domma-cms 0.102.0 → 0.103.0

package/plugins/booking/admin/views/settings.js

@@ -0,0 +1,203 @@
+/**
+ * Booking settings - the banner cog's slideover: the booking page, what
+ * customers may change themselves, emails, links to other Tools, and the days
+ * the whole business is closed. Each field explained in place; the server's
+ * per-field messages shown beside the field.
+ */
+
+import {api, copy, errText, esc, openPanel, store} from '../lib/kit.js';
+import {isDate} from '/plugins/booking/public/lib/time.js';
+
+const SECTIONS = [
+    {key: 'page', label: 'Booking page', icon: 'globe'},
+    {key: 'changes', label: 'Changes', icon: 'refresh-cw'},
+    {key: 'emails', label: 'Emails', icon: 'mail'},
+    {key: 'tools', label: 'Other Tools', icon: 'plug'},
+    {key: 'closed', label: 'Closed days', icon: 'ban'}
+];
+const BOOL_KEYS = ['askPhone', 'phoneRequired', 'allowCancel', 'allowMove', 'sendConfirmation', 'addToContacts', 'calendarBusy'];
+const FIELD_SECTION = {pageTitle: 'page', bookingPath: 'page', timeZone: 'page', termsUrl: 'page', notifyAddress: 'emails'};
+
+/** Zones the browser knows, the business's own first. */
+function zones(current) {
+    let list = [];
+    try { list = Intl.supportedValuesOf('timeZone'); } catch { list = ['Europe/London', 'Europe/Dublin', 'Europe/Paris', 'America/New_York', 'UTC']; }
+    return [...new Set([current, ...list])];
+}
+
+export async function openSettings(ctx, section = 'page') {
+    store.set('booking.settings-seen', true);
+    let info;
+    try { info = await api.settings.get(); } catch (err) { E.toast(`Settings did not load: ${errText(err)}`, {type: 'error'}); return; }
+    const s = info.settings;
+    const f = {};
+    for (const [k, v] of Object.entries(s)) if (k !== 'closures') f[k] = M.observable(v);
+    let closures = (s.closures || []).map(c => ({...c}));
+    const tab = M.observable(SECTIONS.some(x => x.key === section) ? section : 'page');
+    const saving = M.observable(false);
+    const snapshot = () => JSON.stringify([Object.entries(f).map(([k, o]) => [k, o.peek()]), closures]);
+    const opened = snapshot();
+    const model = {
+        ...f, tab, saving,
+        pageUrl: M.computed(() => `${location.origin}${f.bookingPath.value || '/booking'}`),
+        noPhone: M.computed(() => !f.askPhone.value),
+        remindText: M.computed(() => (Number(f.reminderHours.value) > 0 ? `${f.reminderHours.value} hours before` : 'off'))
+    };
+    for (const x of SECTIONS) model[`is_${x.key}`] = M.computed(() => tab.value === x.key);
+
+    const check = (k, label, help = '') => `<label class="bk-check"><input type="checkbox" data-bool="${k}"> ${label}${help ? ` <span data-help-title="${esc(label)}" data-help="${esc(help)}"></span>` : ''}</label>`;
+    const err = (k) => `<small class="bk-err" data-err="${k}" hidden></small>`;
+    const users = ctx.boot.users || [];
+    const html = `<div class="bk-form bk-settings">
+  <div class="bk-seg bk-settings-nav" role="tablist">
+    ${SECTIONS.map(x => `<button type="button" role="tab" data-tab="${x.key}" data-bind-class="tab.value === '${x.key}' && 'is-on'"><span data-icon="${x.icon}" data-icon-size="13"></span> ${x.label}</button>`).join('')}
+  </div>
+
+  <section data-bind-hidden="!is_page.value" class="bk-grid">
+    <div><label class="form-label">Page heading <span data-help-title="Page heading" data-help="The heading on the booking page."></span></label>
+      <input class="form-input" data-model="pageTitle.value" maxlength="80">${err('pageTitle')}</div>
+    <div><label class="form-label">Address <span data-help-title="Address" data-help="Where the booking page lives on your site. /booking gives /booking, a page per service at /booking/service-name, and the customer's own page at /booking/manage/…. Links in emails already sent keep working only at the old address."></span></label>
+      <input class="form-input" data-model="bookingPath.value" maxlength="60">${err('bookingPath')}</div>
+    <div class="bk-wide"><div class="bk-copy"><code data-bind-text="pageUrl.value"></code><button type="button" class="btn btn-sm btn-ghost" data-on-click="copyUrl" title="Copy the address"><span data-icon="copy" data-icon-size="13"></span></button></div></div>
+    <div class="bk-wide"><label class="form-label">Introduction <span data-help-title="Introduction" data-help="A line or two under the heading: what to expect, where you are, how to prepare."></span></label>
+      <textarea class="form-input" rows="2" data-model="intro.value" maxlength="2000"></textarea></div>
+    <div><label class="form-label">Time zone <span data-help-title="Time zone" data-help="Opening hours, the Diary and every time in emails are in this zone - where the business is, not where the customer is."></span></label>
+      <select class="form-select" data-model="timeZone.value">${zones(s.timeZone).map(z => `<option value="${esc(z)}">${esc(z.replace(/_/g, ' '))}</option>`).join('')}</select>${err('timeZone')}</div>
+    <div><label class="form-label">Terms page <span data-help-title="Terms page" data-help="If set, customers tick 'I agree to the terms' (linked here) before booking. /terms or a full https:// address."></span></label>
+      <input class="form-input" data-model="termsUrl.value" placeholder="/terms">${err('termsUrl')}</div>
+    <div class="bk-wide bk-checks">
+      ${check('askPhone', 'Ask for a phone number')}
+      <span data-bind-hidden="noPhone.value">${check('phoneRequired', 'A phone number is required')}</span>
+    </div>
+  </section>
+
+  <section data-bind-hidden="!is_changes.value" class="bk-grid">
+    <p class="bk-wide bk-note">Every confirmation email has a private link where the customer can see their booking - and, if you allow it here, move or cancel it themselves.</p>
+    <div class="bk-wide bk-checks">
+      ${check('allowCancel', 'Customers can cancel', 'From their private link. The time becomes free at once and you are told.')}
+      ${check('allowMove', 'Customers can move to another time', 'To another free time with the same person or room.')}
+    </div>
+    <div><label class="form-label">Up to (hours before) <span data-help-title="Notice for changes" data-help="Changes close this many hours before the booking; after that the page asks them to contact you. 0: right up to the start."></span></label>
+      <input class="form-input" type="number" min="0" max="720" data-model="changeNoticeHours.value"></div>
+  </section>
+
+  <section data-bind-hidden="!is_emails.value" class="bk-grid">
+    ${info.mailReady ? '' : `<div class="bk-wide bk-alert"><span data-icon="alert-triangle" data-icon-size="15"></span>
+      <span><strong>No emails can be sent.</strong> This site has no outgoing mail server, so confirmations and reminders are not sent. Set one up in Settings › Email (SMTP).</span></div>`}
+    <div class="bk-wide bk-checks">
+      ${check('sendConfirmation', 'Email customers a confirmation', 'Sent when they book on the page. The details, a calendar file, and their private link.')}
+    </div>
+    <div><label class="form-label">Reminder (hours before) <span data-help-title="Reminder" data-help="A reminder email this many hours before. 0 turns reminders off. Not sent for a booking made after that point - its confirmation is recent enough."></span></label>
+      <input class="form-input" type="number" min="0" max="336" data-model="reminderHours.value"><small class="bk-muted" data-bind-text="remindText.value"></small></div>
+    <div><label class="form-label">Copies to <span data-help-title="Copies to" data-help="New, moved and cancelled bookings are emailed to the person booked (their email under People &amp; rooms), else here, else the site's own address."></span></label>
+      <input class="form-input" type="email" data-model="notifyAddress.value" placeholder="bookings@example.com">${err('notifyAddress')}</div>
+    <div class="bk-wide"><label class="form-label">Note in every confirmation <span data-help-title="Note" data-help="Directions, parking, what to bring - added at the end of confirmation and move emails."></span></label>
+      <textarea class="form-input" rows="3" data-model="confirmationNote.value" maxlength="2000"></textarea></div>
+  </section>
+
+  <section data-bind-hidden="!is_tools.value" class="bk-grid">
+    <div class="bk-wide bk-checks">
+      ${check('addToContacts', 'Add customers to Contacts', 'Each new customer becomes a contact (once - matched by email), in the address book of the person booked if they are linked to a user, else the owner below.')}
+    </div>
+    <div class="bk-wide"><label class="form-label">Contacts go to <span data-help-title="Contacts owner" data-help="Contacts are per user. Customers of a room, or of a person with no user account, go into this user's Contacts."></span></label>
+      <select class="form-select" data-model="contactsOwnerId.value"><option value="">Nobody (not added)</option>${users.map(u => `<option value="${esc(u.id)}">${esc(u.name)}</option>`).join('')}</select>
+      ${ctx.boot.contacts ? '' : '<small class="bk-muted">Contacts is switched off on this site.</small>'}</div>
+    <div class="bk-wide bk-checks">
+      ${check('calendarBusy', 'Calendar events block booking times', 'A person linked to a user is not offered at times of Calendar events they organise. Needs the Calendar Tool.')}
+      ${ctx.boot.calendar ? '' : '<small class="bk-muted">The Calendar Tool is not on this site, so this has no effect yet.</small>'}
+    </div>
+  </section>
+
+  <section data-bind-hidden="!is_closed.value">
+    <p class="bk-note">Days the whole business is closed - bank holidays, a closure. Nobody can be booked. (For one person's holiday, use their days off.)</p>
+    <div data-part="closures"></div>
+    <div class="bk-actions bk-actions-start"><button type="button" class="btn btn-xs btn-outline" data-on-click="addClosure"><span data-icon="plus" data-icon-size="12"></span> Add closed days</button></div>
+  </section>
+
+  <div class="bk-actions">
+    <span class="bk-spacer"></span>
+    <button type="button" class="btn btn-sm btn-ghost" data-on-click="cancel">Close</button>
+    <button type="button" class="btn btn-sm btn-primary" data-on-click="save" data-bind-disabled="saving.value"><span data-icon="check" data-icon-size="13"></span> Save</button>
+  </div>
+</div>`;
+
+    const drawClosures = (el) => {
+        const box = el.querySelector('[data-part="closures"]');
+        box.innerHTML = closures.length ? closures.map((o, i) => `<div class="bk-off" data-i="${i}">
+  <input type="date" class="form-input" value="${esc(o.from)}" data-k="from" aria-label="From"><span>to</span>
+  <input type="date" class="form-input" value="${esc(o.to)}" data-k="to" aria-label="To">
+  <input class="form-input" value="${esc(o.label)}" data-k="label" placeholder="Bank holiday…" maxlength="80" aria-label="Why">
+  <button type="button" class="btn btn-xs btn-ghost bk-x" data-drop title="Remove" aria-label="Remove"><span data-icon="x" data-icon-size="12"></span></button></div>`).join('')
+            : '<p class="bk-note">None yet.</p>';
+        I.scan(box);
+    };
+
+    let panel = null;
+    panel = await openPanel({
+        title: 'Booking settings',
+        size: 'md',
+        html,
+        model,
+        dirty: () => snapshot() !== opened,
+        before: (el) => {
+            for (const box of el.querySelectorAll('[data-bool]')) {
+                box.checked = Boolean(f[box.dataset.bool].peek());
+                box.addEventListener('change', () => { f[box.dataset.bool].value = box.checked; });
+            }
+            el.querySelector('.bk-settings-nav').addEventListener('click', (e) => {
+                const b = e.target.closest('[data-tab]');
+                if (b) tab.value = b.dataset.tab;
+            });
+            drawClosures(el);
+            const box = el.querySelector('[data-part="closures"]');
+            box.addEventListener('input', (e) => {
+                const row = e.target.closest('[data-i]');
+                if (!row) return;
+                const o = closures[Number(row.dataset.i)];
+                o[e.target.dataset.k] = e.target.value;
+                if (e.target.dataset.k === 'from' && (!o.to || o.to < o.from)) { o.to = o.from; row.querySelector('[data-k="to"]').value = o.from; }
+            });
+            box.addEventListener('click', (e) => {
+                const row = e.target.closest('[data-i]');
+                if (row && e.target.closest('[data-drop]')) { closures.splice(Number(row.dataset.i), 1); drawClosures(el); }
+            });
+        },
+        methods: {
+            cancel: () => panel?.close(),
+            copyUrl: () => copy(model.pageUrl.peek(), 'Booking page address copied'),
+            addClosure() { closures = [...closures, {from: ctx.boot.today, to: ctx.boot.today, label: ''}]; drawClosures(panel.panel); },
+            async save() {
+                if (saving.peek()) return;
+                for (const o of closures) {
+                    if (!isDate(o.from) || !isDate(o.to) || o.to < o.from) { tab.value = 'closed'; E.toast('Closed days: each needs a start date, and an end on or after it.', {type: 'warning'}); return; }
+                }
+                const out = {};
+                for (const [k, o] of Object.entries(f)) out[k] = o.peek();
+                for (const k of BOOL_KEYS) out[k] = Boolean(out[k]);
+                out.changeNoticeHours = Number(out.changeNoticeHours) || 0;
+                out.reminderHours = Number(out.reminderHours) || 0;
+                out.closures = closures;
+                saving.value = true;
+                const el = panel.panel;
+                try {
+                    const r = await api.settings.save(out);
+                    Object.assign(ctx.settings, r.settings);
+                    ctx.tz = r.settings.timeZone;
+                    ctx.boot.settings = ctx.settings;
+                    E.toast('Booking settings saved.', {type: 'success'});
+                    const moved = r.settings.timeZone !== s.timeZone;
+                    panel.close(true);
+                    if (moved) location.reload();
+                } catch (e) {
+                    const errors = e?.body?.errors || {};
+                    for (const box of el.querySelectorAll('[data-err]')) { box.textContent = errors[box.dataset.err] || ''; box.hidden = !errors[box.dataset.err]; }
+                    const first = Object.keys(errors)[0];
+                    if (first && FIELD_SECTION[first]) tab.value = FIELD_SECTION[first];
+                    E.toast(`Not saved: ${errText(e)}`, {type: 'error', duration: 8000});
+                } finally {
+                    saving.value = false;
+                }
+            }
+        }
+    });
+}

package/plugins/booking/collections/booking-bookables.json

@@ -0,0 +1,17 @@
+{
+  "slug": "booking-bookables",
+  "title": "Booking - People & rooms",
+  "description": "Who and what can be booked: people (appointments) and resources (rooms, equipment), each with weekly hours and days off. Edit them in Booking, not here.",
+  "plugin": "booking",
+  "fields": [
+    {"name": "name", "label": "Name", "type": "text"},
+    {"name": "kind", "label": "Kind", "type": "text"},
+    {"name": "active", "label": "Active", "type": "boolean"}
+  ],
+  "api": {
+    "create": {"enabled": false, "access": "admin"},
+    "read":   {"enabled": false, "access": "admin"},
+    "update": {"enabled": false, "access": "admin"},
+    "delete": {"enabled": false, "access": "admin"}
+  }
+}

package/plugins/booking/collections/booking-bookings.json

@@ -0,0 +1,18 @@
+{
+  "slug": "booking-bookings",
+  "title": "Booking - Bookings",
+  "description": "Bookings, times in UTC. They hold customers' details: change them in Booking, never here, so the diary and the emails stay right.",
+  "plugin": "booking",
+  "fields": [
+    {"name": "startAt", "label": "Starts (UTC)", "type": "text"},
+    {"name": "status", "label": "Status", "type": "text"},
+    {"name": "serviceName", "label": "Service", "type": "text"},
+    {"name": "email", "label": "Email", "type": "text"}
+  ],
+  "api": {
+    "create": {"enabled": false, "access": "admin"},
+    "read":   {"enabled": false, "access": "admin"},
+    "update": {"enabled": false, "access": "admin"},
+    "delete": {"enabled": false, "access": "admin"}
+  }
+}

package/plugins/booking/collections/booking-services.json

@@ -0,0 +1,17 @@
+{
+  "slug": "booking-services",
+  "title": "Booking - Services",
+  "description": "What can be booked, for how long, and with whom. Edit them in Booking, not here.",
+  "plugin": "booking",
+  "fields": [
+    {"name": "name", "label": "Name", "type": "text"},
+    {"name": "duration", "label": "Length (minutes)", "type": "number"},
+    {"name": "active", "label": "Active", "type": "boolean"}
+  ],
+  "api": {
+    "create": {"enabled": false, "access": "admin"},
+    "read":   {"enabled": false, "access": "admin"},
+    "update": {"enabled": false, "access": "admin"},
+    "delete": {"enabled": false, "access": "admin"}
+  }
+}

package/plugins/booking/config.js

@@ -0,0 +1,36 @@
+/**
+ * Booking - default settings.
+ *
+ * Every one is editable from the cog in the Booking banner, which writes to
+ * config/plugins.json under `booking.settings`. Times are the business's
+ * wall clock in `timeZone`.
+ */
+export default {
+    // The booking page
+    pageTitle: 'Book',
+    bookingPath: '/booking',
+    intro: '',
+    timeZone: 'Europe/London',
+    askPhone: true,
+    phoneRequired: false,
+    termsUrl: '',
+    confirmationNote: '',
+
+    // Changes by the customer
+    allowCancel: true,
+    allowMove: true,
+    changeNoticeHours: 24,
+
+    // Emails
+    sendConfirmation: true,
+    reminderHours: 24,
+    notifyAddress: '',
+
+    // Links to other Tools
+    addToContacts: true,
+    contactsOwnerId: '',
+    calendarBusy: true,
+
+    // Closed days for the whole business: [{from, to, label}]
+    closures: []
+};

package/plugins/booking/docs/guide.md

@@ -0,0 +1,69 @@
+---
+title: Guide
+order: 1
+---
+
+Let people book time with you, your team, or a room or piece of equipment, straight from your website. Booking is free.
+
+## What it does
+
+- A booking page at `/booking` (you can change the address). Customers pick a service, a day and a free time, then enter their details.
+- **People and rooms.** A person is someone customers book an appointment with. A room or resource is something they book, such as a meeting room, a court or a van. Each has its own weekly hours and days off.
+- **Services.** Each service has a length and optional buffer time before and after, for setting up, cleaning or travel. You also choose how often a start time is offered, how much notice you need, how far ahead people can book, and who provides it.
+- **Emails.** Customers get a confirmation with a calendar file and a reminder before the booking, and you get a copy of each new booking. Each email has a private link that lets the customer move or cancel within the notice you set.
+- **The Diary** in the admin, by day or by week, plus a list of every booking. The sidebar badge shows how many bookings are still to come today.
+- **Nobody is double-booked.** A time is only offered while it is free, and it is checked again at the moment of booking.
+
+## Getting started
+
+1. Switch Booking on in **Tools**.
+2. Open **Booking > People & rooms** and add who or what can be booked. Set the weekly hours and any days off.
+3. Open **Services** and add what can be booked, how long it takes, and who provides it.
+4. Open the settings (the cog in the Booking banner) and check the booking page's address, your time zone and the emails.
+5. Share the booking page link, or put the booking form on any page with the `[booking /]` shortcode.
+
+Booking emails need the site's outgoing email (SMTP) to be set up in **Settings**. Without it, bookings still work, but no emails are sent, and the Booking settings will warn you.
+
+## Booking from Contacts and Email
+
+- **From a contact:** open the contact's menu and choose **Book (name)...** to start a new booking with their details filled in. The contact card also shows their bookings.
+- **From an email:** in Email or Mail Reader, right-click a message (or use its menu) and choose **Book (name)...** to book the sender. If they are already one of your contacts, the booking starts from that contact (phone number included) and is linked to it - no second contact is made.
+- **New customers become contacts.** When someone books, they are added to your Contacts. If they are already there, the booking is linked to their existing contact. You can switch this off in the settings.
+
+The **Book...** options only appear for people who are allowed to manage bookings. The contact option also needs the Contacts Tool switched on.
+
+## Working with the Calendar
+
+If you also use the Calendar Tool, bookings appear there under **Bookings**. A person's own Calendar events block their booking times, so nobody can book them while they are busy. To use this, link the person to their user account in **People & rooms**. You can switch it off per person or for the whole of Booking.
+
+## Putting the booking form on a page
+
+| Shortcode | What it shows |
+|---|---|
+| `[booking /]` | The whole booking form, starting with the list of services |
+| `[booking service="consultation" /]` | Goes straight to one service (use the service's address name, shown in its editor) |
+| `[booking service="consultation" with="..." /]` | One service with one person or room already chosen |
+
+## Changes and cancellations
+
+- **Customers** can move or cancel their own booking from the link in their emails, up to the notice you set (24 hours by default). Closer to the time, the page asks them to contact you instead. You can switch moving and cancelling off in the settings.
+- **You** can move, cancel, or mark a booking as completed or a no-show from the Diary or the booking itself. When you move or cancel a booking, tick **Email the customer** if you want them to be told.
+- If you pick a time that clashes with another booking, Booking asks before double-booking. Only staff can double-book; customers never can.
+
+## Who can use it
+
+Booking has its own permission, **Booking**, which admins have by default. **See** lets someone view the Diary and bookings. **Manage** lets them make, move and cancel bookings, and edit services, people and rooms, and the settings. To give it to other roles, open **Users & Roles**.
+
+## Booking Pro
+
+Booking Pro adds the following to the free Tool:
+- Online appointments, held as a video call on your site.
+- Services that need more than one person or room at once.
+- Classes and group sessions with places and a waiting list.
+- Recurring bookings.
+- Questions to ask customers when they book.
+- A daily limit per person or room, and one booking per customer every so many days.
+
+Taking payment or a deposit online, and booking reports, are planned for Booking Pro.
+
+Your bookings stay the same with or without Pro.

package/plugins/booking/inject/body.html

@@ -0,0 +1 @@
+<script type="module" src="/plugins/booking/public/booking.js?v=1.3.1"></script>

package/plugins/booking/lib/call.js

@@ -0,0 +1,58 @@
+/**
+ * Online bookings (made online by Booking Pro): who may join which call, and
+ * the addresses in the emails, the .ics, the customer's page and the admin.
+ *
+ * The call itself is the engine's (`_lib/call`). A room is a SESSION - the
+ * same service, start and person - so everyone booked into an online class
+ * shares one call, and a one-to-one appointment is a session of one. Links
+ * name the session and the booking: `?b=<booking>&t=<customer token>` for the
+ * customer, `&h=<host key>` for the person they booked. Booking (free) serves
+ * these for any booking that is already online, so a lapsed Pro licence
+ * strands nobody; only Pro can make a service online in the first place.
+ *
+ * @module booking/lib/call
+ */
+
+import {createHash, timingSafeEqual} from 'crypto';
+
+export const OPENS_BEFORE_MIN = 10;
+export const CLOSES_AFTER_MIN = 60;
+const HOLDING = new Set(['pending', 'confirmed', 'completed', 'no-show']);
+
+/** The room a booking's call happens in. */
+export const sessionOf = (b) => createHash('sha256').update(`${b.serviceId}|${b.startAt}|${b.bookableId}`).digest('base64url').slice(0, 22);
+
+const same = (a, b) => {
+    const x = Buffer.from(String(a || ''));
+    const y = Buffer.from(String(b || ''));
+    return x.length === y.length && x.length > 0 && timingSafeEqual(x, y);
+};
+
+/** The customer's join address (relative to the site). */
+export const joinPath = (settings, b) => `${settings.bookingPath}/call/${sessionOf(b)}?b=${encodeURIComponent(b.id)}&t=${encodeURIComponent(b.token)}`;
+/** The host's (the person booked) - never shown to the customer. */
+export const hostPath = (settings, b) => `${settings.bookingPath}/call/${sessionOf(b)}?b=${encodeURIComponent(b.id)}&h=${encodeURIComponent(b.hostKey)}`;
+
+/** When the call opens and closes, for a booking. */
+export function callWindow(b) {
+    return {
+        opensAt: new Date(Date.parse(b.startAt) - OPENS_BEFORE_MIN * 60000).toISOString(),
+        closesAt: new Date(Date.parse(b.endAt) + CLOSES_AFTER_MIN * 60000).toISOString()
+    };
+}
+
+/**
+ * Who the caller is in a room, or null. `cred` is what the join link carried.
+ *
+ * @param {object|null} b - the booking named by `cred.b`
+ * @param {string} room - the room in the address
+ * @param {{t?: string, h?: string}} cred
+ */
+export function whoIsCalling(b, room, cred = {}) {
+    if (!b || b.online !== true || !HOLDING.has(b.status) || sessionOf(b) !== room) return null;
+    const base = {title: b.serviceName, recordingAllowed: b.recordingAllowed === true, max: 6, ...callWindow(b)};
+    // identity: a link the host turns away cannot knock again (the engine remembers it per room).
+    if (cred.h && same(cred.h, b.hostKey)) return {...base, host: true, name: b.bookableName || 'Host', identity: `${b.id}:host`};
+    if (cred.t && same(cred.t, b.token)) return {...base, host: false, name: b.name || 'Guest', identity: `${b.id}:guest`};
+    return null;
+}

package/plugins/booking/lib/extensions.js

@@ -0,0 +1,150 @@
+/**
+ * Where Booking Pro (and anything else) plugs in, without Booking importing
+ * it or it importing Booking: a registry on globalThis, the Shopping Cart's
+ * pattern. Booking owns the data, the screens and the slot engine; an
+ * extension registers from its `onReady` with any of:
+ *
+ *   rules(service)           -> {capacity?, companions?: string[][], maxPerDay?, waitlist?, online?, recordingAllowed?}
+ *                               applied by the free engine (public/lib/slots.js)
+ *   form(service)            -> [{id, label, kind, required?, options?, help?}]  extra booking-form questions
+ *   answers(service, raw)    -> {data, errors}   cleans what the form sent (stored as ext.answers)
+ *   check(ctx)               -> '' or a reason   refuse a booking (ctx: {service, customer, startAt, source, bookings})
+ *   admin: {serviceEditor?, newBooking?, bookingPanel?}   module paths under /plugins/<owner>/ - sections in
+ *                               Booking's own slideovers (see admin/lib/extension-sections.js)
+ *   waitlistUrl              -  where the booking page posts "join the waiting list"
+ *   on:    {made, moved, cancelled, status}  - told after the fact, never waited on
+ *   tabs:  [{key, label, icon, module}]      - admin screens beside Booking's own
+ *
+ * Every hook is optional and guarded: one that throws counts as absent, so an
+ * extension can never stop a booking being made. A lapsed Pro licence means
+ * Pro never registers and every service is plain again (existing bookings keep
+ * what they hold).
+ *
+ * @module booking/lib/extensions
+ */
+
+import {PLAIN} from '../public/lib/slots.js';
+
+const KEY = Symbol.for('domma.booking');
+const safe = (fn, fallback) => { try { const v = fn(); return v === undefined ? fallback : v; } catch { return fallback; } };
+const underOwner = (owner, p) => typeof p === 'string' && p.startsWith(`/plugins/${owner}/`);
+
+export function bookingRegistry() {
+    if (!globalThis[KEY]) {
+        const owners = new Map();
+        globalThis[KEY] = {
+            // 2: rules, form, answers, check, admin sections, waitlistUrl, services.book / cancel (Booking 1.1).
+            // 3: rules may say online (+ recordingAllowed): held as a video call (Booking 1.3).
+            version: 3,
+            services: {},
+            register(owner, ext = {}) {
+                if (typeof owner !== 'string' || !owner) return false;
+                owners.set(owner, ext);
+                return true;
+            },
+            unregister(owner) { owners.delete(owner); },
+            owners: () => [...owners.keys()],
+
+            /**
+             * The rules for a service, merged over every extension. Companion
+             * groups come back as bookable objects (active ones only).
+             */
+            rules(service, bookables = []) {
+                const out = {...PLAIN, companions: [], waitlist: false, online: false, recordingAllowed: false};
+                for (const ext of owners.values()) {
+                    if (typeof ext.rules !== 'function') continue;
+                    const r = safe(() => ext.rules(service), {}) || {};
+                    if (Number(r.capacity) > 1) out.capacity = Math.min(1000, Math.round(Number(r.capacity)));
+                    if (Number(r.maxPerDay) > 0) out.maxPerDay = Math.round(Number(r.maxPerDay));
+                    if (r.waitlist === true) out.waitlist = true;
+                    if (r.online === true) out.online = true;
+                    if (r.recordingAllowed === true) out.recordingAllowed = true;
+                    for (const group of Array.isArray(r.companions) ? r.companions : []) {
+                        const ids = new Set((Array.isArray(group) ? group : []).map(String));
+                        const members = bookables.filter(b => ids.has(b.id) && b.active !== false);
+                        if (members.length) out.companions.push(members);
+                    }
+                }
+                return out;
+            },
+
+            /** Extra questions for the booking form. */
+            form(service) {
+                const out = [];
+                for (const ext of owners.values()) {
+                    if (typeof ext.form !== 'function') continue;
+                    for (const f of safe(() => ext.form(service), []) || []) {
+                        if (f && typeof f.id === 'string' && typeof f.label === 'string') out.push(f);
+                    }
+                }
+                return out;
+            },
+
+            /** Clean the form's answers: {data, errors}. */
+            answers(service, raw) {
+                const data = {};
+                const errors = {};
+                for (const ext of owners.values()) {
+                    if (typeof ext.answers !== 'function') continue;
+                    const r = safe(() => ext.answers(service, raw || {}), null);
+                    if (r?.data) Object.assign(data, r.data);
+                    if (r?.errors) Object.assign(errors, r.errors);
+                }
+                return {data, errors};
+            },
+
+            /** '' when every extension allows the booking, else the first reason given. */
+            async check(ctx) {
+                for (const ext of owners.values()) {
+                    if (typeof ext.check !== 'function') continue;
+                    try {
+                        const why = await ext.check(ctx);
+                        if (typeof why === 'string' && why) return why;
+                    } catch { /* an extension never breaks a booking */ }
+                }
+                return '';
+            },
+
+            /** Where the booking page sends "join the waiting list", or ''. */
+            waitlistUrl() {
+                for (const [owner, ext] of owners) {
+                    if (typeof ext.waitlistUrl === 'string' && ext.waitlistUrl.startsWith(`/api/plugins/${owner}/`)) return ext.waitlistUrl;
+                }
+                return '';
+            },
+
+            /** Admin sections extensions add to Booking's slideovers. */
+            admin() {
+                const out = [];
+                for (const [owner, ext] of owners) {
+                    const a = ext.admin || {};
+                    const entry = {owner};
+                    for (const k of ['serviceEditor', 'newBooking', 'bookingPanel']) if (underOwner(owner, a[k])) entry[k] = a[k];
+                    if (Object.keys(entry).length > 1) out.push(entry);
+                }
+                return out;
+            },
+
+            tabs() {
+                const out = [];
+                for (const [owner, ext] of owners) {
+                    for (const t of Array.isArray(ext.tabs) ? ext.tabs : []) {
+                        if (typeof t?.key !== 'string' || !underOwner(owner, t.module)) continue;
+                        out.push({key: t.key, label: String(t.label || t.key), icon: String(t.icon || 'puzzle'), module: t.module, owner});
+                    }
+                }
+                return out;
+            },
+
+            /** Tell every extension; never throws, never waits. */
+            emit(event, ...args) {
+                for (const ext of owners.values()) {
+                    const fn = ext?.on?.[event];
+                    if (typeof fn !== 'function') continue;
+                    try { Promise.resolve(fn(...args)).catch(() => {}); } catch { /* an extension never breaks a booking */ }
+                }
+            }
+        };
+    }
+    return globalThis[KEY];
+}