(#2 ) - forms improvements

2026-06-12 16:05:14 +02:00
65 changed files with 246 additions and 2507 deletions
@@ -6,10 +6,6 @@ The form definition is an array of element it contains. Each element has a *type
 Keep the form structure and content separate -> when working with the form, take time to figure, if you are working with structure, or existence of something within.
 ## Rendering
 The rendering currently happens on the backend, but that might be wrong. It renders out structure, but interactive components gets rendered on the frontend anyway.
 ## Submitting
 When user submits the form, the `RsvFormSubmitter.js` is called. It collects the values, which we describe in more detail, and then sends it using `fetch` as POST to `reservations/forms/{form_id}`.
@@ -68,4 +64,4 @@ Last thing inspired by Problem Details RFC are extensions. The response can cont
 ## Success handling
-Even success must be handled. The user must know that the submission is successfully finished. What is shown is a templated HTML code that is defined by user. It can contain custom elements, like `<reservation-summary>`.
+Even success must be handled. The user must know that the submission is successfully finished. The form definition can contain a success message as HTML.
@@ -1,181 +0,0 @@
 # Implementation Brief: Live form preview in the form editor
 ## Goal
 Add a real-time form preview pane beside the elements editor on the form **edit** page. Reuse the existing PHP renderer (`RsvFormHtmlRenderer`) via a new admin REST endpoint — do **not** build a JS renderer.
 ## Context you need (don't re-derive)
 - **Editor**: `includes/Views/RsvFormsPage.php`. `show_edit()` renders the edit page; `elements_table_script()` emits the inline `<script>` that drives the elements table. Elements live in an in-memory JS object `rsv_elements_source`; `rsv_elements_source.get_all()` returns the elements array (without internal `id`). Nothing is persisted until the form is saved (PUT).
 - **Renderer**: `includes/Services/Forms/RsvFormHtmlRenderer.php`. `draw(RsvFormDefinition $form): bool` **echoes** the real `<form>` HTML; returns `false` and echoes nothing when the form has no elements. This is the same renderer the frontend uses (`src/render.php`).
 - **Definition object**: `new RsvFormDefinition(string $id, array $definition)` where `$definition` has keys `elements` (array), `email_key`, `success_message`.
 - **Assets**: admin already enqueues the `rsv-client` bundle (`rsv_enqueue_admin_assets` in `includes/RsvAssetsDefinition.php`). It defines the custom elements (`<rsv-reservation-selector>`, `<rsv-reservation-summary>`) and bundles the form CSS (`RsvFormStyles.css` -> confirmed in `build/client.css`). **So form HTML injected via `innerHTML` into the admin page is styled and auto-upgrades its custom elements — no extra assets needed.**
 - `ReservairServiceAPI.nonce` and `ReservairServiceAPI.restUrl` are available globally in admin (localized onto `rsv-client`).
 - The registries `$rsv_form_registry` / `$rsv_template_registry` are populated on `plugins_loaded` (`rsv_bootstrap`), which runs for REST requests too.
 - REST errors are handled globally by the `rest_dispatch_request` filter in `includes/RsvRestApiDefinition.php` (any `Throwable` -> 500 JSON `{error}`), so the endpoint needs no try/catch.
 - `RsvColumnLayout::split('3:2')->column(fn)->column(fn)->output()` (`modules/Layout/RsvColumnLayout.php`) renders side-by-side columns; each callable just echoes. CSS for `.rsv-cols`/`.rsv-col` already exists (used on the list page).
 ## The plan is JS-inline only — no webpack rebuild
 All new editor JS goes inside the existing inline `<script>` in `elements_table_script()`. Do **not** add CSS to `assets/css/*` (that would require a webpack rebuild); use inline `style=""`/a `<style>` block in the PHP if you want the sticky preview.
 ---
 ## Task 1 — Preview endpoint
 **File:** `includes/Controllers/RsvFormDefinitionController.php`
 In `register_routes()`, add a standalone route (the `\d+` id route won't match the non-numeric `preview`, so order is safe):
 ```php
 register_rest_route($this->namespace, '/' . $this->resource_name . '/preview', [
    'methods'             => 'POST',
    'callback'            => [$this, 'preview'],
    'permission_callback' => [RsvRestPolicy::class, 'admin'],
 ]);
 ```
 Add the method:
 ```php
 /** Renders an unsaved definition to HTML for the editor's live preview. */
 function preview(WP_REST_Request $request): WP_REST_Response {
    $definition = $request->get_json_params()['definition'] ?? [];
    if (!is_array($definition)) {
        $definition = [];
    }
    ob_start();
    (new RsvFormHtmlRenderer())->draw(new RsvFormDefinition('preview', $definition));
    $html = ob_get_clean();
    return new WP_REST_Response(['html' => $html], 200);
 }
 ```
 Notes: no-elements case -> `$html` is `''` (handled client-side). A malformed element payload would throw, but the global filter turns it into a 500 the client catch handles gracefully.
 ---
 ## Task 2 — Editor layout (two columns + preview pane)
 **File:** `includes/Views/RsvFormsPage.php`, `show_edit()`.
 Replace the current Form Elements block (the `<h2>Form Elements</h2>` heading, `#form_elements_table`, the add button, and the submit button — currently around lines 133–142) with a split layout. **Keep the existing IDs `form_elements_table` and `rsv_add_element_btn`.** `RsvColumnLayout` is already imported at the top of the file.
 ```php
        <hr>
        <h2>Form Elements</h2>
        <p>Define the fields that will appear in this form.</p>
        <?php
        RsvColumnLayout::split('3:2')
            ->column(function (): void { ?>
                <div id="form_elements_table"></div>
                <p>
                    <button type="button" class="button" id="rsv_add_element_btn">+ Add Element</button>
                </p>
                <p class="submit">
                    <button type="submit" form="edit_form_definition" class="button button-primary">Update Form Definition</button>
                </p>
            <?php })
            ->column(function (): void { ?>
                <h3>Live preview</h3>
                <div id="rsv_form_preview" class="rsv-form-preview" style="position: sticky; top: 40px;"></div>
            <?php })
            ->output();
        ?>
 ```
 The container is `rsv-form-preview` (a plain wrapper) — **not** `reservair-form`; the injected HTML brings its own `<form class="reservair-form ...">`.
 ---
 ## Task 3 — Editor wiring (inline JS in `elements_table_script()`)
 ### 3a. Shared definition collector + preview functions
 Add at the top level of the script (right after the `rsv_elements_source` IIFE). `<?= $form_id ?>` is the meta form's id (`edit_form_definition` on the edit page):
 ```js
 function rsv_collect_definition() {
    const form = document.getElementById('<?= $form_id ?>');
    const get  = (n) => form?.querySelector(`[name="${n}"]`)?.value ?? '';
    return {
        name: get('name'),
        definition: {
            email_key:       get('definition.email_key'),
            success_message: get('definition.success_message'),
            elements:        rsv_elements_source.get_all(),
        },
    };
 }
 const rsv_preview_el = document.getElementById('rsv_form_preview');
 let rsv_preview_timer = null;
 function rsv_schedule_preview() {
    if (!rsv_preview_el) return;
    clearTimeout(rsv_preview_timer);
    rsv_preview_timer = setTimeout(rsv_render_preview, 300);
 }
 function rsv_render_preview() {
    if (!rsv_preview_el) return;
    fetch('<?= get_rest_url(null, 'reservations/v1/form-definition/preview') ?>', {
        method: 'POST',
        credentials: 'same-origin',
        headers: {
            'Content-Type': 'application/json',
            'Accept': 'application/json',
            'X-WP-Nonce': ReservairServiceAPI.nonce,
        },
        body: JSON.stringify(rsv_collect_definition()),
    })
    .then(r => r.ok ? r.json() : r.json().then(e => { throw new Error(e.error || 'Preview failed'); }))
    .then(data => {
        rsv_preview_el.innerHTML = data.html || '<p class="rsv-preview-empty">No fields to preview yet.</p>';
    })
    .catch(() => { rsv_preview_el.innerHTML = '<p class="rsv-preview-empty">Preview unavailable.</p>'; });
 }
 // The preview form is inert: block submission (capture so it works after re-render).
 rsv_preview_el?.addEventListener('submit', (e) => e.preventDefault(), true);
 ```
 ### 3b. Trigger preview on every mutation
 - **Inline edit** (`rsv_render_element_inline_form`, the `builder.build({...})` options): change the two callbacks to also schedule a preview:
  ```js
  on_success: () => { elements_dt.refresh(); rsv_schedule_preview(); },
  on_cancel:  () => { elements_dt.refresh(); rsv_schedule_preview(); },
  ```
 - **Move Up / Move Down / Remove** `func_action`s and the **`rsv_add_element_btn` onclick**: add `rsv_schedule_preview();` right after each `dt.refresh()` / `elements_dt.refresh()`.
 - **Meta fields**: after the existing `rsv_email_key_select` block, add:
  ```js
  const rsv_meta_form = document.getElementById('<?= $form_id ?>');
  ['name', 'definition.email_key', 'definition.success_message'].forEach((n) => {
      const el = rsv_meta_form?.querySelector(`[name="${n}"]`);
      el?.addEventListener('input', rsv_schedule_preview);
      el?.addEventListener('change', rsv_schedule_preview);
  });
  ```
 ### 3c. Reuse the collector for saving
 Simplify the existing `RsvAdminForm.bind(...)` `transform` to reuse the collector (keeps preview == saved shape):
 ```js
 transform: () => rsv_collect_definition(),
 ```
 ### 3d. Initial render
 At the end of the script add:
 ```js
 rsv_render_preview();
 ```
 (`rsv_render_preview` no-ops when `#rsv_form_preview` is absent, e.g. the create page, so the shared script stays safe there.)
 ---
 ## Edge cases / constraints
 - A freshly-added element defaults to `type: 'text'`, which has no registered handler -> silently skipped in the preview until a real type is chosen. Expected.
 - The `<rsv-reservation-selector>` in the preview will fetch availability read-only by `timetable-id` — fine, makes the preview realistic.
 - Use form id `'preview'` (already in the endpoint) so it never collides with a real numeric form id.
 - Don't touch `RsvFormHtmlRenderer` — submission is neutralized client-side.
 ## Verification
 - `php -l includes/Controllers/RsvFormDefinitionController.php includes/Views/RsvFormsPage.php`
 - `composer lint` (runs phpcs, phpstan, psalm) — must pass.
 - No JS build needed (all editor JS is inline).
 - Manual: open a form's edit page -> edit/add/reorder elements and change the meta fields -> preview updates within ~300 ms and matches the frontend form.
@@ -74,21 +74,6 @@
    overflow: hidden;
 }
 /* The component renders inside the host page (e.g. wp-admin in the form editor
   preview), whose form/table stylesheets restyle bare table cells and reveal
   the day radios that only carry the [hidden] attribute. Assert the calendar's
   own appearance here, scoped tightly enough to win that cascade. */
 .rsv-calendar input[type="radio"] {
    display: none;
 }
 .rsv-calendar table,
 .rsv-calendar th,
 .rsv-calendar td {
    border: 0;
    background: none;
 }
 /*.calendar button {
    border: none;
    background-color: transparent;
@@ -130,7 +115,6 @@
 .rsv-calendar td {
    -webkit-user-select:none;user-select:none;
    padding: 0;
    z-index: -1;
 }
@@ -1,30 +1,19 @@
 .rsv-form-btn {
    border-radius: 1.375rem;
    border: 1.5px solid #e0e0e0;
    color: #555;
    padding: 0 calc(1.25rem + 4px);
    height: 3.5rem;
    background-color: white;
    line-height: 140%;
    font-size: 1rem;
    font-size: 15px;
    font-weight: 600;
    font-family: inherit;
    outline: none;
 }
 .rsv-form-btn:hover {
    background-color: #f5f5f5;
 }
 /* Primary CTA (submit / confirm) */
 .rsv-form-btn-primary {
  background: #2563eb;
  color: #fff;
  border-radius: 1.375rem;
  font-size: 1rem;
  padding: 0 calc(1.25rem + 4px);
  line-height: 140%;
  height: 3.5rem;
  border: none;
  font-size: 15px;
  font-weight: 600;
  font-family: inherit;
  cursor: pointer;
  width: 100%;
  transition: background .12s;
@@ -54,6 +43,12 @@
    margin-right: auto;
 }
 /*.reservair-form button {
    padding: var(--s-3) !important;
    font-weight: 400 !important;
 }*/
 /*.reservair-form button,*/
 .rsv-form-input {
    border: 1px solid var(--color-gray-300);
    outline: none;
@@ -170,48 +165,50 @@
    box-shadow: 0 0 0 4px color-mix(in oklab, var(--color-red-500) 25%, transparent) !important;
 }
-.rsv-success-msg {
+.rsv-success-message {
    text-align: center;
    padding: var(--s-5);
    color: var(--color-green-700);
    width: 320px;
 }
-.rsv-success-msg p {
+.rsv-success-message p {
    margin-top: 0;
    font-size: 1.125rem;
    font-weight: 500;
 }
-.rsv-success-msg h1,
+
-.rsv-success-msg h2,
+.mesg {
-.rsv-success-msg h3,
+    width: 100%;
-.rsv-success-msg h4,
+    text-align: center;
-.rsv-success-msg h5,
+    line-height: 1rem;
-.rsv-success-msg h6
+    margin-top: var(--s-5);
-{
+    margin-bottom: var(--s-5);
-    margin-top: 0;
+    padding: var(--s-4) 0;
    margin-bottom: 0.5rem;
 }
-.rsv-summary {
+.success-mesg-icon {
    margin-bottom: 2rem;
 }
-.rsv-success-icon {
+.mesg-icon svg {
-    width: 64px;
+    width: 32px;
-    height: 64px;
+    height: 32px;
    padding: var(--s-2);
    border-radius: 50%;
-    background: #dcfce7;
+    color: #00000094;
    display: flex;
    align-items: center;
    justify-content: center;
    margin-bottom: 20px;
 }
 .error-mesg svg {
    background-color: var(--color-red-200);
 }
 .success-mesg svg {
    background-color: rgba(0, 201, 80, 0.36);
 }
 /* FORM END */
 .rsv-timetable-selector {
    display: grid;
    grid-template-columns: repeat(2, 1fr);
    background-color: white;
 }
@media (max-width: 768px) {
@@ -87,7 +87,7 @@ label.rsv-slots-slot-time>input:checked + .content>.capacity {
  font-weight: 600;
 }
-.rsv-slots-slot:hover:not(.rsv-slots-slot-full):not(.rsv-slots-slot-too-soon):not(.rsv-slots-slot-selected) {
+.rsv-slots-slot:hover:not(.rsv-slots-slot-full):not(.rsv-slots-slot-selected) {
  border-color: #2563eb;
  background: #f5f8ff;
 }
@@ -115,12 +115,6 @@ label.rsv-slots-slot-time>input:checked + .content>.capacity {
  cursor: not-allowed;
 }
 /* Within minimum lead time — available but not yet bookable */
 .rsv-slots-slot-too-soon {
  opacity: 0.45;
  cursor: not-allowed;
 }
 /* Selected */
 .rsv-slots-slot-selected {
  background: #2563eb;
@@ -1,4 +0,0 @@
 import { RsvDataSource } from './RsvDataSource.js';
 export const RsvMembershipKeyResource = (program_id) =>
    RsvDataSource.create_rsv_resource(ReservairServiceAPI.restUrl + '/membership-program/' + program_id + '/keys');
@@ -1,4 +0,0 @@
 import { RsvDataSource } from './RsvDataSource.js';
 export const RsvMembershipProgramResource = () =>
    RsvDataSource.create_rsv_resource(ReservairServiceAPI.restUrl + '/membership-program');
@@ -179,14 +179,6 @@ export const RsvCalendarPicker = (() => {
            new InputEvent('change', { bubbles: true, cancelable: true, composed: true })
          );
        },
        // Re-check the radio for the current date. The date lives in JS state, so
        // this restores the visual selection after a native form.reset() clears it.
        reselect() {
          if (this.date === null) return;
          const radio = this.body.querySelector(`input[id="${this.date.toISOString()}"]`);
          if (radio) radio.checked = true;
        },
      };
      container.classList.add('rsv-calendar');
@@ -37,16 +37,6 @@ class RsvReservationSelector extends HTMLElement {
    this.querySelectorAll('.rsv-slots-slot-selected').forEach(s => s.classList.remove('rsv-slots-slot-selected'));
    this._slots = [];
    this._commit();
    // _commit clears only the slots; keep the picked date selected, re-asserting
    // it in case a surrounding form.reset() just unchecked the calendar radio.
    this._calendar?.reselect();
  }
  // Reset for a new reservation: drop the local selection (keeping the date) and
  // reload availability so slots booked by the previous submission show as full.
  reset() {
    this.clear();
    this.querySelector('rsv-timeline')?.refresh();
  }
  // ---- Private ------------------------------------------------------------
@@ -25,31 +25,6 @@ class RsvReservationSummary extends HTMLElement {
    }
  }
  // ---- Public API ---------------------------------------------------------
  // Detached, static copy of the current selection for the success message.
  // Mirrors the live layout minus the interactive "clear all" control.
  snapshot() {
    const s     = ReservairStrings.summary;
    const list  = this.querySelector('.rsv-summary-list');
    const count = this.querySelector('.rsv-summary-count');
    const price = this.querySelector('.rsv-summary-price');
    const node = document.createElement('div');
    node.className = 'rsv-summary rsv-summary-snapshot';
    node.innerHTML = `
      <div class="rsv-summary-header">
        <span class="rsv-summary-title">${s.title}</span>
      </div>
      <ul class="rsv-summary-list">${list ? list.innerHTML : ''}</ul>
      <div class="rsv-summary-footer">
        <span class="rsv-summary-count">${count ? count.textContent : ''}</span>
        <div class="rsv-summary-price">${price ? price.textContent : ''}</div>
      </div>
    `;
    return node;
  }
  // ---- Private ------------------------------------------------------------
  _build() {
@@ -76,6 +51,7 @@ class RsvReservationSummary extends HTMLElement {
    const all_slots = [...this._all_slots.values()].flatMap(({ slots, price_per_block }) =>
      slots.map(s => ({ ...s, price_per_block }))
    );
    console.log(all_slots);
    const n        = all_slots.length;
    const list     = this.querySelector('.rsv-summary-list');
@@ -35,19 +35,11 @@ class RsvTimeline extends HTMLElement {
    this._render();
  }
  // ---- Public API ---------------------------------------------------------
  // Re-fetch availability for the current date, e.g. after a booking occupied
  // some slots. The date is unchanged, so attributeChangedCallback won't fire.
  refresh() {
    this._render();
  }
  // ---- Private ------------------------------------------------------------
  _on_click(event) {
    const slot = event.target.closest('.rsv-slots-slot');
-    if (slot && !slot.classList.contains('rsv-slots-slot-full') && !slot.classList.contains('rsv-slots-slot-too-soon')) {
+    if (slot && !slot.classList.contains('rsv-slots-slot-full')) {
      slot.classList.toggle('rsv-slots-slot-selected');
      slot.dispatchEvent(new Event('input', { bubbles: true }));
    }
@@ -67,6 +59,10 @@ class RsvTimeline extends HTMLElement {
      const occupancy = await RsvTimetableService.get_availability_for_date(this.timetableId, this.date);
      if (v !== this._version) return;
      if(occupancy.length === 0) {
        this.replaceChildren(this._notice(s.no_blocks));
        return;
      }
      const header = document.createElement('div');
      header.classList.add('rsv-slots-label');
@@ -74,14 +70,9 @@ class RsvTimeline extends HTMLElement {
        weekday: 'long', day: 'numeric', month: 'long',
      }).replace(',', '');
      if(occupancy.length === 0) {
        this.replaceChildren(header, this._notice(s.no_blocks));
        return;
      }
      const blocks = [];
-      for (const { from_minutes, to_minutes, block_size_in_minutes, occupancy: block_occ, lead_time_minutes } of occupancy) {
+      for (const { from_minutes, to_minutes, block_size_in_minutes, occupancy: block_occ } of occupancy) {
        if (from_minutes === to_minutes || block_occ.length === 0) {
          continue;
        }
@@ -89,7 +80,7 @@ class RsvTimeline extends HTMLElement {
        const from_block = parseInt(from_minutes) / block_size_in_minutes;
        const time_slots = block_occ.map((occ, i) =>
-          this._block(this.date, occ, block_size_in_minutes, from_block + i, lead_time_minutes?.[i] ?? 0)
+          this._block(this.date, occ, block_size_in_minutes, from_block + i)
        );
        const time_slot_group = document.createElement('div');
@@ -105,7 +96,7 @@ class RsvTimeline extends HTMLElement {
    }
  }
-  _block(date, left, block_size, idx, min_lead_time_minutes = 0) {
+  _block(date, left, block_size, idx) {
    const from = new Date(date);
    from.setHours(0, idx * block_size, 0, 0);
@@ -116,8 +107,7 @@ class RsvTimeline extends HTMLElement {
    cell.classList.add('rsv-slots-slot', 'rsv-slots-slot-available');
    cell.dataset.start_utc = from.toISOString();
    cell.dataset.end_utc   = to.toISOString();
-    if (left <= 0) cell.classList.add('rsv-slots-slot-full');
+    if (left === 0) cell.classList.add('rsv-slots-slot-full');
    else if (from < new Date(Date.now() + min_lead_time_minutes * 60_000)) cell.classList.add('rsv-slots-slot-too-soon');
    const time_el = document.createElement('span');
    time_el.classList.add('rsv-slots-slot-time');
@@ -56,14 +56,24 @@ export const RsvFormSender = {
    svg.appendChild(path);
    const icon = document.createElement('div');
-    icon.className = 'rsv-success-icon';
+    icon.className = 'success-icon';
    icon.appendChild(svg);
-    const body = this.build_success_body(form, s);
+    const title = document.createElement('div');
    title.className   = 'success-title';
    title.textContent = s.success_title;
    const subtitle = document.createElement('p');
    subtitle.className   = 'success-msg';
    subtitle.textContent = s.success_subtitle;
    const reset_btn = document.createElement('button');
    reset_btn.className   = 'reset-btn';
    reset_btn.textContent = s.new_reservation;
    const state = document.createElement('div');
-    state.className = 'rsv-success-state';
+    state.className = 'success-state';
-    state.append(icon, body);
+    state.append(icon, title, subtitle, reset_btn);
    const msg = document.createElement('div');
    msg.appendChild(state);
@@ -71,50 +81,12 @@ export const RsvFormSender = {
    existing.forEach(child => child.style.display = 'none');
    wrapper.appendChild(msg);
-    // The form catches every data-rsv-reset button in the card and links it to
+    reset_btn.addEventListener('click', () => {
    // its cleanup — so new buttons just need the marker, no wiring here.
    const reset = () => {
      msg.remove();
      form.reset();
      // Native reset leaves custom controls untouched; reset the reservation
      // selectors so their slots, hidden inputs and the summary clear, the date
      // stays selected and availability reloads with the just-booked slots.
      form.querySelectorAll('rsv-reservation-selector').forEach(sel => sel.reset());
      this.clear_feedback(form);
      existing.forEach(child => child.style.display = '');
-    };
+    });
    state.querySelectorAll('[data-rsv-reset]').forEach(btn => btn.addEventListener('click', reset));
  },
  // Body of the success card. Uses the admin-configured template when the form
  // ships one, filling the .rsv-success-summary placeholder (expanded server-side
  // from <reservation-summary>) with a snapshot of the selected slots; otherwise
  // falls back to the default text.
  build_success_body(form, strings) {
    const tpl = form.parentElement?.querySelector('template.rsv-form-success');
    if (!tpl) {
      const subtitle = document.createElement('p');
      subtitle.className   = 'rsv-success-msg';
      subtitle.textContent = strings.success_subtitle;
      return subtitle;
    }
    const body = document.createElement('div');
    body.className = 'rsv-success-msg';
    body.appendChild(tpl.content.cloneNode(true));
    const placeholder = body.querySelector('.rsv-success-summary');
    if (placeholder) {
      const summary = form.querySelector('rsv-reservation-summary');
      if (summary && typeof summary.snapshot === 'function') {
        placeholder.replaceWith(summary.snapshot());
      } else {
        placeholder.remove();
      }
    }
    return body;
  },
  set_loading(form, is_loading) {
@@ -1,6 +1,6 @@
 {
    "require": {
-        "chillerlan/php-qrcode": "^6.0.1"
+        "chillerlan/php-qrcode": "^5.0"
    },
    "autoload": {
        "psr-4": {
@@ -4,44 +4,40 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "c898c79e7e1cf9625a3a3f757c17ee0d",
+    "content-hash": "b4f5229f78cd0eed0c7166614bf05110",
    "packages": [
        {
            "name": "chillerlan/php-qrcode",
-            "version": "6.0.1",
+            "version": "5.0.3",
            "source": {
                "type": "git",
                "url": "https://github.com/chillerlan/php-qrcode.git",
-                "reference": "49006e34bd5328f163e80329e7312f34dceea59b"
+                "reference": "42e215640e9ebdd857570c9e4e52245d1ee51de2"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/chillerlan/php-qrcode/zipball/49006e34bd5328f163e80329e7312f34dceea59b",
+                "url": "https://api.github.com/repos/chillerlan/php-qrcode/zipball/42e215640e9ebdd857570c9e4e52245d1ee51de2",
-                "reference": "49006e34bd5328f163e80329e7312f34dceea59b",
+                "reference": "42e215640e9ebdd857570c9e4e52245d1ee51de2",
                "shasum": ""
            },
            "require": {
-                "chillerlan/php-settings-container": "^3.2.1",
+                "chillerlan/php-settings-container": "^2.1.6 || ^3.2.1",
                "ext-mbstring": "*",
-                "php": "^8.2"
+                "php": "^7.4 || ^8.0"
            },
            "require-dev": {
-                "chillerlan/php-authenticator": "^5.3",
+                "chillerlan/php-authenticator": "^4.3.1 || ^5.2.1",
                "ext-fileinfo": "*",
-                "intervention/image": "^3.11",
+                "phan/phan": "^5.4.5",
-                "phan/phan": "^6.0.1",
+                "phpcompatibility/php-compatibility": "10.x-dev",
                "phpbench/phpbench": "^1.4",
                "phpmd/phpmd": "^2.15",
-                "phpstan/phpstan": "^2.1.40",
+                "phpunit/phpunit": "^9.6",
-                "phpstan/phpstan-deprecation-rules": "^2.0.4",
+                "setasign/fpdf": "^1.8.2",
-                "phpunit/phpunit": "^11.5",
+                "slevomat/coding-standard": "^8.15",
-                "setasign/fpdf": "^1.8.6",
+                "squizlabs/php_codesniffer": "^3.11"
                "slevomat/coding-standard": "^8.28",
                "squizlabs/php_codesniffer": "^4.0"
            },
            "suggest": {
                "chillerlan/php-authenticator": "Yet another Google authenticator! Also creates URIs for mobile apps.",
                "intervention/image": "More advanced GD and ImageMagick output.",
                "setasign/fpdf": "Required to use the QR FPDF output.",
                "simple-icons/simple-icons": "SVG icons that you can use to embed as logos in the QR Code"
            },
@@ -79,7 +75,7 @@
                    "homepage": "https://github.com/chillerlan/php-qrcode/graphs/contributors"
                }
            ],
-            "description": "A QR Code generator and reader with a user-friendly API. PHP 8.2+",
+            "description": "A QR Code generator and reader with a user-friendly API. PHP 7.4+",
            "homepage": "https://github.com/chillerlan/php-qrcode",
            "keywords": [
                "phpqrcode",
@@ -101,20 +97,20 @@
                    "type": "Ko-Fi"
                }
            ],
-            "time": "2026-03-18T21:21:07+00:00"
+            "time": "2024-11-21T16:12:34+00:00"
        },
        {
            "name": "chillerlan/php-settings-container",
-            "version": "3.3.0",
+            "version": "3.2.1",
            "source": {
                "type": "git",
                "url": "https://github.com/chillerlan/php-settings-container.git",
-                "reference": "a0a487cbf5344f721eb504bf0f59bada40c381b7"
+                "reference": "95ed3e9676a1d47cab2e3174d19b43f5dbf52681"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/chillerlan/php-settings-container/zipball/a0a487cbf5344f721eb504bf0f59bada40c381b7",
+                "url": "https://api.github.com/repos/chillerlan/php-settings-container/zipball/95ed3e9676a1d47cab2e3174d19b43f5dbf52681",
-                "reference": "a0a487cbf5344f721eb504bf0f59bada40c381b7",
+                "reference": "95ed3e9676a1d47cab2e3174d19b43f5dbf52681",
                "shasum": ""
            },
            "require": {
@@ -122,13 +118,11 @@
                "php": "^8.1"
            },
            "require-dev": {
                "phan/phan": "^5.5.2",
                "phpmd/phpmd": "^2.15",
-                "phpstan/phpstan": "^2.1.31",
+                "phpstan/phpstan": "^1.11",
-                "phpstan/phpstan-deprecation-rules": "^2.0.3",
+                "phpstan/phpstan-deprecation-rules": "^1.2",
                "phpunit/phpunit": "^10.5",
-                "slevomat/coding-standard": "^8.22",
+                "squizlabs/php_codesniffer": "^3.10"
                "squizlabs/php_codesniffer": "^4.0"
            },
            "type": "library",
            "autoload": {
@@ -153,8 +147,7 @@
                "Settings",
                "configuration",
                "container",
-                "helper",
+                "helper"
                "property hook"
            ],
            "support": {
                "issues": "https://github.com/chillerlan/php-settings-container/issues",
@@ -170,7 +163,7 @@
                    "type": "ko_fi"
                }
            ],
-            "time": "2026-03-20T21:10:52+00:00"
+            "time": "2024-07-16T11:13:48+00:00"
        }
    ],
    "packages-dev": [
@@ -699,16 +692,16 @@
        },
        {
            "name": "amphp/process",
-            "version": "v2.1.0",
+            "version": "v2.0.3",
            "source": {
                "type": "git",
                "url": "https://github.com/amphp/process.git",
-                "reference": "583959df17d00304ad7b0b32285373f985935643"
+                "reference": "52e08c09dec7511d5fbc1fb00d3e4e79fc77d58d"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/amphp/process/zipball/583959df17d00304ad7b0b32285373f985935643",
+                "url": "https://api.github.com/repos/amphp/process/zipball/52e08c09dec7511d5fbc1fb00d3e4e79fc77d58d",
-                "reference": "583959df17d00304ad7b0b32285373f985935643",
+                "reference": "52e08c09dec7511d5fbc1fb00d3e4e79fc77d58d",
                "shasum": ""
            },
            "require": {
@@ -722,7 +715,7 @@
                "amphp/php-cs-fixer-config": "^2",
                "amphp/phpunit-util": "^3",
                "phpunit/phpunit": "^9",
-                "psalm/phar": "6.16.1"
+                "psalm/phar": "^5.4"
            },
            "type": "library",
            "autoload": {
@@ -755,7 +748,7 @@
            "homepage": "https://amphp.org/process",
            "support": {
                "issues": "https://github.com/amphp/process/issues",
-                "source": "https://github.com/amphp/process/tree/v2.1.0"
+                "source": "https://github.com/amphp/process/tree/v2.0.3"
            },
            "funding": [
                {
@@ -763,7 +756,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-05-31T15:11:55+00:00"
+            "time": "2024-04-19T03:13:44+00:00"
        },
        {
            "name": "amphp/serialization",
@@ -993,29 +986,28 @@
        },
        {
            "name": "composer/pcre",
-            "version": "3.4.0",
+            "version": "3.3.2",
            "source": {
                "type": "git",
                "url": "https://github.com/composer/pcre.git",
-                "reference": "d5a341b3fb61f3001970940afb1d332968a183ed"
+                "reference": "b2bed4734f0cc156ee1fe9c0da2550420d99a21e"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/composer/pcre/zipball/d5a341b3fb61f3001970940afb1d332968a183ed",
+                "url": "https://api.github.com/repos/composer/pcre/zipball/b2bed4734f0cc156ee1fe9c0da2550420d99a21e",
-                "reference": "d5a341b3fb61f3001970940afb1d332968a183ed",
+                "reference": "b2bed4734f0cc156ee1fe9c0da2550420d99a21e",
                "shasum": ""
            },
            "require": {
                "php": "^7.4 || ^8.0"
            },
            "conflict": {
-                "phpstan/phpstan": "<2.2.2"
+                "phpstan/phpstan": "<1.11.10"
            },
            "require-dev": {
-                "phpstan/phpstan": "^2",
+                "phpstan/phpstan": "^1.12 || ^2",
-                "phpstan/phpstan-deprecation-rules": "^2",
+                "phpstan/phpstan-strict-rules": "^1 || ^2",
-                "phpstan/phpstan-strict-rules": "^2",
+                "phpunit/phpunit": "^8 || ^9"
                "phpunit/phpunit": "^9"
            },
            "type": "library",
            "extra": {
@@ -1053,7 +1045,7 @@
            ],
            "support": {
                "issues": "https://github.com/composer/pcre/issues",
-                "source": "https://github.com/composer/pcre/tree/3.4.0"
+                "source": "https://github.com/composer/pcre/tree/3.3.2"
            },
            "funding": [
                {
@@ -1063,9 +1055,13 @@
                {
                    "url": "https://github.com/composer",
                    "type": "github"
                },
                {
                    "url": "https://tidelift.com/funding/github/packagist/composer/composer",
                    "type": "tidelift"
                }
            ],
-            "time": "2026-06-07T11:47:49+00:00"
+            "time": "2024-11-12T16:29:46+00:00"
        },
        {
            "name": "composer/semver",
@@ -1571,16 +1567,16 @@
        },
        {
            "name": "johnpbloch/wordpress-core",
-            "version": "6.9.4",
+            "version": "6.9.0",
            "source": {
                "type": "git",
                "url": "https://github.com/johnpbloch/wordpress-core.git",
-                "reference": "13e02e0047ca5c8ec8dc837c2de8a5bd3583b879"
+                "reference": "4626d4e896c36ab77a69ce58627bc76243b5dd07"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/johnpbloch/wordpress-core/zipball/13e02e0047ca5c8ec8dc837c2de8a5bd3583b879",
+                "url": "https://api.github.com/repos/johnpbloch/wordpress-core/zipball/4626d4e896c36ab77a69ce58627bc76243b5dd07",
-                "reference": "13e02e0047ca5c8ec8dc837c2de8a5bd3583b879",
+                "reference": "4626d4e896c36ab77a69ce58627bc76243b5dd07",
                "shasum": ""
            },
            "require": {
@@ -1588,7 +1584,7 @@
                "php": ">=7.2.24"
            },
            "provide": {
-                "wordpress/core-implementation": "6.9.4"
+                "wordpress/core-implementation": "6.9.0"
            },
            "type": "wordpress-core",
            "notification-url": "https://packagist.org/downloads/",
@@ -1615,7 +1611,7 @@
                "source": "https://core.trac.wordpress.org/browser",
                "wiki": "https://codex.wordpress.org/"
            },
-            "time": "2026-03-11T15:27:36+00:00"
+            "time": "2025-12-02T19:10:58+00:00"
        },
        {
            "name": "kelunik/certificate",
@@ -3250,16 +3246,16 @@
        },
        {
            "name": "symfony/polyfill-mbstring",
-            "version": "v1.38.2",
+            "version": "v1.38.1",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/polyfill-mbstring.git",
-                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6"
+                "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
+                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/14c5439eec4ccff081ac14eca2dc57feb2a66d92",
-                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
+                "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92",
                "shasum": ""
            },
            "require": {
@@ -3311,7 +3307,7 @@
                "shim"
            ],
            "support": {
-                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.2"
+                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.1"
            },
            "funding": [
                {
@@ -3331,7 +3327,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-27T06:59:30+00:00"
+            "time": "2026-05-26T12:51:13+00:00"
        },
        {
            "name": "symfony/polyfill-php84",
@@ -3790,16 +3786,16 @@
        },
        {
            "name": "webmozart/assert",
-            "version": "2.4.1",
+            "version": "2.4.0",
            "source": {
                "type": "git",
                "url": "https://github.com/webmozarts/assert.git",
-                "reference": "2ccb7c2e821038c03a3e6e1700c570c158c55f70"
+                "reference": "9007ea6f45ecf352a9422b36644e4bfc039b9155"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/webmozarts/assert/zipball/2ccb7c2e821038c03a3e6e1700c570c158c55f70",
+                "url": "https://api.github.com/repos/webmozarts/assert/zipball/9007ea6f45ecf352a9422b36644e4bfc039b9155",
-                "reference": "2ccb7c2e821038c03a3e6e1700c570c158c55f70",
+                "reference": "9007ea6f45ecf352a9422b36644e4bfc039b9155",
                "shasum": ""
            },
            "require": {
@@ -3850,9 +3846,9 @@
            ],
            "support": {
                "issues": "https://github.com/webmozarts/assert/issues",
-                "source": "https://github.com/webmozarts/assert/tree/2.4.1"
+                "source": "https://github.com/webmozarts/assert/tree/2.4.0"
            },
-            "time": "2026-06-15T15:31:57+00:00"
+            "time": "2026-05-20T13:07:01+00:00"
        },
        {
            "name": "wp-hooks/wordpress-core",
@@ -19,7 +19,6 @@ class RsvFormDefinitionController {
                    'required'   => false,
                    'properties' => [
                        'email_key' => ['type' => 'string', 'required' => false],
                        'success_message' => ['type' => 'string', 'required' => false],
                        'elements'  => ['type' => 'array',  'default'  => []],
                    ],
                ],
@@ -42,12 +41,6 @@ class RsvFormDefinitionController {
            ],
        ]);
        register_rest_route($this->namespace, '/' . $this->resource_name . '/preview', [
            'methods'             => 'POST',
            'callback'            => [$this, 'preview'],
            'permission_callback' => [RsvRestPolicy::class, 'admin'],
        ]);
        register_rest_route($this->namespace, '/' . $this->resource_name . '/(?P<id>\d+)', [
            [
                'methods'             => 'GET',
@@ -85,17 +78,10 @@ class RsvFormDefinitionController {
    }
    function create(WP_REST_Request $request): WP_REST_Response {
        $definition = $request->get_param('definition') ?? [];
        $errors = (new RsvFormDefinitionValidator())->validate($definition);
        if ($errors !== []) {
            return new WP_REST_Response(['error' => implode(' ', $errors)], 422);
        }
        try {
            $id = (new RsvFormDefinitionRepository())->add(
                $request->get_param('name'),
-                $definition
+                $request->get_param('definition') ?? []
            );
        } catch(Throwable $e) {
            Logger::error($e);
@@ -118,20 +104,6 @@ class RsvFormDefinitionController {
        return new WP_REST_Response(null, 204);
    }
    /** Renders an unsaved definition to HTML for the editor's live preview. */
    function preview(WP_REST_Request $request): WP_REST_Response {
        $definition = $request->get_json_params()['definition'] ?? [];
        if (!is_array($definition)) {
            $definition = [];
        }
        ob_start();
        (new RsvFormHtmlRenderer())->draw(new RsvFormDefinition('preview', $definition));
        $html = ob_get_clean();
        return new WP_REST_Response(['html' => $html], 200);
    }
    function update(WP_REST_Request $request): WP_REST_Response {
        $id   = (int) $request->get_param('id');
        $repo = new RsvFormDefinitionRepository();
@@ -140,14 +112,7 @@ class RsvFormDefinitionController {
            return new WP_REST_Response(['error' => 'Not found'], 404);
        }
-        $definition = $request->get_param('definition') ?? [];
+        $repo->update($id, $request->get_param('name'), $request->get_param('definition'));
        $errors = (new RsvFormDefinitionValidator())->validate($definition);
        if ($errors !== []) {
            return new WP_REST_Response(['error' => implode(' ', $errors)], 422);
        }
        $repo->update($id, $request->get_param('name'), $definition);
        return new WP_REST_Response(null, 204);
    }
@@ -1,183 +0,0 @@
 <?php
 class RsvMembershipProgramController {
    use RsvPagedResponseTrait;
    private string $namespace = 'reservations/v1';
    private string $resource_name = 'membership-program';
    private static function schema(): array {
        return [
            'type'       => 'object',
            'properties' => [
                'id'     => ['type' => 'integer', 'readonly' => true],
                'name'   => ['type' => 'string', 'required' => true, 'minLength' => 1],
                'active' => ['type' => 'boolean', 'default' => true],
            ],
        ];
    }
    public function register_routes(): void {
        register_rest_route($this->namespace, '/' . $this->resource_name, [
            [
                'methods'             => 'GET',
                'callback'            => [$this, 'index'],
                'permission_callback' => [RsvRestPolicy::class, 'admin'],
            ],
            [
                'methods'             => 'POST',
                'callback'            => [$this, 'create'],
                'permission_callback' => [RsvRestPolicy::class, 'admin'],
                'args'                => self::input_args(self::schema()),
            ],
        ]);
        register_rest_route($this->namespace, '/' . $this->resource_name . '/(?P<id>\d+)', [
            [
                'methods'             => 'GET',
                'callback'            => [$this, 'show'],
                'permission_callback' => [RsvRestPolicy::class, 'admin'],
            ],
            [
                'methods'             => 'PUT',
                'callback'            => [$this, 'update'],
                'permission_callback' => [RsvRestPolicy::class, 'admin'],
                'args'                => self::input_args(self::schema()),
            ],
            [
                'methods'             => 'DELETE',
                'callback'            => [$this, 'delete'],
                'permission_callback' => [RsvRestPolicy::class, 'admin'],
            ],
        ]);
        register_rest_route($this->namespace, '/' . $this->resource_name . '/(?P<id>\d+)/keys', [
            [
                'methods'             => 'GET',
                'callback'            => [$this, 'index_keys'],
                'permission_callback' => [RsvRestPolicy::class, 'admin'],
            ],
            [
                'methods'             => 'POST',
                'callback'            => [$this, 'add_key'],
                'permission_callback' => [RsvRestPolicy::class, 'admin'],
            ],
        ]);
        register_rest_route($this->namespace, '/' . $this->resource_name . '/(?P<id>\d+)/keys/(?P<key_id>\d+)', [
            [
                'methods'             => 'DELETE',
                'callback'            => [$this, 'delete_key'],
                'permission_callback' => [RsvRestPolicy::class, 'admin'],
            ],
        ]);
    }
    public function index(WP_REST_Request $request): WP_REST_Response {
        [$skip, $limit] = self::paging($request);
        $repo = new RsvMembershipProgramRepository();
        $programs = array_map(fn($p) => $p->to_array(), $repo->all($limit, $skip));
        return $this->paged_response($programs, $repo->count_all());
    }
    public function create(WP_REST_Request $request): WP_REST_Response {
        $params = $request->get_json_params();
        $name = $params['name'] ?? '';
        $active = $params['active'] ?? true;
        if (trim($name) === '') {
            throw new InvalidArgumentException('Name is required.');
        }
        $repo = new RsvMembershipProgramRepository();
        $id = $repo->add($name, $active);
        return new WP_REST_Response(RsvMembershipProgram::from_array(['id' => $id, 'name' => $name, 'active' => $active])->to_array(), 201);
    }
    public function show(WP_REST_Request $request): WP_REST_Response {
        $id = (int) $request->get_param('id');
        $repo = new RsvMembershipProgramRepository();
        $program = $repo->get($id);
        if ($program === null) {
            return new WP_REST_Response(['error' => 'Not found'], 404);
        }
        return new WP_REST_Response($program, 200);
    }
    public function update(WP_REST_Request $request): WP_REST_Response {
        $id = (int) $request->get_param('id');
        $params = $request->get_json_params();
        $name = $params['name'] ?? '';
        $active = $params['active'] ?? true;
        if (trim($name) === '') {
            throw new InvalidArgumentException('Name is required.');
        }
        $repo = new RsvMembershipProgramRepository();
        if ($repo->get($id) === null) {
            return new WP_REST_Response(['error' => 'Not found'], 404);
        }
        $repo->update($id, $name, $active);
        return new WP_REST_Response(['id' => $id, 'name' => $name, 'active' => $active], 200);
    }
    public function delete(WP_REST_Request $request): WP_REST_Response {
        $id = (int) $request->get_param('id');
        $repo = new RsvMembershipProgramRepository();
        if ($repo->get($id) === null) {
            return new WP_REST_Response(['error' => 'Not found'], 404);
        }
        $repo->delete($id);
        return new WP_REST_Response(['ok' => true], 200);
    }
    public function index_keys(WP_REST_Request $request): WP_REST_Response {
        [$skip, $limit] = self::paging($request);
        $program_id = (int) $request->get_param('id');
        $repo = new RsvMembershipProgramRepository();
        if ($repo->get($program_id) === null) {
            return new WP_REST_Response(['error' => 'Program not found'], 404);
        }
        $keys = array_map(fn($k) => $k->to_array(), $repo->keys($program_id, $limit, $skip));
        return $this->paged_response($keys, $repo->count_keys($program_id));
    }
    public function add_key(WP_REST_Request $request): WP_REST_Response {
        $program_id = (int) $request->get_param('id');
        $params = $request->get_json_params();
        $key_value = $params['key_value'] ?? '';
        if (trim($key_value) === '') {
            throw new InvalidArgumentException('Key value is required.');
        }
        $repo = new RsvMembershipProgramRepository();
        if ($repo->get($program_id) === null) {
            return new WP_REST_Response(['error' => 'Program not found'], 404);
        }
        $key_id = $repo->add_key($program_id, $key_value);
        return new WP_REST_Response(['id' => $key_id, 'program_id' => $program_id, 'key_value' => $key_value], 201);
    }
    public function delete_key(WP_REST_Request $request): WP_REST_Response {
        $program_id = (int) $request->get_param('id');
        $key_id = (int) $request->get_param('key_id');
        $repo = new RsvMembershipProgramRepository();
        if ($repo->get($program_id) === null) {
            return new WP_REST_Response(['error' => 'Program not found'], 404);
        }
        $repo->delete_key($key_id);
        return new WP_REST_Response(['ok' => true], 200);
    }
 }
@@ -2,7 +2,6 @@
 class RsvTimetableReservationCreatedEvent {
    public function __construct(
-        public RsvTimetableReservation $reservation,
+        public RsvTimetableReservation $reservation
        public RsvReservation $parent
    ) {}
 }
@@ -9,7 +9,7 @@ class RsvTimetableReservationPendingEvent {
    public function __construct(
        public int                     $reservation_id,
        public RsvTimetableReservation $reservation,
-        public ?string                  $code,
+        public string                  $code,
        public string                  $maintainer_email
    ) {}
 }
@@ -1,19 +1,16 @@
 <?php
 use Reservair\Logger\Logger;
 use Reservair\Templating\RsvTemplateEngine;
 /**
 * Handles all outgoing email for the reservation module.
 *
 * Two responsibilities:
 *  1. Maintainer approval request — fires per timetable item that needs
- *     confirmation, carrying the accept/refuse links the maintainer acts on.
+ *     confirmation; template is hardcoded (not admin-configurable).
 *  2. User notification on form close — fires once per form submission when
- *     every reservation item reaches a terminal state.
+ *     every reservation item reaches a terminal state. Subject/body come from
- *
+ *     the form definition's reservation element `email_templates` attr.
 * Both subjects/bodies come from the reservation element's `email_templates`
 * attr, falling back to the hardcoded defaults when the admin left them blank.
 *
 * Exceptions are swallowed so a mail failure never rolls back a transaction.
 */
@@ -25,7 +22,11 @@ class RsvEmailListener {
        <p>Rezervace č. {{reservation_id}} čeká na vaše schválení.</p>
        <p><strong>Datum:</strong> {{date}}</p>
        <p><strong>Čas:</strong> {{start}} – {{end}}</p>
-        <p><reservation-actions></reservation-actions></p>
+        <p>
            <a href='{{accept_url}}'>Přijmout</a>
            &nbsp;|&nbsp;
            <a href='{{refuse_url}}'>Odmítnout</a>
        </p>
    ";
    private const string DEFAULT_ACCEPTED_SUBJECT = 'Rezervace přijata';
@@ -47,81 +48,39 @@ class RsvEmailListener {
    public static function on_pending(RsvTimetableReservationPendingEvent $event): void {
        try {
            global $rsv_template_registry;
            $engine = new RsvTemplateEngine(registry: $rsv_template_registry);
            $tz       = wp_timezone();
            $start_dt = (clone $event->reservation->start_utc)->setTimezone($tz);
            $end_dt   = (clone $event->reservation->end_utc)->setTimezone($tz);
-            [$tpl, $form_values] = self::resolve_maintainer_template($event);
+            $body = (new RsvEmailTemplater())->render(self::DEFAULT_PENDING_BODY, [
            // Treat blank (admin cleared the field) the same as "use the default".
            $subject_tpl = trim((string) ($tpl['subject'] ?? '')) !== '' ? $tpl['subject'] : self::DEFAULT_PENDING_SUBJECT;
            $body_tpl    = trim((string) ($tpl['body']    ?? '')) !== '' ? $tpl['body']    : self::DEFAULT_PENDING_BODY;
            // Reservation context wins over form values on key collisions, so the
            // accept/refuse links can never be shadowed by a submitted field.
            $symbols = array_merge($form_values, [
                'reservation_id' => (string) $event->reservation_id,
-                'date'           => $start_dt->format('Y-m-d'),
+                'date'           => esc_html($start_dt->format('Y-m-d')),
-                'start'          => $start_dt->format('H:i'),
+                'start'          => esc_html($start_dt->format('H:i')),
-                'end'            => $end_dt->format('H:i'),
+                'end'            => esc_html($end_dt->format('H:i')),
-                'accept_url'     => get_rest_url(null, 'reservations/v1/timetable-reservation/accept/' . $event->code),
+                'accept_url'     => esc_url(get_rest_url(null, 'reservations/v1/timetable-reservation/accept/' . $event->code)),
-                'refuse_url'     => get_rest_url(null, 'reservations/v1/timetable-reservation/refuse/' . $event->code),
+                'refuse_url'     => esc_url(get_rest_url(null, 'reservations/v1/timetable-reservation/refuse/' . $event->code)),
            ]);
-            $subject = sanitize_text_field($engine->render_plain($subject_tpl, $symbols));
+            (new RsvEmailSender())->send($event->maintainer_email, self::DEFAULT_PENDING_SUBJECT, $body);
            $body    = $engine->render($body_tpl, $symbols);
            (new RsvEmailSender())->send($event->maintainer_email, $subject, $body);
        } catch (\Throwable $e) {
            Logger::error($e);
        }
    }
    /**
-     * Resolves the admin-authored maintainer template for the timetable this
+     * HTML-escape scalar form values for safe interpolation into an HTML email
-     * reservation belongs to, together with the submission's field values so the
+     * body. Non-scalar values (e.g. nested arrays) are dropped to an empty
-     * template can reference the submitter's answers.
+     * string since the templater only substitutes plain placeholders.
     *
-     * @return array{0: array<string, mixed>, 1: array<string, mixed>} The
+     * @param array<string,mixed> $values
-     *         maintainer template (empty when none is configured) and form values.
+     * @return array<string,string>
     */
-    private static function resolve_maintainer_template(RsvTimetableReservationPendingEvent $event): array {
+    private static function escape_values(array $values): array {
-        $form_submit_id = (new RsvReservationRepository())->get_form_submit_id($event->reservation_id);
+        $escaped = [];
-        if ($form_submit_id === null) {
+        foreach ($values as $key => $value) {
-            return [[], []];
+            $escaped[$key] = is_scalar($value) ? esc_html((string) $value) : '';
        }
-
+        return $escaped;
        $form_submit = (new RsvFormSubmitRepository())->get($form_submit_id);
        if ($form_submit === null) {
            return [[], []];
        }
        $form_values = is_array($form_submit['values'] ?? null) ? $form_submit['values'] : [];
        $definition = (new RsvFormDefinitionRepository())->get((int) $form_submit['form_id']);
        if ($definition === null) {
            return [[], $form_values];
        }
        $elements            = $definition['definition']['elements'] ?? [];
        $reservation_element = null;
        foreach ($elements as $el) {
            if (!is_array($el) || ($el['type'] ?? '') !== 'reservation') {
                continue;
            }
            $reservation_element ??= $el; // fall back to the first reservation element
            if ((int) ($el['timetable_id'] ?? 0) === $event->reservation->timetable_id) {
                $reservation_element = $el;
                break;
            }
        }
        $template = $reservation_element['email_templates']['maintainer'] ?? [];
        return [is_array($template) ? $template : [], $form_values];
    }
    public static function on_form_submit_closed(RsvFormSubmitClosedEvent $event): void {
@@ -177,21 +136,15 @@ class RsvEmailListener {
            $subject_tpl = trim((string) ($tpl['subject'] ?? '')) !== '' ? $tpl['subject'] : $default_subject;
            $body_tpl    = trim((string) ($tpl['body']    ?? '')) !== '' ? $tpl['body']    : $default_body;
-            global $rsv_template_registry;
+            $templater = new RsvEmailTemplater();
            $engine = new RsvTemplateEngine(registry: $rsv_template_registry);
-            $form_definition = new RsvFormDefinition((string) $form_submit['form_id'], $definition['definition']);
+            // Subject is plain text: render with raw values, then strip any tags
-            $form_data       = new RsvFormData($form_values);
+            // or newlines to avoid header issues.
            $subject = sanitize_text_field($templater->render($subject_tpl, $form_values));
-            // Calculated values (e.g. price) win over submitted fields so they can't be shadowed.
+            // Body is HTML: escape the user-submitted values before interpolation
-            $symbols = array_merge($form_values, (new RsvFormCalculatedValues())->for($form_definition, $form_data));
+            // so they can't inject markup into the message.
-
+            $body = $templater->render($body_tpl, self::escape_values($form_values));
            // Subject is plain text: render without HTML-escaping, then strip tags/newlines.
            $subject = sanitize_text_field($engine->render_plain($subject_tpl, $symbols));
            // Body is HTML: the engine HTML-escapes all interpolated values.
            $body = $engine->render($body_tpl, $symbols);
            error_log("Prc");
            (new RsvEmailSender())->send($user_email, $subject, $body);
        } catch (\Throwable $e) {
@@ -10,37 +10,23 @@ class RsvGoogleCalendarListener {
    public static function on_created(RsvTimetableReservationCreatedEvent $event): void {
        try {
            $form_submit = (new RsvFormSubmitRepository())->get((int) $event->parent->form_submit_id);
            if ($form_submit === null) {
                return;
            }
            $definition = (new RsvFormDefinitionRepository())->get((int) $form_submit['form_id']);
            if ($definition === null) {
                return;
            }
            $email_key  = $definition['definition']['email_key'] ?? null;
            $user_email = is_string($email_key) && $email_key !== '' ? ($form_values[$email_key] ?? null) : null;
            $gcal = new RsvGoogleCalendarService();
            if (!$gcal->is_google_connected()) {
                return;
            }
-            $calendar_id = self::resolve_calendar_id($gcal, $event->reservation->timetable_id);
+            $calendar_id = self::resolve_calendar_id($gcal, $event->timetable_id);
            if (!$calendar_id) {
                return;
            }
-            $status = $event->reservation->is_confirmed == null ? 'tentative' : 'confirmed';
+            $status = $event->reservation->requires_confirmation ? 'tentative' : 'confirmed';
            $gcal->add_event(
                $calendar_id,
                "Reservation #{$event->reservation->id}",
-                // format time as utc
+                $event->reservation->start,
-                $event->reservation->start_utc->format('Y-m-d H:i:s'),
+                $event->reservation->end,
-                $event->reservation->end_utc->format('Y-m-d H:i:s'),
+                $event->reservation->user_email,
                $user_email,
                $event->reservation->id,
                $status,
            );
@@ -1,42 +0,0 @@
 <?php
 class RsvMembershipKey {
    public ?int $id;
    public int $program_id;
    public string $key_value;
    public static function schema(): array {
        return [
            'type'       => 'object',
            'properties' => [
                'id'         => ['type' => 'integer', 'readonly' => true],
                'program_id' => ['type' => 'integer', 'required' => true],
                'key_value'  => ['type' => 'string', 'required' => true, 'minLength' => 1],
            ],
        ];
    }
    public static function from_array(array $data): self {
        return new self(
            intval($data['id'] ?? null),
            intval($data['program_id'] ?? 0),
            $data['key_value'] ?? ''
        );
    }
    public function __construct(?int $id, int $program_id, string $key_value) {
        $this->id = $id;
        $this->program_id = $program_id;
        $this->key_value = $key_value;
    }
    public function to_array() {
        return [
            'id' => $this->id,
            'program_id' => $this->program_id,
            'key_value' => $this->key_value,
        ];
    }
 }
@@ -1,42 +0,0 @@
 <?php
 class RsvMembershipProgram {
    public ?int $id;
    public string $name;
    public bool $active;
    public static function schema(): array {
        return [
            'type'       => 'object',
            'properties' => [
                'id'     => ['type' => 'integer', 'readonly' => true],
                'name'   => ['type' => 'string', 'required' => true, 'minLength' => 1],
                'active' => ['type' => 'boolean', 'default' => true],
            ],
        ];
    }
    public static function from_array(array $data): self {
        return new self(
            intval($data['id'] ?? null),
            $data['name'] ?? '',
            boolval($data['active'] ?? true)
        );
    }
    public function __construct(?int $id, string $name, bool $active = true) {
        $this->id = $id;
        $this->name = $name;
        $this->active = $active;
    }
    public function to_array() {
        return [
            'id' => $this->id,
            'name' => $this->name,
            'active' => $this->active,
        ];
    }
 }
@@ -6,19 +6,16 @@
 class RsvTimetableAvailability {
    /**
     * @param array<int,int> $occupancy Number of available seats for each time block
     * @param array<int,int> $lead_time_minutes   Minimum lead time in minutes required for each block
     */
    public function __construct(
        public int $from_minutes,
        public int $to_minutes,
        public int $block_size_in_minutes,
-        public array $occupancy,
+        public array $occupancy
        public array $lead_time_minutes = []
    ) { }
-    public function push_block(int $capacity, int $min_lead_time_minutes = 0) {
+    public function push_block(int $capacity) {
        $this->occupancy[] = $capacity;
        $this->lead_time_minutes[] = $min_lead_time_minutes;
        $this->to_minutes += $this->block_size_in_minutes;
    }
 }
@@ -6,8 +6,6 @@ class RsvTimetableReservation {
    public DateTime $start_utc; // UTC, 'Y-m-d H:i:s'
    public DateTime $end_utc;   // UTC, 'Y-m-d H:i:s'
    public ?int $is_confirmed = null;
    public static function schema(): array {
        return [
            'type'       => 'object',
@@ -1,114 +0,0 @@
 <?php
 use Reservair\Database\Db;
 class RsvMembershipProgramRepository {
    private string $table_program;
    private string $table_key;
    public function __construct() {
        $this->table_program = Db::prefix() . 'rsv_membership_program';
        $this->table_key = Db::prefix() . 'rsv_membership_key';
    }
    public function all(?int $limit = null, int $skip = 0): array {
        if ($limit === null) {
            $rows = Db::get_results(
                "SELECT * FROM {$this->table_program} ORDER BY id DESC",
                [],
                ARRAY_A
            );
        } else {
            $rows = Db::get_results(
                "SELECT * FROM {$this->table_program} ORDER BY id DESC LIMIT %d OFFSET %d",
                [$limit, $skip],
                ARRAY_A
            );
        }
        return array_map(fn($row) => RsvMembershipProgram::from_array($row), $rows);
    }
    public function count_all(): int {
        return (int) Db::get_var("SELECT COUNT(*) FROM {$this->table_program}");
    }
    public function get(int $id): ?array {
        return Db::get_row(
            "SELECT * FROM {$this->table_program} WHERE id = %d",
            [$id],
            ARRAY_A
        );
    }
    public function add(string $name, bool $active): int {
        return Db::insert($this->table_program, [
            'name' => $name,
            'active' => $active ? 1 : 0,
        ]);
    }
    public function update(int $id, string $name, bool $active): int {
        return Db::update(
            $this->table_program,
            [
                'name' => $name,
                'active' => $active ? 1 : 0,
            ],
            ['id' => $id]
        );
    }
    public function delete(int $id): void {
        Db::delete($this->table_program, ['id' => $id]);
    }
    public function keys(int $program_id, ?int $limit = null, int $skip = 0): array {
        if ($limit === null) {
            $rows = Db::get_results(
                "SELECT * FROM {$this->table_key} WHERE program_id = %d ORDER BY id",
                [$program_id],
                ARRAY_A
            );
        } else {
            $rows = Db::get_results(
                "SELECT * FROM {$this->table_key} WHERE program_id = %d ORDER BY id LIMIT %d OFFSET %d",
                [$program_id, $limit, $skip],
                ARRAY_A
            );
        }
        return array_map(fn($row) => RsvMembershipKey::from_array($row), $rows);
    }
    public function count_keys(int $program_id): int {
        return (int) Db::get_var(
            "SELECT COUNT(*) FROM {$this->table_key} WHERE program_id = %d",
            [$program_id]
        );
    }
    private function normalize_key(string $key_value): string {
        return preg_replace('/\s+/', ' ', strtolower(trim($key_value)));
    }
    public function add_key(int $program_id, string $key_value): int {
        return Db::insert($this->table_key, [
            'program_id' => $program_id,
            'key_value' => $key_value,
            'key_normalized_value' => $this->normalize_key($key_value)
        ]);
    }
    public function delete_key(int $key_id): void {
        Db::delete($this->table_key, ['id' => $key_id]);
    }
    public function key_exists(int $program_id, string $key_value): bool {
        return Db::get_var(
            "SELECT 1 FROM {$this->table_key} k
             INNER JOIN {$this->table_program} p ON p.id = k.program_id
             WHERE p.active = 1 AND k.program_id = %d AND k.key_normalized_value = %s
             LIMIT 1",
            [$program_id, $this->normalize_key($key_value)]
        ) !== null;
    }
 }
@@ -50,7 +50,6 @@ class RsvTimetableRepository {
                'name'             => $timetable->name,
                'block_size'       => $timetable->block_size,
                'maintainer_email' => $timetable->maintainer_email,
                'google_calendar_id' => $timetable->google_calendar_id,
            ],
            ['id' => $id]
        );
@@ -34,8 +34,7 @@ class RsvTimetableReservationRepository {
                 WHERE timetable_id = %d
                   AND `start_utc` < %s
                   AND `end_utc`   > %s",
-                [$timetable_id, $end_utc->format('Y-m-d H:i:s'), $start_utc->format('Y-m-d H:i:s')],
+                [$timetable_id, $end_utc, $start_utc]
                ARRAY_A
            )
        );
    }
@@ -8,7 +8,6 @@ function rsv_admin_menu_definition() {
    $forms        = new RsvFormsPage();
    $timetable    = new RsvTimetablePage();
    $google_cal   = new RsvGoogleCalendarSettingsPage();
    $membership   = new RsvMembershipProgramsPage();
    add_menu_page(
        'Reservations Settings',     // Page title
@@ -29,15 +28,6 @@ function rsv_admin_menu_definition() {
        [$forms, 'render']
    );
    add_submenu_page(
        'reservations-settings',
        'Membership Programs',
        'Membership Programs',
        RsvCapabilities::MANAGE,
        'membership-programs',
        [$membership, 'render']
    );
    add_submenu_page(
        'reservations-settings',
        'Timetables',
@@ -52,15 +52,8 @@ function rsv_enqueue_assets(): void {
 }
 function rsv_enqueue_admin_assets(): void {
-    // The client bundle defines the custom elements shared by both front-end and
+    wp_enqueue_script('rsv-admin', rsv_build_url('admin.js'), [], filemtime(rsv_build_file('admin.js')));
-    // admin. enqueue_block_assets already enqueues `rsv-client` in the editor, so
+    wp_enqueue_style('rsv-admin',  rsv_build_url('admin.css'), [], filemtime(rsv_build_file('admin.css')));
    // re-using the same handle here keeps it loaded exactly once (WP dedupes by
    // handle) instead of bundling a second copy into admin.js.
    wp_enqueue_script('rsv-client', rsv_build_url('client.js'), [], filemtime(rsv_build_file('client.js')));
    wp_enqueue_style('rsv-client',  rsv_build_url('client.css'), [], filemtime(rsv_build_file('client.css')));
-    wp_enqueue_script('rsv-admin', rsv_build_url('admin.js'), ['rsv-client'], filemtime(rsv_build_file('admin.js')));
+    rsv_localize_api('rsv-admin');
    wp_enqueue_style('rsv-admin',  rsv_build_url('admin.css'), ['rsv-client'], filemtime(rsv_build_file('admin.css')));
    rsv_localize_api('rsv-client');
 }
@@ -93,26 +93,6 @@ class RsvInstaller {
                ON DELETE CASCADE
        ) $charset_collate;");
        self::run("CREATE TABLE IF NOT EXISTS {$wpdb->prefix}rsv_membership_program (
            id      bigint unsigned NOT NULL AUTO_INCREMENT,
            name    TINYTEXT        NOT NULL,
            active  BOOLEAN         NOT NULL DEFAULT TRUE,
            PRIMARY KEY (id)
        ) $charset_collate;");
        self::run("CREATE TABLE IF NOT EXISTS {$wpdb->prefix}rsv_membership_key (
            id          bigint unsigned NOT NULL AUTO_INCREMENT,
            program_id  bigint unsigned NOT NULL,
            key_value   VARCHAR(191)    NOT NULL,
            key_normalized_value   VARCHAR(191)    NOT NULL,
            PRIMARY KEY (id),
            UNIQUE KEY uniq_program_key (program_id, key_normalized_value),
            KEY idx_key_value (key_normalized_value),
            CONSTRAINT fk_member_key_program
                FOREIGN KEY (program_id) REFERENCES {$wpdb->prefix}rsv_membership_program (id)
                ON DELETE CASCADE
        ) $charset_collate;");
        // Grant the custom capability that gates the admin REST endpoints.
        RsvCapabilities::ensure();
    }
@@ -84,5 +84,4 @@ function rsv_define_rest_api(): void {
    (new RsvTimetableReservationController())->register_routes();
    (new RsvFormController())->register_routes();
    (new RsvFormDefinitionController())->register_routes();
    (new RsvMembershipProgramController())->register_routes();
 }
@@ -0,0 +1,9 @@
 <?php
 class RsvEmailTemplater {
    public function render(string $template, array $data) : string {
        return preg_replace_callback('/{{\s*(\w+)\s*}}/', function($matches) use ($data) {
            return $data[$matches[1]] ?? '';
        }, $template);
    }
 }
@@ -5,7 +5,7 @@ class RsvButtonElementHandler implements RsvFormElementHandler {
    public function draw(RsvFormElementDefinition $element): void {
        ?>
        <div class="rsv-form-input-group rsv-form-input-short">
-            <button class="rsv-form-btn rsv-form-btn-primary"><?= $element->getLabel() ?></button>
+            <button class="rsv-form-btn-primary"><?= $element->getLabel() ?></button>
        </div>
        <?php
    }
@@ -1,5 +1,6 @@
 <?php
 interface RsvFormElementHandler {
    function draw(RsvFormElementDefinition $def) : void;
@@ -14,7 +14,7 @@ class RsvFormReservationElementHandler implements RsvFormElementHandler {
        $name            = $element->getName();
        ?>
        <div class="rsv-form-input-group">
-            <label class="rsv-form-label"><?= esc_html($element->getLabel()) ?></label>
+            <label><?= esc_html($element->getLabel()) ?></label>
            <rsv-reservation-selector
                timetable-id="<?= $timetable_id ?>"
                name="<?= esc_attr($name) ?>"
@@ -1,21 +0,0 @@
 <?php
 class RsvOutputTextElementHandler implements RsvFormElementHandler {
    private const ALLOWED_TAGS = ['p', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6'];
    public function draw(RsvFormElementDefinition $def): void {
        $raw = $def->getAttr('tag', 'p');
        $tag = in_array($raw, self::ALLOWED_TAGS, true) ? $raw : 'p';
        echo '<' . $tag . ' class="rsv-form-output-text">' . esc_html($def->getLabel()) . '</' . $tag . '>';
    }
    public function submit(RsvFormElementDefinition $def, int $submit_id, array $data, RsvFormSubmitResult $result): bool {
        return true;
    }
    public function rollback(RsvFormElementDefinition $def, int $submit_id, array $data, RsvFormSubmitResult $result): void {
        // No side effects to undo.
    }
 }
@@ -1,22 +0,0 @@
 <?php
 /** Computes a form's total price as the sum of its elements' prices, reduced by membership discount. */
 class RsvFormPriceCalculator {
    public function calculate(RsvFormDefinition $definition, RsvFormData $data): float {
        global $rsv_form_price_registry;
        $total = 0.0;
        foreach ($definition->getElements() as $element) {
            $calculator = $rsv_form_price_registry->get($element->getType());
            if ($calculator === null) {
                continue; // Unpriced element type contributes nothing.
            }
            $total += (float) $calculator($element, $data->getValue($element->getName()));
        }
        $pct = (new RsvMembershipService())->discount_for($definition, $data);
        return $total * (1.0 - max(0.0, min(100.0, $pct)) / 100.0);
    }
 }
@@ -1,21 +0,0 @@
 <?php
 class RsvFormPriceCalculatorRegistry {
    /** @var array<string, callable(RsvFormElementDefinition, mixed): float> */
    private array $calculators = [];
    public function register(string $type, callable $calculator): void {
        $this->calculators[$type] = $calculator;
    }
    public function get(string $type): ?callable {
        return $this->calculators[$type] ?? null;
    }
    /** Builds the registry and lets other modules contribute calculators. */
    public static function boot(): self {
        $registry = new self();
        do_action('rsv-register-price-calculator', $registry);
        return $registry;
    }
 }
@@ -1,36 +0,0 @@
 <?php
 /** Values derived from a submission (not entered by the visitor), exposed to templates. */
 final class RsvFormCalculatedValues {
    /** @return array<string, mixed> */
    public function for(RsvFormDefinition $definition, RsvFormData $data): array {
        $calculator = new RsvFormPriceCalculator();
        global $rsv_form_price_registry;
        $price_before_discount = 0.0;
        foreach ($definition->getElements() as $element) {
            $element_calculator = $rsv_form_price_registry->get($element->getType());
            if ($element_calculator === null) {
                continue;
            }
            $price_before_discount += (float) $element_calculator($element, $data->getValue($element->getName()));
        }
        $discount_pct = (new RsvMembershipService())->discount_for($definition, $data);
        $final_price = $calculator->calculate($definition, $data);
        return [
            'price' => $final_price,
            'price_before_discount' => $price_before_discount,
            'discount_percent' => $discount_pct,
        ];
    }
    /**
     * The names these values expose, so template validation accepts {{ price }}.
     * @return list<string>
     */
    public static function names(): array {
        return ['price', 'price_before_discount', 'discount_percent'];
    }
 }
@@ -7,12 +7,8 @@ class RsvFormDefinition {
    public string $email_key = "";
    public array $membership = [];
    public string $success_message = "";
    /**
-     * @param array<string,mixed> $definition Full definition array including 'elements', 'email_key' and 'success_message'.
+     * @param array<int,mixed> $definition Full definition array including 'elements' and 'email_key'.
     */
    public function __construct(string $id, array $definition) {
        $this->_elements = [];
@@ -25,8 +21,6 @@ class RsvFormDefinition {
        $this->_id       = $id;
        $this->email_key = $definition['email_key'] ?? '';
        $this->membership      = $definition['membership'] ?? [];
        $this->success_message = $definition['success_message'] ?? '';
    }
    public function getId(): string {
@@ -37,20 +31,6 @@ class RsvFormDefinition {
        return $this->email_key;
    }
    /** @return array<int,array{program_id:int,discount:float,field:string}> */
    public function getMembershipBindings(): array {
        return $this->membership['bindings'] ?? [];
    }
    public function getMembershipCombine(): string {
        return $this->membership['combine'] ?? 'max';
    }
    /** Template shown to the visitor after a successful submission. */
    public function getSuccessMessage(): string {
        return $this->success_message;
    }
    public function hasElements() : bool {
        return count($this->_elements) > 0;
@@ -1,152 +0,0 @@
 <?php
 use Reservair\Templating\RsvTemplateEngine;
 /**
 * Validates a form definition before it is persisted.
 *
 * Template checks (symbols, syntax, custom elements) are delegated to the
 * common template validator; on top of that this enforces form-level rules,
 * such as requiring a submit button once the form defines any fields.
 */
 final class RsvFormDefinitionValidator {
    /**
     * @param array<string,mixed> $definition The inner definition (elements, email_key, success_message).
     * @return list<string> Human-readable problems; empty when the definition is valid.
     */
    public function validate(array $definition): array {
        $elements = is_array($definition['elements'] ?? null) ? $definition['elements'] : [];
        $symbols  = $this->symbols($elements);
        $engine   = $this->engine();
        $errors = [];
        // Templates reference submitted values by form-element name.
        foreach ($this->templates($definition, $elements) as $label => $template) {
            foreach ($engine->validate($template, $symbols) as $problem) {
                $errors[] = "{$label}: {$problem}";
            }
        }
        // A form that collects fields must give the visitor a way to send them.
        if ($elements !== [] && !$this->has_submit($elements)) {
            $errors[] = 'Form must contain a submit button.';
        }
        // Validate membership bindings if present.
        $errors = array_merge($errors, $this->validate_membership_bindings($definition));
        return $errors;
    }
    /**
     * Names that templates may reference — the form's symbol table.
     *
     * @param array<int,mixed> $elements
     * @return list<string>
     */
    private function symbols(array $elements): array {
        $names = RsvFormCalculatedValues::names(); // calculated values are referencable too
        foreach ($elements as $el) {
            $name = is_array($el) ? ($el['name'] ?? '') : '';
            if (is_string($name) && $name !== '') {
                $names[] = $name;
            }
        }
        return $names;
    }
    /**
     * The definition's admin-authored templates, keyed by a label used to
     * prefix any problems found in them.
     *
     * @param array<string,mixed> $definition
     * @param array<int,mixed>    $elements
     * @return array<string,string>
     */
    private function templates(array $definition, array $elements): array {
        $templates = [];
        $success = $definition['success_message'] ?? '';
        if (is_string($success) && trim($success) !== '') {
            $templates['Success message'] = $success;
        }
        foreach ($elements as $el) {
            if (!is_array($el) || ($el['type'] ?? '') !== 'reservation') {
                continue;
            }
            $email_templates = $el['email_templates'] ?? [];
            if (!is_array($email_templates)) {
                continue;
            }
            foreach (['on_accepted' => 'accepted', 'on_refused' => 'refused'] as $key => $human) {
                $tpl = $email_templates[$key] ?? [];
                if (!is_array($tpl)) {
                    continue;
                }
                foreach (['subject', 'body'] as $part) {
                    $value = $tpl[$part] ?? '';
                    if (is_string($value) && trim($value) !== '') {
                        $templates["Email ({$human} {$part})"] = $value;
                    }
                }
            }
        }
        return $templates;
    }
    /** @param array<int,mixed> $elements */
    private function has_submit(array $elements): bool {
        foreach ($elements as $el) {
            if (is_array($el) && ($el['type'] ?? '') === 'button') {
                return true;
            }
        }
        return false;
    }
    private function engine(): RsvTemplateEngine {
        global $rsv_template_registry;
        return new RsvTemplateEngine(registry: $rsv_template_registry);
    }
    /**
     * @param array<string,mixed> $definition
     * @return list<string>
     */
    private function validate_membership_bindings(array $definition): array {
        $errors = [];
        $membership = $definition['membership'] ?? [];
        if (!is_array($membership)) {
            return $errors;
        }
        $bindings = $membership['bindings'] ?? [];
        if (!is_array($bindings)) {
            return $errors;
        }
        foreach ($bindings as $idx => $binding) {
            if (!is_array($binding)) {
                continue;
            }
            $program_id = intval($binding['program_id'] ?? 0);
            $discount = floatval($binding['discount'] ?? 0.0);
            if ($program_id <= 0) {
                $errors[] = "Membership binding {$idx}: program_id must be a positive integer.";
            }
            if ($discount < 0.0 || $discount > 100.0) {
                $errors[] = "Membership binding {$idx}: discount must be between 0 and 100.";
            }
        }
        return $errors;
    }
 }
@@ -1,6 +1,5 @@
 <?php
 use Reservair\Templating\RsvTemplateEngine;
 class RsvFormHtmlRenderer {
    public function draw(RsvFormDefinition $form): bool {
@@ -21,37 +20,12 @@ class RsvFormHtmlRenderer {
        <?php endforeach; ?>
        </form>
        <?php $this->draw_success_template($form); ?>
        </div>
        <?php
        return true;
    }
    /**
     * Emits the admin-configured success message as an inert <template> that the
     * client clones once the form is submitted. A <reservation-summary> element
     * expands to a placeholder div that RsvFormSender fills with the visitor's
     * selected slots.
     */
    private function draw_success_template(RsvFormDefinition $form): void {
        $message = trim($form->getSuccessMessage());
        if ($message === '') {
            return;
        }
        global $rsv_template_registry;
        $engine = new RsvTemplateEngine(registry: $rsv_template_registry);
        // Sanitize admin HTML before rendering, allowing the registered template
        // custom elements through so the engine can expand them.
        $allowed = $rsv_template_registry->kses_allowed(wp_kses_allowed_html('post'));
        $html    = $engine->render(wp_kses($message, $allowed));
        ?>
        <template class="rsv-form-success"><?= $html ?></template>
        <?php
    }
    public function draw_element(RsvFormElementDefinition $data): void {
        global $rsv_form_registry;
@@ -1,9 +0,0 @@
 # Membership
 Forms can have a price calculated from it's definition and submitted data. For a discount, the administrator can create a membership program. In the system, that means a collection of strings. In the form definition, the administrator defines, which membership program applies what discount and how to extract the key into the membership program from the from submission.
 ## Matching the keys
 The membership is a collection of keys. But some types of them are hard to match exactly. For example it might be important to ignore case or be culture invariant. For this reason, second column in the membership table is used, which is for the normalized key, that must be matched exactly against another normalized key. 
 For example, for full names, the process of normalization might remove diacritics or convert to lowercase. The same process must be applied when looking for the key.
@@ -1,50 +0,0 @@
 <?php
 class RsvMembershipService {
    /**
     * Total membership discount for a submission.
     *
     * Each binding names a form field whose submitted value must match a key
     * in the bound program. Matching bindings' discounts are combined per the
     * definition's combine mode: the best single discount, or all summed and
     * capped at 100%.
     */
    public function discount_for(RsvFormDefinition $def, RsvFormData $data): float {
        $repo = new RsvMembershipProgramRepository();
        $matched_discounts = [];
        foreach ($def->getMembershipBindings() as $binding) {
            $program_id = intval($binding['program_id'] ?? 0);
            $discount   = floatval($binding['discount'] ?? 0.0);
            $field      = strval($binding['field'] ?? '');
            if ($program_id <= 0 || $field === '') {
                continue;
            }
            $raw   = $data->getValue($field, '');
            $value = is_scalar($raw) ? trim((string) $raw) : '';
            if ($value === '') {
                continue;
            }
            if ($repo->key_exists($program_id, $value)) {
                $matched_discounts[] = $discount;
            }
        }
        if (empty($matched_discounts)) {
            return 0.0;
        }
        if ($def->getMembershipCombine() === 'sum') {
            return min(100.0, array_sum($matched_discounts));
        }
        return max($matched_discounts);
    }
 }
@@ -27,9 +27,6 @@ class RsvReservationService {
    }
    public function create(RsvReservation $reservation) {
        $reservation->timetable_reservations =
            $this->merge_adjacent($reservation->timetable_reservations);
        // Serialise the availability-check + insert per timetable so two
        // concurrent bookings for the last free slot can't both pass the
        // capacity check and oversell. Locks are taken in a stable order to
@@ -53,10 +50,9 @@ class RsvReservationService {
            try {
                $reservation_id = $this->repo->insert($reservation->to_array());
                $reservation->id = $reservation_id;
                foreach ($reservation->timetable_reservations as $timetable_reservation) {
-                    $timetable_reservation->id = $timetable_reservation_service->create($reservation_id, $timetable_reservation);
+                    $timetable_reservation_service->create($reservation_id, $timetable_reservation);
                }
                Db::commit();
@@ -68,19 +64,7 @@ class RsvReservationService {
            // Only now that the rows are durably committed do we let listeners
            // (maintainer emails, calendar sync) observe the new reservation.
-            foreach($reservation->timetable_reservations as $timetable_reservation) {
+            $timetable_reservation_service->flush_deferred_events();
                if($timetable_reservation->is_confirmed === null) {
                    $maintainer_email = (new RsvTimetableRepository())->get_maintainer_email($timetable_reservation->timetable_id);
                    RsvEventDispatcher::dispatch(new RsvTimetableReservationPendingEvent(
                        $reservation_id,
                        $timetable_reservation,
                        $timetable_reservation_service->get_confirmation_code($timetable_reservation->id),
                        $maintainer_email
                    ));
                }
                RsvEventDispatcher::dispatch(new RsvTimetableReservationCreatedEvent($timetable_reservation, $reservation));
            }
            $this->confirmation_state_changed($reservation_id);
@@ -96,48 +80,6 @@ class RsvReservationService {
        return Db::prefix() . 'rsv_booking_' . $timetable_id;
    }
    /**
     * Collapse runs of touching reservations into single spans, so a sequence
     * of back-to-back blocks is stored and notified as one booking.
     *
     * @param  list<RsvTimetableReservation> $timetable_reservations
     * @return list<RsvTimetableReservation>
     */
    private function merge_adjacent(array $timetable_reservations): array {
        $by_timetable = [];
        foreach ($timetable_reservations as $tr) {
            $by_timetable[$tr->timetable_id][] = $tr;
        }
        $merged = [];
        foreach ($by_timetable as $group) {
            usort($group, fn($a, $b) => $a->start_utc <=> $b->start_utc);
            $current = null;
            foreach ($group as $tr) {
                if ($current !== null && $tr->start_utc <= $current->end_utc) {
                    if ($tr->end_utc > $current->end_utc) {
                        $current->end_utc = $tr->end_utc;
                    }
                    continue;
                }
                if ($current !== null) {
                    $merged[] = $current;
                }
                $current = new RsvTimetableReservation(
                    null, $tr->timetable_id, $tr->start_utc, $tr->end_utc
                );
            }
            if ($current !== null) {
                $merged[] = $current;
            }
        }
        return $merged;
    }
    /** Delete a reservation and its dependent timetable reservations and confirmations. */
    public function delete(int $id): void {
        $this->repo->delete($id);
@@ -35,15 +35,6 @@ class RsvTimetableReservationService {
            ->get_overlapping_capacity($timetable_id, $start_utc, $end_utc);
        if (count($overlapping_capacity) === 0) {
            Logger::error("No available capacity for timetable_id: $timetable_id, start_utc: " . $start_utc->format('Y-m-d H:i:s') . ", end_utc: " . $end_utc->format('Y-m-d H:i:s'));
            return false;
        }
        $max_lead_time    = max(array_map(fn($c) => (int) $c->min_lead_time_minutes, $overlapping_capacity));
        $earliest_allowed = new DateTime('now', new DateTimeZone('UTC'));
        $earliest_allowed->modify("+{$max_lead_time} minutes");
        if ($start_utc < $earliest_allowed) {
            Logger::error("Reservation rejected: minimum lead time of {$max_lead_time} minutes not met for timetable_id: $timetable_id");
            return false;
        }
@@ -51,7 +42,6 @@ class RsvTimetableReservationService {
        $end_min   = $this->time_of_day_minutes($end_utc);
        if ((int) $overlapping_capacity[0]->start_time > $start_min) {
            Logger::error("Overlapping capacity start_time: " . (int) $overlapping_capacity[0]->start_time . " is after the reservation start_time: $start_min");
            return false;
        }
@@ -69,7 +59,6 @@ class RsvTimetableReservationService {
        $capacity     = (int) $overlapping_capacity[0]->capacity;
        $reservations = $this->repo->get_overlapping($timetable_id, $start_utc, $end_utc);
        error_log('reservations: ' . json_encode($reservations));
        return count($reservations) < $capacity;
    }
@@ -115,9 +104,13 @@ class RsvTimetableReservationService {
        return $this->repo->has_pending_confirmation($reservation_id);
    }
-    public function get_confirmation_code(int $reservation_id): ?string {
+    private function get_confirmation_code(int $reservation_id): string {
        $code = $this->repo->get_confirmation_code($reservation_id);
        if ($code === null) {
            throw new InvalidArgumentException('No pending confirmation for this reservation.');
        }
        return $code;
    }
@@ -153,13 +146,20 @@ class RsvTimetableReservationService {
            if ($maintainer_email) {
                $code = $this->create_confirmation($reservation_id, $id);
                $this->deferred_events[] = new RsvTimetableReservationPendingEvent(
                    $reservation_id,
                    $reservation,
                    $code,
                    $maintainer_email
                );
            }
        } else {
            $reservation->is_confirmed = 1;
            $reservation_service = new RsvReservationService();
            $reservation_service->confirmation_state_changed($reservation_id);
        }
        $this->deferred_events[] = new RsvTimetableReservationCreatedEvent($reservation);
        return $id;
    }
@@ -98,8 +98,7 @@ class RsvTimetableService {
                    $availabilities[] = new RsvTimetableAvailability($i * $block_length, ($i + 1) * $block_length, $block_length, []);
                }
-                $max_lead_time = empty($capacity_stack) ? 0 : max(array_map(fn($x) => $x->min_lead_time_minutes, $capacity_stack));
+                $availabilities[$availability_idx]->push_block($total_capacity - count($reservation_stack));
                $availabilities[$availability_idx]->push_block($total_capacity - count($reservation_stack), $max_lead_time);
            } else if($total_capacity === 0 && count($availabilities) !== $availability_idx) {
                $availability_idx++;
            }
@@ -106,7 +106,6 @@ class RsvFormsPage extends RsvAdminPage {
        $next_id    = count($elements_with_ids) + 1;
        $timetables = (new RsvTimetableService())->get_all();
        $programs   = array_map(fn($p) => $p->to_array(), (new RsvMembershipProgramRepository())->all());
        $email_key_options = ['' => '— select field —'];
        foreach ($raw_elements as $el) {
@@ -127,72 +126,38 @@ class RsvFormsPage extends RsvAdminPage {
        echo RsvFormBuilder::create('edit_form_definition', get_rest_url(null, 'reservations/v1/form-definition/' . $id), 'PUT', 'Form definition updated.')
            ->text('name', 'Name', '', true, $form_def['name'])
            ->select('definition.email_key', 'Email Key', $email_key_options, "Form field that holds the submitter's email address.", true, $definition['email_key'] ?? '')
            ->code('definition.success_message', 'Success message', 'Shown to the visitor after a successful submission. HTML is allowed. Use <reservation-summary></reservation-summary> to display the selected reservations. Leave blank for the default message.', $definition['success_message'] ?? '')
            ->render();
        ?>
        <hr>
        <h2>Membership Discounts</h2>
        <p>Map a membership program to a discount percentage. The chosen field's value must match a key in that program for the discount to apply.</p>
        <?php
        $membership = $definition['membership'] ?? [];
        $bindings   = $membership['bindings'] ?? [];
        ?>
        <div id="rsv_membership_bindings_table"></div>
        <p>
            <button type="button" class="button" id="rsv_add_binding_btn">+ Add Binding</button>
        </p>
        <label>
            Combine mode:
            <select name="definition.membership_combine">
                <option value="max" <?= ($membership['combine'] ?? 'max') === 'max' ? 'selected' : '' ?>>Max (best discount wins)</option>
                <option value="sum" <?= ($membership['combine'] ?? 'max') === 'sum' ? 'selected' : '' ?>>Sum (capped at 100%)</option>
            </select>
        </label>
        <hr>
        <?php
        RsvColumnLayout::split('3:2')
            ->column(function (): void { ?>
        <h2>Form Elements</h2>
        <p>Define the fields that will appear in this form.</p>
        <div id="form_elements_table"></div>
        <p>
            <button type="button" class="button" id="rsv_add_element_btn">+ Add Element</button>
        </p>
        <p class="submit">
            <button type="submit" form="edit_form_definition" class="button button-primary">Update Form Definition</button>
        </p>
            <?php })
            ->column(function (): void { ?>
                <h3>Live preview</h3>
                <div id="rsv_form_preview" class="rsv-form-preview" style="position: sticky; top: 40px;"></div>
            <?php })
            ->output();
        ?>
-        <?php $this->elements_table_script($elements_with_ids, $next_id, 'edit_form_definition', $element_types, $timetables, $programs, $bindings); ?>
+        <?php $this->elements_table_script($elements_with_ids, $next_id, 'edit_form_definition', $element_types, $timetables); ?>
        <?php
    }
-    private function elements_table_script(array $elements_with_ids, int $next_id, string $form_id, array $element_types, array $timetables = [], array $programs = [], array $bindings = []): void {
+    private function elements_table_script(array $elements_with_ids, int $next_id, string $form_id, array $element_types, array $timetables = []): void {
        $elements_json   = json_encode($elements_with_ids);
        $types_json      = json_encode(array_values($element_types));
        $timetables_json = json_encode(array_values($timetables));
        $programs_json   = json_encode(array_values($programs));
        $bindings_json   = json_encode(array_values($bindings));
        $bindings_next   = count($bindings) + 1;
        ?>
        <script>
        const rsv_element_types = <?= $types_json ?>;
        const rsv_timetables    = <?= $timetables_json ?>;
        const rsv_membership_programs = <?= $programs_json ?>;
        const RSV_EMAIL_DEFAULTS = {
            accepted_subject: <?= json_encode('Rezervace přijata') ?>,
            accepted_body:    <?= json_encode("<h1>Vaše rezervace byla přijata</h1>\n<p>Vaše rezervace byla schválena. Těšíme se na vás!</p>") ?>,
            refused_subject:  <?= json_encode('Rezervace zamítnuta') ?>,
            refused_body:     <?= json_encode("<h1>Vaše rezervace byla zamítnuta</h1>\n<p>Vaše rezervace bohužel nebyla schválena. Zkuste prosím jiný termín.</p>") ?>,
            maintainer_subject: <?= json_encode('Nová rezervace čeká na schválení') ?>,
            maintainer_body:    <?= json_encode("<h1>Nový požadavek o rezervaci</h1>\n<p>Rezervace č. {{reservation_id}} čeká na vaše schválení.</p>\n<p><strong>Datum:</strong> {{date}}</p>\n<p><strong>Čas:</strong> {{start}} – {{end}}</p>\n<p><reservation-actions></reservation-actions></p>") ?>,
        };
        const rsv_elements_source = (function(initial_items, next_id_start) {
@@ -210,7 +175,7 @@ class RsvFormsPage extends RsvAdminPage {
                    if (idx === -1) return Promise.reject(new Error('Element not found'));
                    // Destructure reservation-specific fields so they don't bleed into extra_attrs.
                    const { id: _id, name: _n, label: _l, type: _t, desc: _d, required: _r,
-                            price_per_block: _p, email_templates: _et, timetable_id: _ti, tag: _tag, ...extra_attrs } = items[idx];
+                            price_per_block: _p, email_templates: _et, timetable_id: _ti, ...extra_attrs } = items[idx];
                    items[idx] = {
                        ...extra_attrs,
                        id,
@@ -224,17 +189,10 @@ class RsvFormsPage extends RsvAdminPage {
                            pattern:         data.pattern ?? '',
                            pattern_message: data.pattern_message ?? '',
                        } : {}),
                        ...(data.type === 'output-text' ? {
                            tag: data.tag ?? 'p',
                        } : {}),
                        ...(data.type === 'reservation' ? {
                            timetable_id:    data.timetable_id ? parseInt(data.timetable_id) : null,
                            price_per_block: parseFloat(data.price_per_block ?? '0') || 0,
                            email_templates: {
                                maintainer: {
                                    subject: data.email_maintainer_subject ?? RSV_EMAIL_DEFAULTS.maintainer_subject,
                                    body:    data.email_maintainer_body    ?? RSV_EMAIL_DEFAULTS.maintainer_body,
                                },
                                on_accepted: {
                                    enabled: !!data.email_accepted_enabled,
                                    subject: data.email_accepted_subject ?? RSV_EMAIL_DEFAULTS.accepted_subject,
@@ -273,98 +231,6 @@ class RsvFormsPage extends RsvAdminPage {
            };
        })(<?= $elements_json ?>, <?= $next_id ?>);
        const rsv_bindings_source = (function(initial_items, next_id_start) {
            const items = (initial_items || []).map((b, i) => ({
                id:         i + 1,
                program_id: parseInt(b.program_id) || 0,
                discount:   parseFloat(b.discount) || 0,
                field:      b.field ?? '',
            }));
            let next_id = next_id_start;
            return {
                get_page(skip, limit) {
                    skip = skip ?? 0;
                    limit = limit ?? 20;
                    return Promise.resolve({ total: items.length, data: items.slice(skip, skip + limit) });
                },
                put(id, data) {
                    const idx = items.findIndex(e => e.id === id);
                    if (idx === -1) return Promise.reject(new Error('Binding not found'));
                    items[idx] = {
                        id,
                        program_id: parseInt(data.program_id) || 0,
                        discount:   parseFloat(data.discount) || 0,
                        field:      data.field ?? '',
                    };
                    return Promise.resolve(items[idx]);
                },
                add() {
                    const item = { id: next_id++, program_id: 0, discount: 0, field: '' };
                    items.push(item);
                    return item;
                },
                remove(id) {
                    const idx = items.findIndex(e => e.id === id);
                    if (idx !== -1) items.splice(idx, 1);
                },
                get_all() {
                    return items
                        .filter(b => b.program_id > 0)
                        .map(({ id, ...rest }) => rest);
                },
            };
        })(<?= $bindings_json ?>, <?= $bindings_next ?>);
        function rsv_collect_definition() {
            const form = document.getElementById('<?= $form_id ?>');
            const get  = (n) => form?.querySelector(`[name="${n}"]`)?.value ?? '';
            return {
                name: get('name'),
                definition: {
                    email_key:        get('definition.email_key'),
                    success_message:  get('definition.success_message'),
                    membership:       {
                        bindings: rsv_bindings_source.get_all(),
                        combine:  get('definition.membership_combine') || 'max',
                    },
                    elements:         rsv_elements_source.get_all(),
                },
            };
        }
        const rsv_preview_el = document.getElementById('rsv_form_preview');
        let rsv_preview_timer = null;
        function rsv_schedule_preview() {
            if (!rsv_preview_el) return;
            clearTimeout(rsv_preview_timer);
            rsv_preview_timer = setTimeout(rsv_render_preview, 300);
        }
        function rsv_render_preview() {
            if (!rsv_preview_el) return;
            fetch('<?= get_rest_url(null, 'reservations/v1/form-definition/preview') ?>', {
                method: 'POST',
                credentials: 'same-origin',
                headers: {
                    'Content-Type': 'application/json',
                    'Accept': 'application/json',
                    'X-WP-Nonce': ReservairServiceAPI.nonce,
                },
                body: JSON.stringify(rsv_collect_definition()),
            })
            .then(r => r.ok ? r.json() : r.json().then(e => { throw new Error(e.error || 'Preview failed'); }))
            .then(data => {
                rsv_preview_el.innerHTML = data.html || '<p class="rsv-preview-empty">No fields to preview yet.</p>';
            })
            .catch(() => { rsv_preview_el.innerHTML = '<p class="rsv-preview-empty">Preview unavailable.</p>'; });
        }
        // The preview form is inert: block submission (capture so it works after re-render).
        rsv_preview_el?.addEventListener('submit', (e) => e.preventDefault(), true);
        function rsv_render_element_inline_form(dt, row, data) {
            const builder = RsvInlineFormBuilder.create(rsv_elements_source)
                .fieldset('Element', '50%')
@@ -376,7 +242,6 @@ class RsvFormsPage extends RsvAdminPage {
                    .input_checkbox('required', 'Required', data?.required ?? false);
            if ((data?.type ?? rsv_element_types[0]) === 'reservation') {
                const maintainer = data?.email_templates?.maintainer  ?? {};
                const accepted = data?.email_templates?.on_accepted ?? {};
                const refused  = data?.email_templates?.on_refused  ?? {};
                const timetable_options = [
@@ -386,9 +251,6 @@ class RsvFormsPage extends RsvAdminPage {
                builder
                    .input_select('timetable_id', 'Timetable', timetable_options, data?.timetable_id ?? '')
                    .input_number('price_per_block', 'Price per block', data?.price_per_block ?? 0)
                    .fieldset('Email - for maintainer', '100%')
                        .input_text('email_maintainer_subject', 'Subject', maintainer.subject ?? RSV_EMAIL_DEFAULTS.maintainer_subject)
                        .input_textarea('email_maintainer_body', 'Body', maintainer.body ?? RSV_EMAIL_DEFAULTS.maintainer_body)
                    .fieldset('Email — accepted', '100%')
                        .input_checkbox('email_accepted_enabled', 'Send email when accepted', accepted.enabled ?? true)
                        .input_text('email_accepted_subject', 'Subject', accepted.subject ?? RSV_EMAIL_DEFAULTS.accepted_subject)
@@ -399,19 +261,6 @@ class RsvFormsPage extends RsvAdminPage {
                        .input_textarea('email_refused_body', 'Body', refused.body ?? RSV_EMAIL_DEFAULTS.refused_body);
            }
            if ((data?.type ?? rsv_element_types[0]) === 'output-text') {
                builder
                    .input_select('tag', 'Tag', [
                        { value: 'p',  label: 'Paragraph (p)' },
                        { value: 'h1', label: 'Heading 1 (h1)' },
                        { value: 'h2', label: 'Heading 2 (h2)' },
                        { value: 'h3', label: 'Heading 3 (h3)' },
                        { value: 'h4', label: 'Heading 4 (h4)' },
                        { value: 'h5', label: 'Heading 5 (h5)' },
                        { value: 'h6', label: 'Heading 6 (h6)' },
                    ], data?.tag ?? 'p');
            }
            if ((data?.type ?? rsv_element_types[0]) === 'input-text') {
                builder
                    .input_select('validation', 'Validation', [
@@ -431,8 +280,8 @@ class RsvFormsPage extends RsvAdminPage {
                id: data?.id,
                colspan: 6,
                save_label: 'Save',
-                on_success: () => { elements_dt.refresh(); rsv_schedule_preview(); },
+                on_success: () => elements_dt.refresh(),
-                on_cancel:  () => { elements_dt.refresh(); rsv_schedule_preview(); },
+                on_cancel:  () => elements_dt.refresh(),
            });
            // Type swaps whole fieldsets, so re-render the inline form on change.
@@ -476,17 +325,14 @@ class RsvFormsPage extends RsvAdminPage {
                    'Move Up': RsvDataGrid.func_action(function(dt, row, data) {
                        rsv_elements_source.move_up(data.id);
                        dt.refresh();
                        rsv_schedule_preview();
                    }),
                    'Move Down': RsvDataGrid.func_action(function(dt, row, data) {
                        rsv_elements_source.move_down(data.id);
                        dt.refresh();
                        rsv_schedule_preview();
                    }),
                    'Remove': RsvDataGrid.func_action(function(dt, row, data) {
                        rsv_elements_source.remove(data.id);
                        dt.refresh();
                        rsv_schedule_preview();
                    }),
                }),
                'label':    RsvDataGrid.column('Label',       false),
@@ -519,7 +365,6 @@ class RsvFormsPage extends RsvAdminPage {
        document.getElementById('rsv_add_element_btn').onclick = function() {
            rsv_elements_source.add();
            elements_dt.refresh();
            rsv_schedule_preview();
        };
        }
@@ -540,98 +385,16 @@ class RsvFormsPage extends RsvAdminPage {
        }
        rsv_email_key_select?.addEventListener('focus', rsv_sync_email_key_options);
        // Membership discount bindings — edited in a data grid backed by the
        // in-memory source above; persisted with the rest of the definition.
        function rsv_binding_program_options() {
            return [
                { value: '', label: '— select program —' },
                ...rsv_membership_programs.map(p => ({ value: p.id, label: p.name })),
            ];
        }
        function rsv_binding_field_options() {
            const options = [{ value: '', label: '— select field —' }];
            for (const el of rsv_elements_source.get_all()) {
                if (!el.name) continue;
                options.push({ value: el.name, label: el.label ? `${el.label} (${el.name})` : el.name });
            }
            return options;
        }
        function rsv_render_binding_inline_form(dt, row, data) {
            return RsvInlineFormBuilder.create(rsv_bindings_source)
                .fieldset('Discount binding', '100%')
                    .input_select('program_id', 'Program', rsv_binding_program_options(), data?.program_id ?? '')
                    .input_number('discount', 'Discount %', data?.discount ?? 0)
                    .input_select('field', 'Field', rsv_binding_field_options(), data?.field ?? '')
                .build({
                    id: data?.id,
                    colspan: 3,
                    save_label: 'Save',
                    on_success: () => { rsv_bindings_dt.refresh(); rsv_schedule_preview(); },
                    on_cancel:  () => { rsv_bindings_dt.refresh(); rsv_schedule_preview(); },
                });
        }
        const rsv_bindings_table_el = document.getElementById('rsv_membership_bindings_table');
        if (rsv_bindings_table_el) {
            var rsv_bindings_dt = RsvDataGrid.create_data_grid(
                rsv_bindings_table_el,
                rsv_bindings_source,
                {
                    'program_id': RsvDataGrid.action_column('Program', false, {
                        'Edit': RsvDataGrid.edit_action(function(dt, row, data) {
                            row.classList.add(
                                'inline-edit-row', 'inline-edit-row-post',
                                'quick-edit-row',  'quick-edit-row-post',
                                'inline-edit-post', 'inline-editor'
                            );
                            row.replaceChildren(rsv_render_binding_inline_form(dt, row, data));
                        }),
                        'Remove': RsvDataGrid.func_action(function(dt, row, data) {
                            rsv_bindings_source.remove(data.id);
                            dt.refresh();
                            rsv_schedule_preview();
                        }),
                    }),
                    'discount': RsvDataGrid.column('Discount %', false),
                    'field':    RsvDataGrid.column('Field',      false),
                }
            );
            rsv_bindings_dt.map_column('program_id', (dt, row, data) => {
                const td = document.createElement('td');
                const p = rsv_membership_programs.find(p => String(p.id) === String(data.program_id));
                td.innerText = p ? p.name : (data.program_id ? `#${data.program_id}` : '—');
                return td;
            });
            rsv_bindings_dt.map_column('field', (dt, row, data) => {
                const td = document.createElement('td');
                const el = rsv_elements_source.get_all().find(e => e.name === data.field);
                td.innerText = data.field ? (el && el.label ? `${el.label} (${el.name})` : data.field) : '—';
                return td;
            });
            rsv_bindings_dt.refresh();
            document.getElementById('rsv_add_binding_btn')?.addEventListener('click', function() {
                rsv_bindings_source.add();
                rsv_bindings_dt.refresh();
                rsv_schedule_preview();
            });
        }
        const rsv_meta_form = document.getElementById('<?= $form_id ?>');
        ['name', 'definition.email_key', 'definition.success_message', 'definition.membership_combine'].forEach((n) => {
            const el = rsv_meta_form?.querySelector(`[name="${n}"]`);
            el?.addEventListener('input', rsv_schedule_preview);
            el?.addEventListener('change', rsv_schedule_preview);
        });
        RsvAdminForm.bind(document.getElementById('<?= $form_id ?>'), {
-            transform: () => rsv_collect_definition(),
+            transform: (body) => ({
                name: body.name,
                definition: {
                    email_key: body.definition?.email_key ?? '',
                    elements:  rsv_elements_source.get_all(),
                },
            }),
            refresh: () => { if (typeof forms_dt !== 'undefined') forms_dt.refresh(); },
        });
        rsv_render_preview();
        </script>
        <?php
    }
@@ -1,130 +0,0 @@
 <?php
 use Reservair\Forms\RsvFormBuilder;
 use Reservair\Layout\RsvColumnLayout;
 class RsvMembershipProgramsPage extends RsvAdminPage {
    protected function render_content(): void {
        if (isset($_GET['action']) && $_GET['action'] === 'edit' && isset($_GET['id'])) {
            $this->show_edit(intval($_GET['id']));
            return;
        }
        $this->show_list();
    }
    private function show_list(): void {
        ?>
        <h1>Membership Programs</h1>
        <hr>
        <?php
        RsvColumnLayout::split('1:2')
            ->column(function () {
                echo RsvFormBuilder::create('add_membership_program', get_rest_url(null, 'reservations/v1/membership-program'), 'POST', 'Membership program created.')
                    ->heading('Add Program')
                    ->nonce('my_action', 'add_membership_program_nonce')
                    ->text('name', 'Name')
                    ->render();
                ?>
                <hr>
                <p class="submit">
                    <button type="submit" form="add_membership_program" class="button button-primary">Add Program</button>
                </p>
            <?php })
            ->column(function () { ?>
                <div id="programs_table"></div>
                <script>
                var programs_dt = RsvDataGrid.create_data_grid(programs_table,
                    RsvMembershipProgramResource(), {
                        'id': RsvDataGrid.column('ID', false, 30),
                        'name': RsvDataGrid.action_column('Name', false, {
                            'Edit': RsvDataGrid.link_action((data) =>
                                `<?= menu_page_url('membership-programs', false) ?>&id=${data.id}&action=edit`
                            ),
                            'Delete': RsvDataGrid.func_action(function(dt, row, data) {
                                if (!confirm('Delete this program? This cannot be undone.')) return;
                                dt.resource.delete(data.id).then(() => programs_dt.refresh()).catch(err => alert(err.message));
                            }),
                        }),
                        'active': RsvDataGrid.column('Active', false),
                    });
                programs_dt.refresh();
                </script>
            <?php })
            ->output();
        ?>
        <script>
        RsvAdminForm.bind(document.getElementById('add_membership_program'), {
            refresh: () => { if (typeof programs_dt !== 'undefined') programs_dt.refresh(); },
        });
        </script>
        <?php
    }
    private function show_edit(int $id): void {
        $repo = new RsvMembershipProgramRepository();
        $program = $repo->get($id);
        if ($program === null) {
            echo '<div class="notice notice-error"><p>Program not found.</p></div>';
            return;
        }
        ?>
        <h1>Edit Program: <?= esc_html($program['name']) ?></h1>
        <a href="<?= menu_page_url('membership-programs', false) ?>">← Back to Programs</a>
        <hr>
        <?php
        echo RsvFormBuilder::create('edit_membership_program', get_rest_url(null, 'reservations/v1/membership-program/' . $id), 'PUT', 'Program updated.')
            ->text('name', 'Name', '', true, $program['name'])
            ->checkbox('active', 'Active', '', $program['active'] ?? true)
            ->render();
        ?>
        <script>
        RsvAdminForm.bind(document.getElementById('edit_membership_program'));
        </script>
        <hr>
        <h2>Roster</h2>
        <p>Each member is identified by a single key. The key format depends on the active membership strategy.</p>
        <?php
        RsvColumnLayout::split('1:2')
            ->column(function () use ($id) {
                echo RsvFormBuilder::create('add_membership_key', get_rest_url(null, 'reservations/v1/membership-program/' . $id . '/keys'), 'POST', 'Member added.')
                    ->heading('Add Member')
                    ->text('key_value', 'Key')
                    ->render();
                ?>
                <hr>
                <p class="submit">
                    <button type="submit" form="add_membership_key" class="button button-primary">Add Member</button>
                </p>
            <?php })
            ->column(function () use ($id) { ?>
                <div id="roster_table"></div>
                <script>
                var roster_dt = RsvDataGrid.create_data_grid(roster_table,
                    RsvMembershipKeyResource(<?= (int) $id ?>), {
                        'id': RsvDataGrid.column('ID', false, 30),
                        'key_value': RsvDataGrid.action_column('Key', false, {
                            'Delete': RsvDataGrid.func_action(function(dt, row, data) {
                                if (!confirm('Delete this member? This cannot be undone.')) return;
                                dt.resource.delete(data.id).then(() => roster_dt.refresh()).catch(err => alert(err.message));
                            }),
                        }),
                    });
                roster_dt.refresh();
                </script>
            <?php })
            ->output();
        ?>
        <script>
        RsvAdminForm.bind(document.getElementById('add_membership_key'), {
            refresh: () => { if (typeof roster_dt !== 'undefined') roster_dt.refresh(); },
            onSuccess: () => { document.getElementById('add_membership_key')?.reset(); },
        });
        </script>
        <?php
    }
 }
@@ -27,9 +27,7 @@ class Db {
    public static function get_results(string $sql, array $params = [], string $output = OBJECT): array {
        global $wpdb;
-        $query = empty($params) ? $sql : $wpdb->prepare($sql, $params);
+        $rows = $wpdb->get_results(empty($params) ? $sql : $wpdb->prepare($sql, $params), $output);
        error_log($query);
        $rows = $wpdb->get_results($query, $output);
        self::throw_if_error();
        return $rows ?? [];
    }
@@ -1,76 +0,0 @@
 <?php
 namespace Reservair\Forms;
 /**
 * Wraps WordPress' bundled CodeMirror (wp_enqueue_code_editor) as a drop-in
 * replacement for a <textarea>.
 *
 * The textarea stays the source of truth: CodeMirror mirrors its content back
 * on every edit, so any form serialization that reads the textarea's value
 * keeps working unchanged. When the user has turned syntax highlighting off in
 * their profile, this degrades to the plain textarea.
 */
 class RsvCodeEditor
 {
    /**
     * Renders a code-editor-backed <textarea> and arranges for it to be
     * upgraded to CodeMirror on the page.
     *
     * @param array{name?:string,value?:string,mode?:string,rows?:int,class?:string} $args
     *        mode is a MIME type understood by wp_enqueue_code_editor, e.g.
     *        'text/html' or 'text/css'.
     */
    public static function render(string $id, array $args = []): string
    {
        $name  = $args['name']  ?? $id;
        $value = $args['value'] ?? '';
        $mode  = $args['mode']  ?? 'text/html';
        $rows  = $args['rows']  ?? 8;
        $class = $args['class'] ?? 'large-text code';
        $textarea = '<textarea id="' . esc_attr($id) . '" name="' . esc_attr($name) . '"'
                  . ' rows="' . $rows . '" class="' . esc_attr($class) . '">'
                  . esc_textarea($value)
                  . '</textarea>';
        $settings = wp_enqueue_code_editor(['type' => $mode]);
        // Syntax highlighting disabled in the user's profile — keep it plain.
        if ($settings === false) {
            return $textarea;
        }
        self::schedule_init($id, $settings);
        return $textarea;
    }
    /**
     * Initializes CodeMirror on $id after the code editor script loads, and
     * keeps the underlying textarea in sync — including dispatching `input` so
     * listeners (live previews, change tracking) still fire while typing.
     *
     * @param array<array-key,mixed> $settings As returned by wp_enqueue_code_editor.
     */
    private static function schedule_init(string $id, array $settings): void
    {
        $id_json       = wp_json_encode($id);
        $settings_json = wp_json_encode($settings);
        if ($id_json === false || $settings_json === false) {
            return;
        }
        $script = '(function(){'
                . 'var ta=document.getElementById(' . $id_json . ');'
                . 'if(!ta||!window.wp||!wp.codeEditor)return;'
                . 'var ed=wp.codeEditor.initialize(ta,' . $settings_json . ');'
                . 'ed.codemirror.on("change",function(cm){'
                . 'cm.save();'
                . 'ta.dispatchEvent(new Event("input",{bubbles:true}));'
                . '});'
                . '})();';
        wp_add_inline_script('code-editor', $script);
    }
 }
@@ -194,30 +194,6 @@ class RsvFormBuilder
        return $this->row($id, $label, $ctrl, $desc);
    }
    /**
     * Syntax-highlighted editor backed by WordPress' bundled CodeMirror.
     *
     * Serializes exactly like {@see textarea()} — the underlying <textarea>
     * stays the source of truth.
     *
     * @param string $mode MIME type for highlighting, e.g. 'text/html'.
     */
    public function code(
        string $id,
        string $label,
        string $desc     = '',
        string $value    = '',
        string $mode     = 'text/html',
        int    $rows     = 8
    ): static {
        $ctrl = RsvCodeEditor::render($id, [
            'value' => $value,
            'mode'  => $mode,
            'rows'  => $rows,
        ]);
        return $this->row($id, $label, $ctrl, $desc);
    }
    public function custom(string $label, callable $fn) : static {
        $this->rows[] = '<tr>'
                      . '<th>' . esc_html($label) . '</th>'
@@ -1,90 +0,0 @@
 <?php
 namespace Reservair\Templating\Elements;
 use Reservair\Templating\RsvTemplateElement;
 use Reservair\Templating\RsvTemplateSymbols;
 use chillerlan\QRCode\Output\QRGdImagePNG;
 use chillerlan\QRCode\QRCode;
 use chillerlan\QRCode\Data\QRMatrix;
 use chillerlan\QRCode\QROptions;
 use chillerlan\QRCode\Output\QROutputInterface;
 /** Renders a QR payment code for the form's total price into an email body. */
 class RsvQrPaymentElement implements RsvTemplateElement {
    public function render(RsvTemplateSymbols $symbols): string {
        $account = trim((string) $symbols->get('account', ''));
        if ($account === '') {
            return ''; // No payee account configured — nothing to render.
        }
        $payload = $this->spayd(
            $account,
            (float)  $symbols->get('price', 0),
            (string) $symbols->get('currency', 'CZK'),
            (string) $symbols->get('message', ''),
            (string) $symbols->get('variable_symbol', '')
        );
        $src = $this->image_url($payload);
        if ($src === '') {
            return ''; // Image could not be written.
        }
        return '<img class="rsv-qr-payment" alt="' . esc_attr__('QR platba', 'reservair')
            . '" src="' . esc_url($src) . '" />';
    }
    public function symbols(): array {
        return ['account', 'currency', 'message', 'variable_symbol'];
    }
    /** Builds a SPAYD string (Czech QR payment). '*' is the field delimiter. */
    private function spayd(string $account, float $price, string $currency, string $message, string $vs): string {
        $parts = [
            'SPD*1.0',
            'ACC:' . $account,
            'AM:'  . number_format($price, 2, '.', ''),
            'CC:'  . $currency,
        ];
        if ($message !== '') {
            $parts[] = 'MSG:' . str_replace('*', ' ', $message);
        }
        if ($vs !== '') {
            $parts[] = 'X-VS:' . preg_replace('/\D/', '', $vs);
        }
        return implode('*', $parts);
    }
    /**
     * Writes the QR PNG under uploads (deduped by payload hash) and returns its
     * public URL, or '' if it could not be written.
     */
    private function image_url(string $payload): string {
        $uploads = wp_upload_dir();
        $dir     = $uploads['basedir'] . '/reservair-qr';
        $name    = hash('sha256', $payload) . '.png';
        $path    = $dir . '/' . $name;
        if (!file_exists($path)) {
            wp_mkdir_p($dir);
            if (file_put_contents($path, $this->png($payload)) === false) {
                return '';
            }
        }
        return $uploads['baseurl'] . '/reservair-qr/' . $name;
    }
    private function png(string $payload): string {
        $options = new QROptions();
        $options->version             = 7;
        $options->outputInterface     = QRGdImagePNG::class;
        $options->scale               = 4;
        $options->outputBase64        = false;
        $options->bgColor             = [200, 150, 200];
        return (string) (new QRCode($options))->render($payload);
    }
 }
@@ -1,37 +0,0 @@
 <?php
 namespace Reservair\Templating\Elements;
 use Reservair\Templating\RsvTemplateElement;
 use Reservair\Templating\RsvTemplateSymbols;
 /**
 * Renders accept / refuse action buttons for a reservation, for the maintainer
 * approval email. The links come from the template's accept_url and refuse_url
 * symbols; the button labels can be overridden with the accept-label and
 * refuse-label attributes.
 */
 class RsvReservationActionsElement implements RsvTemplateElement {
    /** Inline styles, since email clients ignore stylesheets. */
    private const string ACCEPT_STYLE = 'display:inline-block;padding:10px 18px;margin-right:8px;background:#2e7d32;color:#ffffff;text-decoration:none;border-radius:4px;font-weight:bold;';
    private const string REFUSE_STYLE = 'display:inline-block;padding:10px 18px;background:#c62828;color:#ffffff;text-decoration:none;border-radius:4px;font-weight:bold;';
    public function render(RsvTemplateSymbols $symbols): string {
        $accept_url = (string) $symbols->get('accept_url', '');
        $refuse_url = (string) $symbols->get('refuse_url', '');
        if ($accept_url === '' && $refuse_url === '') {
            return '';
        }
        $accept_label = (string) $symbols->get('accept-label', 'Přijmout');
        $refuse_label = (string) $symbols->get('refuse-label', 'Odmítnout');
        return '<a href="' . esc_url($accept_url) . '" style="' . self::ACCEPT_STYLE . '">' . esc_html($accept_label) . '</a>'
             . '<a href="' . esc_url($refuse_url) . '" style="' . self::REFUSE_STYLE . '">' . esc_html($refuse_label) . '</a>';
    }
    public function symbols(): array {
        return ['accept-label', 'refuse-label'];
    }
 }
@@ -1,22 +0,0 @@
 <?php
 namespace Reservair\Templating\Elements;
 use Reservair\Templating\RsvTemplateElement;
 use Reservair\Templating\RsvTemplateSymbols;
 /**
 * Emits the client-side summary placeholder. The browser-side RsvFormSender
 * locates this div after form submission and fills it with the visitor's
 * selected time slots.
 */
 class RsvReservationSummaryElement implements RsvTemplateElement {
    public function render(RsvTemplateSymbols $symbols): string {
        return '<div class="rsv-success-summary"></div>';
    }
    public function symbols(): array {
        return [];
    }
 }
@@ -1,26 +0,0 @@
 <?php
 namespace Reservair\Templating\Elements;
 use Reservair\Templating\RsvTemplateElement;
 use Reservair\Templating\RsvTemplateSymbols;
 /**
 * Renders a button that asks the form to clear itself. It only carries the
 * data-rsv-reset marker; RsvFormSender finds marked buttons in the success card
 * and links them to the form's cleanup. The label can be overridden with the
 * label attribute.
 */
 class RsvResetFormButtonElement implements RsvTemplateElement {
    public function render(RsvTemplateSymbols $symbols): string {
        $label = (string) $symbols->get('label', 'Odeslat znova');
        return '<button type="button" class="rsv-form-btn" data-rsv-reset>'
             . esc_html($label)
             . '</button>';
    }
    public function symbols(): array {
        return ['label'];
    }
 }
@@ -1,23 +0,0 @@
 # Templating
 Templates allow to replace place values of symbols in text written in one language. Templating itself requires a language. Therefore the process combines two languages.
 This plugin uses templates for success messages of forms & emails. The usage might expand in the future. That is one of the quality attributes of this requirement.
 ## Language
 As both use cases are using HTML (one is an email and another a webpage), the templates in this plugin also uses HTML. The frontend for HTML is `RsvHtmlTemplateParser`, that transforms it into an internal structure. The input language can be changed by writing a new frontend for the compiler in the future.
 The main advantage of HTML is that it can be easily extended with custom elements. But we do note that traditional custom elements using JS cannot be used, because JS would not work like that in emails for example.
 Extensions and the plugin itself can register custom elements to templates, for example `<reservation-summary>` that auto-expands onto a nice summary of the selected time slots.
 Atomic values and strings can be retrieved from submitted data using JSON Path RFC using this syntax: `{{ path }}`. The reason for JSON Path is the simplicity of implementation. We are careful not to overcomplicate the templating language, for a price of being less powerful. Helm language being the example of what not to do.
 The language can be easily validated for symbols existence and validity.
 ## Custom elements
 The Templating module calls `rsv-template-register-custom-elements` to register custom elements to templates. Plugins can subscribe to it and in the handler register their own custom elements.
 Custom element has a symbol table with values in the input and outputs string. If the custom element has attributes, like `<custom-element attr="test">`, the symbol `attr` with value `test` will also be added to the symbol table.
@@ -1,17 +0,0 @@
 <?php
 namespace Reservair\Templating;
 /** A registered handler for a hyphenated custom element tag. */
 interface RsvTemplateElement {
    /** Renders the element to a trusted HTML string given the resolved symbol table. */
    public function render(RsvTemplateSymbols $symbols): string;
    /**
     * Returns the symbol names this element understands — used by validation to
     * report missing or extra attributes.
     *
     * @return list<string>
     */
    public function symbols(): array;
 }
@@ -1,250 +0,0 @@
 <?php
 namespace Reservair\Templating;
 use Reservair\Logger\Logger;
 /**
 * Renders templates in two phases: first it substitutes {{ path }} interpolations
 * with values from the data, then it walks the HTML and expands the registered
 * custom elements. The public entry point for the module.
 */
 class RsvTemplateEngine {
    public readonly RsvTemplateRegistry $registry;
    public function __construct(?RsvTemplateRegistry $registry = null) {
        $this->registry = $registry ?? new RsvTemplateRegistry();
    }
    /**
     * Renders $source as HTML. Interpolated scalar values are HTML-escaped;
     * custom elements emit their own trusted markup.
     *
     * @param array<string, mixed> $data
     */
    public function render(string $source, array $data = []): string {
        try {
            return $this->expand_elements(
                $this->interpolate($source, $data, escape: true),
                $data,
            );
        } catch (RsvTemplateException $e) {
            throw $e;
        } catch (\Throwable $e) {
            Logger::error($e);
            throw new RsvTemplateException('Template render failed: ' . $e->getMessage(), 0, $e);
        }
    }
    /**
     * Renders $source for a plain-text context such as an email subject: values
     * are substituted without HTML-escaping and all tags are stripped.
     *
     * @param array<string, mixed> $data
     */
    public function render_plain(string $source, array $data = []): string {
        return trim(wp_strip_all_tags($this->interpolate($source, $data, escape: false)));
    }
    /**
     * Lists a template's problems without rendering it (empty = valid): empty
     * interpolations, references to unknown symbols, unregistered custom
     * elements, and attributes an element does not declare.
     *
     * @param list<string>|null $symbols When given, the roots an interpolation may
     *        reference; a path rooted outside the set is reported as unknown. Null
     *        skips the reference check (any path is accepted).
     * @return list<string>
     */
    public function validate(string $source, ?array $symbols = null): array {
        $errors = [];
        if (preg_match_all('/{{\s*([^}]*?)\s*}}/', $source, $matches)) {
            foreach ($matches[1] as $path) {
                $expr = trim($path);
                if ($expr === '') {
                    $errors[] = 'Empty interpolation: {{ }}';
                    continue;
                }
                $root = $this->tokens($expr)[0] ?? null;
                if ($symbols !== null && $root !== null && !in_array($root, $symbols, true)) {
                    $errors[] = "Unknown reference: {{ {$expr} }}";
                }
            }
        }
        foreach ($this->custom_elements($this->load($source)) as $element) {
            $handler = $this->registry->get($element->tagName);
            if ($handler === null) {
                $errors[] = "Unregistered custom element: <{$element->tagName}>";
                continue;
            }
            $allowed = $handler->symbols();
            foreach ($this->attributes($element) as $name => $value) {
                if (!in_array($name, $allowed, true)) {
                    $errors[] = "Unknown attribute \"{$name}\" on <{$element->tagName}>";
                }
            }
        }
        return $errors;
    }
    // -------------------------------------------------------------------------
    // Phase 1 — interpolation
    // -------------------------------------------------------------------------
    /** @param array<string, mixed> $data */
    private function interpolate(string $source, array $data, bool $escape): string {
        return preg_replace_callback('/{{\s*([^}]+?)\s*}}/', function (array $match) use ($data, $escape): string {
            $value = $this->resolve($match[1], $data);
            if (!is_scalar($value)) {
                return ''; // null and non-scalar (arrays/objects) render empty
            }
            $string = (string) $value;
            return $escape ? esc_html($string) : $string;
        }, $source) ?? $source;
    }
    // -------------------------------------------------------------------------
    // Phase 2 — custom element expansion
    // -------------------------------------------------------------------------
    /**
     * Replaces each registered custom element with its handler's output. The
     * element is swapped for a unique comment marker, the document is serialised,
     * and the markers are substituted for the (trusted) handler strings — so the
     * output is never re-escaped by the serialiser.
     *
     * @param array<string, mixed> $data
     */
    private function expand_elements(string $html, array $data): string {
        // Skip the DOM round-trip unless a hyphenated tag could match a handler.
        if ($this->registry->all() === [] || !preg_match('/<[a-z][a-z0-9]*-/i', $html)) {
            return $html;
        }
        $dom          = $this->load($html);
        $nonce        = 'rsv-' . bin2hex(random_bytes(6));
        $replacements = [];
        foreach ($this->custom_elements($dom) as $i => $element) {
            $handler = $this->registry->get($element->tagName);
            if ($handler === null) {
                continue; // leave unknown custom elements in place
            }
            $token                           = "{$nonce}-{$i}";
            $replacements["<!--{$token}-->"] = $handler->render(
                new RsvTemplateSymbols(array_merge($data, $this->attributes($element)))
            );
            $element->parentNode?->replaceChild($dom->createComment($token), $element);
        }
        return strtr($this->serialize($dom), $replacements);
    }
    // -------------------------------------------------------------------------
    // JSON Path resolver
    // -------------------------------------------------------------------------
    /**
     * Resolves a minimal JSON Path expression against $data.
     *
     * Supported forms: bare key, $.key, $.a.b, $.items[0], $['key'].
     * Returns null for a missing path; the renderer emits an empty string for null.
     *
     * @param array<string, mixed> $data
     */
    private function resolve(string $path, array $data): mixed {
        $current = $data;
        foreach ($this->tokens($path) as $token) {
            if (!is_array($current) || !array_key_exists($token, $current)) {
                return null;
            }
            $current = $current[$token];
        }
        return $current;
    }
    /**
     * Splits a JSON Path into its key tokens, dropping the root sigil and
     * bracket-notation quotes — e.g. "$.items[0]" yields ['items', '0'].
     *
     * @return list<string>
     */
    private function tokens(string $path): array {
        $raw    = preg_split('/[\.\[\]]+/', $path, -1, PREG_SPLIT_NO_EMPTY) ?: [];
        $tokens = [];
        foreach ($raw as $token) {
            if ($token === '$') {
                continue; // root sigil
            }
            $tokens[] = trim($token, "'\""); // strip bracket-notation quotes
        }
        return $tokens;
    }
    // -------------------------------------------------------------------------
    // DOM helpers
    // -------------------------------------------------------------------------
    private function load(string $html): \DOMDocument {
        $dom  = new \DOMDocument();
        $prev = libxml_use_internal_errors(true);
        // The XML encoding hint forces UTF-8; NOIMPLIED/NODEFDTD keep the fragment
        // free of the synthetic <html>/<body>/doctype wrappers libxml adds.
        $dom->loadHTML(
            '<?xml encoding="UTF-8">' . $html,
            LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD,
        );
        libxml_clear_errors();
        libxml_use_internal_errors($prev);
        // Drop the encoding hint, which libxml leaves behind as a stray node.
        foreach (iterator_to_array($dom->childNodes) as $node) {
            if ($node instanceof \DOMProcessingInstruction
                || ($node instanceof \DOMComment && str_contains((string) $node->nodeValue, 'xml encoding'))) {
                $dom->removeChild($node);
            }
        }
        return $dom;
    }
    /**
     * Every hyphenated element in document order — registered or not.
     *
     * @return list<\DOMElement>
     */
    private function custom_elements(\DOMDocument $dom): array {
        $elements = [];
        foreach ((new \DOMXPath($dom))->query('//*[contains(local-name(), "-")]') as $node) {
            if ($node instanceof \DOMElement) {
                $elements[] = $node;
            }
        }
        return $elements;
    }
    /** @return array<string, string> */
    private function attributes(\DOMElement $element): array {
        $attributes = [];
        if ($element->hasAttributes()) {
            foreach ($element->attributes as $attribute) {
                $attributes[$attribute->name] = $attribute->value;
            }
        }
        return $attributes;
    }
    private function serialize(\DOMDocument $dom): string {
        $html = '';
        foreach ($dom->childNodes as $child) {
            $html .= $dom->saveHTML($child);
        }
        return $html;
    }
 }
@@ -1,5 +0,0 @@
 <?php
 namespace Reservair\Templating;
 class RsvTemplateException extends \RuntimeException {}
@@ -1,41 +0,0 @@
 <?php
 namespace Reservair\Templating;
 /** Holds the mapping from custom element tag names to their handlers. */
 class RsvTemplateRegistry {
    /** @var array<string, RsvTemplateElement> */
    private array $elements = [];
    public function register(string $tag, RsvTemplateElement $element): void {
        $this->elements[$tag] = $element;
    }
    public function get(string $tag): ?RsvTemplateElement {
        return $this->elements[$tag] ?? null;
    }
    /** @return array<string, RsvTemplateElement> */
    public function all(): array {
        return $this->elements;
    }
    /**
     * Extends a wp_kses allowlist so the registered custom elements survive
     * sanitization of admin HTML. Each element contributes its tag and the
     * attributes it declares via symbols().
     *
     * @param array<string, mixed> $base A wp_kses allowed-html map to extend.
     * @return array<string, mixed>
     */
    public function kses_allowed(array $base = []): array {
        foreach ($this->elements as $tag => $element) {
            $attributes = [];
            foreach ($element->symbols() as $name) {
                $attributes[$name] = true;
            }
            $base[$tag] = $attributes;
        }
        return $base;
    }
 }
@@ -1,18 +0,0 @@
 <?php
 namespace Reservair\Templating;
 /** Immutable symbol table passed to custom-element handlers. */
 class RsvTemplateSymbols {
    /** @param array<string, mixed> $data */
    public function __construct(private readonly array $data) {}
    /** @return array<string, mixed> */
    public function all(): array {
        return $this->data;
    }
    public function get(string $name, mixed $default = null): mixed {
        return $this->data[$name] ?? $default;
    }
 }
@@ -639,6 +639,9 @@
    <ClassMustBeFinal>
      <code><![CDATA[RsvFormDefinition]]></code>
    </ClassMustBeFinal>
    <InvalidArrayOffset>
      <code><![CDATA[$definition['email_key']]]></code>
    </InvalidArrayOffset>
    <MissingPropertyType>
      <code><![CDATA[$_elements]]></code>
    </MissingPropertyType>
@@ -1,9 +1,4 @@
 <?php
 use Reservair\Templating\Elements\RsvReservationSummaryElement;
 use Reservair\Templating\Elements\RsvReservationActionsElement;
 use Reservair\Templating\Elements\RsvResetFormButtonElement;
 use Reservair\Templating\Elements\RsvQrPaymentElement;
 /**
 * Plugin Name:       Reservair
 * Description:       A reservation and booking system for WordPress. Site visitors browse available time slots and submit reservation requests via a Gutenberg block; administrators manage timetables, services, forms, and reservations from the WordPress admin panel.
@@ -34,7 +29,7 @@ register_activation_hook( __FILE__, [ 'RsvInstaller', 'install' ] );
 * plugins we might interact with) is fully loaded.
 */
 function rsv_bootstrap(): void {
-	global $rsv_form_registry, $rsv_template_registry, $rsv_form_price_registry;
+	global $rsv_form_registry;
 	// Re-grant the custom capability after a plugin *update* (the activation hook
 	// only runs on activate). No-op once the stored version matches.
@@ -52,31 +47,6 @@ function rsv_bootstrap(): void {
 	$rsv_form_registry->register( 'button',                     new RsvButtonElementHandler() );
 	$rsv_form_registry->register( 'reservation',                new RsvFormReservationElementHandler() );
 	$rsv_form_registry->register( 'output-reservation-summary', new RsvReservationSummaryElementHandler() );
 	$rsv_form_registry->register( 'output-text',                new RsvOutputTextElementHandler() );
 	// Price calculators — extensions add per-element calculators via the action.
 	add_action( 'rsv-register-price-calculator', function ( RsvFormPriceCalculatorRegistry $reg ): void {
 		$reg->register( 'reservation', function ( RsvFormElementDefinition $def, $value ): float {
 			if ( ! is_array( $value ) || ! is_array( $value['timetable_reservations'] ?? null ) ) {
 				return 0.0;
 			}
 			$price_per_block = (float) $def->getAttr( 'price_per_block', 0 );
 			return $price_per_block * count( $value['timetable_reservations'] );
 		} );
 	} );
 	$rsv_form_price_registry = RsvFormPriceCalculatorRegistry::boot();
 	// Template custom-element registry. Extensions register via the action.
 	add_action( 'rsv-template-register-custom-elements', function ( \Reservair\Templating\RsvTemplateRegistry $reg ): void {
 		$reg->register( 'reservation-summary', new RsvReservationSummaryElement() );
 		$reg->register( 'reservation-actions', new RsvReservationActionsElement() );
 		$reg->register( 'reset-form-button',   new RsvResetFormButtonElement() );
 		$reg->register( 'qr-payment', new RsvQrPaymentElement() );
 	} );
 	$rsv_template_registry = new \Reservair\Templating\RsvTemplateRegistry();
 	do_action( 'rsv-template-register-custom-elements', $rsv_template_registry );
 }
 add_action( 'plugins_loaded', 'rsv_bootstrap' );
@@ -1,6 +1,5 @@
-// The client bundle (custom elements, form sender, client styles) is loaded
+import './client.js';
-// separately under the shared `rsv-client` handle — see rsv_enqueue_admin_assets.
+
 // Bundling it here too would run customElements.define() twice in the editor.
 import '../assets/css/RsvAdminStyle.css';
 import { RsvDataGrid } from '../assets/js/elements/RsvDatagrid.js';
@@ -12,8 +11,6 @@ import { RsvFormDefinitionResource } from '../assets/js/datasource/RsvFormDefini
 import { RsvTimetableResource } from '../assets/js/datasource/RsvTimetableResource.js';
 import { RsvTimetableCapacityResource } from '../assets/js/datasource/RsvTimetableCapacityResource.js';
 import { RsvTimetableReservationResource } from '../assets/js/datasource/RsvTimetableReservationResource.js';
 import { RsvMembershipProgramResource } from '../assets/js/datasource/RsvMembershipProgramResource.js';
 import { RsvMembershipKeyResource } from '../assets/js/datasource/RsvMembershipKeyResource.js';
 import { RsvReservationClient } from '../assets/js/datasource/RsvReservationClient.js';
 window.RsvDataGrid = RsvDataGrid;
@@ -24,6 +21,4 @@ window.RsvFormDefinitionResource = RsvFormDefinitionResource;
 window.RsvTimetableResource = RsvTimetableResource;
 window.RsvTimetableCapacityResource = RsvTimetableCapacityResource;
 window.RsvTimetableReservationResource = RsvTimetableReservationResource;
 window.RsvMembershipProgramResource = RsvMembershipProgramResource;
 window.RsvMembershipKeyResource = RsvMembershipKeyResource;
 window.RsvReservationClient = RsvReservationClient;