@acms-subir/core 0.3.3 → 0.3.4

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @acms-subir/core
 
+## 0.3.4
+
+### Patch Changes
+
+- d29c1c8: Calendar admin: a real calendar and fewer tabs.
+
+  - **Schedule** (`/admin/calendar`): a month and week grid of events, drafts, subscribed calendars and bookings. Click a day (or drag across days) to add an event with a live preview, drag an event to move it — one date of a repeating event or the whole series — with Undo, open a day's full list, and show or hide each calendar. Phones get a compact month with dots and a day list.
+  - **Where it lands**: the New event dialog and the event editor's When section show a mini month with busy days and what else is on the chosen day.
+  - **Fewer tabs**: the Calendar section is now Schedule and Bookings. Events became Schedule's List view; Calendars, subscribed calendars, share links and defaults moved to one **Calendar settings** page; Resources became **Bookings → Rooms & people**. Old URLs redirect. One name per thing (subscribed calendar, share link, needs approval) and one "New ▾" per page.
+  - **Booking approval**: a site-wide setting (Calendar settings → Booking approval, or `acms({ calendar: { bookings: { approval } } })`) — automatically confirm (default), automatically unless a rule flags it (longer than N hours, first booking from an email, more than N people), or approve each booking. Each link can follow it or choose its own, with an optional deadline that approves or declines unanswered requests.
+  - **Weeks start on** Sunday or Monday (Calendar settings → Defaults), used by the Schedule and the public calendar.
+
+  Migration v40 adds `settings.calendar` and booking link approval columns; existing links keep their behavior.
+
+- d29c1c8: Events can hold bookable rooms. Tick the rooms or people an event uses (event settings → Rooms, or the Rooms line in quick add), and they can't be booked while it happens, with optional setup and cleanup minutes, or for the whole day. Holds are worked out from the event, so moving, repeating, skipping a date, cancelling or deleting it frees or moves the room automatically. Every booking path respects them: booking pages, embeds, the mobile API and agent tools.
+
+  - Each room shows whether it's free at the event's time. Overlapping bookings show inline and again in a publish dialog, where you keep each one (share the room) or cancel it and email the guest.
+  - Drafts hold rooms only when "Hold now" is on. Picking rooms fills the event's place when it's empty.
+  - Holds show in Bookings → Day view, on each room's page ("Held by events"), in the Schedule peek and in the room's staff calendar feed. Staff bookings over a hold need "Book anyway".
+  - Agent and REST event tools accept `rooms: { resources, span, setup, cleanup }`.
+
+  Migration v41 adds `events.room_hold`.
+
+- d29c1c8: Fixes and theme features from a real site build.
+
+  - `acms section add <name> --native --force` now only replaces the app's copy in `mobile/sections/`; it never rewrites the theme's web component or `theme.json`.
+  - `settings.update` accepts `timezone` and `locale` (validated like Settings → General) and rejects unknown keys instead of silently dropping them.
+  - Core section styles are wrapped in `:where()`, so any theme class beats them without doubled selectors. Embed cards drop their outer margin at the start or end of a section or page.
+  - Themes can replace the site header and footer with `templates/header.astro` / `templates/footer.astro`. They receive a resolved `site` prop (`ChromeProps`): localized links, the current page, language names like "Español", social icons, and search/scheme/menu hooks.
+  - Section image fields (and defaults) can point at theme files (`assets/hero.jpg`); they resolve to the built URL on the site and in the mobile API.
+  - Post sources (`PostItem`) include `authors` (name, URL, avatar) and an automatic excerpt when the post has none.
+  - `/api/v1/events` `from`/`to` accept ISO date-times with a timezone as well as site-local days; the client types document both.
+  - `acms theme dev` serves the project's `public/` folder and prints the preview's admin URL and password.
+
+- 8dbe45e: Fix fresh installs failing to build: pin every TipTap package to the same version so a new TipTap release can't mix versions.
+
 ## 0.3.3
 
 ### Patch Changes

package/cli/preview.mjs

@@ -1,4 +1,4 @@
-import { mkdir, writeFile, cp, symlink, mkdtemp, readFile } from 'node:fs/promises';
+import { mkdir, writeFile, cp, symlink, mkdtemp, readFile, stat } from 'node:fs/promises';
 import { join, resolve, dirname } from 'node:path';
 import { createRequire } from 'node:module';
 import { spawn, spawnSync } from 'node:child_process';
@@ -10,6 +10,8 @@ export async function prepareFixture(p,dir,slug){
   const req=createRequire(join(p.cwd,'package.json'));const astro=dirname(req.resolve('astro/package.json'));
   await symlink(dirname(astro),join(root,'node_modules'),'dir');
   await mkdir(join(root,'src/themes'),{recursive:true});await symlink(dir,join(root,'src/themes',slug),'dir');
+  // the project's public/ (videos, posters, fonts the theme links to by URL) serves as-is
+  const pub=join(p.cwd,'public');if(await stat(pub).then(s=>s.isDirectory(),()=>false))await symlink(pub,join(root,'public'),'dir');
   await mkdir(join(root,'src/pages/acms-theme-preview'),{recursive:true});await mkdir(join(root,'src/actions'),{recursive:true});
   await writeFile(join(root,'src/actions/index.ts'),"export { server } from '@acms-subir/core/actions';\n");
   await writeFile(join(root,'package.json'),JSON.stringify({name:'acms-isolated-preview',type:'module',private:true}));
@@ -31,8 +33,9 @@ await repo.updateSettings({activeTheme:${JSON.stringify(slug)}});
 return Astro.redirect('/');
 ---`);
   await writeFile(join(root,'src/pages/acms-theme-preview/index.astro'),`---\nconst routes=['/','/preview-about','/blog','/blog?page=2','/blog/preview-post-0','/events/preview-event','/calendar','/book','/search?q=Fixture','/404'];\n---\n<html><head><title>ACMS theme fixture controls</title></head><body><h1>Isolated theme preview</h1><p>Initialize synthetic data once, then inspect real ACMS routes. Empty lists and missing covers are intentional. Check phone, tablet and desktop layouts using the controls below.</p><a href='/acms-theme-preview/setup'>Initialize fixtures</a><nav>{routes.map(route=><p><a href={route} target='fixture'>{route}</a></p>)}</nav><p><a href='/?scheme=light' target='fixture'>Light</a> · <a href='/?scheme=dark' target='fixture'>Dark</a></p><p aria-label='Preview width'><button data-width='390px'>Phone</button> <button data-width='768px'>Tablet</button> <button data-width='100%'>Desktop</button></p><iframe id='fixture' name='fixture' title='Theme preview' src='/' style='width:100%;height:70vh;border:1px solid #999;max-width:100%'></iframe><script>document.querySelectorAll('button[data-width]').forEach(button=>button.addEventListener('click',()=>{const frame=document.getElementById('fixture');if(frame)frame.style.width=button.getAttribute('data-width')||'100%';}));</script></body></html>`);
-  const env={PATH:process.env.PATH,HOME:process.env.HOME,TMPDIR:process.env.TMPDIR,NODE_ENV:'development',SQLITE_URL:`file:${join(root,'fixture.db')}`,SESSION_SECRET:randomBytes(32).toString('hex'),ADMIN_PASSWORD:randomBytes(24).toString('hex'),ACMS_NO_UPDATE_CHECK:'1'};
-  return {root,astro:join(astro,'astro.js'),env};
+  const password=randomBytes(12).toString('hex');
+  const env={PATH:process.env.PATH,HOME:process.env.HOME,TMPDIR:process.env.TMPDIR,NODE_ENV:'development',SQLITE_URL:`file:${join(root,'fixture.db')}`,SESSION_SECRET:randomBytes(32).toString('hex'),ADMIN_PASSWORD:password,ACMS_NO_UPDATE_CHECK:'1'};
+  return {root,astro:join(astro,'astro.js'),env,password};
 }
 export async function buildFixture(p,dir,slug){
   const fixture=await prepareFixture(p,dir,slug);
@@ -42,7 +45,8 @@ export async function buildFixture(p,dir,slug){
 }
 export async function devFixture(p,dir,slug,flags){
   const f=await prepareFixture(p,dir,slug);const port=Number(flags.port??4322);if(!Number.isInteger(port)||port<1024||port>65535)fail('USAGE','Port must be 1024–65535.');
-  console.error(`Isolated preview: http://localhost:${port}/acms-theme-preview\nWorkspace: ${f.root}\nTheme sources are linked for live reload; fixture data stays isolated.`);
+  // a throwaway local-only server with synthetic data, so the password is safe to show
+  console.error(`Isolated preview: http://localhost:${port}/acms-theme-preview\nAdmin: http://localhost:${port}/admin  ·  password: ${f.password}\nWorkspace: ${f.root}\nTheme sources and public/ are linked for live reload; fixture data stays isolated.`);
   const child=spawn(process.execPath,[f.astro,'dev','--host','127.0.0.1','--port',String(port),...(!flags.json&&process.stdout.isTTY?['--open','/acms-theme-preview']:[])],{cwd:f.root,env:f.env,stdio:['ignore','pipe','pipe']});child.stdout.pipe(process.stderr);child.stderr.pipe(process.stderr);
   const stop=()=>child.kill('SIGTERM');process.once('SIGINT',stop);process.once('SIGTERM',stop);
   const exit=await new Promise((done,reject)=>{child.once('exit',done);child.once('error',reject);});process.removeListener('SIGINT',stop);process.removeListener('SIGTERM',stop);

package/cli/sections.mjs

@@ -64,8 +64,10 @@ export async function sectionCommand(command, args, flags) {
     const dest = join(dir, 'sections', target);
     // the mobile app: packaged native component by default, an editable copy with --native
     const mobile = await targetApp(flags, { required: !!flags.native });
-    // already in the theme + --native: only add the app's copy, leave the web section alone
-    const nativeOnly = flags.native && !flags.force && (await exists(dest)) && Boolean((await readJson(join(dir, 'theme.json'))).sections?.[type]);
+    // already in the theme + --native: only add the app's copy, never touch the
+    // web section or theme.json — --force then means "replace the app copy".
+    // (Replacing the theme's web section takes a plain `section add --force`.)
+    const nativeOnly = flags.native && (await exists(dest)) && Boolean((await readJson(join(dir, 'theme.json'))).sections?.[type]);
     if ((await exists(dest)) && !flags.force && !nativeOnly) fail('EXISTS', `sections/${target} already exists.`, [], ['Use --as <type> or --force.']);
     const nativePlan = flags.native ? await libraryTwin(mobile.app, name, type, flags, false) : null;
     if (flags['dry-run']) return { dryRun: true, type, files: nativeOnly ? [] : [`sections/${target}`, 'theme.json'], ...(nativePlan ? { native: nativePlan } : {}) };

package/docs/mobile.md

@@ -116,7 +116,7 @@ Read the app's `AGENTS.md` too: it holds the same rules, next to the code.
 | `useSite()` | name, menu, languages, features (`calendar`, `bookings`, `blog`) |
 | `usePage(slug)` | a published page: `mode` (`sections`/`content`), `sections`, `body.html`; 404 when missing |
 | `usePosts({ collection, limit })` / `usePost(slug)` | posts (infinite: `items`, `fetchNextPage`) |
-| `useEvents({ calendar, from, to, limit, q })` | `data.occurrences[]` (`start`, `end`, `allDay`, `event`) in a window (default 30 days, max 90) |
+| `useEvents({ calendar, from, to, limit, q })` | `data.occurrences[]` (`start`, `end`, `allDay`, `event`) in a window (default 30 days, max 90). `from`/`to` take a site-local day (`'2026-10-01'`) or an ISO date-time with a zone (`new Date().toISOString()`) |
 | `useEvent(slug)` | one event |
 | `useResources()` / `useAvailability({ resource, link })` / `useBooking()` | bookings |
 | `useLocale()`, `useTheme()`, `useLayout()`, `useRefresh()`, `useOpenLink()` | language, tokens, layout, refresh, links |

package/docs/theme-authoring.md

@@ -32,9 +32,25 @@ const { page, posts } = Astro.props;
 {posts.map(post => <PostCard href={collectionUrl(post.collection, post.slug)} title={post.title} excerpt={post.excerpt} />)}
 ```
 
-Public types: HomeProps (settings, page, posts, tags), PageProps (settings, page, html), PostProps (settings, post, html, authors, related), EventProps (settings, event, occurrence, calendars, html, upcoming, origin, preview, rsvp), SectionProps (settings, page, variant, data). Public components: PostCard with card/row/feature variants, Pager with base/page/count, TagLabel with name/href/accent. Helpers include collectionUrl, postUrl, postsIndexUrl, tagUrl, formatDate, slugify, authorSlug, localeFromPath, localeHomeUrl and CONTENT. Use collectionUrl for non-default collections; postUrl is the built-in posts alias.
+Public types: ChromeProps (site), HomeProps (settings, page, posts, tags), PageProps (settings, page, html), PostProps (settings, post, html, authors, related), EventProps (settings, event, occurrence, calendars, html, upcoming, origin, preview, rsvp), SectionProps (settings, page, variant, data). Public components: PostCard with card/row/feature variants, Pager with base/page/count, TagLabel with name/href/accent. Helpers include collectionUrl, postUrl, postsIndexUrl, tagUrl, formatDate, slugify, authorSlug, localeFromPath, localeHomeUrl and CONTENT. Use collectionUrl for non-default collections; postUrl is the built-in posts alias.
 
-Template filenames: `home.astro`, `event.astro`, `post-<name>.astro`, `page-<name>.astro`. Post/page variants are selected in the content editor. Core owns routes, auth, SEO and published-content queries. Templates only replace their documented content area. Never query private data from a public section or insert untrusted strings with set:html. The core's rendered `html`/`bodyHtml` is the intended rich-content handoff.
+Template filenames: `home.astro`, `event.astro`, `header.astro`, `footer.astro`, `post-<name>.astro`, `page-<name>.astro`.
+
+`header.astro` and `footer.astro` replace the site header and footer on every public page. They receive `ChromeProps` — one `site` prop (`SiteChrome`) with everything already resolved for the request: `title`, `tagline`, `logo`, `homeUrl`, `links` (header nav, each `{ label, url, current, external }`, already localized), `footerLinks`, `social` (with inline SVG `icon`), `readLinks`, `footerHtml`, `languages` (`{ code, label, url, current }`, where `label` is the language's own name, e.g. "Español"), `search` (`{ url, label }` or null), `schemeToggle`, `liveHeader`, `headerStyle`, `footerStyle`. Core behaviors attach through data hooks, so keep them on your own elements: `data-search-open` (opens search), `data-scheme-toggle` (light/dark), `data-menu-open` (phone menu sheet, built from `site.links`) and a hidden `data-live-header` link (shown during a live stream).
+
+```astro
+---
+import type { ChromeProps } from '@acms-subir/core/theme';
+const { site } = Astro.props as ChromeProps;
+---
+<header class="gh-head">
+  <a href={site.homeUrl}>{site.logo ? <img src={site.logo} alt={site.title} /> : site.title}</a>
+  <nav>{site.links.map((l) => <a href={l.url} aria-current={l.current ? 'page' : undefined}>{l.label}</a>)}</nav>
+  {site.languages.map((l) => <a href={l.url} lang={l.code} aria-current={l.current ? 'true' : undefined}>{l.label}</a>)}
+  {site.search && <a href={site.search.url} data-search-open>{site.search.label}</a>}
+  <button type="button" data-menu-open aria-label="Open menu">Menu</button>
+</header>
+``` Post/page variants are selected in the content editor. Core owns routes, auth, SEO and published-content queries. Templates only replace their documented content area. Never query private data from a public section or insert untrusted strings with set:html. The core's rendered `html`/`bodyHtml` is the intended rich-content handoff.
 
 ## Editable sections
 
@@ -56,7 +72,7 @@ Custom definitions live in `theme.json`:
 }
 ```
 
-The component receives SectionProps<Data>; `acms theme types <slug>` (also run by `acms check`) writes `section-types.d.ts` with one Data interface per section. Field kinds: text, textarea, richtext, image, url, link, select (options required), number, toggle, date, time, list (a repeater of those) and source (live events, posts or booking links). The full guide, including presets, migrations and the starter library (`acms section library` / `acms section add`), is `acms docs sections`. Instances have stable id/type/version/variant/hidden/data fields. A page layout has mode and sections, persisted by page ID in `settings.sectionPages`. Section values and order have a design draft lifecycle distinct from rich-text/widget page drafts; publishing design does not publish pending page text. Theme switches preserve the map. To migrate a custom schema, transform a pulled draft to the new version, review it, and push it with its revision; incompatible versions never auto-convert silently. Existing widget pages continue using their original renderer.
+The component receives SectionProps<Data>; `acms theme types <slug>` (also run by `acms check`) writes `section-types.d.ts` with one Data interface per section. Field kinds: text, textarea, richtext, image, url, link, select (options required), number, toggle, date, time, list (a repeater of those) and source (live events, posts or booking links). An image field (or its default) may name a file the theme ships, like `assets/hero.jpg`; it resolves to that file's built URL on the website and in the mobile API. Post sources give each item `excerpt` (the post's own, else the first ~160 characters of its text) and `authors` (`{ name, url, avatar }`, public byline fields only). The full guide, including presets, migrations and the starter library (`acms section library` / `acms section add`), is `acms docs sections`. Instances have stable id/type/version/variant/hidden/data fields. A page layout has mode and sections, persisted by page ID in `settings.sectionPages`. Section values and order have a design draft lifecycle distinct from rich-text/widget page drafts; publishing design does not publish pending page text. Theme switches preserve the map. To migrate a custom schema, transform a pulled draft to the new version, review it, and push it with its revision; incompatible versions never auto-convert silently. Existing widget pages continue using their original renderer.
 
 Images in template files should be imported using relative paths so Astro bundles them. Theme CSS can reference `url(assets/name.webp)`; ACMS resolves it through the bundled asset inventory. Brand images and editable section images use the media library. Packaged assets must be local files under assets; declare them in the manifest. Use `theme pack --optimize` to run current img-subir and rewrite references before packing. Original-image backup directories are excluded.
 

package/integration.mjs

@@ -257,7 +257,7 @@ function resolveSearch(search) {
 const EVENT_FIELD_TYPES = ['text', 'textarea', 'number', 'url', 'select'];
 function resolveCalendar(calendar, contentBases, locales) {
   const defaults = {
-    enabled: true, base: '/calendar', eventsBase: '/events', bookings: true, bookBase: '/book',
+    enabled: true, base: '/calendar', eventsBase: '/events', bookings: true, bookBase: '/book', bookingApproval: 'auto',
     resourceKinds: ['Room', 'Person', 'Vehicle', 'Equipment'], defaultView: 'month', eventFields: [],
   };
   if (calendar === false) return { ...defaults, enabled: false };
@@ -275,17 +275,31 @@ function resolveCalendar(calendar, contentBases, locales) {
   }
   const enabled = calendar.enabled ?? true;
   if (typeof enabled !== 'boolean') throw new Error('acms: calendar.enabled must be true or false');
+  // bookings: true | false | { approval: 'auto' | 'rules' | 'manual' } — the
+  // object form turns bookings on and sets the starting approval default
+  // (Calendar settings → Bookings can change it later)
+  const bookingsOpt = calendar.bookings ?? true;
+  let bookingApproval = defaults.bookingApproval;
+  if (bookingsOpt && typeof bookingsOpt === 'object' && !Array.isArray(bookingsOpt)) {
+    const extra = Object.keys(bookingsOpt).filter((k) => k !== 'approval');
+    if (extra.length) throw new Error(`acms: unknown calendar.bookings key "${extra[0]}" — the only option is calendar.bookings.approval`);
+    bookingApproval = bookingsOpt.approval ?? defaults.bookingApproval;
+    if (!['auto', 'rules', 'manual'].includes(bookingApproval)) {
+      throw new Error(`acms: calendar.bookings.approval must be "auto", "rules", or "manual" — got "${bookingApproval}"`);
+    }
+  }
   const resolved = {
     enabled,
     base: calendar.base ?? defaults.base,
     eventsBase: calendar.eventsBase ?? defaults.eventsBase,
-    bookings: calendar.bookings ?? true,
+    bookings: typeof bookingsOpt === 'object' && bookingsOpt !== null ? true : bookingsOpt,
+    bookingApproval,
     bookBase: calendar.bookBase ?? defaults.bookBase,
     resourceKinds: calendar.resourceKinds ?? defaults.resourceKinds,
     defaultView: calendar.defaultView ?? defaults.defaultView,
     eventFields: [],
   };
-  if (typeof resolved.bookings !== 'boolean') throw new Error('acms: calendar.bookings must be true or false');
+  if (typeof resolved.bookings !== 'boolean') throw new Error('acms: calendar.bookings must be true, false, or { approval }');
   if (!Array.isArray(resolved.resourceKinds) || !resolved.resourceKinds.length || resolved.resourceKinds.some((k) => typeof k !== 'string' || !k.trim())) {
     throw new Error('acms: calendar.resourceKinds must be a non-empty array of labels, e.g. ["Room", "Person"]');
   }
@@ -385,6 +399,8 @@ export const homes = import.meta.glob('/src/themes/*/templates/home.astro', { ea
 export const postTpls = import.meta.glob('/src/themes/*/templates/post-*.astro', { eager: true });
 export const pageTpls = import.meta.glob('/src/themes/*/templates/page-*.astro', { eager: true });
 export const eventTpls = import.meta.glob('/src/themes/*/templates/event.astro', { eager: true });
+export const headerTpls = import.meta.glob('/src/themes/*/templates/header.astro', { eager: true });
+export const footerTpls = import.meta.glob('/src/themes/*/templates/footer.astro', { eager: true });
 export const migrations = import.meta.glob('/src/themes/*/migrations/*.mjs', { eager: true });
 `;
 
@@ -544,7 +560,8 @@ export default function acms(options = {}) {
       ['/api/v1/calendars', 'api/v1/calendars.ts'],
       ['/api/calendar/events', 'api/calendar/events/index.ts'],
       ['/api/calendar/calendars', 'api/calendar/calendars.ts'],
-      ['/admin/calendar', 'admin/calendar/index.ts'],
+      ['/admin/calendar', 'admin/calendar/index.astro'],
+      ['/admin/calendar/settings', 'admin/calendar/settings.astro'],
       ['/admin/calendar/events', 'admin/calendar/events/index.astro'],
       ['/admin/calendar/events/[id]', 'admin/calendar/events/[id].astro'],
       ['/admin/calendar/calendars', 'admin/calendar/calendars.astro'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "publishConfig": {
     "access": "public"
   },
@@ -61,15 +61,17 @@
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
     "@libsql/client": "^0.15.0",
-    "@tiptap/core": "^3.30.1",
-    "@tiptap/extension-code-block-lowlight": "^3.30.1",
+    "@tiptap/core": "3.30.1",
+    "@tiptap/extension-bubble-menu": "3.30.1",
+    "@tiptap/extension-code-block-lowlight": "3.30.1",
+    "@tiptap/extension-floating-menu": "3.30.1",
     "@tiptap/extension-highlight": "3.30.1",
-    "@tiptap/extension-table": "^3.30.1",
-    "@tiptap/extensions": "^3.30.1",
-    "@tiptap/pm": "^3.30.1",
-    "@tiptap/react": "^3.30.1",
-    "@tiptap/starter-kit": "^3.30.1",
-    "@tiptap/suggestion": "^3.30.1",
+    "@tiptap/extension-table": "3.30.1",
+    "@tiptap/extensions": "3.30.1",
+    "@tiptap/pm": "3.30.1",
+    "@tiptap/react": "3.30.1",
+    "@tiptap/starter-kit": "3.30.1",
+    "@tiptap/suggestion": "3.30.1",
     "franc-min": "^6.2.0",
     "hast-util-to-html": "^9.0.5",
     "lowlight": "^3.3.0",
@@ -78,12 +80,12 @@
     "pdfjs-dist": "^6.3.289",
     "prismjs": "^1.30.0",
     "sanitize-html": "^2.17.7",
+    "semver": "^7.7.2",
     "simple-icons": "^16.27.1",
+    "tar": "^7.5.1",
     "turndown": "^7.2.4",
     "zod": "^3.24.0",
-    "zod-to-json-schema": "^3.25.2",
-    "semver": "^7.7.2",
-    "tar": "^7.5.1"
+    "zod-to-json-schema": "^3.25.2"
   },
   "peerDependencies": {
     "@astrojs/cloudflare": "^12.6.13",

package/src/actions/index.ts

@@ -16,16 +16,21 @@ import { normalizeCalendarSrc } from '../lib/calendar/src';
 import { getCalendarEvents } from '../lib/calendar/ics';
 import { siteLocale } from '../lib/dates';
 import { normalizePageLocale, localeHomeUrl } from '../lib/i18n';
-import { CALENDAR } from '../lib/calendar/config';
+import { CALENDAR, bookingsEnabled } from '../lib/calendar/config';
+import { holdConflicts } from '../lib/booking/holds';
+import { setBookingStatus } from '../lib/booking/service';
 import { eventTimeZone, featuredOccurrence, formatOccurrence, isValidTimeZone, normalizeEventTimes, safeColor } from '../lib/calendar/events';
 import { eventsFromCsv, eventsFromIcs, eventsFromVEvents } from '../lib/calendar/import';
 import { loadFeed } from '../lib/calendar/ics';
 import { NATIVE_ALL } from '../lib/calendar/render';
 import { collectViewEvents } from '../lib/calendar/data';
+import { loadBoard } from '../lib/calendar/board';
+import { duplicateEvent, moveOccurrence, moveSeries, quickCreate, undoMove } from '../lib/calendar/schedule';
 import { waitUntilFrom } from '../lib/webhooks';
 import { eventChanged, eventDeleted } from '../lib/calendar/hooks';
 import { siteOrigin } from '../lib/seo';
 import type { CalEvent } from '../lib/schema';
+import { CalEvent as CalEventSchema } from '../lib/schema';
 import { diffDesign, revertDesignChange, summarizeChanges } from '../lib/designDiff';
 import { shareEpoch } from '../lib/drafts';
 import { createDesignToken } from '../lib/preview';
@@ -391,11 +396,15 @@ export const server = {
         siteLogo: z.string().optional(),
         siteFavicon: z.string().optional(),
         siteCover: z.string().optional(),
-      }),
+        // IANA zone ('' = UTC) and BCP 47 locale ('' = en-US), same rules as Settings → General
+        timezone: z.string().max(100).refine((tz) => tz === '' || isValidTimeZone(tz), { message: 'Use an IANA timezone like America/New_York.' }).optional(),
+        locale: z.string().max(40).refine((l) => { if (l === '') return true; try { return Intl.getCanonicalLocales(l).length === 1; } catch { return false; } }, { message: 'Use a language tag like en-US or es.' }).optional(),
+      // unknown keys are an error, not silently dropped
+      }).strict(),
       handler: async (data, ctx) => {
         await requireAdmin(ctx);
         const repo = await getRepo(ctx.locals);
-        await repo.updateSettings(data);
+        await repo.updateSettings({ ...data, ...(data.locale ? { locale: Intl.getCanonicalLocales(data.locale)[0] } : {}) });
         return { ok: true };
       },
     }),
@@ -797,6 +806,54 @@ export const server = {
         return { sources: normalized, upcoming, total: events.length, labels };
       },
     }),
+    // Schedule (admin month/week grid): every occurrence between two days
+    range: defineAction({
+      input: z.object({ from: z.string().regex(/^\d{4}-\d{2}-\d{2}$/), to: z.string().regex(/^\d{4}-\d{2}-\d{2}$/) }),
+      handler: async ({ from, to }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        try { return await loadBoard(repo, await repo.getSettings(), from, to); }
+        catch (e) { throw new ActionError({ code: 'BAD_REQUEST', message: e instanceof Error ? e.message : 'Couldn’t load the calendar.' }); }
+      },
+    }),
+    // Calendar settings → Defaults / Bookings
+    saveSettings: defineAction({
+      input: z.object({
+        weekStart: z.union([z.literal(0), z.literal(1)]).optional(),
+        defaultCalendarId: z.string().max(100).optional(),
+        showBookings: z.boolean().optional(),
+        approval: z.enum(['auto', 'rules', 'manual']).optional(),
+        approvalRules: z.object({
+          longerThan: z.number().int().min(0).max(60 * 24 * 60),
+          firstTime: z.boolean(),
+          moreSeats: z.number().int().min(0).max(100000),
+          deadlineHours: z.number().int().min(0).max(24 * 60),
+          deadlineAction: z.enum(['approve', 'decline']),
+        }).optional(),
+        // reset every booking link to "use the site default"
+        applyToLinks: z.boolean().optional(),
+      }),
+      handler: async ({ applyToLinks, ...patch }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const settings = await repo.getSettings();
+        if (patch.defaultCalendarId) {
+          const cal = await repo.getCalendar(patch.defaultCalendarId);
+          if (!cal || cal.kind !== 'native') throw new ActionError({ code: 'BAD_REQUEST', message: 'Pick one of your calendars.' });
+        }
+        const calendar = { ...settings.calendar, ...Object.fromEntries(Object.entries(patch).filter(([, v]) => v !== undefined)) };
+        await repo.updateSettings({ calendar });
+        let updated = 0;
+        if (applyToLinks) {
+          for (const l of await repo.listBookingLinks()) {
+            if (l.approval === 'default') continue;
+            await repo.updateBookingLink(l.id, { approval: 'default' });
+            updated++;
+          }
+        }
+        return { calendar: (await repo.getSettings()).calendar, updated };
+      },
+    }),
   },
 
   events: {
@@ -829,6 +886,7 @@ export const server = {
         calendarIds: z.array(z.string()).max(50).optional(),
         fields: z.record(z.string().max(2000)).optional(),
         rsvp: z.object({ enabled: z.boolean(), capacity: z.number().int().min(0).max(100000), autoConfirm: z.boolean(), maxSeats: z.number().int().min(1).max(50) }).optional(),
+        roomHold: z.object({ resourceIds: z.array(z.string()).max(50), span: z.enum(['event', 'day']), before: z.number().int().min(0).max(1440), after: z.number().int().min(0).max(1440), whileDraft: z.boolean(), keep: z.array(z.string()).max(500).default([]) }).optional(),
         scheduledAt: nullableTs.optional(),
       }),
       handler: async ({ id, ...data }, ctx) => {
@@ -865,6 +923,131 @@ export const server = {
         return { ok: true };
       },
     }),
+    // Event editor → Rooms: which rooms/people are free at this event's time
+    // (for every room, so the picker can label them), and which existing
+    // bookings the selected rooms would overlap. Works on unsaved values.
+    roomStatus: defineAction({
+      input: z.object({
+        eventId: z.string().default(''),
+        title: z.string().max(300).default(''),
+        start: z.string().regex(/^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2})?$/),
+        end: z.string().max(20).default(''),
+        allDay: z.boolean(),
+        timezone: z.string().max(100).default(''),
+        rrule: z.string().max(500).default(''),
+        exdates: z.array(z.string()).max(500).default([]),
+        roomHold: z.object({ resourceIds: z.array(z.string()).max(50), span: z.enum(['event', 'day']), before: z.number().int().min(0).max(1440), after: z.number().int().min(0).max(1440), whileDraft: z.boolean(), keep: z.array(z.string()).max(500).default([]) }),
+      }),
+      handler: async (input, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const settings = await repo.getSettings();
+        if (!bookingsEnabled()) return { rooms: [], holds: '' };
+        let times: { start: string; end: string };
+        try { times = normalizeEventTimes({ start: input.start, end: input.end, allDay: input.allDay }); }
+        catch { throw new ActionError({ code: 'BAD_REQUEST', message: 'Pick a valid date and time.' }); }
+        const resources = await repo.listResources();
+        const now = Date.now();
+        // a stand-in event holding every room, so each one gets a status
+        const probe = CalEventSchema.parse({
+          id: input.eventId || 'probe', slug: 'probe', title: input.title || 'Event', ...times, allDay: input.allDay,
+          timezone: input.timezone, rrule: input.rrule, exdates: input.exdates, status: 'published', startAt: 0, endAt: 0, createdAt: 0, updatedAt: 0,
+          roomHold: { ...input.roomHold, resourceIds: resources.map((r) => r.id), keep: input.roomHold.keep },
+        });
+        const { conflicts, holds } = await holdConflicts(repo, settings, probe, { now });
+        const tz = settings.timezone || 'UTC';
+        const locale = siteLocale(settings);
+        const day = new Intl.DateTimeFormat(locale, { weekday: 'short', month: 'short', day: 'numeric', timeZone: tz });
+        const time = new Intl.DateTimeFormat(locale, { hour: 'numeric', minute: '2-digit', timeZone: tz });
+        const range = (a: number, b: number) => { try { return time.formatRange(a, b); } catch { return `${time.format(a)} – ${time.format(b)}`; } };
+        const occurrences = new Set(holds.map((h) => h.eventStart)).size;
+        const first = holds[0];
+        const holdsLabel = first ? (input.roomHold.span === 'day' ? `Holds all day on ${day.format(first.eventStart)}` : `Holds ${range(first.start, first.end)} on ${day.format(first.eventStart)}`) + (occurrences > 1 ? ` and ${occurrences - 1} more date${occurrences === 2 ? '' : 's'}` : '') : '';
+        return {
+          holds: holdsLabel,
+          rooms: resources.map((r) => {
+            const mine = conflicts.filter((c) => c.booking.resourceId === r.id);
+            return {
+              id: r.id, name: r.name, kind: r.kind, capacity: r.capacity,
+              datesWithBookings: new Set(mine.map((c) => c.hold.eventStart)).size, dates: occurrences,
+              conflicts: mine.slice(0, 20).map((c) => ({
+                id: c.booking.id, name: c.booking.kind === 'block' ? `Blocked${c.booking.notes ? ` · ${c.booking.notes}` : ''}` : c.booking.name,
+                block: c.booking.kind === 'block', status: c.booking.status,
+                when: `${day.format(c.booking.start)} · ${range(c.booking.start, c.booking.end)}`,
+              })),
+            };
+          }),
+        };
+      },
+    }),
+    // Event editor → Rooms → "Cancel and email": frees the room for the event
+    cancelBookingsForEvent: defineAction({
+      input: z.object({ ids: z.array(z.string()).min(1).max(100), message: z.string().max(2000).default('') }),
+      handler: async ({ ids, message }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        const settings = await repo.getSettings();
+        const opts = { origin: siteOrigin(settings, ctx.url), locals: ctx.locals, waitUntil: waitUntilFrom(ctx.locals) };
+        let cancelled = 0;
+        for (const id of ids) {
+          const b = await repo.getBooking(id);
+          if (!b || (b.status !== 'pending' && b.status !== 'confirmed')) continue;
+          try { await setBookingStatus(repo, b, 'cancelled', opts, message.trim() || undefined); cancelled++; } catch { /* changed meanwhile */ }
+        }
+        return { cancelled };
+      },
+    }),
+    // Schedule: click a day → title, time, calendar → saved (draft or published)
+    quickCreate: defineAction({
+      input: z.object({
+        title: z.string().max(300),
+        start: z.string().regex(/^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2})?$/),
+        end: z.string().regex(/^(\d{4}-\d{2}-\d{2}(T\d{2}:\d{2})?)?$/).default(''),
+        allDay: z.boolean(),
+        calendarId: z.string().max(100).default(''),
+        rrule: z.string().max(500).default(''),
+        location: z.string().max(300).default(''),
+        publish: z.boolean().default(false),
+        roomIds: z.array(z.string()).max(50).default([]),
+      }),
+      handler: async (input, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        try { const e = await quickCreate(repo, input, hooksFor(ctx)); return { id: e.id, status: e.status }; } catch (e) { asActionError(e); }
+      },
+    }),
+    // Schedule: drag to another day. `occurrence` + mode 'one' moves a single
+    // repeat; otherwise the whole event moves.
+    move: defineAction({
+      input: z.object({ id: z.string(), days: z.number().int(), mode: z.enum(['series', 'one']).default('series'), occurrence: z.string().max(20).default('') }),
+      handler: async ({ id, days, mode, occurrence }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        try {
+          const r = mode === 'one' ? await moveOccurrence(repo, id, occurrence, days, hooksFor(ctx)) : await moveSeries(repo, id, days, hooksFor(ctx));
+          return { id: r.event.id, undo: r.undo };
+        } catch (e) { asActionError(e); }
+      },
+    }),
+    undoMove: defineAction({
+      input: z.union([
+        z.object({ kind: z.literal('series'), id: z.string(), days: z.number().int() }),
+        z.object({ kind: z.literal('split'), id: z.string(), seriesId: z.string(), occurrence: z.string().max(20) }),
+      ]),
+      handler: async (undo, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        try { await undoMove(repo, undo, hooksFor(ctx)); return { ok: true }; } catch (e) { asActionError(e); }
+      },
+    }),
+    duplicate: defineAction({
+      input: z.object({ id: z.string() }),
+      handler: async ({ id }, ctx) => {
+        await requireAdmin(ctx);
+        const repo = await getRepo(ctx.locals);
+        try { return { id: (await duplicateEvent(repo, id)).id }; } catch (e) { asActionError(e); }
+      },
+    }),
     // editor pickers (event card): every event with its next date
     list: defineAction({
       input: z.object({ publishedOnly: z.boolean().default(false) }),

package/src/components/booking/BookingFlow.astro

@@ -7,6 +7,7 @@ import type { Booking, BookingLink, Resource, Settings } from '../../lib/schema'
 import { bookingLinkUrl, resourceUrl } from '../../lib/calendar/config';
 import { describeLength, describeLink, linkLengths, openDays, slotsForDay, ymd, type AvailabilityContext } from '../../lib/booking/availability';
 import { addMonths, fmt, monthCells, slotLabel } from '../../lib/booking/view';
+import { confirmsInstantly, linkApproval } from '../../lib/booking/approval';
 
 interface Props {
   resource: Resource;
@@ -21,6 +22,8 @@ interface Props {
 }
 const { resource, link, ctx, settings, url, error = '', values = {}, embed = false, reschedule = null } = Astro.props;
 const tz = ctx.resource.timezone || settings.timezone || 'UTC';
+// "rules" links usually confirm at once, but may not — promise only what's certain
+const instant = confirmsInstantly(linkApproval(link, settings));
 const f = fmt(settings, tz);
 const today = ymd(ctx.now, tz);
 const lengths = linkLengths(link);
@@ -51,7 +54,7 @@ const q = (patch: Record<string, string | number | undefined>) => {
 };
 const rules = [
   describeLink(link),
-  link.autoConfirm ? 'Confirmed instantly' : 'Needs approval',
+  instant ? 'Confirmed instantly' : 'Needs approval',
   link.bufferBefore || link.bufferAfter ? `Includes ${[link.bufferBefore && `${link.bufferBefore} min setup`, link.bufferAfter && `${link.bufferAfter} min cleanup`].filter(Boolean).join(' + ')}` : '',
 ].filter(Boolean);
 const val = (k: string) => values[k] ?? '';
@@ -142,8 +145,8 @@ const val = (k: string) => values[k] ?? '';
             ))}
           </>
         )}
-        <button class="pc-bk-submit" type="submit">{reschedule ? 'Move my booking' : link.autoConfirm ? 'Confirm booking' : 'Request booking'}</button>
-        {!link.autoConfirm && !reschedule && <p class="pc-bk-fine">We’ll email you once it’s approved. Nothing is final until then.</p>}
+        <button class="pc-bk-submit" type="submit">{reschedule ? 'Move my booking' : instant ? 'Confirm booking' : 'Request booking'}</button>
+        {!instant && !reschedule && <p class="pc-bk-fine">We’ll email you once it’s approved. Nothing is final until then.</p>}
       </form>
     </section>
   )}

package/src/components/calendar/BookingsHead.astro

@@ -0,0 +1,51 @@
+---
+// Shared header for the Bookings home: Requests (what came in) and Rooms &
+// people (what can be booked) are two tabs of one place, with the same ⚙ and
+// "New ▾" as the Schedule. Extra page actions go in the default slot.
+interface Props {
+  active: 'requests' | 'rooms';
+  sub: string;
+  pending: number;
+  rooms: number;
+  // on the Requests page the menu opens its dialogs in place
+  inPlace?: boolean;
+}
+const { active, sub, pending, rooms, inPlace = false } = Astro.props;
+const gear = 'M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6zM19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 1 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06A1.65 1.65 0 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06A1.65 1.65 0 0 0 9 4.68a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06A1.65 1.65 0 0 0 19.4 9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z';
+---
+
+<div class="page-head bk-head">
+  <div>
+    <h1>Bookings</h1>
+    <p class="sub">{sub}</p>
+  </div>
+  <div class="page-actions">
+    <slot />
+    <a class="btn ico" href="/admin/calendar/settings#bookings" title="Calendar settings" aria-label="Calendar settings"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d={gear} /></svg></a>
+    <details class="newmenu">
+      <summary class="btn primary">New <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><path d="M6 9l6 6 6-6" /></svg></summary>
+      <div class="newmenu-pop" role="menu">
+        {inPlace
+          ? <button type="button" role="menuitem" data-modal="bk-add">Booking <small>for someone</small></button>
+          : <a role="menuitem" href="/admin/calendar/bookings?add=1">Booking <small>for someone</small></a>}
+        {inPlace
+          ? <button type="button" role="menuitem" data-modal="bk-block">Block time <small>room closed, time off</small></button>
+          : <a role="menuitem" href="/admin/calendar/bookings?block=1">Block time <small>room closed, time off</small></a>}
+        {active === 'rooms'
+          ? <button type="button" role="menuitem" data-modal="new-resource">Room or person</button>
+          : <a role="menuitem" href="/admin/calendar/resources?new=1">Room or person</a>}
+      </div>
+    </details>
+  </div>
+</div>
+<nav class="ptabs" aria-label="Bookings">
+  <a href="/admin/calendar/bookings" aria-current={active === 'requests' ? 'page' : undefined}>Requests{pending > 0 && <small class="attn">{pending} {pending === 1 ? 'needs' : 'need'} approval</small>}</a>
+  <a href="/admin/calendar/resources" aria-current={active === 'rooms' ? 'page' : undefined}>Rooms &amp; people<small>{rooms}</small></a>
+</nav>
+
+<script>
+  document.addEventListener('click', (e) => {
+    const m = document.querySelector<HTMLDetailsElement>('details.newmenu[open]');
+    if (m && (!(e.target instanceof Node) || !m.contains(e.target) || (e.target as Element).closest('[role=menuitem]'))) m.open = false;
+  });
+</script>