeat === 'other' ? d.repeatText : '',
+        d.roomsUnsure ? 'room: not sure' : d.roomIds.map((id) => roomName.get(id) ?? 'a deleted room').join(', '),
+        d.people ? `about ${d.people} people` : '', type?.label ?? ''].filter(Boolean).join(' · ');
+      if (tab === 'pending' && d.roomIds.length) {
+        const found = await requestClashes(repo, q, settings, rooms);
+        const names = d.roomIds.map((id) => roomName.get(id)).filter(Boolean).join(' and ');
+        clash = found.length
+          ? { taken: true, text: `${found[0].room} on ${f.slot(found[0].start, found[0].end)}${found[0].title ? ` (${found[0].title})` : ''}${found.length > 1 ? ` and ${found.length - 1} more` : ''}` }
+          : { taken: false, text: `${names} ${d.roomIds.length > 1 ? 'are' : 'is'} free then` };
+      }
+    } else if (q.kind === 'move') {
+      title = e?.title ?? 'A deleted event';
+      line = await dateRequestWhen(repo, q);
+      if (tab === 'pending' && e) {
+        const found = await dateRequestClashes(repo, q);
+        clash = found.length
+          ? { taken: true, text: `${roomName.get(found[0].resourceId) ?? 'A room'} on ${f.slot(found[0].start, found[0].end)}${found[0].title ? ` (${found[0].title})` : ''}${found.length > 1 ? ` and ${found.length - 1} more` : ''}` }
+          : { taken: false, text: 'Its rooms are free then' };
+      }
+    } else {
+      title = e?.title ?? String(q.data.title ?? 'A deleted event');
+      line = q.key ? f.key(q.key) : 'every date';
+    }
+    const answer = q.state === 'pending' ? '' : `${q.state === 'approved' ? 'Approved' : q.state === 'declined' ? 'Declined' : 'Withdrawn'}${q.reviewedBy ? ` by ${userName.get(q.reviewedBy) ?? 'staff'}` : ''} · ${ago(now, q.reviewedAt || q.updatedAt)}`;
+    rows.push({
+      key: `r:${q.id}`, dom: `r-${q.id}`, id: q.id, kind: q.kind, head: `${KIND[q.kind]} · ${SOURCE[q.source]} · ${ago(now, q.createdAt)}`,
+      title, line, who, email: q.requester?.email ?? users.find((u) => u.id === q.userId)?.email ?? '', note: q.note, clash, answer, reply: q.reply,
+      href: q.eventId ? `/admin/calendar/events/${q.eventId}` : '', at: q.updatedAt, canReply: true, sort: q.state === 'pending' ? q.createdAt : q.reviewedAt,
+    });
+  }
+  // members' requests staged on their events (lib/calendar/requests.ts): waiting ones, and declined ones until the host dismisses them
+  if (tab !== 'approved' && MEMBERS.enabled && page === 1) {
+    const staged = tab === 'pending' ? await pendingRequests(repo) : events.filter((e) => e.request?.state === 'declined');
+    for (const e of staged) rows.push({ ...await memberRow(repo, e, settings, userName, now), sort: e.request!.at });
+  }
+  rows.sort((a, b) => (tab === 'pending' ? a.sort - b.sort : b.sort - a.sort));
+  return { rows: rows.map(({ sort: _, ...r }) => r), more: found.length > ROWS_PER_PAGE };
+}
+
+async function memberRow(repo: ContentRepository, e: CalEvent, settings: Settings, userName: Map<string, string>, now: number): Promise<RequestRow> {
+  const req = e.request!;
+  const shown = mergeEventDraft(e);
+  const o = featuredOccurrence(shown, settings, now);
+  const f = fmt(settings);
+  let clash: RequestRow['clash'] = null;
+  if (req.state === 'pending' && shown.roomHold.resourceIds.length) {
+    const { clashes } = await eventClashes(repo, settings, { ...shown, status: 'published' } as CalEvent, { now, horizonDays: 120 });
+    clash = clashes.length ? { taken: true, text: `${clashes.length} date${clashes.length === 1 ? '' : 's'} clash with other events (open it to see)` } : { taken: false, text: 'Its rooms are free then' };
+  }
+  return {
+    key: `e:${e.id}`, dom: `e-${e.id}`, id: e.id, kind: req.kind === 'new' ? 'member-new' : 'member-changes',
+    head: `${req.kind === 'new' ? 'New event' : 'Changes'} · from a host on My events · ${ago(now, req.at)}`,
+    title: shown.title || 'Untitled event', line: o ? `${formatOccurrence(o, f.tz, f.locale).date} · ${formatOccurrence(o, f.tz, f.locale).time}` : '',
+    who: userName.get(req.by) ?? 'A member', email: '', note: req.note, clash,
+    answer: req.state === 'declined' ? `Declined${req.reviewedBy ? ` by ${userName.get(req.reviewedBy) ?? 'staff'}` : ''} · ${ago(now, req.reviewedAt)}` : '',
+    reply: req.reply, href: `/admin/calendar/events/${e.id}`, at: req.at, canReply: false,
+  };
+}
+
+/** How many wait, for the tab's count: rows of their own plus members' requests. */
+export async function pendingCount(repo: ContentRepository): Promise<number> {
+  return (await repo.requests.count({ states: ['pending'] })) + (MEMBERS.enabled ? (await pendingRequests(repo)).length : 0);
+}
+
+const lines = (v: FormDataEntryValue | null) => String(v ?? '').split(/[\s,;]+/).map((x) => x.trim().toLowerCase()).filter(Boolean);
+const num = (v: FormDataEntryValue | null, fallback: number) => { const n = Number.parseInt(String(v ?? ''), 10); return Number.isFinite(n) ? n : fallback; };
+
+/**
+ * The settings form: types as rows (type-label-N, type-tag-N, type-cal-N and
+ * type-<locale>-N; a row without a label is dropped), the words in each
+ * language, the phone, who's told, the daily cap and how long answered
+ * requests are kept.
+ */
+export function settingsFromForm(data: FormData, current: RequestSettings, calendarIds: string[]): RequestSettings {
+  const types: RequestSettings['types'] = [];
+  // ids of the kinds already saved, so a new kind never takes one (renamed kinds keep theirs)
+  const keptIds = new Set(Array.from({ length: 12 }, (_, i) => String(data.get(`type-id-${i}`) ?? '')).filter(Boolean));
+  for (let i = 0; i < 12; i++) {
+    const label = String(data.get(`type-label-${i}`) ?? '').trim().slice(0, 60);
+    if (!label) continue;
+    if (types.some((t) => t.label.toLowerCase() === label.toLowerCase())) throw new ApiError(400, `Two kinds are called “${label}”. Give each kind its own name.`);
+    // a kind keeps its id when renamed (requests point at it); a new one gets a free id from its name
+    const kept = String(data.get(`type-id-${i}`) ?? '');
+    const base = slugify(label.normalize('NFKD').replace(/[\u0300-\u036f]/g, '')).slice(0, 36) || 'kind';
+    let id = kept && !types.some((t) => t.id === kept) ? kept : base;
+    for (let n = 2; types.some((t) => t.id === id) || (!kept && keptIds.has(id)); n++) id = `${base}-${n}`;
+    const cal = String(data.get(`type-cal-${i}`) ?? '');
+    types.push({ id, label, tag: String(data.get(`type-tag-${i}`) ?? '').trim().slice(0, 60), calendarId: calendarIds.includes(cal) ? cal : '',
+      translations: Object.fromEntries(extraLocales().map((l) => [l, String(data.get(`type-${l}-${i}`) ?? '').trim().slice(0, 60)]).filter(([, v]) => v)) });
+  }
+  const notify = lines(data.get('notify'));
+  const bad = notify.find((a) => !validAddress(a));
+  if (bad) throw new ApiError(400, `“${bad.slice(0, 80)}” isn’t an email address.`);
+  if (notify.length > 20) throw new ApiError(400, 'Add up to 20 addresses.');
+  const parsed = RequestSettings.safeParse({
+    open: data.get('open') === '1', types,
+    replyTime: String(data.get('replyTime') ?? '').trim(), notice: String(data.get('notice') ?? '').trim(),
+    translations: Object.fromEntries(extraLocales().map((l) => [l, { replyTime: String(data.get(`replyTime-${l}`) ?? '').trim(), notice: String(data.get(`notice-${l}`) ?? '').trim() }])),
+    phone: String(data.get('phone') ?? '').trim(), notify, phones: data.has('phones') ? data.getAll('phones').includes('1') : current.phones,
+    perDay: num(data.get('perDay'), current.perDay), keepDays: num(data.get('keepDays'), current.keepDays),
+  });
+  if (!parsed.success) {
+    const field = String(parsed.error.issues[0]?.path[0] ?? '');
+    const why: Record<string, string> = { replyTime: 'Keep the reply time under 60 characters.', notice: 'Keep the notice under 400 characters.', phone: 'Keep the phone number under 40 characters.',
+      perDay: 'Pick a daily limit from 0 to 10,000.', keepDays: 'Keep answered requests from 7 to 1,095 days.', translations: 'Keep each translation as short as the original.' };
+    throw new ApiError(400, why[field] ?? 'Check the request settings.');
+  }
+  return parsed.data;
+}

package/src/lib/calendar/request-config.ts

@@ -0,0 +1,8 @@
+import { userConfig } from 'virtual:acms-config';
+
+// acms({ requests }) config (integration.mjs resolves it): off unless a site
+// turns it on, and only with the calendar. `path` is the public form ('/request'
+// by default, '/es/request' in Spanish); `page: false` keeps the app API and
+// Calendar → Requests but drops that form, so a site can build its own.
+export const REQUESTS: { enabled: boolean; path: string; page: boolean } =
+  { enabled: false, path: '/request', page: true, ...userConfig.requests };

package/src/lib/calendar/request-mail.ts

@@ -0,0 +1,158 @@
+import type { ContentRepository } from '../repo/types';
+import type { RequestRecord, Settings } from '../schema';
+import type { Mail } from '../email/types';
+import { siteLang, siteLocale } from '../dates';
+import { I18N, localeName } from '../i18n';
+import { fill } from '../live/words';
+import { parseWall } from './events';
+import { zonedToUtc } from './ics';
+import { requestSettings, type NewEventDetails, type RequestMailPayload } from './request-service';
+import { requestStaffWords, requestStrings } from './request-words';
+
+// The emails about event requests (queued by lib/calendar/request-service.ts
+// as kind 'calendar-request') and the staff push. To the person: in the
+// language they asked in, and never with words they typed (their title or
+// message), so the form can't be used to email someone else a message; only
+// the date, time, kind, rooms and number of people, or the event's own title.
+// Staff get everything, in the site's main language, with Reply-To set to
+// the person. Plain HTML like the other emails, plus a text part.
+
+const esc = (s: string) => s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]!));
+const oneLine = (s: string) => s.replace(/\s+/g, ' ').trim();
+
+/** the site's main language, and the locale for its dates (keeping the site's region when it's the same language) */
+function language(settings: Settings, lang = '') {
+  const l = lang || (I18N.enabled && I18N.defaultLocale) || siteLang(settings);
+  const base = l.toLowerCase().split('-')[0];
+  return { lang: l, locale: base === siteLang(settings) ? siteLocale(settings) : l };
+}
+
+/** "Sat, Nov 7 · 2:00 – 5:00 PM" for site-local wall times, in a language */
+export function requestWhen(start: string, end: string, settings: Settings, locale: string): string {
+  const tz = settings.timezone || 'UTC';
+  const s = parseWall(start), e = parseWall(end);
+  if (!s || s.dateOnly) return start;
+  const at = (w: NonNullable<typeof s>) => zonedToUtc(w.y, w.m, w.d, w.hh, w.mm, 0, tz);
+  const f = (o: Intl.DateTimeFormatOptions) => {
+    try { return new Intl.DateTimeFormat(locale, { ...o, timeZone: tz }); }
+    catch { return new Intl.DateTimeFormat('en-US', { ...o, timeZone: 'UTC' }); }
+  };
+  const date = f({ weekday: 'short', month: 'short', day: 'numeric' }).format(at(s));
+  const time = f({ hour: 'numeric', minute: '2-digit' });
+  return `${date} · ${e && !e.dateOnly ? time.formatRange(at(s), at(e)) : time.format(at(s))}`;
+}
+
+/** a date (YYYY-MM-DD…) as "Sat, Nov 7" */
+function dayText(key: string, settings: Settings, locale: string) {
+  const w = parseWall(key.slice(0, 10));
+  if (!w) return key;
+  try { return new Intl.DateTimeFormat(locale, { weekday: 'short', month: 'short', day: 'numeric', timeZone: 'UTC' }).format(Date.UTC(w.y, w.m - 1, w.d)); }
+  catch { return key.slice(0, 10); }
+}
+
+interface Summary { what: string; lines: string[] }
+/** the request as the person may see it again: never their own words */
+async function personSummary(repo: ContentRepository, q: RequestRecord, settings: Settings, lang: string, locale: string): Promise<Summary> {
+  const w = requestStrings(lang);
+  if (q.kind === 'change') {
+    const e = q.eventId ? await repo.getEvent(q.eventId) : null;
+    const title = e?.title ?? String(q.data.title ?? '');
+    return { what: fill(w.changeTo, { title }), lines: [q.key ? dayText(q.key, settings, locale) : w.everyDate] };
+  }
+  if (q.kind !== 'new') return { what: '', lines: [] };
+  const d = q.data as unknown as NewEventDetails;
+  const rooms = await repo.listResources();
+  const type = requestSettings(settings).types.find((t) => t.id === d.type);
+  const parts = [
+    requestWhen(d.start, d.end, settings, locale),
+    ...(d.repeat === 'weekly' ? [w.weekly] : []),
+    d.roomIds.map((id) => rooms.find((r) => r.id === id)?.name).filter(Boolean).join(', '),
+    d.people ? fill(w.aboutPeople, { count: String(d.people) }) : '',
+    type ? (lang && type.translations[lang]) || type.label : '',
+  ].filter(Boolean);
+  return { what: '', lines: [parts.join(' · ')] };
+}
+
+function page(site: string, heading: string, paras: string[], quote: string, button?: { label: string; url: string }, foot = '') {
+  const box = quote ? `<p style="background:#efebe4;border-radius:8px;padding:10px 12px;white-space:pre-line">${esc(quote)}</p>` : '';
+  const btn = button ? `<p><a style="display:inline-block;background:#ee5d20;color:#fff;padding:10px 18px;border-radius:8px;text-decoration:none" href="${esc(button.url)}">${esc(button.label)}</a></p>` : '';
+  return `<!doctype html><html><body style="margin:0;background:#f6f5f2;color:#24211c;font:16px/1.6 system-ui,sans-serif"><div style="max-width:520px;margin:auto;padding:32px 24px"><p style="color:#7d776e">${esc(site)}</p><h1 style="font-size:22px">${esc(heading)}</h1>`
+    + paras.map((p) => `<p>${esc(p)}</p>`).join('') + box + btn + (foot ? `<p style="color:#7d776e;font-size:14px">${esc(foot)}</p>` : '') + '</div></body></html>';
+}
+
+/** One queued request email, or null when it no longer applies. */
+export async function requestMail(repo: ContentRepository, recipient: string, p: RequestMailPayload, origin: string): Promise<Mail | null> {
+  const q = await repo.requests.get(p.requestId);
+  if (!q) return null;
+  const settings = await repo.getSettings();
+  const site = settings.siteTitle;
+  if (p.kind === 'staff-new') {
+    // staff hear only about requests still waiting
+    if (q.state !== 'pending') return null;
+    return staffMail(repo, q, recipient, settings, origin);
+  }
+  const { lang, locale } = language(settings, q.requester?.locale);
+  const w = requestStrings(lang).mail;
+  const s = await personSummary(repo, q, settings, lang, locale);
+  const rq = requestSettings(settings);
+  const replyTime = (q.requester?.locale && rq.translations[q.requester.locale]?.replyTime) || rq.replyTime;
+  const change = q.kind === 'change';
+  const [subject, intro, quote] = p.kind === 'received' ? [w.receivedSubject, [w.received, ...(replyTime ? [fill(w.within, { time: replyTime })] : [])], '']
+    : p.kind === 'reply' ? [w.replySubject, [w.reply], p.message ?? '']
+    : p.kind === 'approved' ? [w.approvedSubject, [change ? w.approvedChange : w.approved], p.message ? `${w.fromTeam} ${p.message}` : '']
+    : [w.declinedSubject, [change ? w.declinedChange : w.declined], p.message ? `${w.fromTeam} ${p.message}` : ''];
+  const details = [s.what, ...s.lines].filter(Boolean);
+  const foot = p.kind === 'received' ? w.notYou : '';
+  return {
+    to: recipient, subject: `${subject} · ${site}`,
+    text: [subject, '', ...intro, '', ...details, ...(quote ? ['', quote] : []), ...(foot ? ['', foot] : [])].join('\n'),
+    html: page(site, subject, [...intro, details.join(' — ')], quote, undefined, foot),
+  };
+}
+
+async function staffMail(repo: ContentRepository, q: RequestRecord, to: string, settings: Settings, origin: string): Promise<Mail> {
+  const { lang, locale } = language(settings);
+  const w = requestStaffWords(lang);
+  const site = settings.siteTitle;
+  const user = q.userId ? await repo.getUser(q.userId) : null;
+  const who = q.requester ?? { name: user?.name ?? '', email: user?.email ?? '', phone: '', locale: '' };
+  const rows: [string, string][] = [];
+  let subject: string;
+  if (q.kind === 'new') {
+    const d = q.data as unknown as NewEventDetails;
+    const rooms = await repo.listResources();
+    const type = requestSettings(settings).types.find((t) => t.id === d.type);
+    subject = fill(w.subjectNew, { title: oneLine(d.title) });
+    rows.push([w.when, requestWhen(d.start, d.end, settings, locale)]);
+    if (d.repeat !== 'once') rows.push([w.repeats, d.repeat === 'weekly' ? requestStrings(lang).weekly : d.repeatText]);
+    rows.push([w.rooms, d.roomsUnsure ? w.roomsUnsure : d.roomIds.map((id) => rooms.find((r) => r.id === id)?.name ?? '').filter(Boolean).join(', ') || '—']);
+    if (d.people) rows.push([w.people, String(d.people)]);
+    if (type) rows.push([w.type, type.label]);
+  } else {
+    const e = q.eventId ? await repo.getEvent(q.eventId) : null;
+    const title = e?.title ?? String(q.data.title ?? '');
+    subject = fill(q.kind === 'change' ? w.subjectChange : w.subjectMove, { title: oneLine(title) });
+    rows.push([w.date, q.key ? dayText(q.key, settings, locale) : w.everyDate]);
+    const d = q.data as { start?: string; end?: string };
+    if (q.kind !== 'change' && d.start && d.end) rows.push([w.when, requestWhen(d.start, d.end, settings, locale)]);
+  }
+  rows.push([w.from, [who.name, who.email, who.phone].filter(Boolean).join(' · ')]);
+  if (who.locale) rows.push([w.language, localeName(who.locale, true)]);
+  const quote = q.note ? `${q.kind === 'change' ? w.whatChange : w.message}: “${q.note}”` : '';
+  const url = `${origin}/admin/calendar/requests#r-${q.id}`;
+  const intro = w.intro[q.source];
+  return {
+    to, subject: `${subject} · ${site}`, ...(who.email ? { replyTo: who.email } : {}),
+    text: [subject, '', intro, '', ...rows.map(([k, v]) => `${k}: ${v}`), ...(quote ? ['', quote] : []), '', `${w.open}: ${url}`, '', w.why].join('\n'),
+    html: page(site, subject, [intro, ...rows.map(([k, v]) => `${k}: ${v}`)], quote, { label: w.open, url }, w.why),
+  };
+}
+
+/** The staff push: that a request arrived and for when, nothing the person typed. */
+export async function requestPush(_repo: ContentRepository, q: RequestRecord, settings: Settings): Promise<{ title: string; body: string }> {
+  const { lang, locale } = language(settings);
+  const w = requestStaffWords(lang);
+  const d = q.data as { start?: string; end?: string };
+  const when = d.start && d.end ? requestWhen(d.start, d.end, settings, locale) : q.key ? dayText(q.key, settings, locale) : '';
+  return { title: w.pushTitle, body: when ? fill(w.pushBody, { when }) : '' };
+}