@agent-native/core 0.192.0 → 0.192.1-nightly-20260926144920

package/corpus/templates/calendar/server/handlers/availability.ts

@@ -75,36 +75,38 @@ export const getPublicAvailability = defineEventHandler(
         .from(schema.bookingLinks)
         .where(eq(schema.bookingLinks.slug, slug))
         .then((rows) => rows[0]);
-      if (link?.ownerEmail) {
-        const ownerConfig = (await getUserSetting(
-          link.ownerEmail,
-          "calendar-availability",
-        )) as unknown as AvailabilityConfig | null;
-        if (ownerConfig) return ownerConfig;
-        const ownerSettings = (await getUserSetting(
-          link.ownerEmail,
-          "calendar-settings",
-        )) as { timezone?: string } | null;
-        return createDefaultAvailability(
-          ownerSettings?.timezone || "America/New_York",
-        );
+      const usernameOwnerEmail = username
+        ? await getBookingUsernameOwner(username)
+        : null;
+      if (
+        username &&
+        (!usernameOwnerEmail ||
+          (link && link.ownerEmail !== usernameOwnerEmail))
+      ) {
+        throw createError({
+          statusCode: 404,
+          statusMessage: "Booking page not found",
+        });
       }
 
-      if (username) {
-        const ownerEmail = await getBookingUsernameOwner(username);
-        if (!ownerEmail) {
-          throw createError({
-            statusCode: 404,
-            statusMessage: "Booking page not found",
-          });
-        }
-
+      const ownerEmail = link?.ownerEmail || usernameOwnerEmail;
+      if (ownerEmail) {
         const ownerConfig = (await getUserSetting(
           ownerEmail,
           "calendar-availability",
         )) as unknown as AvailabilityConfig | null;
-        if (ownerConfig?.bookingPageSlug === slug) return ownerConfig;
-        if (!ownerConfig && slug === "book") {
+        if (
+          ownerConfig &&
+          (link?.ownerEmail ||
+            !username ||
+            ownerConfig.bookingPageSlug === slug)
+        ) {
+          return ownerConfig;
+        }
+        if (
+          !ownerConfig &&
+          (link?.ownerEmail || !username || slug === "book")
+        ) {
           const ownerSettings = (await getUserSetting(
             ownerEmail,
             "calendar-settings",
@@ -113,11 +115,12 @@ export const getPublicAvailability = defineEventHandler(
             ownerSettings?.timezone || "America/New_York",
           );
         }
-
-        throw createError({
-          statusCode: 404,
-          statusMessage: "Booking page not found",
-        });
+        if (username) {
+          throw createError({
+            statusCode: 404,
+            statusMessage: "Booking page not found",
+          });
+        }
       }
     }
 

package/corpus/templates/calendar/server/handlers/bookings.ts

@@ -3,6 +3,7 @@ import { getOrgContext, orgMembers } from "@agent-native/core/org";
 import {
   getSession,
   getAppProductionUrl,
+  getRequestContext,
   recordChange,
   readBody,
   runWithRequestContext,
@@ -29,7 +30,6 @@ import type {
   Booking,
   CalendarEvent,
   AvailabilityConfig,
-  ConferencingConfig,
   CustomField,
   TimeSlot,
 } from "../../shared/api.js";
@@ -55,12 +55,18 @@ import {
 import {
   getBookingLinkCoHostEmails,
   getBookingLinkRequiredHostEmails,
+  isBookingLinkHost,
   normalizeBookingHosts,
+  parseBookingConferencingConfig,
 } from "../lib/booking-link-utils.js";
 import { getOwnerBookingTimeZone } from "../lib/booking-timezone.js";
 import { eventBlocksAvailability } from "../lib/calendar-availability.js";
 import * as googleCalendar from "../lib/google-calendar.js";
-import { createZoomMeeting } from "../lib/zoom.js";
+import {
+  createZoomMeeting,
+  deleteZoomMeeting,
+  needsZoomCancellationReview,
+} from "../lib/zoom.js";
 import { getBookingUsernameOwner } from "./booking-usernames.js";
 
 async function requireRequestContext<T>(
@@ -89,16 +95,23 @@ async function getBookingLinkSlugsForOwners(
   return Array.from(new Set(rows.map((row) => row.slug)));
 }
 
-async function getBookingLinkOwnerEmail(
-  slug: string,
-): Promise<string | undefined> {
+async function getBookingLinkDetails(slug: string) {
   if (!slug) return undefined;
-  const row = await getDb()
-    .select({ ownerEmail: schema.bookingLinks.ownerEmail })
+  return getDb()
+    .select({
+      ownerEmail: schema.bookingLinks.ownerEmail,
+      hosts: schema.bookingLinks.hosts,
+      conferencing: schema.bookingLinks.conferencing,
+    })
     .from(schema.bookingLinks)
     .where(eq(schema.bookingLinks.slug, slug))
     .then((rows) => rows[0]);
-  return row?.ownerEmail;
+}
+
+async function getBookingLinkOwnerEmail(
+  slug: string,
+): Promise<string | undefined> {
+  return (await getBookingLinkDetails(slug))?.ownerEmail;
 }
 
 function stripCrlf(value: unknown): string {
@@ -608,7 +621,7 @@ async function resolveAvailabilityContext({
   draft?: BookingAvailabilityDraft;
   db?: ConflictDb;
 }): Promise<AvailabilityContext> {
-  const [configRaw, bookingLink] = await Promise.all([
+  const [configRaw, bookingLink, usernameOwnerEmail] = await Promise.all([
     getSetting("calendar-availability"),
     slug
       ? db
@@ -629,6 +642,9 @@ async function resolveAvailabilityContext({
           )
           .then((rows) => rows[0])
       : Promise.resolve(undefined),
+    username && !draft
+      ? getBookingUsernameOwner(username)
+      : Promise.resolve(null),
   ]);
   if (draft && !bookingLink) {
     throw createError({
@@ -636,47 +652,57 @@ async function resolveAvailabilityContext({
       statusMessage: "Booking link not found",
     });
   }
+  if (username && !draft && !usernameOwnerEmail) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: "Booking page not found",
+    });
+  }
+  if (username && !draft && bookingLink) {
+    if (bookingLink.ownerEmail !== usernameOwnerEmail) {
+      throw createError({
+        statusCode: 404,
+        statusMessage: "Booking page not found",
+      });
+    }
+  } else if (username && !draft) {
+    return {
+      effectiveConfig: null,
+      ownerEmail: undefined,
+      hostEmails: [],
+      eligibleHosts: [],
+      slug,
+      bookingLink: undefined,
+      durationSource: undefined,
+      conflictSlugs: [],
+    };
+  }
   const config = configRaw as unknown as AvailabilityConfig | null;
-  const usernameOwnerEmail =
-    !bookingLink && username && !draft
-      ? await getBookingUsernameOwner(username)
-      : null;
-  const candidateOwnerEmail = bookingLink?.ownerEmail || usernameOwnerEmail;
-  const [candidateOwnerConfigRaw, candidateOwnerSettingsRaw] =
-    candidateOwnerEmail
-      ? await Promise.all([
-          getUserSetting(candidateOwnerEmail, "calendar-availability"),
-          getUserSetting(candidateOwnerEmail, "calendar-settings"),
-        ])
-      : [null, null];
-  const candidateOwnerConfig =
-    candidateOwnerConfigRaw as AvailabilityConfig | null;
-  const usernameSlugMatches =
-    !usernameOwnerEmail ||
-    candidateOwnerConfig?.bookingPageSlug === slug ||
-    (!candidateOwnerConfig && slug === "book");
-  const ownerEmail =
-    bookingLink?.ownerEmail ||
-    (usernameSlugMatches ? usernameOwnerEmail || undefined : undefined);
+  const ownerEmail = bookingLink?.ownerEmail;
   const overrides = bookingLink
     ? resolveBookingLinkAvailabilityOverrides({ bookingLink, draft })
     : undefined;
   const hostEmails = overrides?.hostEmails ?? (ownerEmail ? [ownerEmail] : []);
-  const ownerConfig = ownerEmail ? candidateOwnerConfig : null;
-  const ownerSettings = ownerEmail
-    ? (candidateOwnerSettingsRaw as { timezone?: string } | null)
-    : null;
+  const [ownerConfigRaw, ownerSettingsRaw, ownerLinkSlugs, eligibleHosts] =
+    await Promise.all([
+      ownerEmail
+        ? getUserSetting(ownerEmail, "calendar-availability")
+        : Promise.resolve(null),
+      ownerEmail
+        ? getUserSetting(ownerEmail, "calendar-settings")
+        : Promise.resolve(null),
+      ownerEmail
+        ? getBookingLinkSlugsForOwners(hostEmails, db)
+        : Promise.resolve([]),
+      getEligibleHostAvailability(ownerEmail, hostEmails),
+    ]);
+  const ownerConfig = ownerConfigRaw as AvailabilityConfig | null;
+  const ownerSettings = ownerSettingsRaw as { timezone?: string } | null;
   const conflictSlugs = ownerEmail
-    ? await getBookingLinkSlugsForOwners(hostEmails, db).then((slugs) =>
-        Array.from(new Set([slug, ...slugs])),
-      )
+    ? Array.from(new Set([slug, ...ownerLinkSlugs]))
     : slug
       ? [slug]
       : [];
-  const eligibleHosts = await getEligibleHostAvailability(
-    ownerEmail,
-    hostEmails,
-  );
 
   return {
     effectiveConfig:
@@ -685,9 +711,7 @@ async function resolveAvailabilityContext({
         ? createDefaultAvailability(
             ownerSettings?.timezone || "America/New_York",
           )
-        : username
-          ? null
-          : config),
+        : config),
     ownerEmail,
     hostEmails,
     eligibleHosts,
@@ -1387,6 +1411,20 @@ export const createBooking = defineEventHandler(async (event: H3Event) => {
     }
 
     // Check for conflicts + insert atomically in a transaction
+    const parsedConferencing = parseBookingConferencingConfig(
+      link?.conferencing,
+    );
+    if (parsedConferencing.status === "invalid") {
+      setResponseStatus(event, 422);
+      return {
+        error: "Failed to create booking",
+        code: "invalid_conferencing_config",
+      };
+    }
+    const conferencing =
+      parsedConferencing.status === "valid"
+        ? parsedConferencing.config
+        : undefined;
     const db = getDb();
     const insertResult = await db.transaction(async (tx) => {
       if (viewer) {
@@ -1469,6 +1507,7 @@ export const createBooking = defineEventHandler(async (event: H3Event) => {
             ? JSON.stringify(fieldResponses)
             : null,
         cancelToken,
+        zoomNeedsReview: conferencing?.type === "zoom",
         status: "confirmed",
         createdAt: now,
         ownerEmail: hostEmail,
@@ -1486,17 +1525,12 @@ export const createBooking = defineEventHandler(async (event: H3Event) => {
       return { error: "This time slot is no longer available" };
     }
 
-    // Resolve conferencing config
-    let conferencing: ConferencingConfig | undefined;
-    if (link?.conferencing) {
-      try {
-        conferencing = JSON.parse(link.conferencing);
-      } catch {}
-    }
     let meetingLink: string | undefined;
     let googleEventId: string | undefined;
     let calendarAccountId: string | undefined;
     let meetingLinkPending = false;
+    let zoomMeetingId: string | undefined;
+    let zoomAccountId: string | undefined;
 
     // For custom-URL conferencing, use the static URL — only http(s).
     if (conferencing?.type === "custom" && conferencing.url) {
@@ -1536,6 +1570,8 @@ export const createBooking = defineEventHandler(async (event: H3Event) => {
           throw new Error("Zoom meeting was not created");
         }
         meetingLink = zoomResult.meetingUrl;
+        zoomMeetingId = zoomResult.meetingId;
+        zoomAccountId = zoomResult.accountId;
       } catch (error) {
         console.error(
           `[bookings] Failed to create Zoom meeting for ${hostEmail}:`,
@@ -1543,8 +1579,7 @@ export const createBooking = defineEventHandler(async (event: H3Event) => {
         );
         // Zoom may have created the meeting even if its response was lost or
         // unreadable, so keep the booking to reserve the slot and prevent a
-        // retry from silently creating a duplicate meeting. Finish the
-        // independent calendar write before returning the provider error.
+        // retry from silently creating a duplicate meeting.
         meetingLinkPending = true;
       }
     }
@@ -1634,10 +1669,23 @@ export const createBooking = defineEventHandler(async (event: H3Event) => {
         meetingLink?: string;
         googleEventId?: string;
         calendarAccountId?: string;
+        zoomNeedsReview?: boolean;
+        zoomMeetingId?: string;
+        zoomAccountId?: string;
         meetingLinkPending: boolean;
       } = { meetingLinkPending };
       if (meetingLink) providerUpdates.meetingLink = meetingLink;
       if (googleEventId) providerUpdates.googleEventId = googleEventId;
+      if (zoomMeetingId) providerUpdates.zoomMeetingId = zoomMeetingId;
+      if (zoomAccountId) providerUpdates.zoomAccountId = zoomAccountId;
+      if (
+        conferencing?.type === "zoom" &&
+        meetingLink &&
+        zoomMeetingId &&
+        zoomAccountId
+      ) {
+        providerUpdates.zoomNeedsReview = false;
+      }
       if (googleEventId && calendarAccountId) {
         providerUpdates.calendarAccountId = calendarAccountId;
       }
@@ -1664,6 +1712,7 @@ export const createBooking = defineEventHandler(async (event: H3Event) => {
       ...(meetingLinkPending ? { meetingLinkPending: true } : {}),
       googleEventId,
       cancelToken,
+      zoomNeedsReview: conferencing?.type === "zoom" && meetingLinkPending,
       status: "confirmed",
       createdAt: now,
     };
@@ -1897,6 +1946,7 @@ export const getAvailableSlots = defineEventHandler(async (event: H3Event) => {
 export async function cancelBookingById(
   id: string,
   origin = getAppProductionUrl(),
+  options: { zoomMeetingResolved?: boolean } = {},
 ) {
   if (!id)
     throw createError({ statusCode: 400, statusMessage: "id is required" });
@@ -1914,11 +1964,23 @@ export async function cancelBookingById(
 
   // Bookings have no ownerEmail of their own — scope through the booking link.
   const accessibleLinks = await db
-    .select({ slug: schema.bookingLinks.slug })
+    .select({
+      slug: schema.bookingLinks.slug,
+      ownerEmail: schema.bookingLinks.ownerEmail,
+      hosts: schema.bookingLinks.hosts,
+      conferencing: schema.bookingLinks.conferencing,
+    })
     .from(schema.bookingLinks)
-    .where(accessFilter(schema.bookingLinks, schema.bookingLinkShares));
-  const accessibleSlugs = new Set(accessibleLinks.map((link) => link.slug));
-  if (!accessibleSlugs.has(existing.slug)) {
+    .where(
+      accessFilter(
+        schema.bookingLinks,
+        schema.bookingLinkShares,
+        undefined,
+        "editor",
+      ),
+    );
+  const link = accessibleLinks.find((item) => item.slug === existing.slug);
+  if (!link) {
     throw createError({ statusCode: 403, statusMessage: "Access denied" });
   }
 
@@ -1926,7 +1988,35 @@ export async function cancelBookingById(
     return { success: true, alreadyCancelled: true };
   }
 
-  const hostEmail = await getBookingLinkOwnerEmail(existing.slug);
+  if (
+    options.zoomMeetingResolved === true &&
+    !isBookingLinkHost(link, getRequestContext()?.userEmail)
+  ) {
+    throw createError({ statusCode: 403, statusMessage: "Access denied" });
+  }
+
+  if (
+    needsZoomCancellationReview({
+      ...existing,
+      conferencing: link.conferencing,
+    }) &&
+    options.zoomMeetingResolved !== true
+  ) {
+    throw createError({
+      statusCode: 409,
+      statusMessage:
+        "Check the Zoom meeting and resolve it before canceling this booking",
+    });
+  }
+
+  if (existing.zoomMeetingId && existing.zoomAccountId) {
+    await deleteZoomMeeting({
+      accountId: existing.zoomAccountId,
+      meetingId: existing.zoomMeetingId,
+    });
+  }
+
+  const hostEmail = link.ownerEmail;
   const bookingTimeZone = await getOwnerBookingTimeZone(hostEmail);
   const bookAgainUrl = existing.slug
     ? `${origin}/book/${existing.slug}`
@@ -1940,7 +2030,7 @@ export async function cancelBookingById(
   await deleteGoogleEventForBooking({ booking: existing, hostEmail });
   await db
     .update(schema.bookings)
-    .set({ status: "cancelled" })
+    .set({ status: "cancelled", zoomNeedsReview: false })
     .where(eq(schema.bookings.id, id));
   recordBookingsChanged(hostEmail);
   return { success: true };
@@ -1949,9 +2039,19 @@ export async function cancelBookingById(
 export const deleteBooking = defineEventHandler(async (event: H3Event) => {
   return requireRequestContext(event, async () => {
     try {
+      const body = await readBody(event);
+      const parsed = z
+        .object({ zoomMeetingResolved: z.boolean().optional() })
+        .strict()
+        .safeParse(body ?? {});
+      if (!parsed.success) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid cancellation options" };
+      }
       return await cancelBookingById(
         getRouterParam(event, "id") as string,
         getRequestURL(event).origin,
+        parsed.data,
       );
     } catch (error: any) {
       setResponseStatus(event, error?.statusCode ?? 500);
@@ -1982,6 +2082,7 @@ export const getBookingByToken = defineEventHandler(async (event: H3Event) => {
 
     // Return limited info — don't expose internal IDs
     const booking = rowToBooking(row);
+    const link = await getBookingLinkDetails(row.slug);
     return {
       eventTitle: booking.eventTitle,
       name: booking.name,
@@ -1989,6 +2090,10 @@ export const getBookingByToken = defineEventHandler(async (event: H3Event) => {
       end: booking.end,
       slug: booking.slug,
       meetingLink: booking.meetingLink,
+      zoomCancellationNeedsReview: needsZoomCancellationReview({
+        ...row,
+        conferencing: link?.conferencing,
+      }),
       meetingLinkPending: booking.meetingLinkPending,
       status: booking.status,
     };
@@ -2024,12 +2129,34 @@ export const cancelBookingByToken = defineEventHandler(
         return { success: true, alreadyCancelled: true };
       }
 
+      const link = await getBookingLinkDetails(row.slug);
+      if (
+        needsZoomCancellationReview({
+          ...row,
+          conferencing: link?.conferencing,
+        })
+      ) {
+        setResponseStatus(event, 409);
+        return {
+          error:
+            "The organizer must review the Zoom meeting before this booking can be canceled",
+          code: "zoom_meeting_review_required",
+        };
+      }
+
+      if (row.zoomMeetingId && row.zoomAccountId) {
+        await deleteZoomMeeting({
+          accountId: row.zoomAccountId,
+          meetingId: row.zoomMeetingId,
+        });
+      }
+
       await db
         .update(schema.bookings)
-        .set({ status: "cancelled" })
+        .set({ status: "cancelled", zoomNeedsReview: false })
         .where(eq(schema.bookings.id, row.id));
 
-      const hostEmail = await getBookingLinkOwnerEmail(row.slug);
+      const hostEmail = link?.ownerEmail;
       const bookingTimeZone = await getOwnerBookingTimeZone(hostEmail);
       const reqUrl = getRequestURL(event);
       const bookAgainUrl = row.slug
@@ -2046,7 +2173,7 @@ export const cancelBookingByToken = defineEventHandler(
 
       return { success: true, slug: row.slug };
     } catch (error: any) {
-      setResponseStatus(event, 500);
+      setResponseStatus(event, error?.statusCode ?? 500);
       return { error: error.message };
     }
   },

package/corpus/templates/calendar/server/lib/booking-link-utils.ts

@@ -1,7 +1,17 @@
-import type { BookingHost, BookingLink } from "../../shared/api.js";
+import { z } from "zod";
+
+import type {
+  BookingHost,
+  BookingLink,
+  ConferencingConfig,
+} from "../../shared/api.js";
 import { schema } from "../db/index.js";
 
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const httpUrlSchema = z
+  .string()
+  .url()
+  .refine((value) => /^https?:\/\//i.test(value));
 
 function stripCrlf(value: unknown): string {
   return (
@@ -29,6 +39,33 @@ function parseJson<T>(value: string | null, fallback: T): T {
   }
 }
 
+const conferencingConfigSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("none"), url: z.string().optional() }),
+  z.object({ type: z.literal("google_meet"), url: z.string().optional() }),
+  z.object({ type: z.literal("zoom"), url: z.string().optional() }),
+  z.object({
+    type: z.literal("custom"),
+    url: httpUrlSchema,
+  }),
+]);
+
+export function parseBookingConferencingConfig(
+  value: string | null | undefined,
+):
+  | { status: "absent" }
+  | { status: "invalid" }
+  | { status: "valid"; config: ConferencingConfig } {
+  if (value == null) return { status: "absent" };
+  try {
+    const parsed = conferencingConfigSchema.safeParse(JSON.parse(value));
+    return parsed.success
+      ? { status: "valid", config: parsed.data }
+      : { status: "invalid" };
+  } catch {
+    return { status: "invalid" };
+  }
+}
+
 export function normalizeBookingHosts(
   input: unknown,
   ownerEmail?: string | null,
@@ -100,6 +137,14 @@ export function getBookingLinkRequiredHostEmails(
   return emails;
 }
 
+export function isBookingLinkHost(
+  row: Pick<typeof schema.bookingLinks.$inferSelect, "hosts" | "ownerEmail">,
+  userEmail: unknown,
+): boolean {
+  const email = normalizeBookingHostEmail(userEmail);
+  return !!email && getBookingLinkRequiredHostEmails(row).includes(email);
+}
+
 export function rowToBookingLink(
   row: typeof schema.bookingLinks.$inferSelect,
 ): BookingLink {

package/corpus/templates/calendar/server/lib/zoom.ts

@@ -24,6 +24,8 @@ import {
  */
 import { nanoid } from "nanoid";
 
+import { parseBookingConferencingConfig } from "./booking-link-utils.js";
+
 const PROVIDER = "zoom_video";
 const SCOPES = [
   "meeting:write:meeting",
@@ -56,6 +58,51 @@ export function getZoomAuthUrl(redirectUri: string, state: string) {
   return `https://zoom.us/oauth/authorize?${params}`;
 }
 
+function createProvider(creds: { clientId: string; clientSecret: string }) {
+  return createZoomProvider({
+    clientId: creds.clientId,
+    clientSecret: creds.clientSecret,
+    getAccessToken: (credentialId) => resolveAccessToken(credentialId),
+    updateTokens: async (credentialId, tokens) => {
+      const existing = await getOAuthTokens(PROVIDER, credentialId);
+      await saveOAuthTokens(PROVIDER, credentialId, {
+        ...existing,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken ?? (existing as any)?.refreshToken,
+        expiresAt: tokens.expiresAt?.getTime(),
+      });
+    },
+  });
+}
+
+export function needsZoomCancellationReview(booking: {
+  zoomNeedsReview?: boolean;
+  meetingLink?: string | null;
+  zoomMeetingId?: string | null;
+  zoomAccountId?: string | null;
+  conferencing?: string | null;
+  status?: string;
+}): boolean {
+  if (booking.status === "cancelled") return false;
+  if (booking.zoomMeetingId && booking.zoomAccountId) return false;
+  if (booking.zoomNeedsReview) return true;
+  const conferencing = parseBookingConferencingConfig(booking.conferencing);
+  if (conferencing.status === "invalid") return true;
+  if (conferencing.status === "valid" && conferencing.config.type === "zoom") {
+    return true;
+  }
+  if (!booking.meetingLink) return false;
+
+  try {
+    const hostname = new URL(booking.meetingLink).hostname.toLowerCase();
+    return ["zoom.us", "zoom.com", "zoomgov.com"].some(
+      (domain) => hostname === domain || hostname.endsWith(`.${domain}`),
+    );
+  } catch {
+    return true;
+  }
+}
+
 /**
  * Exchange an authorization code for Zoom tokens. Stores them in
  * `oauth_tokens(provider="zoom_video", account_id=<zoom_user_id>, owner=<ownerEmail>)`.
@@ -168,7 +215,12 @@ export async function disconnectZoom(ownerEmail: string) {
  * owned by the host. `not_started` means the meeting creation request was not sent.
  */
 export type ZoomMeetingResult =
-  | { status: "created"; meetingUrl: string; meetingId: string }
+  | {
+      status: "created";
+      meetingUrl: string;
+      meetingId: string;
+      accountId: string;
+    }
   | { status: "not_started" }
   | { status: "rejected" };
 
@@ -248,9 +300,22 @@ export async function createZoomMeeting(opts: {
     status: "created",
     meetingUrl: result.meetingUrl,
     meetingId: result.meetingId,
+    accountId: credentialId,
   };
 }
 
+export async function deleteZoomMeeting(opts: {
+  accountId: string;
+  meetingId: string;
+}): Promise<void> {
+  const creds = getZoomCreds();
+  if (!creds) throw new Error("Zoom OAuth is not configured");
+  await createProvider(creds).deleteMeeting!({
+    credentialId: opts.accountId,
+    meetingId: opts.meetingId,
+  });
+}
+
 /**
  * Resolve a fresh access token for a Zoom credential, refreshing it if it's
  * expired (or near-expiry). Persists the refreshed tokens back to oauth_tokens.