@acms-subir/core 0.3.3-next.20260929113209 → 0.3.4

package/src/lib/booking/holds.ts

@@ -0,0 +1,120 @@
+// Rooms held by events. An event that lists rooms/people in roomHold makes
+// them unbookable while it happens (± setup/cleanup) or for the whole day.
+// Holds are computed from events every time — never stored as bookings — so
+// moving, repeating, skipping a date, cancelling or deleting the event frees
+// or moves the room automatically. availabilityContext() adds these to its
+// busy list, so every booking path (pages, embeds, app, API, agent) obeys.
+import type { ContentRepository } from '../repo/types';
+import type { Booking, CalEvent, Resource, Settings } from '../schema';
+import { expandEvents } from '../calendar/events';
+import { tzParts, zonedToUtc } from '../calendar/ics';
+import { resourceZone } from './availability';
+
+export interface Hold {
+  resourceId: string;
+  eventId: string;
+  title: string;
+  start: number; // incl. setup
+  end: number; // incl. cleanup
+  eventStart: number; // the occurrence itself
+  eventEnd: number;
+}
+
+const DAY = 86_400_000;
+
+/** Does this event hold its rooms right now? */
+export function holdsRooms(e: Pick<CalEvent, 'status' | 'cancelled' | 'roomHold'>): boolean {
+  if (e.cancelled || !e.roomHold.resourceIds.length) return false;
+  return e.status === 'published' || e.status === 'scheduled' || (e.status === 'draft' && e.roomHold.whileDraft);
+}
+
+// midnight (in tz) of the day containing ms
+function dayStart(ms: number, tz: string): number {
+  const p = tzParts(ms, tz);
+  return zonedToUtc(p.y, p.m, p.d, 0, 0, 0, tz);
+}
+function nextDayStart(ms: number, tz: string): number {
+  // +26h then back to that day's midnight survives DST changes
+  return dayStart(dayStart(ms, tz) + DAY + 2 * 3_600_000, tz);
+}
+
+/** Holds for the given events in [from, to). `force` counts drafts too (editor previews). */
+export function holdsFromEvents(
+  events: CalEvent[],
+  resources: Map<string, Pick<Resource, 'id' | 'timezone'>>,
+  settings: Pick<Settings, 'timezone'>,
+  from: number,
+  to: number,
+  opts: { force?: boolean; resourceId?: string } = {}
+): Hold[] {
+  const out: Hold[] = [];
+  const holding = events.filter((e) => (opts.force ? !e.cancelled && e.roomHold.resourceIds.length > 0 : holdsRooms(e))
+    && (!opts.resourceId || e.roomHold.resourceIds.includes(opts.resourceId)));
+  if (!holding.length) return out;
+  // widen the window so setup/cleanup and whole-day holds at the edges count
+  const pad = 2 * DAY;
+  const occurrences = expandEvents(holding, settings, { displayTz: settings.timezone || 'UTC', now: from, windowStartMs: from - pad, windowEndMs: to + pad });
+  for (const o of occurrences) {
+    const h = o.event.roomHold;
+    for (const resourceId of h.resourceIds) {
+      if (opts.resourceId && resourceId !== opts.resourceId) continue;
+      const r = resources.get(resourceId);
+      if (!r) continue;
+      let start: number;
+      let end: number;
+      if (h.span === 'day') {
+        const tz = resourceZone(r, settings.timezone || 'UTC');
+        start = dayStart(o.start, tz);
+        end = nextDayStart(Math.max(o.start, o.end - 1), tz);
+      } else {
+        start = o.start - h.before * 60_000;
+        end = o.end + h.after * 60_000;
+      }
+      if (end <= from || start >= to) continue;
+      out.push({ resourceId, eventId: o.event.id, title: o.event.title || 'Event', start, end, eventStart: o.start, eventEnd: o.end });
+    }
+  }
+  return out.sort((a, b) => a.start - b.start);
+}
+
+/** Holds on the site's live events (what booking pages must respect). */
+export async function eventHolds(repo: ContentRepository, settings: Pick<Settings, 'timezone'>, from: number, to: number, resourceId?: string): Promise<Hold[]> {
+  const [events, resources] = await Promise.all([repo.listEvents(), repo.listResources()]);
+  return holdsFromEvents(events, new Map(resources.map((r) => [r.id, r])), settings, from, to, { resourceId });
+}
+
+export interface HoldConflict {
+  booking: Pick<Booking, 'id' | 'name' | 'email' | 'start' | 'end' | 'status' | 'resourceId' | 'kind' | 'notes'>;
+  hold: Hold;
+}
+
+/**
+ * Bookings that overlap an event's holds. `event` may be unsaved (the
+ * editor's current values): holds are computed as if it were published.
+ * Repeating events are checked over the next `horizonDays` (default a year).
+ */
+export async function holdConflicts(
+  repo: ContentRepository,
+  settings: Pick<Settings, 'timezone'>,
+  event: CalEvent,
+  opts: { now?: number; horizonDays?: number } = {}
+): Promise<{ conflicts: HoldConflict[]; holds: Hold[] }> {
+  const now = opts.now ?? Date.now();
+  const to = now + (opts.horizonDays ?? 366) * DAY;
+  const resources = new Map((await repo.listResources()).map((r) => [r.id, r]));
+  const holds = holdsFromEvents([event], resources, settings, now, to, { force: true });
+  if (!holds.length) return { conflicts: [], holds };
+  const keep = new Set(event.roomHold.keep);
+  const conflicts: HoldConflict[] = [];
+  for (const resourceId of new Set(holds.map((h) => h.resourceId))) {
+    const mine = holds.filter((h) => h.resourceId === resourceId);
+    const bookings = await repo.listBookings({ resourceId, from: mine[0].start, to: mine[mine.length - 1].end, statuses: ['pending', 'confirmed'], kinds: ['booking', 'block'] });
+    for (const b of bookings) {
+      if (keep.has(b.id)) continue;
+      // a booking's own buffers (hold_start/end) don't count, only its real time
+      const hold = mine.find((h) => b.start < h.end && b.end > h.start);
+      if (hold) conflicts.push({ booking: { id: b.id, name: b.name, email: b.email, start: b.start, end: b.end, status: b.status, resourceId: b.resourceId, kind: b.kind, notes: b.notes }, hold });
+    }
+  }
+  return { conflicts: conflicts.sort((a, b) => a.booking.start - b.booking.start), holds };
+}

package/src/lib/booking/service.ts

@@ -12,6 +12,8 @@ import { manageUrl as manageUrlFor, eventUrl } from '../calendar/config';
 import { eventTimeZone, locationLine } from '../calendar/events';
 import { bookingEmail, whenText, type BookingEmail } from './emails';
 import { holdOf, isBookable, resourceZone, type AvailabilityContext, type Interval } from './availability';
+import { decideStatus, linkApproval } from './approval';
+import { eventHolds } from './holds';
 
 export interface FlowOptions {
   origin: string;
@@ -62,11 +64,13 @@ export async function availabilityContext(
   ignoreBookingId?: string
 ): Promise<AvailabilityContext> {
   const to = now + (link.maxAdvance + 2) * 86_400_000;
-  const [bookings, busy] = await Promise.all([
+  const [bookings, busy, held] = await Promise.all([
     repo.listBookings({ resourceId: resource.id, from: now - 86_400_000, to, statuses: ['pending', 'confirmed'] }),
     busyIntervals(resource, now - 86_400_000, to, now),
+    // events that use this room/person (lib/booking/holds.ts)
+    eventHolds(repo, settings, now - 86_400_000, to, resource.id),
   ]);
-  return { resource, link, bookings, busy, siteTimezone: settings.timezone, now, ignoreBookingId };
+  return { resource, link, bookings, busy: [...busy, ...held.map(({ start, end }) => ({ start, end }))], siteTimezone: settings.timezone, now, ignoreBookingId };
 }
 
 // ---- notifications ---------------------------------------------------------
@@ -171,7 +175,11 @@ export async function createResourceBooking(
   // staff adding a booking by hand may ignore notice windows, never overlaps
   const ctx = await availabilityContext(repo, resource, link, settings, opts.now ?? Date.now());
   if (args.source !== 'admin' && !isBookable(ctx, args.start, args.end)) throw new BookingError(409, 'That time was just taken or isn’t available. Please pick another.');
-  const status: BookingStatus = args.status ?? (link.autoConfirm ? 'confirmed' : 'pending');
+  const approval = linkApproval(link, settings);
+  const returning = approval.mode === 'rules' && approval.rules.firstTime
+    ? (await repo.listBookings({ email: booker.email, statuses: ['pending', 'confirmed'], kinds: ['booking'] })).length > 0
+    : true;
+  const status: BookingStatus = args.status ?? decideStatus(approval, { start: args.start, end: args.end, seats: 1, returning });
   const b = await repo.createBooking({
     kind: 'booking', resourceId: resource.id, linkId: link.id, eventId: '', status,
     start: args.start, end: args.end, ...holdOf(link, args.start, args.end),
@@ -275,3 +283,29 @@ export async function sendDueReminders(repo: ContentRepository, opts: FlowOption
   await kickEmail(repo,opts.locals,opts.waitUntil);
   return due.length;
 }
+
+// cron: pending bookings nobody answered within the link's deadline get the
+// chosen decision (approve or decline). Bookings that already started are
+// left alone — deciding them now would only send a confusing email.
+export async function decideOverdue(repo: ContentRepository, opts: FlowOptions): Promise<number> {
+  const now = opts.now ?? Date.now();
+  const pending = await repo.listBookings({ from: now, statuses: ['pending'], kinds: ['booking'] });
+  if (!pending.length) return 0;
+  const settings = await repo.getSettings();
+  const links = new Map<string, BookingLink | null>();
+  let decided = 0;
+  for (const b of pending) {
+    if (b.start <= now) continue;
+    if (!links.has(b.linkId)) links.set(b.linkId, await repo.getBookingLink(b.linkId));
+    const link = links.get(b.linkId);
+    if (!link) continue;
+    const { rules } = linkApproval(link, settings);
+    if (!rules.deadlineHours || b.createdAt + rules.deadlineHours * 3_600_000 > now) continue;
+    try {
+      await setBookingStatus(repo, b, rules.deadlineAction === 'decline' ? 'declined' : 'confirmed', opts,
+        rules.deadlineAction === 'decline' ? 'We weren’t able to confirm this booking in time. Please pick another time.' : undefined);
+      decided++;
+    } catch { /* changed meanwhile — next sweep sees the new state */ }
+  }
+  return decided;
+}

package/src/lib/calendar/agent-schema.ts

@@ -15,6 +15,14 @@ const eventFields = {
   location: z.object({ name: z.string().max(300).default(''), address: z.string().max(500).default(''), url: z.string().max(1000).default('') }).strict().optional(),
   cta: z.object({ label: z.string().max(120).default(''), href: z.string().max(1000).default(''), style: z.enum(['primary', 'outline']).default('primary') }).strict().optional(),
   calendars: z.array(z.string().max(100)).max(20).optional(),
+  // bookable rooms/people (slugs from the booking resources) this event uses:
+  // they can't be booked while it happens (± setup/cleanup minutes) or all day
+  rooms: z.object({
+    resources: z.array(z.string().max(100)).max(50),
+    span: z.enum(['event', 'day']).default('event'),
+    setup: z.number().int().min(0).max(1440).default(0),
+    cleanup: z.number().int().min(0).max(1440).default(0),
+  }).strict().optional(),
   tags: z.array(z.string().trim().min(1).max(100)).max(50).optional(),
   cancelled: z.boolean().optional(),
   seoTitle: z.string().max(300).optional(),
@@ -43,6 +51,6 @@ export const EVENT_TOOL_DESCRIPTIONS: Record<(typeof EVENT_TOOL_NAMES)[number],
   get_event: 'Read one event including any pending draft. Times are wall-clock strings in the event timezone.',
   list_calendars: 'List calendars (slug, name, visibility, kind). Use slugs in create_event/update_event "calendars".',
   create_event: 'Create a DRAFT event. start/end are wall-clock "YYYY-MM-DDTHH:mm" (or "YYYY-MM-DD" with allDay) in the event timezone (site timezone when omitted). content is Markdown. rrule is an RFC 5545 rule like "FREQ=WEEKLY;BYDAY=TU". Never publishes.',
-  update_event: 'Update supplied event fields. Published/scheduled events stage a pending draft that goes live on publish/Update. calendars replaces the list.',
+  update_event: 'Update supplied event fields. rooms (resource slugs) holds bookable rooms so they cannot be booked during the event; [] releases them. Published/scheduled events stage a pending draft that goes live on publish/Update. calendars replaces the list.',
   publish_event: 'Publish an event (applying any pending draft). Requires owner-enabled publishing permission.',
 };

package/src/lib/calendar/agent.ts

@@ -35,6 +35,17 @@ async function resolveCalendars(repo: ContentRepository, slugs: string[] | undef
   });
 }
 
+async function resolveRooms(repo: ContentRepository, rooms: { resources: string[]; span: 'event' | 'day'; setup: number; cleanup: number } | undefined, keep: string[] = []) {
+  if (rooms === undefined) return undefined;
+  const all = await repo.listResources();
+  const resourceIds = rooms.resources.map((s) => {
+    const r = all.find((x) => x.slug === s || x.id === s);
+    if (!r) throw new ApiError(400, `Unknown room or person "${s}". Call list_resources for valid slugs.`);
+    return r.id;
+  });
+  return { resourceIds, span: rooms.span, before: rooms.setup, after: rooms.cleanup, whileDraft: false, keep };
+}
+
 function checkLinks(a: { cta?: { href: string }; location?: { url: string }; timezone?: string }) {
   if (a.cta?.href && !/^(https?:\/\/|\/(?!\/)|mailto:|tel:)/i.test(a.cta.href)) throw new ApiError(400, 'cta.href must start with https://, /, mailto: or tel:.');
   if (a.location?.url && !/^https?:\/\//i.test(a.location.url)) throw new ApiError(400, 'location.url must start with https://.');
@@ -54,6 +65,7 @@ export async function runEventTool(repo: ContentRepository, input: EventToolInpu
       start: e.start, end: e.end, allDay: e.allDay, rrule: e.rrule,
       next: o ? formatOccurrence(o, settings.timezone || 'UTC', siteLocale(settings)).range : '',
       calendars: e.calendarIds.map((id) => calMap.get(id)?.slug).filter(Boolean),
+      rooms: e.roomHold.resourceIds.length ? { resources: e.roomHold.resourceIds, span: e.roomHold.span, setup: e.roomHold.before, cleanup: e.roomHold.after } : null,
       hasPendingDraft: Boolean(e.draft), editUrl: editUrl(e.id),
     };
   };
@@ -91,13 +103,14 @@ export async function runEventTool(repo: ContentRepository, input: EventToolInpu
         rrule: a.rrule ?? '', excerpt: a.excerpt ?? '', location: a.location, cta: a.cta, tags: a.tags,
         cancelled: a.cancelled ?? false, seoTitle: a.seoTitle, seoDesc: a.seoDesc,
         calendarIds: (await resolveCalendars(repo, a.calendars)) ?? [],
+        ...(a.rooms ? { roomHold: await resolveRooms(repo, a.rooms) } : {}),
         ...(a.content !== undefined ? { bodyHtml: renderAgentMarkdown(a.content) } : {}),
       });
       if (a.tags?.length) await repo.ensureTags(a.tags);
       return { ...summary(e) };
     }
     case 'update_event': {
-      const { id, content, calendars: slugs, ...rest } = input.arguments;
+      const { id, content, calendars: slugs, rooms, ...rest } = input.arguments;
       checkLinks(rest);
       const before = await repo.getEvent(id);
       if (!before) throw new ApiError(404, 'Event not found.');
@@ -108,6 +121,8 @@ export async function runEventTool(repo: ContentRepository, input: EventToolInpu
       }
       const calendarIds = await resolveCalendars(repo, slugs);
       if (calendarIds) data.calendarIds = calendarIds;
+      const roomHold = await resolveRooms(repo, rooms, before.roomHold.keep);
+      if (roomHold) data.roomHold = roomHold;
       if (data.start !== undefined || data.end !== undefined || data.allDay !== undefined) {
         const merged = mergeEventDraft(before);
         try {

package/src/lib/calendar/board.ts

@@ -0,0 +1,171 @@
+// Data for the admin Schedule: every occurrence in a date range — events
+// (drafts included), subscribed calendars, bookings and blocked time —
+// flattened into site-local days so the browser only does layout
+// (lib/calendar/grid.ts). Times are shown in the site timezone.
+import type { ContentRepository } from '../repo/types';
+import type { CalEvent, Settings } from '../schema';
+import { collectViewEvents } from './data';
+import { eventTimeZone, safeColor } from './events';
+import { tzParts, zonedToUtc } from './ics';
+import { addDays, isIsoDay, type GridItem, type Iso } from './grid';
+import { bookingsEnabled } from './config';
+import { siteLocale } from '../dates';
+import { describeRepeat } from './rrule';
+import { holdsRooms } from '../booking/holds';
+
+export type BoardKind = 'event' | 'feed' | 'booking' | 'block';
+export type BoardStatus = 'published' | 'draft' | 'scheduled' | 'archived' | 'feed' | 'pending' | 'confirmed';
+
+export interface BoardItem extends GridItem {
+  kind: BoardKind;
+  id: string; // event id / booking id / '' for feeds
+  time: string; // short start label, e.g. "7p", "10:30a"
+  range: string; // "7:00 – 8:30 PM" or "All day"
+  color: string;
+  calendarId: string;
+  calendarName: string;
+  status: BoardStatus;
+  recurring: boolean;
+  repeat: string; // "Weekly on Wednesday" ('' when it doesn't repeat)
+  rooms: string[]; // bookable rooms this event holds (names)
+  roomsHeld: boolean; // false for drafts that don't hold yet
+  // this occurrence's start as wall time in the event's own zone (for exdates)
+  occurrence: string;
+  cancelled: boolean;
+  location: string;
+  edited: boolean; // live event with unpublished changes
+  url: string; // public URL ('' when none)
+}
+
+export interface BoardCalendar { id: string; name: string; color: string; kind: 'native' | 'feed'; visibility: string }
+
+export interface BoardData {
+  from: Iso;
+  to: Iso;
+  today: Iso;
+  weekStart: 0 | 1;
+  items: BoardItem[];
+  calendars: BoardCalendar[];
+  errors: string[];
+}
+
+const pad = (n: number) => String(n).padStart(2, '0');
+const isoOf = (p: { y: number; m: number; d: number }) => `${p.y}-${pad(p.m)}-${pad(p.d)}`;
+export const NO_CALENDAR = '';
+export const BOOKING_COLOR = '#8e919a';
+
+function shortTime(hh: number, mm: number): string {
+  const h = hh % 12 || 12;
+  return `${h}${mm ? `:${pad(mm)}` : ''}${hh < 12 ? 'a' : 'p'}`;
+}
+
+export function todayIn(tz: string, now = Date.now()): Iso {
+  return isoOf(tzParts(now, tz || 'UTC'));
+}
+
+// local day + minutes for an instant; `endExclusive` maps midnight to the
+// previous day's 24:00 so an event ending at midnight stays on its day
+function local(ms: number, tz: string, endExclusive = false) {
+  const p = tzParts(endExclusive ? ms - 1 : ms, tz);
+  const day = isoOf(p);
+  const min = endExclusive ? p.hh * 60 + p.mm + 1 : p.hh * 60 + p.mm;
+  return { day, min: Math.min(min, 1440), hh: p.hh, mm: p.mm };
+}
+
+export async function loadBoard(repo: ContentRepository, settings: Settings, from: Iso, to: Iso, opts: { now?: number } = {}): Promise<BoardData> {
+  if (!isIsoDay(from) || !isIsoDay(to) || to < from) throw new Error('Pick a valid date range.');
+  // at most ~14 weeks per request — a month grid needs 6, prefetching adds the neighbours
+  if (addDays(from, 100) < to) throw new Error('That date range is too long.');
+  const tz = settings.timezone || 'UTC';
+  const now = opts.now ?? Date.now();
+  const startMs = zonedToUtc(+from.slice(0, 4), +from.slice(5, 7), +from.slice(8, 10), 0, 0, 0, tz);
+  const endIso = addDays(to, 1);
+  const endMs = zonedToUtc(+endIso.slice(0, 4), +endIso.slice(5, 7), +endIso.slice(8, 10), 0, 0, 0, tz);
+  const win = { displayTz: tz, now, windowStartMs: startMs, windowEndMs: endMs };
+
+  const { events, calendars, errors } = await collectViewEvents(repo, settings, win, { audience: 'admin', includeFeeds: true, includeBookings: false });
+  const locale = siteLocale(settings);
+  const timeFmt = new Intl.DateTimeFormat(locale, { hour: 'numeric', minute: '2-digit', timeZone: tz });
+  const rangeOf = (s: number, e: number, allDay: boolean) => {
+    if (allDay) return 'All day';
+    try { return timeFmt.formatRange(s, e); } catch { return `${timeFmt.format(s)} – ${timeFmt.format(e)}`; }
+  };
+  const calById = new Map(calendars.map((c) => [c.id, c]));
+  const roomName = new Map((bookingsEnabled() ? await repo.listResources() : []).map((r) => [r.id, r.name]));
+  const items: BoardItem[] = [];
+
+  for (const v of events) {
+    const e: CalEvent | undefined = v.event;
+    const allDay = v.allDay;
+    const s = local(v.start, tz);
+    const en = local(v.end, tz, true);
+    const startDay = s.day;
+    const endDay = allDay ? addDays(startDay, Math.max(1, v.days) - 1) : en.day < s.day ? s.day : en.day;
+    const cal = e ? e.calendarIds.map((id) => calById.get(id)).find(Boolean) : calendars.find((c) => c.name === v.calendarName && c.kind === 'feed');
+    let occurrence = '';
+    if (e) {
+      const p = tzParts(v.start, eventTimeZone(e, settings));
+      occurrence = allDay ? isoOf(p) : `${isoOf(p)}T${pad(p.hh)}:${pad(p.mm)}`;
+    }
+    items.push({
+      key: e ? `e:${e.id}:${v.start}` : `f:${cal?.id ?? ''}:${v.start}:${v.title}`,
+      kind: e ? 'event' : 'feed',
+      id: e?.id ?? '',
+      title: v.title,
+      startDay, endDay, allDay,
+      startMin: allDay ? 0 : s.min,
+      endMin: allDay ? 1440 : en.min,
+      time: allDay ? '' : shortTime(s.hh, s.mm),
+      range: rangeOf(v.start, v.end, allDay),
+      color: v.color ?? (cal ? safeColor(cal.color) : '#8a8378'),
+      calendarId: cal?.id ?? NO_CALENDAR,
+      calendarName: cal?.name ?? '',
+      status: e ? (e.status as BoardStatus) : 'feed',
+      recurring: Boolean(e?.rrule),
+      repeat: e?.rrule ? describeRepeat(e.rrule, e.start) : '',
+      rooms: e ? e.roomHold.resourceIds.map((id) => roomName.get(id)).filter((n): n is string => Boolean(n)) : [],
+      roomsHeld: e ? holdsRooms(e) : false,
+      occurrence,
+      cancelled: Boolean(v.cancelled),
+      location: v.location,
+      edited: Boolean(e?.draft),
+      url: e?.status === 'published' ? v.url ?? '' : '',
+    });
+  }
+
+  if (bookingsEnabled() && settings.calendar.showBookings) {
+    const [bookings, resources] = await Promise.all([
+      repo.listBookings({ from: startMs, to: endMs, statuses: ['pending', 'confirmed'], kinds: ['booking', 'block'] }),
+      repo.listResources(),
+    ]);
+    const rById = new Map(resources.map((r) => [r.id, r]));
+    for (const b of bookings) {
+      const r = rById.get(b.resourceId);
+      const s = local(b.start, tz);
+      const en = local(b.end, tz, true);
+      const allDay = s.min === 0 && en.min === 1440;
+      items.push({
+        key: `b:${b.id}`,
+        kind: b.kind === 'block' ? 'block' : 'booking',
+        id: b.id,
+        title: b.kind === 'block' ? `${r?.name ?? 'Blocked'} · ${b.notes || 'Blocked'}` : `${r?.name ?? 'Booking'} · ${b.name}`,
+        startDay: s.day, endDay: en.day < s.day ? s.day : en.day, allDay,
+        startMin: allDay ? 0 : s.min, endMin: allDay ? 1440 : en.min,
+        time: allDay ? '' : shortTime(s.hh, s.mm),
+        range: rangeOf(b.start, b.end, allDay),
+        color: BOOKING_COLOR,
+        calendarId: `res:${b.resourceId}`,
+        calendarName: r?.name ?? '',
+        status: b.status as BoardStatus,
+        recurring: false, repeat: '', rooms: [], roomsHeld: false, occurrence: '', cancelled: false,
+        location: r?.name ?? '', edited: false, url: '',
+      });
+    }
+  }
+
+  items.sort((a, b) => a.startDay.localeCompare(b.startDay) || a.startMin - b.startMin);
+  return {
+    from, to, items, errors, today: todayIn(tz, now), weekStart: settings.calendar.weekStart,
+    calendars: calendars.map((c) => ({ id: c.id, name: c.name, color: safeColor(c.color), kind: c.kind, visibility: c.visibility })),
+  };
+}

package/src/lib/calendar/config.ts

@@ -21,6 +21,8 @@ export interface CalendarConfig {
   eventsBase: string;
   // bookings: rooms, people and equipment at bookBase (off = no /book routes)
   bookings: boolean;
+  // starting approval default for booking links (acms({ calendar: { bookings: { approval } } }))
+  bookingApproval: 'auto' | 'rules' | 'manual';
   bookBase: string;
   resourceKinds: string[];
   defaultView: 'month' | 'week' | 'list';
@@ -32,6 +34,7 @@ const FALLBACK: CalendarConfig = {
   base: '/calendar',
   eventsBase: '/events',
   bookings: true,
+  bookingApproval: 'auto',
   bookBase: '/book',
   resourceKinds: ['Room', 'Person', 'Vehicle', 'Equipment'],
   defaultView: 'month',

package/src/lib/calendar/grid.ts

@@ -0,0 +1,169 @@
+// Pure date + layout math for the admin Schedule (month and week grids).
+// Runs on the server and in the browser, so no repo, no Intl time zones:
+// every date here is a site-local calendar day as "YYYY-MM-DD", and every
+// item already carries its local start/end day (lib/calendar/board.ts).
+
+export type Iso = string;
+
+export interface GridItem {
+  key: string;
+  startDay: Iso;
+  endDay: Iso; // inclusive
+  allDay: boolean;
+  startMin: number; // minutes after midnight on startDay (timed items)
+  endMin: number; // minutes after midnight on endDay
+  title: string;
+}
+
+const pad = (n: number) => String(n).padStart(2, '0');
+const toUtc = (d: Iso) => Date.UTC(+d.slice(0, 4), +d.slice(5, 7) - 1, +d.slice(8, 10));
+const fromUtc = (ms: number): Iso => {
+  const t = new Date(ms);
+  return `${t.getUTCFullYear()}-${pad(t.getUTCMonth() + 1)}-${pad(t.getUTCDate())}`;
+};
+
+export const isIsoDay = (s: string) => /^\d{4}-\d{2}-\d{2}$/.test(s) && fromUtc(toUtc(s)) === s;
+export const addDays = (d: Iso, n: number): Iso => fromUtc(toUtc(d) + n * 86_400_000);
+export const diffDays = (a: Iso, b: Iso) => Math.round((toUtc(b) - toUtc(a)) / 86_400_000);
+// 0 = Sunday … 6 = Saturday
+export const dayOfWeek = (d: Iso) => new Date(toUtc(d)).getUTCDay();
+export const monthOf = (d: Iso) => d.slice(0, 7);
+export const isIsoMonth = (s: string) => /^\d{4}-(0[1-9]|1[0-2])$/.test(s);
+export function addMonths(month: string, n: number): string {
+  const y = +month.slice(0, 4), m = +month.slice(5, 7) - 1 + n;
+  const t = new Date(Date.UTC(y, m, 1));
+  return `${t.getUTCFullYear()}-${pad(t.getUTCMonth() + 1)}`;
+}
+
+export function startOfWeek(d: Iso, weekStart: 0 | 1): Iso {
+  return addDays(d, -((dayOfWeek(d) - weekStart + 7) % 7));
+}
+
+// Weeks covering a month: always whole weeks, 4–6 rows depending on the month
+export function monthWeeks(month: string, weekStart: 0 | 1): Iso[][] {
+  const first = `${month}-01`;
+  const last = addDays(`${addMonths(month, 1)}-01`, -1);
+  const weeks: Iso[][] = [];
+  for (let w = startOfWeek(first, weekStart); w <= last; w = addDays(w, 7)) {
+    weeks.push(Array.from({ length: 7 }, (_, i) => addDays(w, i)));
+  }
+  return weeks;
+}
+
+export function weekDays(day: Iso, weekStart: 0 | 1): Iso[] {
+  const s = startOfWeek(day, weekStart);
+  return Array.from({ length: 7 }, (_, i) => addDays(s, i));
+}
+
+// Items that need a bar across days: all-day items and anything that runs
+// past midnight. Single-day timed items render as chips.
+export const isSpanning = (it: GridItem) => it.allDay || it.endDay > it.startDay;
+
+export interface Bar<T extends GridItem> {
+  item: T;
+  col: number; // 0-based column inside the week
+  span: number; // columns covered
+  lane: number;
+  continuesLeft: boolean;
+  continuesRight: boolean;
+}
+
+export interface WeekLayout<T extends GridItem> {
+  bars: Bar<T>[]; // visible bars; `lane` is the line they sit on
+  chips: { item: T; line: number }[][]; // per column, visible chips and their line
+  hidden: number[]; // per column, items not shown ("+N more")
+  all: T[][]; // per column, everything on that day (for the day panel)
+}
+
+const byStart = <T extends GridItem>(a: T, b: T) =>
+  a.startDay.localeCompare(b.startDay) || Number(b.allDay) - Number(a.allDay) || a.startMin - b.startMin || a.title.localeCompare(b.title);
+
+// Lay out one week row as `lines` stacked slots per day. Bars (all-day and
+// multi-day items) take the same line across every day they cover; timed
+// chips fill each day's free lines. A day with more than fits keeps its last
+// line for "+N more".
+export function layoutWeek<T extends GridItem>(days: Iso[], items: T[], lines: number): WeekLayout<T> {
+  const first = days[0], last = days[days.length - 1];
+  const inWeek = items.filter((it) => it.startDay <= last && it.endDay >= first).sort(byStart);
+  const all: T[][] = days.map((d) => inWeek.filter((it) => it.startDay <= d && it.endDay >= d));
+
+  // greedy lane packing, longest bar first among those starting the same day
+  const clip = (d: Iso) => (d < first ? first : d);
+  const spanning = inWeek.filter(isSpanning).sort((a, b) =>
+    clip(a.startDay).localeCompare(clip(b.startDay)) || diffDays(b.startDay, b.endDay) - diffDays(a.startDay, a.endDay) || byStart(a, b));
+  const laneEnds: number[] = [];
+  const placed: Bar<T>[] = [];
+  for (const item of spanning) {
+    const col = Math.max(0, diffDays(first, item.startDay));
+    const end = Math.min(days.length - 1, diffDays(first, item.endDay));
+    let lane = laneEnds.findIndex((e) => e < col);
+    if (lane === -1) { lane = laneEnds.length; laneEnds.push(end); } else laneEnds[lane] = end;
+    placed.push({ item, col, span: end - col + 1, lane, continuesLeft: item.startDay < first, continuesRight: item.endDay > last });
+  }
+  const covers = (b: Bar<T>, c: number) => b.col <= c && b.col + b.span > c;
+  const timed = days.map((d) => inWeek.filter((it) => !isSpanning(it) && it.startDay === d));
+  const overflow = days.map((_, c) => {
+    const here = placed.filter((b) => covers(b, c));
+    return here.length + timed[c].length > lines || here.some((b) => b.lane >= lines);
+  });
+  const visible = (b: Bar<T>) => {
+    if (b.lane >= lines) return false;
+    if (b.lane < lines - 1) return true;
+    for (let c = b.col; c < b.col + b.span; c++) if (overflow[c]) return false;
+    return true;
+  };
+  // a hidden bar needs a "+N more" line in every day it covers, which can
+  // hide more bars on that line — settle until nothing changes
+  for (let changed = true; changed; ) {
+    changed = false;
+    for (const b of placed) {
+      if (visible(b)) continue;
+      for (let c = b.col; c < b.col + b.span; c++) if (!overflow[c]) { overflow[c] = true; changed = true; }
+    }
+  }
+  const bars = placed.filter(visible);
+  const chips: { item: T; line: number }[][] = [];
+  const hidden: number[] = [];
+  for (let c = 0; c < days.length; c++) {
+    const capacity = overflow[c] ? lines - 1 : lines;
+    const taken = new Set(bars.filter((b) => covers(b, c)).map((b) => b.lane));
+    const free: number[] = [];
+    for (let l = 0; l < capacity; l++) if (!taken.has(l)) free.push(l);
+    const shown = timed[c].slice(0, free.length).map((item, i) => ({ item, line: free[i] }));
+    chips.push(shown);
+    const hiddenBars = placed.filter((b) => covers(b, c) && !visible(b)).length;
+    hidden.push(hiddenBars + timed[c].length - shown.length);
+  }
+  return { bars, chips, hidden, all };
+}
+
+// Week view: side-by-side columns for overlapping timed items in one day
+export interface Placed<T extends GridItem> { item: T; top: number; height: number; col: number; cols: number }
+export function layoutDay<T extends GridItem>(day: Iso, items: T[]): Placed<T>[] {
+  const list = items
+    .filter((it) => !isSpanning(it) && it.startDay === day)
+    .sort((a, b) => a.startMin - b.startMin || b.endMin - a.endMin);
+  const out: Placed<T>[] = [];
+  let group: Placed<T>[] = [];
+  let groupEnd = -1;
+  const flush = () => {
+    const cols = group.reduce((n, p) => Math.max(n, p.col + 1), 1);
+    for (const p of group) p.cols = cols;
+    out.push(...group);
+    group = [];
+  };
+  for (const item of list) {
+    const end = Math.max(item.endMin, item.startMin + 20);
+    if (item.startMin >= groupEnd && group.length) flush();
+    const taken = new Set(group.filter((p) => p.top + p.height > item.startMin).map((p) => p.col));
+    let col = 0;
+    while (taken.has(col)) col++;
+    group.push({ item, top: item.startMin, height: end - item.startMin, col, cols: 1 });
+    groupEnd = Math.max(groupEnd, end);
+  }
+  if (group.length) flush();
+  return out;
+}
+
+// Move an item by whole days, keeping its length (drag to reschedule)
+export const shiftDays = (from: Iso, to: Iso) => diffDays(from, to);

package/src/lib/calendar/migration.ts

@@ -0,0 +1,16 @@
+// Schedule + approval settings. Site-wide calendar settings (week start,
+// default calendar, booking approval default) live in one JSON column; each
+// booking link gains an approval mode that can follow that default. Existing
+// links that confirmed automatically now follow the site default (which
+// starts as automatic, so nothing changes); manual ones stay manual.
+export const CALENDAR_SETTINGS_MIGRATION = { version: 40, statements: [
+  `ALTER TABLE settings ADD COLUMN calendar TEXT NOT NULL DEFAULT '{}'`,
+  `ALTER TABLE booking_links ADD COLUMN approval TEXT NOT NULL DEFAULT 'default'`,
+  `ALTER TABLE booking_links ADD COLUMN approval_rules TEXT NOT NULL DEFAULT '{}'`,
+  `UPDATE booking_links SET approval = CASE auto_confirm WHEN 1 THEN 'default' ELSE 'manual' END`,
+] };
+
+// events that reserve bookable rooms/people (CalEvent.roomHold)
+export const ROOM_HOLD_MIGRATION = { version: 41, statements: [
+  `ALTER TABLE events ADD COLUMN room_hold TEXT NOT NULL DEFAULT '{}'`,
+] };