@acms-subir/core 0.3.59 → 0.3.60

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @acms-subir/core
 
+## 0.3.60
+
+### Patch Changes
+
+- 9e2d741: A follow-up for forms on sites in more than one language, and for staff reading time answers.
+
+  - **Times read the way your site writes them.** A time answer, stored as 24-hour `18:30`, now shows the way your site's locale writes times (Settings → Timezone & language): "6:30 PM" for en-US, "6:30 p.m." for es-MX, "18:30" for es-ES. You'll see this in Forms → Responses, the editor app's responses and the staff alert emails. For event registrations, it's in the hosts' "New RSVP" email and the registration's details in Bookings. CSV exports keep the stored `HH:mm`, just as they keep dates as `YYYY-MM-DD`, because spreadsheets sort and format that reliably. Nothing stored changes, and searching Responses still matches the stored text ("18:30").
+  - **Error messages in the visitor's language.** On `/es/forms/<id>`, and in Form blocks on Spanish pages, a missing or invalid answer now gets a Spanish message that names the question by the Spanish label the visitor saw ("Responde “Hora”."). The form's other refusals are in Spanish too: a form that changed, a post that's too large, too many submissions, "reload the form". Event pages word their RSVP form's errors the same way. Apps get these messages in the `locale` they send to `POST /api/v1/forms/{id}/responses` (also the 404 and 410 from `GET /api/v1/forms/{id}`), and for RSVP answers sent to `POST /api/v1/bookings` with a `locale`. Error codes and statuses don't change, so apps that check them keep working. Messages come in English, Spanish, French, German and Portuguese; other languages get English, and pages in the main language read as before.
+  - **Forms stored with their keys in another order take responses again.** Sometimes a form definition is written straight into the database or imported, with its JSON keys in a different order from the one the site uses. Every response to such a form failed with "This form changed. Reload and try again." Responses are now checked against the form by what it asks, not by how its JSON is written, so they go through. A form that's unpublished, archived or really changed between loading and sending still refuses the response.
+
+  There's no migration, and nothing to change after updating.
+
 ## 0.3.59
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.59",
+  "version": "0.3.60",
   "publishConfig": {
     "access": "public"
   },

package/src/lib/booking/service.ts

@@ -1,4 +1,4 @@
-import { collectResponse, displayAnswers } from '../forms/service';
+import { collectResponse, displayAnswers, staffAnswers } from '../forms/service';
 // Booking workflows shared by the public booking pages, the admin, the REST
 // API and agent tools, so every path validates, notifies and fires webhooks
 // the same way. Auto-confirm links confirm on the spot (and show on the
@@ -158,7 +158,8 @@ export async function bookingMail(repo: ContentRepository, b: Booking, kind: Boo
     position: await waitlistPosition(repo, b), hours: WAITLIST_HOLD / 3_600_000,
     until: b.holdUntil === null ? '' : untilText(b.holdUntil, d.tz, settings),
   } : undefined;
-  return bookingEmail(kind, { booking:b,resource:d.resource,link:d.link,title:d.title,location:d.location,when:d.when,
+  // staff read an RSVP's time answers as the site writes them ("6:30 PM"); Booking.answers keeps them as stored
+  return bookingEmail(kind, { booking:staff ? { ...b, answers: staffAnswers(b, siteLocale(settings)) } : b,resource:d.resource,link:d.link,title:d.title,location:d.location,when:d.when,
     manageUrl:mine ? origin + mine : staff ? adminBookingUrl(origin, b, kind) : origin + bookingManagePath({ manageToken: b.manageToken, locale: language.locale }),
     mineLink: !!mine,
     siteTitle:settings.siteTitle,host:new URL(origin).host,organizer:parseFrom(from)?.email,message:snapshot?.message,

package/src/lib/editor/site-data.ts

@@ -3,6 +3,7 @@ import type { Link } from '../schema';
 import { LinksAvatarShape, LinksAvatarFit, LinksAvatarScale, LinkKind } from '../schema';
 import { ApiError } from '../api';
 import { displayAnswers } from '../forms/service';
+import { siteLocale } from '../dates';
 import type { EditorContext } from './http';
 import { isAdmin, requireAdmin } from './roles';
 import { principalCan, requirePrincipal } from '../permissions/access';
@@ -35,13 +36,16 @@ export async function formResponsesFor(c: EditorContext, id: string, q: z.infer<
   await requirePrincipal(c.repo, c.who, 'forms.responses');
   const form = await c.repo.forms.get(id);
   if (!form || form.kind !== 'form') throw new ApiError(404, 'Form not found.');
-  const rows = await c.repo.forms.searchSubmissions(id, { q: q.q, since: q.since ? Date.parse(q.since) : undefined, limit: q.limit + 1, offset: (q.page - 1) * q.limit });
+  const [rows, settings] = await Promise.all([
+    c.repo.forms.searchSubmissions(id, { q: q.q, since: q.since ? Date.parse(q.since) : undefined, limit: q.limit + 1, offset: (q.page - 1) * q.limit }),
+    c.repo.getSettings(),
+  ]);
   return {
     form: { id: form.id, name: form.name },
     items: rows.slice(0, q.limit).map((s) => ({
       id: s.id, createdAt: iso(s.createdAt)!,
-      // labelled answers from the questions as they were when submitted
-      answers: Object.entries(displayAnswers(s.response)).map(([label, value]) => ({ label, value })),
+      // labelled answers from the questions as they were when submitted, times as the site writes them
+      answers: Object.entries(displayAnswers(s.response, siteLocale(settings))).map(([label, value]) => ({ label, value })),
     })),
     pagination: { page: q.page, limit: q.limit, nextPage: rows.length > q.limit ? q.page + 1 : null },
   };

package/src/lib/forms/alert-mail.ts

@@ -2,8 +2,9 @@
 // and its push: in the site's main language, like other staff emails. With
 // the answers, every question in order with its label; without them (forms
 // that ask for sensitive things), only that a response arrived and when, so
-// the email holds nothing about the person. Plain HTML like the staff
-// booking emails, plus a text part. Other languages fall back to English.
+// the email holds nothing about the person. Times read as the site writes
+// them ("6:30 PM" in en-US). Plain HTML like the staff booking emails, plus a
+// text part. Other languages fall back to English.
 import type { ContentRepository } from '../repo/types';
 import type { Settings } from '../schema';
 import type { Mail } from '../email/types';
@@ -12,6 +13,7 @@ import { siteLang, siteLocale } from '../dates';
 import { I18N } from '../i18n';
 import { fill } from '../live/words';
 import { answerFields, type FormField, type FormResponse } from './schema';
+import { timeText } from './service';
 
 /** alerts one form sends in a day (the site's); the last one says so */
 export const ALERTS_PER_DAY = 50;
@@ -64,9 +66,10 @@ function whenText(at: number, locale: string, tz: string, year: boolean) {
 // names can't break the subject line
 const oneLine = (s: string) => s.replace(/\s+/g, ' ').trim();
 
-function shown(f: FormField, value: string | undefined, w: AlertWords) {
+function shown(f: FormField, value: string | undefined, w: AlertWords, locale: string) {
   if (f.type === 'checkbox' || f.type === 'consent') return value === 'yes' ? w.yes : w.no;
   if (f.type === 'checkboxes') return value ? value.split('\n').join(', ') : '—';
+  if (f.type === 'time' && value) return timeText(value, locale);
   return value || '—';
 }
 /** the answer to the first email question, when it's a usable address (else '') */
@@ -94,7 +97,7 @@ export async function formAlertMail(repo: ContentRepository, to: string, p: Aler
   const name = oneLine(form.name);
   const heading = fill(w.subject, { form: name });
   const intro = fill(w.received, { when: whenText(s.createdAt, locale, settings.timezone, true) });
-  const rows: [string, string][] = answers ? answerFields(s.response.definition).map((f) => [f.label, shown(f, s.response.answers[f.id], w)]) : [];
+  const rows: [string, string][] = answers ? answerFields(s.response.definition).map((f) => [f.label, shown(f, s.response.answers[f.id], w, locale)]) : [];
   // replies reach the person only when the email shows their answers
   const replyTo = answers ? replyAddress(s.response) : '';
   const notes = [...(replyTo ? [fill(w.reply, { email: replyTo })] : []), ...(p.last ? [fill(w.last, { max: String(ALERTS_PER_DAY) })] : [])];

package/src/lib/forms/http.ts

@@ -1,29 +1,31 @@
-import { ApiError } from '../api';
 import { sha256Hex } from '../api-keys';
 import type { ContentRepository } from '../repo/types';
 import type { FormDefinition } from './schema';
 import { AnswerError, answersFrom } from './validate';
+import { refuse } from './service';
+// Refusals say why (service.ts refuse): the public form and event pages word
+// them in the visitor's language (formError); admin pages show the English.
 export function checkOrigin(request: Request) {
   const origin = request.headers.get('origin');
-  if ((origin && origin !== new URL(request.url).origin) || request.headers.get('sec-fetch-site') === 'cross-site') throw new ApiError(403, 'Please submit from this site.');
+  if ((origin && origin !== new URL(request.url).origin) || request.headers.get('sec-fetch-site') === 'cross-site') throw refuse(403, 'otherSite');
 }
 export async function readForm(request: Request): Promise<FormData> {
   checkOrigin(request);
   // Read the stream with an actual bound (Content-Length is not trustworthy).
   const reader = request.body?.getReader(); let length = 0; const chunks: Uint8Array[] = [];
-  if (reader) for (;;) { const { value, done } = await reader.read(); if (done) break; length += value.length; if (length > 100_000) { await reader.cancel(); throw new ApiError(413, 'This form is too large.'); } chunks.push(value); }
+  if (reader) for (;;) { const { value, done } = await reader.read(); if (done) break; length += value.length; if (length > 100_000) { await reader.cancel(); throw refuse(413, 'tooLarge'); } chunks.push(value); }
   const bytes = new Uint8Array(length); let at = 0; for (const c of chunks) { bytes.set(c, at); at += c.length; }
   try { return await new Response(bytes, { headers: { 'Content-Type': request.headers.get('content-type') || 'application/x-www-form-urlencoded' } }).formData(); }
-  catch { throw new ApiError(400, 'Could not read this form.'); }
+  catch { throw refuse(400, 'unreadable'); }
 }
 export function readAnswers(data: FormData, definition: FormDefinition) {
   try { return answersFrom(name => data.getAll(name), definition); }
-  catch (e) { if (e instanceof AnswerError) throw new ApiError(400, e.message); throw e; }
+  catch (e) { if (e instanceof AnswerError) throw refuse(400, e.reason, e.field); throw e; }
 }
 export async function submissionGuard(repo: ContentRepository, data: FormData, address: string, scope: string) {
-  if (data.get('website')) throw new ApiError(400, 'Could not submit this form.');
-  if (!await repo.email.rateLimit(`forms:${await sha256Hex(scope + ':' + address)}`, 20, 60_000)) throw new ApiError(429, 'Too many submissions. Please try again in a minute.');
+  if (data.get('website')) throw refuse(400, 'spam');
+  if (!await repo.email.rateLimit(`forms:${await sha256Hex(scope + ':' + address)}`, 20, 60_000)) throw refuse(429, 'tooFast');
   const key = String(data.get('requestId') ?? '');
-  if (!/^[a-f\d]{8}-[a-f\d]{4}-4[a-f\d]{3}-[89ab][a-f\d]{3}-[a-f\d]{12}$/i.test(key)) throw new ApiError(400, 'Reload the form and try again.');
+  if (!/^[a-f\d]{8}-[a-f\d]{4}-4[a-f\d]{3}-[89ab][a-f\d]{3}-[a-f\d]{12}$/i.test(key)) throw refuse(400, 'reload');
   return key;
 }

package/src/lib/forms/schema.ts

@@ -36,8 +36,8 @@ export const FormField = z.object({
   // Checkbox answers are stored newline-joined, so a choice is one line.
   options: z.array(z.string().trim().min(1).max(200).regex(/^[^\r\n]*$/, 'Each choice must be one line.')).max(50).default([]),
   // Newer props are optional (not defaulted) on purpose: parsing must not add
-  // keys to stored definitions, because form versions and the submission
-  // guard compare the exact JSON. Read them through the helpers below.
+  // keys to stored definitions, because form versions hash the exact JSON.
+  // Read them through the helpers below.
   placeholder: z.string().max(120).optional(),
   width: z.enum(['full', 'half']).optional(),
   allowOther: z.boolean().optional(),
@@ -86,6 +86,21 @@ export const SavedForm = z.object({
 export type SavedForm = z.infer<typeof SavedForm>;
 export const FormSubmission = z.object({ id: z.string(), formId: z.string(), response: FormResponse, createdAt: z.number() });
 export type FormSubmission = z.infer<typeof FormSubmission>;
+// JSON with every object's keys in one order (and undefined left out, as
+// JSON.stringify does), so the same data reads the same however it was written
+const sorted = (v: unknown): string => Array.isArray(v) ? `[${v.map((x) => (x === undefined ? 'null' : sorted(x))).join(',')}]`
+  : v && typeof v === 'object' ? `{${Object.keys(v).sort().filter((k) => (v as Record<string, unknown>)[k] !== undefined).map((k) => `${JSON.stringify(k)}:${sorted((v as Record<string, unknown>)[k])}`).join(',')}}`
+  : JSON.stringify(v) ?? 'null';
+const meaning = (schema: z.ZodTypeAny, v: unknown) => { const r = schema.safeParse(v); return sorted(r.success ? r.data : v); };
+/**
+ * Whether two definitions are the same form, by meaning rather than as
+ * written: both parsed (defaults filled in), keys in one order. One stored
+ * straight in the database or imported may order its keys differently from
+ * how the site writes it.
+ */
+export const sameDefinition = (a: unknown, b: unknown) => meaning(FormDefinition, a) === meaning(FormDefinition, b);
+/** The same for two responses (its definition, version and answers). */
+export const sameResponse = (a: unknown, b: unknown) => meaning(FormResponse, a) === meaning(FormResponse, b);
 const field = (id: string, label: string, type: FormField['type'], required = false, options: string[] = []): FormField => ({ id, label, type, required, help: '', options });
 export function starter(key: string): FormDefinition {
   const contact = key === 'contact', interest = key === 'interest';

package/src/lib/forms/service.ts

@@ -1,8 +1,34 @@
 import { ApiError } from '../api';
 import { sha256Hex } from '../api-keys';
-import { FormDefinition, answerFields, type FormResponse } from './schema';
+import type { Booking } from '../schema';
+import { isExtraLocale } from '../translations';
+import { FormDefinition, answerFields, type FormField, type FormResponse } from './schema';
 import { AnswerError, checkAnswer } from './validate';
-import { withoutWords } from './localize';
+import { localizeForm, withoutWords } from './localize';
+import { formErrorText, type FormErrorReason } from './words';
+
+/**
+ * A refusal the person sending a form reads (the web form, an event's RSVP
+ * questions, the app API): why, and the question when it's about one. The
+ * message is the English one; the page or app words it in the person's
+ * language with formError. Not `code`: the app API sends an ApiError's code
+ * as the error code, and these keep theirs (invalid_request, conflict…).
+ */
+export type FormRefusal = ApiError & { refusal: { reason: FormErrorReason; field?: Pick<FormField, 'id' | 'label'> } };
+export const refuse = (status: number, reason: FormErrorReason, field?: Pick<FormField, 'id' | 'label'>, retryAfter?: number): FormRefusal =>
+  Object.assign(new ApiError(status, formErrorText(reason, field?.label), retryAfter), { refusal: { reason, field: field && { id: field.id, label: field.label } } });
+const isRefusal = (e: unknown): e is FormRefusal => e instanceof ApiError && 'refusal' in e;
+/**
+ * A form's refusal in `lang` (the page's language, or the app's ?locale=),
+ * naming the question as `definition` reads in it: the label the person saw.
+ * Same status; anything else comes back as it is.
+ */
+export function formError<E>(e: E, lang: string | null | undefined, definition?: FormDefinition): E | FormRefusal {
+  if (!isRefusal(e)) return e;
+  const { refusal } = e, id = refusal.field?.id;
+  const shown = id && definition ? localizeForm(definition, isExtraLocale(lang) ? lang : '').fields.find((f) => f.id === id) : undefined;
+  return Object.assign(new ApiError(e.status, formErrorText(refusal.reason, shown?.label ?? refusal.field?.label, lang), e.retryAfter), { refusal });
+}
 
 // The version is the questions and their choices in each language, not the
 // other translated words: rewording a label, help or title doesn't change
@@ -15,17 +41,31 @@ export const formVersion = (definition: FormDefinition) => sha256Hex(JSON.string
 export async function collectResponse(definition: FormDefinition, input: Record<string, string>, version?: string): Promise<FormResponse> {
   definition = FormDefinition.parse(definition);
   const current = await formVersion(definition);
-  if (version !== undefined && version !== current) throw new ApiError(409, 'This form has changed. Review the updated questions and submit again.');
+  if (version !== undefined && version !== current) throw refuse(409, 'changed');
   const answers: Record<string, string> = Object.create(null);
-  if (Object.keys(input).length > 30) throw new ApiError(400, 'Too many answers.');
+  if (Object.keys(input).length > 30) throw refuse(400, 'tooManyAnswers');
   for (const f of answerFields(definition)) {
     try { answers[f.id] = checkAnswer(f, input[f.id] ?? ''); }
-    catch (e) { if (e instanceof AnswerError) throw new ApiError(400, e.message); throw e; }
+    catch (e) { if (e instanceof AnswerError) throw refuse(400, e.reason, e.field); throw e; }
   }
   return { version: current, definition, answers };
 }
+/**
+ * A stored time ("18:30") as `locale` writes times: "6:30 PM" in en-US,
+ * "6:30 p.m." in es-MX, "18:30" in es-ES. Without a locale (or for anything
+ * that isn't HH:mm) it stays as it is.
+ */
+export function timeText(value: string, locale?: string | null): string {
+  const m = /^(\d{2}):(\d{2})$/.exec(value);
+  if (!m || !locale) return value;
+  try { return new Intl.DateTimeFormat(locale, { hour: 'numeric', minute: '2-digit', timeZone: 'UTC' }).format(Date.UTC(2000, 0, 1, Number(m[1]), Number(m[2]))); }
+  catch { return value; }
+}
 // Labels are a compatibility view only; snapshots are the authoritative record.
-export function displayAnswers(response: FormResponse): Record<string, string> {
+// locale: staff screens and emails show times as the site writes them
+// (timeText); without one they stay as stored, as RSVPs keep them in
+// Booking.answers. Exports never pass one.
+export function displayAnswers(response: FormResponse, locale?: string): Record<string, string> {
   const out: Record<string, string> = Object.create(null);
   for (const f of answerFields(response.definition)) {
     const v = response.answers[f.id];
@@ -33,10 +73,13 @@ export function displayAnswers(response: FormResponse): Record<string, string> {
     let n = 0;
     while (Object.hasOwn(out, label)) label = `${f.label} (${f.id}${n++ ? `-${n}` : ''})`;
     out[label] = f.type === 'checkbox' || f.type === 'consent' ? v === 'yes' ? 'Yes' : 'No'
-      : f.type === 'checkboxes' ? (v ? v.split('\n').join(', ') : '—') : v || '—';
+      : f.type === 'checkboxes' ? (v ? v.split('\n').join(', ') : '—') : f.type === 'time' && v ? timeText(v, locale) : v || '—';
   }
   return out;
 }
+/** A booking's answers as staff read them: an RSVP form's with times in `locale` (displayAnswers), else the stored ones. */
+export const staffAnswers = (b: Pick<Booking, 'answers' | 'formResponse'>, locale: string) =>
+  b.formResponse ? displayAnswers(b.formResponse, locale) : b.answers;
 export function csv(rows: unknown[][]): string {
   return '\uFEFF' + rows.map(row => row.map(cell => {
     let s = String(cell ?? '');

package/src/lib/forms/store.ts

@@ -1,6 +1,7 @@
 import type { SqlDriver, SqlStatement } from '../repo/sql';
 import { ApiError } from '../api';
-import { FormAlerts, FormDefinition, FormResponse, FormSubmission, SavedForm } from './schema';
+import { FormAlerts, FormDefinition, FormResponse, FormSubmission, SavedForm, sameDefinition, sameResponse } from './schema';
+import { refuse } from './service';
 const row = (r: Record<string, unknown>) => SavedForm.parse({ ...r, definition: JSON.parse(String(r.definition)), draft: r.draft ? JSON.parse(String(r.draft)) : null, createdAt: r.created_at, updatedAt: r.updated_at, alerts: JSON.parse(String(r.alerts || '{}')) });
 const submission = (r: Record<string, unknown>) => FormSubmission.parse({ id: r.id, formId: r.form_id, response: JSON.parse(String(r.response)), createdAt: r.created_at });
 export const formInsert = (f: SavedForm): SqlStatement => ({ sql: 'INSERT INTO forms (id,name,kind,purpose,status,definition,draft,revision,created_at,updated_at,alerts) VALUES (?,?,?,?,?,?,?,?,?,?,?)', args: [f.id,f.name,f.kind,f.purpose,f.status,JSON.stringify(f.definition),f.draft ? JSON.stringify(f.draft) : null,f.revision,f.createdAt,f.updatedAt,JSON.stringify(f.alerts)] });
@@ -36,7 +37,7 @@ export class FormStore {
     const r = (await (await this.driver()).all('SELECT * FROM form_submissions WHERE id=? AND form_id=?', [id, formId]))[0];
     return r ? submission(r) : null;
   }
-  /** the response this request id already saved to this form, if any (as stored JSON) */
+  /** the response this request id already saved to this form, if any (as stored JSON; compare it with sameResponse) */
   async receipt(formId: string, requestId: string) {
     const r = (await (await this.driver()).all('SELECT response FROM form_submissions WHERE id=? AND form_id=?', [requestId, formId]))[0];
     return r ? String(r.response) : null;
@@ -51,11 +52,20 @@ export class FormStore {
     const db = await this.driver();
     // The receipt is also the unique request identity, so retries don't duplicate responses.
     const old = (await db.all('SELECT form_id,response FROM form_submissions WHERE id=?', [requestId]))[0];
-    if (old && (old.form_id !== formId || String(old.response) !== JSON.stringify(response))) throw new ApiError(409, 'This request was already submitted with different answers. Reload to send a new response.');
+    if (old && (old.form_id !== formId || !sameResponse(JSON.parse(String(old.response)), response))) throw refuse(409, 'resent');
     const at = Date.now();
-    if (!old) await db.batch([{ sql: 'INSERT OR IGNORE INTO form_submissions (id,form_id,response,created_at) SELECT ?,?,?,? WHERE EXISTS (SELECT 1 FROM forms WHERE id=? AND status=\'published\' AND kind=\'form\' AND purpose=\'general\' AND definition=?)', args: [requestId,formId,JSON.stringify(response),at,formId,JSON.stringify(response.definition)] }, ...(also?.(at) ?? [])]);
+    if (!old) {
+      // The form must still take responses and be the one they answered,
+      // compared by meaning: a definition written straight into the database
+      // or imported may order its keys differently. The insert then checks
+      // the stored text it just read, so a publish or archive in between
+      // still refuses it (a draft save leaves the live definition alone).
+      const live = (await db.all("SELECT definition FROM forms WHERE id=? AND status='published' AND kind='form' AND purpose='general'", [formId]))[0];
+      if (!live || !sameDefinition(JSON.parse(String(live.definition)), response.definition)) throw refuse(409, 'changedAtSave');
+      await db.batch([{ sql: 'INSERT OR IGNORE INTO form_submissions (id,form_id,response,created_at) SELECT ?,?,?,? WHERE EXISTS (SELECT 1 FROM forms WHERE id=? AND status=\'published\' AND kind=\'form\' AND purpose=\'general\' AND definition=?)', args: [requestId,formId,JSON.stringify(response),at,formId,String(live.definition)] }, ...(also?.(at) ?? [])]);
+    }
     const saved = (await db.all('SELECT form_id,response,created_at FROM form_submissions WHERE id=?', [requestId]))[0];
-    if (!saved || saved.form_id !== formId || String(saved.response) !== JSON.stringify(response)) throw new ApiError(409, 'This form changed. Reload and try again.');
+    if (!saved || saved.form_id !== formId || !sameResponse(JSON.parse(String(saved.response)), response)) throw refuse(409, 'changedAtSave');
     return !old && Number(saved.created_at) === at;
   }
   // Archived → draft (the definition is kept; publishing reopens it).

package/src/lib/forms/validate.ts

@@ -2,26 +2,32 @@
 // readAnswers) and the builder's preview. No server imports here.
 import { answerFields, hasOther, type FormDefinition, type FormField } from './schema';
 import { mainChoice } from './localize';
+import { formErrorText, type FormErrorReason } from './words';
 
 /** Value of the "Other" radio/checkbox; its text arrives as `o_<field id>`. */
 export const OTHER = '__other__';
-export class AnswerError extends Error {}
-const invalid = (f: FormField) => new AnswerError(`Please enter a valid answer for “${f.label}”.`);
+/** An answer refused: why, and the question. The message is the English one; pages and apps word it in the visitor's language (service.ts formError). */
+export class AnswerError extends Error {
+  constructor(public reason: Extract<FormErrorReason, 'required' | 'invalid' | 'tooLong' | 'badAnswer'>, public field: Pick<FormField, 'id' | 'label'>) {
+    super(formErrorText(reason, field.label));
+  }
+}
+const invalid = (f: FormField) => new AnswerError('invalid', f);
 
 /** Reads posted answers (`q_<id>`, plus `o_<id>` for "Other" text). Checkbox groups may post several values; they are stored newline-joined. */
 export function answersFrom(getAll: (name: string) => unknown[], definition: Pick<FormDefinition, 'fields'>): Record<string, string> {
   const answers: Record<string, string> = Object.create(null);
   for (const f of answerFields(definition)) {
     const values = getAll(`q_${f.id}`);
-    if (values.some(v => typeof v !== 'string')) throw new AnswerError('Invalid form answer.');
-    const other = () => { const o = getAll(`o_${f.id}`); if (o.length > 1 || o.some(v => typeof v !== 'string')) throw new AnswerError('Invalid form answer.'); return String(o[0] ?? '').trim(); };
+    if (values.some(v => typeof v !== 'string')) throw new AnswerError('badAnswer', f);
+    const other = () => { const o = getAll(`o_${f.id}`); if (o.length > 1 || o.some(v => typeof v !== 'string')) throw new AnswerError('badAnswer', f); return String(o[0] ?? '').trim(); };
     if (f.type === 'checkboxes') {
-      if (values.length > f.options.length + 1) throw new AnswerError('Invalid form answer.');
+      if (values.length > f.options.length + 1) throw new AnswerError('badAnswer', f);
       let list = values as string[];
       if (hasOther(f) && list.includes(OTHER)) { const text = other(); list = list.filter(v => v !== OTHER); if (text) list.push(text); }
       answers[f.id] = list.join('\n');
     } else {
-      if (values.length > 1) throw new AnswerError('Invalid form answer.');
+      if (values.length > 1) throw new AnswerError('badAnswer', f);
       const value = String(values[0] ?? '');
       answers[f.id] = f.type === 'radio' && hasOther(f) && value === OTHER ? other() : value;
     }
@@ -33,24 +39,24 @@ export function answersFrom(getAll: (name: string) => unknown[], definition: Pic
 const TIME = /^([01]?\d|2[0-3]):([0-5]\d)$/;
 
 /**
- * Validates one answer and returns its stored form. Throws AnswerError with a
- * visitor-facing message. A choice may come in any of the form's languages;
+ * Validates one answer and returns its stored form. Throws AnswerError (why,
+ * and the question). A choice may come in any of the form's languages;
  * it's stored as the main-language choice.
  */
 export function checkAnswer(f: FormField, raw: unknown): string {
-  if (typeof raw !== 'string' || raw.length > 2000) throw new AnswerError(`“${f.label}” is too long.`);
+  if (typeof raw !== 'string' || raw.length > 2000) throw new AnswerError('tooLong', f);
   if (f.type === 'heading') return '';
   if (f.type === 'checkboxes') {
     const items = raw.split('\n').map(s => s.trim()).filter(Boolean).map(s => mainChoice(f, s) ?? s);
     const extra = items.filter(i => !f.options.includes(i));
-    if (f.required && !items.length) throw new AnswerError(`Please answer “${f.label}”.`);
+    if (f.required && !items.length) throw new AnswerError('required', f);
     if (new Set(items).size !== items.length || extra.length > (hasOther(f) ? 1 : 0) || extra.some(e => e.length > 200)) throw invalid(f);
     // Store in the form's choice order, with "Other" text last.
     return [...f.options.filter(o => items.includes(o)), ...extra].join('\n');
   }
   let value = raw.trim();
   const agree = f.type === 'checkbox' || f.type === 'consent';
-  if (f.required && (!value || (agree && value !== 'yes'))) throw new AnswerError(`Please answer “${f.label}”.`);
+  if (f.required && (!value || (agree && value !== 'yes'))) throw new AnswerError('required', f);
   if (!value) return value;
   let valid = true;
   if (f.type === 'email') valid = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);

package/src/lib/forms/words.ts

@@ -1,10 +1,12 @@
 // The public form's own words, around the ones its author wrote: the button
 // and the thank-you when the form has none, the dropdown's empty choice,
-// "Other" with its text box, and "Send another response". In the page's
-// language (/forms/<id> and /es/forms/<id>, an event's RSVP questions); the
-// author's own words come from the form and its translations. {label}: the
-// question (live/words.ts `fill`). Other languages fall back to English.
+// "Other" with its text box, "Send another response", and why it refused
+// what was sent. In the page's language (/forms/<id> and /es/forms/<id>, an
+// event's RSVP questions) or the app's (?locale=); the author's own words
+// come from the form and its translations. {label}: the question
+// (live/words.ts `fill`). Other languages fall back to English.
 import { DEFAULT_THANKS } from './schema';
+import { fill } from '../live/words';
 
 export interface FormStrings {
   submit: string;
@@ -25,8 +27,64 @@ const STRINGS: Record<string, FormStrings> = {
   pt: { submit: 'Enviar', thanks: 'Obrigado. Recebemos sua resposta.', choose: 'Escolha…', other: 'Outro', typeAnswer: 'Digite sua resposta', otherAnswer: 'Outra resposta para {label}', sendAnother: 'Enviar outra resposta' },
 };
 
-export const formStrings = (locale: string | null | undefined): FormStrings =>
-  STRINGS[(locale || 'en').toLowerCase().split('-')[0]] ?? STRINGS.en;
+const base = (locale: string | null | undefined) => (locale || 'en').toLowerCase().split('-')[0];
+export const formStrings = (locale: string | null | undefined): FormStrings => STRINGS[base(locale)] ?? STRINGS.en;
 
 /** The form's thank-you, or the page's own words when it has none (or still has the default one). */
 export const thanksText = (confirmation: string, w: FormStrings) => (confirmation.trim() && confirmation !== DEFAULT_THANKS ? confirmation : w.thanks);
+
+/**
+ * Why a form refused what was sent: a question's answer (required, invalid,
+ * tooLong, badAnswer; validate.ts) or the whole submission (service.ts,
+ * http.ts, store.ts and the app API). The English words are the messages
+ * pages and apps always got.
+ */
+export type FormErrorReason = 'required' | 'invalid' | 'tooLong' | 'badAnswer' | 'tooManyAnswers' | 'changed' | 'changedAtSave' | 'resent'
+  | 'tooLarge' | 'unreadable' | 'otherSite' | 'spam' | 'tooFast' | 'reload' | 'saveFailed' | 'notFound' | 'closed' | 'appTooFast' | 'dayFull';
+
+const ERRORS: Record<string, Record<FormErrorReason, string>> = {
+  en: {
+    required: 'Please answer “{label}”.', invalid: 'Please enter a valid answer for “{label}”.', tooLong: '“{label}” is too long.', badAnswer: 'Invalid form answer.',
+    tooManyAnswers: 'Too many answers.', changed: 'This form has changed. Review the updated questions and submit again.', changedAtSave: 'This form changed. Reload and try again.',
+    resent: 'This request was already submitted with different answers. Reload to send a new response.', tooLarge: 'This form is too large.', unreadable: 'Could not read this form.',
+    otherSite: 'Please submit from this site.', spam: 'Could not submit this form.', tooFast: 'Too many submissions. Please try again in a minute.', reload: 'Reload the form and try again.',
+    saveFailed: 'Could not save your response. Please try again.', notFound: 'Form not found.', closed: 'This form is no longer accepting responses.',
+    appTooFast: 'Too many responses. Please try again in a minute.', dayFull: 'This form has had a lot of responses today. Please try again tomorrow.',
+  },
+  es: {
+    required: 'Responde “{label}”.', invalid: 'Escribe una respuesta válida para “{label}”.', tooLong: 'Tu respuesta a “{label}” es demasiado larga.', badAnswer: 'Una de las respuestas no es válida.',
+    tooManyAnswers: 'Hay demasiadas respuestas.', changed: 'Este formulario cambió. Revisa las preguntas actualizadas y vuelve a enviarlo.', changedAtSave: 'Este formulario cambió. Vuelve a cargarlo e inténtalo de nuevo.',
+    resent: 'Esta solicitud ya se envió con otras respuestas. Vuelve a cargar la página para enviar una respuesta nueva.', tooLarge: 'Este formulario es demasiado grande.', unreadable: 'No pudimos leer este formulario.',
+    otherSite: 'Envía el formulario desde este sitio.', spam: 'No se pudo enviar este formulario.', tooFast: 'Demasiados envíos. Vuelve a intentarlo en un minuto.', reload: 'Vuelve a cargar el formulario e inténtalo de nuevo.',
+    saveFailed: 'No pudimos guardar tu respuesta. Inténtalo de nuevo.', notFound: 'No encontramos este formulario.', closed: 'Este formulario ya no acepta respuestas.',
+    appTooFast: 'Demasiadas respuestas. Vuelve a intentarlo en un minuto.', dayFull: 'Este formulario recibió muchas respuestas hoy. Vuelve a intentarlo mañana.',
+  },
+  fr: {
+    required: 'Veuillez répondre à « {label} ».', invalid: 'Veuillez saisir une réponse valide pour « {label} ».', tooLong: 'Votre réponse à « {label} » est trop longue.', badAnswer: 'Une des réponses n’est pas valide.',
+    tooManyAnswers: 'Trop de réponses.', changed: 'Ce formulaire a changé. Vérifiez les questions mises à jour et renvoyez-le.', changedAtSave: 'Ce formulaire a changé. Rechargez-le et réessayez.',
+    resent: 'Cette demande a déjà été envoyée avec d’autres réponses. Rechargez la page pour envoyer une nouvelle réponse.', tooLarge: 'Ce formulaire est trop volumineux.', unreadable: 'Impossible de lire ce formulaire.',
+    otherSite: 'Veuillez envoyer le formulaire depuis ce site.', spam: 'Impossible d’envoyer ce formulaire.', tooFast: 'Trop d’envois. Réessayez dans une minute.', reload: 'Rechargez le formulaire et réessayez.',
+    saveFailed: 'Impossible d’enregistrer votre réponse. Veuillez réessayer.', notFound: 'Formulaire introuvable.', closed: 'Ce formulaire n’accepte plus de réponses.',
+    appTooFast: 'Trop de réponses. Réessayez dans une minute.', dayFull: 'Ce formulaire a reçu beaucoup de réponses aujourd’hui. Réessayez demain.',
+  },
+  de: {
+    required: 'Bitte beantworten Sie „{label}“.', invalid: 'Bitte geben Sie eine gültige Antwort für „{label}“ ein.', tooLong: 'Ihre Antwort auf „{label}“ ist zu lang.', badAnswer: 'Eine der Antworten ist ungültig.',
+    tooManyAnswers: 'Zu viele Antworten.', changed: 'Dieses Formular wurde geändert. Prüfen Sie die aktualisierten Fragen und senden Sie es erneut.', changedAtSave: 'Dieses Formular wurde geändert. Laden Sie es neu und versuchen Sie es noch einmal.',
+    resent: 'Diese Anfrage wurde bereits mit anderen Antworten gesendet. Laden Sie die Seite neu, um eine neue Antwort zu senden.', tooLarge: 'Dieses Formular ist zu groß.', unreadable: 'Dieses Formular konnte nicht gelesen werden.',
+    otherSite: 'Bitte senden Sie das Formular über diese Website.', spam: 'Dieses Formular konnte nicht gesendet werden.', tooFast: 'Zu viele Einsendungen. Bitte versuchen Sie es in einer Minute erneut.', reload: 'Laden Sie das Formular neu und versuchen Sie es noch einmal.',
+    saveFailed: 'Ihre Antwort konnte nicht gespeichert werden. Bitte versuchen Sie es erneut.', notFound: 'Formular nicht gefunden.', closed: 'Dieses Formular nimmt keine Antworten mehr an.',
+    appTooFast: 'Zu viele Antworten. Bitte versuchen Sie es in einer Minute erneut.', dayFull: 'Dieses Formular hat heute sehr viele Antworten erhalten. Bitte versuchen Sie es morgen erneut.',
+  },
+  pt: {
+    required: 'Responda “{label}”.', invalid: 'Digite uma resposta válida para “{label}”.', tooLong: 'Sua resposta a “{label}” é longa demais.', badAnswer: 'Uma das respostas não é válida.',
+    tooManyAnswers: 'Há respostas demais.', changed: 'Este formulário mudou. Revise as perguntas atualizadas e envie novamente.', changedAtSave: 'Este formulário mudou. Recarregue e tente novamente.',
+    resent: 'Este pedido já foi enviado com outras respostas. Recarregue a página para enviar uma nova resposta.', tooLarge: 'Este formulário é grande demais.', unreadable: 'Não foi possível ler este formulário.',
+    otherSite: 'Envie o formulário por este site.', spam: 'Não foi possível enviar este formulário.', tooFast: 'Envios demais. Tente novamente em um minuto.', reload: 'Recarregue o formulário e tente novamente.',
+    saveFailed: 'Não foi possível salvar sua resposta. Tente novamente.', notFound: 'Formulário não encontrado.', closed: 'Este formulário não aceita mais respostas.',
+    appTooFast: 'Respostas demais. Tente novamente em um minuto.', dayFull: 'Este formulário recebeu muitas respostas hoje. Tente novamente amanhã.',
+  },
+};
+
+/** A refusal in `locale` (English when it's none of these); label: the question as the person read it. */
+export const formErrorText = (reason: FormErrorReason, label = '', locale?: string | null) =>
+  fill((ERRORS[base(locale)] ?? ERRORS.en)[reason], { label });

package/src/lib/mobile/bookings.ts

@@ -1,6 +1,9 @@
 import { z } from 'zod';
 import type { ContentRepository } from '../repo/types';
 import type { Booking } from '../schema';
+import type { FormDefinition } from '../forms/schema';
+import { formError } from '../forms/service';
+import { siteLang } from '../dates';
 import { ApiError, readJson } from '../api';
 import { sha256Hex } from '../api-keys';
 import { siteOrigin } from '../seo';
@@ -55,6 +58,8 @@ export async function submitBooking(repo: ContentRepository, request: Request, l
   };
   const existing = await replay();
   if (existing) return existing;
+  // an RSVP's questions: their refusals name them as the app showed them, in its language
+  let definition: FormDefinition | undefined;
   try {
     const settings = await repo.getSettings();
     const flow = { origin: siteOrigin(settings, new URL(request.url)), locals, waitUntil: waitUntilFrom(locals), idempotency };
@@ -64,6 +69,7 @@ export async function submitBooking(repo: ContentRepository, request: Request, l
     if ('event' in body) {
       const occurrence = await rsvpOccurrence(repo, body.event, body.start);
       const { event } = occurrence;
+      definition = event.rsvp.form;
       if (body.seats > (event.rsvp.maxSeats || 1)) throw new ApiError(400, 'Too many seats for one RSVP.');
       // the app must have seen the current questions: a changed form then answers 409, as on the website
       // (closed dates fall through to createRsvp's own answer)
@@ -82,6 +88,6 @@ export async function submitBooking(repo: ContentRepository, request: Request, l
     // or delivery may have failed after commit. The ledger is authoritative.
     const existing = await replay();
     if (existing) return existing;
-    throw error;
+    throw formError(error, locale || siteLang(await repo.getSettings()), definition);
   }
 }

package/src/lib/mobile/forms.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import type { ContentRepository } from '../repo/types';
-import type { FormDefinition, SavedForm } from '../forms/schema';
-import { collectResponse, formVersion } from '../forms/service';
+import { sameDefinition, sameResponse, type FormDefinition, type SavedForm } from '../forms/schema';
+import { collectResponse, formError, formVersion, refuse } from '../forms/service';
 import { saveResponse } from '../forms/alerts';
 import { localizeForm } from '../forms/localize';
 import { formStrings, thanksText } from '../forms/words';
@@ -20,15 +20,17 @@ import type { PublicContext } from './route';
 // the web form (/forms/<id>), plus app limits: an Idempotency-Key per
 // response (retries never duplicate), 10 responses per address per form per
 // minute, and a per-form daily ceiling from Admin → Mobile app so one form
-// can't be flooded.
+// can't be flooded. Refusals a person reads come in the request's language
+// (?locale=, else the site's main one), naming a question as the app showed
+// it; their codes and statuses are the same in every language.
 
 const UUID4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
 async function publishedForm(repo: ContentRepository, id: string): Promise<SavedForm> {
   // ids are UUIDs; anything else can't be a form
   const form = id && id.length <= 100 ? await repo.forms.get(id) : null;
-  if (!form || form.kind !== 'form' || form.purpose !== 'general' || form.status === 'draft') throw new ApiError(404, 'Form not found.');
-  if (form.status === 'archived') throw new ApiError(410, 'This form is no longer accepting responses.');
+  if (!form || form.kind !== 'form' || form.purpose !== 'general' || form.status === 'draft') throw refuse(404, 'notFound');
+  if (form.status === 'archived') throw refuse(410, 'closed');
   return form;
 }
 
@@ -64,8 +66,9 @@ async function ownWords(repo: ContentRepository, locale: string | null) {
 
 export async function getForm(repo: ContentRepository, url: URL, id: string) {
   const locale = formLocale(url, true);
-  await requireAccess(repo, 'forms');
-  const form = await publishedForm(repo, id);
+  const settings = await requireAccess(repo, 'forms');
+  // "not found" and "no longer accepting responses" in the request's language too
+  const form = await publishedForm(repo, id).catch((e) => { throw formError(e, locale ?? siteLang(settings)); });
   const json = await formJson(form.definition, locale);
   const w = await ownWords(repo, locale);
   return { id: form.id, ...json, title: json.title || form.name, submitLabel: json.submitLabel || w.submit, confirmation: thanksText(json.confirmation, w) };
@@ -92,26 +95,29 @@ export async function submitFormResponse(c: PublicContext) {
   const key = c.request.headers.get('idempotency-key') ?? '';
   if (!UUID4.test(key)) throw new ApiError(400, 'Send a random UUID v4 in Idempotency-Key and reuse it only for retries.');
   const body = formResponseInput.parse(await readJson(c.request, 50_000));
-  if (body.website) throw new ApiError(400, 'Could not submit this form.');
-  const form = await publishedForm(c.repo, id);
-  if (!await c.repo.email.rateLimit(`forms:app:${await sha256Hex(`${form.id}:${c.address}`)}`, 10, 60_000)) throw new ApiError(429, 'Too many responses. Please try again in a minute.');
-  const answers = joinAnswers(body.answers);
-  // the key is the stored response id: a retry of a saved response answers
-  // as before and costs nothing (also after the form changed); the same key
-  // with different answers is a 409
-  const prior = await c.repo.forms.receipt(form.id, key.toLowerCase());
-  if (prior) {
-    const unchanged = JSON.stringify((JSON.parse(prior) as { definition: unknown }).definition) === JSON.stringify(form.definition);
-    if (unchanged && JSON.stringify(await collectResponse(form.definition, answers, body.version)) !== prior)
-      throw new ApiError(409, 'This request was already submitted with different answers. Reload to send a new response.');
+  let definition: FormDefinition | undefined;
+  try {
+    if (body.website) throw refuse(400, 'spam');
+    const form = await publishedForm(c.repo, id);
+    definition = form.definition;
+    if (!await c.repo.email.rateLimit(`forms:app:${await sha256Hex(`${form.id}:${c.address}`)}`, 10, 60_000)) throw refuse(429, 'appTooFast');
+    const answers = joinAnswers(body.answers);
+    // the key is the stored response id: a retry of a saved response answers
+    // as before and costs nothing (also after the form changed); the same key
+    // with different answers is a 409
+    const prior = await c.repo.forms.receipt(form.id, key.toLowerCase());
+    if (prior) {
+      const stored = JSON.parse(prior) as { definition: unknown };
+      if (sameDefinition(stored.definition, form.definition) && !sameResponse(await collectResponse(form.definition, answers, body.version), stored)) throw refuse(409, 'resent');
+      return receipt(c.repo, form, locale);
+    }
+    const response = await collectResponse(form.definition, answers, body.version);
+    // only valid new responses count toward the daily ceiling
+    const cap = settings.mobileAccess.responsesPerFormDay;
+    if (cap && !await c.repo.email.rateLimit(`forms:day:${form.id}`, cap, 86_400_000)) throw refuse(429, 'dayFull', undefined, 86_400);
+    await saveResponse(c.repo, form, response, key.toLowerCase(), { via: 'app', locals: c.locals });
     return receipt(c.repo, form, locale);
-  }
-  const response = await collectResponse(form.definition, answers, body.version);
-  // only valid new responses count toward the daily ceiling
-  const cap = settings.mobileAccess.responsesPerFormDay;
-  if (cap && !await c.repo.email.rateLimit(`forms:day:${form.id}`, cap, 86_400_000)) throw new ApiError(429, 'This form has had a lot of responses today. Please try again tomorrow.', 86_400);
-  await saveResponse(c.repo, form, response, key.toLowerCase(), { via: 'app', locals: c.locals });
-  return receipt(c.repo, form, locale);
+  } catch (e) { throw formError(e, locale ?? siteLang(settings), definition); }
 }
 // the thank-you in the app's language (?locale=), as the web form shows it
 async function receipt(repo: ContentRepository, form: SavedForm, locale: string | null) {

package/src/lib/mobile/openapi.ts

@@ -63,7 +63,7 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
     ['/announcements/{id}', 'One announcement that is up, in the requested language; requires announcements', localeOnlyQuery, ref('AnnouncementDetail')],
     ['/links', 'The links page: profile, socials and visible blocks in order (owner switch: links)', empty, ref('Links')],
     ['/live', 'Live video status: the current broadcast (or null), server time and the owner’s display choices; never cached; 404 while live video is off', empty, ref('LiveStatus'), false],
-    ['/forms/{id}', 'A published form’s questions, in the requested language (locale: its labels, help, choices, button and thank-you there; words it has no translation for stay in the main language; version is the same in every language); 410 when it stopped accepting responses (owner switch: forms)', localeOnlyQuery, ref('Form')],
+    ['/forms/{id}', 'A published form’s questions, in the requested language (locale: its labels, help, choices, button and thank-you there; words it has no translation for stay in the main language; version is the same in every language); 410 when it stopped accepting responses (the 404 and 410 messages in the requested language too; owner switch: forms)', localeOnlyQuery, ref('Form')],
     ['/openapi.json', 'OpenAPI 3.1 document (no v1 envelope)', empty, { type: 'object', required: ['openapi', 'info', 'paths', 'components'] }],
   ];
   for (const [path, summary, query, schema, cache = true] of reads) {
@@ -82,7 +82,7 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
   paths['/api/v1/bookings'] = {
     post: {
       summary: 'Create a guest booking or an RSVP, or replay an existing request; RSVPs require calendar, room bookings also bookings',
-      description: '20 attempts/minute/client address. JSON body up to 50,000 bytes. Responses use no-store. Reuse a random UUID v4 once per booking intent. Checkbox groups send a list of answers. An RSVP to an event with questions needs formVersion from GET /events/{slug}/rsvp; a changed form answers 409. An RSVP from an email that already has one for that date (a place on its waitlist too) answers 409 with code duplicate (and emails that RSVP’s link again); past the event’s RSVP deadline, 410. A full date answers 409, unless the event keeps a waitlist (RsvpStatus.waitlist.enabled) and the RSVP sends waitlist: true: then it takes a place in line (status waitlisted, no seats) and is emailed when a spot opens.',
+      description: '20 attempts/minute/client address. JSON body up to 50,000 bytes. Responses use no-store. Reuse a random UUID v4 once per booking intent. Checkbox groups send a list of answers. An RSVP to an event with questions needs formVersion from GET /events/{slug}/rsvp; a changed form answers 409. Refused answers (a required question, an invalid answer, a changed form) carry their message in the body’s locale, naming the question as GET /events/{slug}/rsvp showed it; codes and statuses don’t change. An RSVP from an email that already has one for that date (a place on its waitlist too) answers 409 with code duplicate (and emails that RSVP’s link again); past the event’s RSVP deadline, 410. A full date answers 409, unless the event keeps a waitlist (RsvpStatus.waitlist.enabled) and the RSVP sends waitlist: true: then it takes a place in line (status waitlisted, no seats) and is emailed when a spot opens.',
       parameters: [{ name: 'Idempotency-Key', in: 'header', required: true, schema: { type: 'string', format: 'uuid', pattern: '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$' } }],
       requestBody: { required: true, content: media(jsonSchema(bookingInput)) },
       responses: { ...errors,
@@ -116,7 +116,7 @@ export async function getOpenApi(_repo: ContentRepository, url: URL) {
   paths['/api/v1/bookings/manage/ics'] = { get: { summary: 'Calendar file for the booking (text/calendar, no v1 envelope)', parameters: [bookingToken],
     responses: { ...errors, 200: { description: 'An iCalendar file.', content: { 'text/calendar': { schema: { type: 'string' } } } } } }, ...cors };
   paths['/api/v1/forms/{id}/responses'] = { post: { ...priv('Send a response to a published form', ref('FormReceipt'), { body: formResponseInput, write: true, status: 201,
-    description: 'Same validation as the web form. Idempotency-Key (UUID v4) is the response id: retries never duplicate. 10 responses per address per form per minute, plus the owner’s daily ceiling per form (429). version from GET /forms/{id}: a changed form answers 409 (a translation alone doesn’t change it). A choice may be sent as shown in the requested language or in the main one; it is stored as the main-language choice. A time answer is HH:mm (24-hour). locale: the confirmation in that language (one the site doesn’t have gets the main language’s). Leave website empty (spam trap).' }),
+    description: 'Same validation as the web form. Idempotency-Key (UUID v4) is the response id: retries never duplicate. 10 responses per address per form per minute, plus the owner’s daily ceiling per form (429). version from GET /forms/{id}: a changed form answers 409 (a translation alone doesn’t change it). A choice may be sent as shown in the requested language or in the main one; it is stored as the main-language choice. A time answer is HH:mm (24-hour). locale: the confirmation, and the message of a refusal a person reads (a missing or invalid answer naming the question as shown in that language, a changed form, the limits), in that language; one the site doesn’t have gets the main language’s. Error codes and statuses are the same in every language. Leave website empty (spam trap).' }),
     parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }, { name: 'locale', in: 'query', required: false, schema: { type: 'string', minLength: 1, maxLength: 35 } }, { name: 'Idempotency-Key', in: 'header', required: true, schema: { type: 'string', format: 'uuid' } }] }, ...cors };
   const requestNote = 'Requires acms({ requests }) (site.features.requests); 404 when off. No account.';
   paths['/api/v1/requests/options'] = { get: priv('What the event request form offers: open or closed, the types, requestable rooms and changeable events (with their dates), the site’s reply time and notice (in the requested language) and its phone', ref('RequestOptions'), { query: requestOptionsQuery,

package/src/pages/admin/calendar/bookings.astro

@@ -1,5 +1,5 @@
 ---
-import { csv } from '../../../lib/forms/service';
+import { csv, staffAnswers } from '../../../lib/forms/service';
 import { readForm } from '../../../lib/forms/http';
 import Admin from '../../../layouts/Admin.astro';
 import BookingsHead from '../../../components/calendar/BookingsHead.astro';
@@ -16,6 +16,7 @@ import { emailReadiness } from '../../../lib/email/readiness';
 import { siteOrigin } from '../../../lib/seo';
 import { waitUntilFrom } from '../../../lib/webhooks';
 import { forbiddenUnless } from '../../../lib/permissions/access';
+import { siteLocale } from '../../../lib/dates';
 
 // Bookings (mockup I): Cal.com-style tabs, an agenda by day with pending
 // requests first, a Day view with one column per resource, a details panel
@@ -366,7 +367,7 @@ const activeLinks = links.filter((l) => l.active && resById.has(l.resourceId));
               {b.seats > 1 && <div><dt>Seats</dt><dd>{b.seats}</dd></div>}
               {b.status === 'waitlisted' && <div><dt>Waitlist</dt><dd>#{placeOf(b)} in line</dd></div>}
               {b.status === 'offered' && <div><dt>Spot held</dt><dd>Until {heldUntil(b)} · they confirm it from their email</dd></div>}
-              {Object.entries(b.answers).map(([k, v]) => <div><dt>{k}</dt><dd>{v}</dd></div>)}
+              {Object.entries(staffAnswers(b, siteLocale(settings))).map(([k, v]) => <div><dt>{k}</dt><dd>{v}</dd></div>)}
               <div><dt>Booked</dt><dd>{f.day.format(b.createdAt)} · {SOURCES[b.source] ?? b.source}</dd></div>
             </dl>
             <form method="post" class="bk-notes">

package/src/pages/admin/forms/[id]/submissions.astro

@@ -9,6 +9,7 @@ import { answerFields, relativeTime, versionLabeler, wideRows } from '../../../.
 import type { FormSubmission } from '../../../../lib/forms/schema';
 import '../../../../styles/forms-admin.css';
 import { forbiddenUnless } from '../../../../lib/permissions/access';
+import { siteLocale } from '../../../../lib/dates';
 
 const repo = await getRepo(Astro.locals);
 { const denied = await forbiddenUnless(Astro.request, Astro.cookies, repo, 'forms.responses'); if (denied) return denied; }
@@ -67,9 +68,11 @@ const shortWhen = (ts: number) => {
   return fmt(ts, { month: 'short', day: 'numeric', ...(new Date(ts).getFullYear() !== new Date().getFullYear() ? { year: 'numeric' } : {}) });
 };
 // displayAnswers owns per-type formatting; call it on subsets of the snapshot.
+// Times read as the site writes them ("6:30 PM"); the CSV keeps them as stored.
+const locale = siteLocale(settings);
 const show = (r: FormSubmission, keep: (id: string) => boolean) => {
   const fields = answerFields(r.response.definition.fields).filter(f => keep(f.id));
-  return fields.length ? Object.entries(displayAnswers({ ...r.response, definition: { ...r.response.definition, fields } })) : [];
+  return fields.length ? Object.entries(displayAnswers({ ...r.response, definition: { ...r.response.definition, fields } }, locale)) : [];
 };
 const data: ResponseRow[] = rows.slice(0, 100).map(r => ({
   id: r.id,

package/src/pages/events/[slug].astro

@@ -1,7 +1,7 @@
 ---
 import { ApiError } from '../../lib/api';
 import { starter } from '../../lib/forms/schema';
-import { formVersion } from '../../lib/forms/service';
+import { formError, formVersion } from '../../lib/forms/service';
 import { renderFields, hiddenFields } from '../../lib/forms/render';
 import { localizeForm } from '../../lib/forms/localize';
 import { formStrings } from '../../lib/forms/words';
@@ -50,7 +50,9 @@ const occurrence = featuredOccurrence(event, settings, now, on && /^\d{4}-\d{2}-
 if (!occurrence) return new Response(null, { status: 404, statusText: 'Not found' });
 const origin = siteOrigin(settings, Astro.url);
 // RSVP: "Save my seat" posts back here and lands on the manage page, in the
-// visitor's language (its emails speak it too)
+// visitor's language (its emails speak it too, and the form's errors name its
+// questions as the page shows them)
+const lang = (I18N.enabled ? locale : '') || siteLang(settings);
 let rsvpError = '';
 let rsvpDuplicate = false;
 let formValues: Record<string,string> = {};
@@ -69,15 +71,15 @@ if (Astro.request.method === 'POST' && event.rsvp.enabled) {
     const booking = await submitEventForm(repo, event, occurrence, form, requestId, { origin, locals: Astro.locals, waitUntil: waitUntilFrom(Astro.locals) }, locale);
     return Astro.redirect(`${localePath(manageUrl(booking.manageToken), locale)}?new=1`, 303);
   } catch (err) {
-    const w = rsvpStrings((I18N.enabled ? locale : '') || siteLang(settings));
+    const w = rsvpStrings(lang);
     // the address already has one: a notice in the page's words (templates that don't know it show it as the error)
     rsvpDuplicate = err instanceof BookingError && err.code === 'duplicate';
-    rsvpError = rsvpDuplicate ? `${w.duplicate} ${w.duplicateNote}` : err instanceof BookingError || err instanceof ApiError ? err.message : w.saveError;
+    rsvpError = rsvpDuplicate ? `${w.duplicate} ${w.duplicateNote}` : err instanceof BookingError || err instanceof ApiError ? formError(err, lang, definition).message : w.saveError;
   }
 }
 const formHtml = hiddenFields(await formVersion(definition), requestId) + `<input type="hidden" name="occurrence" value="${occurrence.start}">`;
 // the questions in the page's language (main-language words where the form has none)
-const fieldsHtml = renderFields(localizeForm(definition, isExtraLocale(locale) ? locale : ''), formValues, 'event-registration', formStrings((I18N.enabled ? locale : '') || siteLang(settings)));
+const fieldsHtml = renderFields(localizeForm(definition, isExtraLocale(locale) ? locale : ''), formValues, 'event-registration', formStrings(lang));
 const taken = event.rsvp.enabled ? await seatsTaken(repo, event.id, occurrence.start) : 0;
 // the event's RSVP deadline for this date (null: open until it ends)
 const closesAt = event.rsvp.enabled ? rsvpDeadline(occurrence, settings) : null;

package/src/pages/forms/[id].astro

@@ -2,11 +2,12 @@
 import Site from '../../layouts/Site.astro';
 import { getRepo } from '../../lib/repo';
 import { renderForm } from '../../lib/forms/render';
-import { collectResponse } from '../../lib/forms/service';
+import { collectResponse, formError } from '../../lib/forms/service';
 import { readForm, readAnswers, submissionGuard } from '../../lib/forms/http';
 import { saveResponse } from '../../lib/forms/alerts';
 import { localizeForm } from '../../lib/forms/localize';
-import { formStrings, thanksText } from '../../lib/forms/words';
+import { formErrorText, formStrings, thanksText } from '../../lib/forms/words';
+import { sameDefinition } from '../../lib/forms/schema';
 import { ApiError } from '../../lib/api';
 import { I18N, localePath, requestLocale } from '../../lib/i18n';
 import { isExtraLocale } from '../../lib/translations';
@@ -17,7 +18,8 @@ if (!form || form.status !== 'published' || form.kind !== 'form' || form.purpose
 Astro.response.headers.set('Cache-Control', 'private, no-store');
 const embed = Astro.url.searchParams.has('embed');
 // /es/forms/<id>: the form's Spanish words (main-language ones where it has
-// none) and the page's own words in Spanish; answers are stored the same
+// none) and the page's own words in Spanish, its errors too (naming the
+// question as the page shows it); answers are stored the same
 const locale = requestLocale(Astro.url, Astro.locals);
 const formLocale = isExtraLocale(locale) ? locale : '';
 const lang = (I18N.enabled ? locale : '') || siteLang(await repo.getSettings());
@@ -33,12 +35,12 @@ if (Astro.request.method === 'POST') {
     // a resubmit of a saved response (refresh, double click) thanks them again,
     // also after the form changed since; the same id with other answers is a 409
     const prior = await repo.forms.receipt(form.id, requestId);
-    if (!prior || JSON.stringify((JSON.parse(prior) as { definition: unknown }).definition) === JSON.stringify(form.definition)) {
+    if (!prior || sameDefinition((JSON.parse(prior) as { definition: unknown }).definition, form.definition)) {
       const response = await collectResponse(form.definition, values, prior ? undefined : String(data.get('formVersion') || ''));
       await saveResponse(repo, form, response, requestId, { via: 'web', locals: Astro.locals });
     }
     success = true;
-  } catch (e) { error = e instanceof ApiError ? e.message : 'Could not save your response. Please try again.'; Astro.response.status = e instanceof ApiError ? e.status : 500; }
+  } catch (e) { error = e instanceof ApiError ? formError(e, lang, form.definition).message : formErrorText('saveFailed', '', lang); Astro.response.status = e instanceof ApiError ? e.status : 500; }
 }
 const w = formStrings(lang);
 const html = success ? '' : await renderForm(form.id, form.definition, values, error, requestId, embed, { locale: formLocale, lang, action: path });