@agent-native/scheduling 0.1.24 → 0.1.25

package/dist/actions/_helpers.d.ts

@@ -1,5 +1,15 @@
 export declare function currentUserEmail(): string;
 export declare function currentUserEmailOrNull(): string | null;
+/**
+ * Verify the current user is the host of a booking. Throws "Not authorized to
+ * <action>" if not. Mirrors the `isHost` half of the `isHost || hasToken`
+ * guard used by cancel-booking/reschedule-booking, for booking actions that
+ * don't accept a public capability token (attendee/note/status mutations —
+ * host identity is the only legitimate caller for these).
+ */
+export declare function assertBookingHost(booking: {
+    hostEmail: string;
+}, action: string): void;
 export declare function currentOrgId(): string | undefined;
 export declare function assertTeamAdmin(teamId: string): Promise<void>;
 /**

package/dist/actions/_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../src/actions/_helpers.ts"],"names":[],"mappings":"AAOA,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAEtD;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBnE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBpE"}
+{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../src/actions/_helpers.ts"],"names":[],"mappings":"AAOA,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAC9B,MAAM,EAAE,MAAM,GACb,IAAI,CAMN;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBnE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBpE"}

package/dist/actions/_helpers.js

@@ -12,6 +12,20 @@ export function currentUserEmail() {
 export function currentUserEmailOrNull() {
     return getSchedulingContext().getCurrentUserEmail() ?? null;
 }
+/**
+ * Verify the current user is the host of a booking. Throws "Not authorized to
+ * <action>" if not. Mirrors the `isHost` half of the `isHost || hasToken`
+ * guard used by cancel-booking/reschedule-booking, for booking actions that
+ * don't accept a public capability token (attendee/note/status mutations —
+ * host identity is the only legitimate caller for these).
+ */
+export function assertBookingHost(booking, action) {
+    const userEmail = currentUserEmailOrNull();
+    const isHost = !!userEmail && userEmail === booking.hostEmail;
+    if (!isHost) {
+        throw new Error(`Not authorized to ${action}`);
+    }
+}
 export function currentOrgId() {
     return getSchedulingContext().getCurrentOrgId?.();
 }

package/dist/actions/_helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"_helpers.js","sourceRoot":"","sources":["../../src/actions/_helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC,mBAAmB,EAAE,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,oBAAoB,EAAE,CAAC,mBAAmB,EAAE,IAAI,IAAI,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,oBAAoB,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAClD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SACzC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CACxC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC3B,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SACzC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CACxC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}
+{"version":3,"file":"_helpers.js","sourceRoot":"","sources":["../../src/actions/_helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,oBAAoB,EAAE,CAAC,mBAAmB,EAAE,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,oBAAoB,EAAE,CAAC,mBAAmB,EAAE,IAAI,IAAI,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA8B,EAC9B,MAAc;IAEd,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,oBAAoB,EAAE,CAAC,eAAe,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc;IAClD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SACzC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CACxC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC3B,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SACzC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SACxB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CACxC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/actions/add-booking-attendee.js

@@ -3,6 +3,7 @@ import { nanoid } from "nanoid";
 import { z } from "zod";
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
+import { assertBookingHost } from "./_helpers.js";
 export default defineAction({
     description: "Add an attendee (or seat reservation) to a booking",
     schema: z.object({
@@ -15,6 +16,7 @@ export default defineAction({
         const booking = await getBookingByUid(args.uid);
         if (!booking)
             throw new Error(`Booking ${args.uid} not found`);
+        assertBookingHost(booking, "add an attendee to this booking");
         const { getDb, schema } = getSchedulingContext();
         await getDb()
             .insert(schema.bookingAttendees)

package/dist/actions/add-booking-attendee.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-booking-attendee.js","sourceRoot":"","sources":["../../src/actions/add-booking-attendee.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,oDAAoD;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,KAAK,EAAE;aACV,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;aAC/B,MAAM,CAAC;YACN,EAAE,EAAE,MAAM,EAAE;YACZ,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACL,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"add-booking-attendee.js","sourceRoot":"","sources":["../../src/actions/add-booking-attendee.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,oDAAoD;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,iBAAiB,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC;QAC9D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,KAAK,EAAE;aACV,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;aAC/B,MAAM,CAAC;YACN,EAAE,EAAE,MAAM,EAAE;YACZ,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;YAC/B,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACL,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;CACF,CAAC,CAAC"}

package/dist/actions/add-booking-note.js

@@ -3,7 +3,7 @@ import { nanoid } from "nanoid";
 import { z } from "zod";
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
-import { currentUserEmail } from "./_helpers.js";
+import { assertBookingHost, currentUserEmail } from "./_helpers.js";
 export default defineAction({
     description: "Add an internal (host-only) note to a booking",
     schema: z.object({ uid: z.string(), content: z.string() }),
@@ -11,6 +11,7 @@ export default defineAction({
         const booking = await getBookingByUid(args.uid);
         if (!booking)
             throw new Error(`Booking ${args.uid} not found`);
+        assertBookingHost(booking, "add a note to this booking");
         const { getDb, schema } = getSchedulingContext();
         const id = nanoid();
         await getDb().insert(schema.bookingNotes).values({

package/dist/actions/add-booking-note.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-booking-note.js","sourceRoot":"","sources":["../../src/actions/add-booking-note.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,+CAA+C;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1D,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YAC/C,EAAE;YACF,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,WAAW,EAAE,gBAAgB,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC;IAChB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"add-booking-note.js","sourceRoot":"","sources":["../../src/actions/add-booking-note.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEpE,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,+CAA+C;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1D,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,iBAAiB,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;QACzD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YAC/C,EAAE;YACF,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,WAAW,EAAE,gBAAgB,EAAE;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC;IAChB,CAAC;CACF,CAAC,CAAC"}

package/dist/actions/confirm-booking.js

@@ -1,10 +1,15 @@
 import { defineAction } from "@agent-native/core";
 import { z } from "zod";
 import { updateBookingStatus, getBookingByUid, } from "../server/bookings-repo.js";
+import { assertBookingHost } from "./_helpers.js";
 export default defineAction({
     description: "Confirm a pending booking (requires-confirmation flow)",
     schema: z.object({ uid: z.string() }),
     run: async (args) => {
+        const booking = await getBookingByUid(args.uid);
+        if (!booking)
+            throw new Error(`Booking ${args.uid} not found`);
+        assertBookingHost(booking, "confirm this booking");
         await updateBookingStatus(args.uid, "confirmed");
         return { booking: await getBookingByUid(args.uid) };
     },

package/dist/actions/confirm-booking.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-booking.js","sourceRoot":"","sources":["../../src/actions/confirm-booking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AAEpC,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,wDAAwD;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"confirm-booking.js","sourceRoot":"","sources":["../../src/actions/confirm-booking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,wDAAwD;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,iBAAiB,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;QACnD,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;CACF,CAAC,CAAC"}

package/dist/actions/duplicate-event-type.js

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core";
+import { assertAccess } from "@agent-native/core/sharing";
 import { z } from "zod";
 import { getEventTypeById, createEventType, } from "../server/event-types-repo.js";
 import { currentUserEmail, currentOrgId } from "./_helpers.js";
@@ -13,6 +14,7 @@ export default defineAction({
         const source = await getEventTypeById(args.id);
         if (!source)
             throw new Error("Event type not found");
+        await assertAccess("event-type", args.id, "editor");
         return {
             eventType: await createEventType({
                 ownerEmail: source.teamId ? undefined : currentUserEmail(),

package/dist/actions/duplicate-event-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"duplicate-event-type.js","sourceRoot":"","sources":["../../src/actions/duplicate-event-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,GAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,yCAAyC;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACrD,OAAO;YACL,SAAS,EAAE,MAAM,eAAe,CAAC;gBAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,YAAY,EAAE;gBACrB,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,MAAM,CAAC,KAAK,SAAS;gBAChD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;gBAChC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC;SACH,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"duplicate-event-type.js","sourceRoot":"","sources":["../../src/actions/duplicate-event-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,eAAe,GAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,yCAAyC;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACpD,OAAO;YACL,SAAS,EAAE,MAAM,eAAe,CAAC;gBAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE;gBAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,YAAY,EAAE;gBACrB,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,MAAM,CAAC,KAAK,SAAS;gBAChD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;gBAChC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC;SACH,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/actions/get-booking.d.ts

@@ -1,7 +1,9 @@
 declare const _default: import("@agent-native/core").ActionDefinition<{
     uid: string;
 }, {
-    booking: import("../index.js").Booking | null;
+    booking: null;
+} | {
+    booking: import("../index.js").Booking;
 }>;
 export default _default;
 //# sourceMappingURL=get-booking.d.ts.map

package/dist/actions/get-booking.js

@@ -1,9 +1,16 @@
 import { defineAction } from "@agent-native/core";
 import { z } from "zod";
 import { getBookingByUid } from "../server/bookings-repo.js";
+import { assertBookingHost } from "./_helpers.js";
 export default defineAction({
     description: "Get a booking by uid",
     schema: z.object({ uid: z.string() }),
-    run: async (args) => ({ booking: await getBookingByUid(args.uid) }),
+    run: async (args) => {
+        const booking = await getBookingByUid(args.uid);
+        if (!booking)
+            return { booking: null };
+        assertBookingHost(booking, "view this booking");
+        return { booking };
+    },
 });
 //# sourceMappingURL=get-booking.js.map

package/dist/actions/get-booking.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-booking.js","sourceRoot":"","sources":["../../src/actions/get-booking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,sBAAsB;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;CACpE,CAAC,CAAC"}
+{"version":3,"file":"get-booking.js","sourceRoot":"","sources":["../../src/actions/get-booking.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,sBAAsB;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvC,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;CACF,CAAC,CAAC"}

package/dist/actions/mark-no-show.js

@@ -1,6 +1,8 @@
 import { defineAction } from "@agent-native/core";
 import { z } from "zod";
 import { markNoShow } from "../server/booking-service.js";
+import { getBookingByUid } from "../server/bookings-repo.js";
+import { assertBookingHost } from "./_helpers.js";
 export default defineAction({
     description: "Mark an attendee as no-show on a booking",
     schema: z.object({
@@ -8,6 +10,10 @@ export default defineAction({
         attendeeEmail: z.string(),
     }),
     run: async (args) => {
+        const booking = await getBookingByUid(args.uid);
+        if (!booking)
+            throw new Error(`Booking ${args.uid} not found`);
+        assertBookingHost(booking, "mark no-show on this booking");
         await markNoShow(args.uid, args.attendeeEmail);
         return { ok: true };
     },

package/dist/actions/mark-no-show.js.map

@@ -1 +1 @@
-{"version":3,"file":"mark-no-show.js","sourceRoot":"","sources":["../../src/actions/mark-no-show.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,0CAA0C;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;KAC1B,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"mark-no-show.js","sourceRoot":"","sources":["../../src/actions/mark-no-show.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,0CAA0C;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;KAC1B,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,iBAAiB,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;QAC3D,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/actions/remove-booking-attendee.js

@@ -3,6 +3,7 @@ import { and, eq } from "drizzle-orm";
 import { z } from "zod";
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
+import { assertBookingHost } from "./_helpers.js";
 export default defineAction({
     description: "Remove an attendee from a booking",
     schema: z.object({ uid: z.string(), email: z.string() }),
@@ -10,6 +11,7 @@ export default defineAction({
         const booking = await getBookingByUid(args.uid);
         if (!booking)
             throw new Error(`Booking ${args.uid} not found`);
+        assertBookingHost(booking, "remove an attendee from this booking");
         const { getDb, schema } = getSchedulingContext();
         await getDb()
             .delete(schema.bookingAttendees)

package/dist/actions/remove-booking-attendee.js.map

@@ -1 +1 @@
-{"version":3,"file":"remove-booking-attendee.js","sourceRoot":"","sources":["../../src/actions/remove-booking-attendee.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,mCAAmC;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACxD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,KAAK,EAAE;aACV,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;aAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,EACjD,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAC9C,CACF,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"remove-booking-attendee.js","sourceRoot":"","sources":["../../src/actions/remove-booking-attendee.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,mCAAmC;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACxD,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,iBAAiB,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;QACnE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,KAAK,EAAE;aACV,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;aAC/B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,EACjD,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAC9C,CACF,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;CACF,CAAC,CAAC"}

package/dist/actions/revoke-private-link.js

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core";
+import { assertAccess } from "@agent-native/core/sharing";
 import { eq } from "drizzle-orm";
 import { z } from "zod";
 import { getSchedulingContext } from "../server/context.js";
@@ -7,7 +8,23 @@ export default defineAction({
     schema: z.object({ hash: z.string() }),
     run: async (args) => {
         const { getDb, schema } = getSchedulingContext();
-        await getDb()
+        const db = getDb();
+        const [link] = await db
+            .select({ eventTypeId: schema.hashedLinks.eventTypeId })
+            .from(schema.hashedLinks)
+            .where(eq(schema.hashedLinks.hash, args.hash))
+            .limit(1);
+        if (!link)
+            return { ok: true };
+        try {
+            await assertAccess("event-type", link.eventTypeId, "editor");
+        }
+        catch {
+            // Keep private-link hashes unprobeable: callers without access receive
+            // the same idempotent result as callers presenting an unknown hash.
+            return { ok: true };
+        }
+        await db
             .delete(schema.hashedLinks)
             .where(eq(schema.hashedLinks.hash, args.hash));
         return { ok: true };

package/dist/actions/revoke-private-link.js.map

@@ -1 +1 @@
-{"version":3,"file":"revoke-private-link.js","sourceRoot":"","sources":["../../src/actions/revoke-private-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,8BAA8B;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,KAAK,EAAE;aACV,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"revoke-private-link.js","sourceRoot":"","sources":["../../src/actions/revoke-private-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE,8BAA8B;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;QACjD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;aACvD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;aAC7C,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,oEAAoE;YACpE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,EAAE;aACL,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/actions/send-reschedule-link.js

@@ -2,6 +2,7 @@ import { defineAction } from "@agent-native/core";
 import { z } from "zod";
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
+import { assertBookingHost } from "./_helpers.js";
 export default defineAction({
     description: "Return the public reschedule URL for a booking (send it to an attendee)",
     schema: z.object({ uid: z.string() }),
@@ -9,6 +10,7 @@ export default defineAction({
         const booking = await getBookingByUid(args.uid);
         if (!booking)
             throw new Error(`Booking ${args.uid} not found`);
+        assertBookingHost(booking, "view the reschedule link for this booking");
         const baseUrl = getSchedulingContext().publicBaseUrl ?? "";
         return {
             url: `${baseUrl}/reschedule/${booking.uid}?token=${booking.rescheduleToken}`,

package/dist/actions/send-reschedule-link.js.map

@@ -1 +1 @@
-{"version":3,"file":"send-reschedule-link.js","sourceRoot":"","sources":["../../src/actions/send-reschedule-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,yEAAyE;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC;QAC3D,OAAO;YACL,GAAG,EAAE,GAAG,OAAO,eAAe,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC,eAAe,EAAE;SAC7E,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"send-reschedule-link.js","sourceRoot":"","sources":["../../src/actions/send-reschedule-link.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,yEAAyE;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/D,iBAAiB,CAAC,OAAO,EAAE,2CAA2C,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC;QAC3D,OAAO;YACL,GAAG,EAAE,GAAG,OAAO,eAAe,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC,eAAe,EAAE;SAC7E,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/scheduling",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "Scheduling primitives for agent-native apps — event types, availability, bookings, team scheduling, workflows, and routing forms.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -53,7 +53,7 @@
     "nanoid": "^5.1.9",
     "rrule": "^2.8.1",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "^0.4.6"
+    "@agent-native/toolkit": "^0.4.7"
   },
   "devDependencies": {
     "@libsql/client": "^0.15.8",
@@ -64,7 +64,7 @@
     "react": "^19.2.5",
     "typescript-7": "npm:typescript@^7.0.2",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.97.0"
+    "@agent-native/core": "0.98.0"
   },
   "peerDependencies": {
     "@agent-native/core": ">=0.8.0",

package/src/actions/_helpers.ts

@@ -15,6 +15,24 @@ export function currentUserEmailOrNull(): string | null {
   return getSchedulingContext().getCurrentUserEmail() ?? null;
 }
 
+/**
+ * Verify the current user is the host of a booking. Throws "Not authorized to
+ * <action>" if not. Mirrors the `isHost` half of the `isHost || hasToken`
+ * guard used by cancel-booking/reschedule-booking, for booking actions that
+ * don't accept a public capability token (attendee/note/status mutations —
+ * host identity is the only legitimate caller for these).
+ */
+export function assertBookingHost(
+  booking: { hostEmail: string },
+  action: string,
+): void {
+  const userEmail = currentUserEmailOrNull();
+  const isHost = !!userEmail && userEmail === booking.hostEmail;
+  if (!isHost) {
+    throw new Error(`Not authorized to ${action}`);
+  }
+}
+
 export function currentOrgId(): string | undefined {
   return getSchedulingContext().getCurrentOrgId?.();
 }

package/src/actions/add-booking-attendee.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description: "Add an attendee (or seat reservation) to a booking",
@@ -16,6 +17,7 @@ export default defineAction({
   run: async (args) => {
     const booking = await getBookingByUid(args.uid);
     if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "add an attendee to this booking");
     const { getDb, schema } = getSchedulingContext();
     await getDb()
       .insert(schema.bookingAttendees)

package/src/actions/add-booking-note.ts

@@ -4,7 +4,7 @@ import { z } from "zod";
 
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
-import { currentUserEmail } from "./_helpers.js";
+import { assertBookingHost, currentUserEmail } from "./_helpers.js";
 
 export default defineAction({
   description: "Add an internal (host-only) note to a booking",
@@ -12,6 +12,7 @@ export default defineAction({
   run: async (args) => {
     const booking = await getBookingByUid(args.uid);
     if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "add a note to this booking");
     const { getDb, schema } = getSchedulingContext();
     const id = nanoid();
     await getDb().insert(schema.bookingNotes).values({

package/src/actions/booking-authz.spec.ts

@@ -0,0 +1,288 @@
+/**
+ * Cross-tenant write (IDOR) regression tests for booking actions that
+ * mutate — or disclose a capability token for — a booking that belongs to
+ * another host. Mirrors the `isHost` guard already proven in
+ * `cancel-booking.ts` / `reschedule-booking.ts`.
+ */
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { createClient, type Client } from "@libsql/client";
+import { drizzle } from "drizzle-orm/libsql";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import * as schema from "../schema/index.js";
+import { setSchedulingContext } from "../server/context.js";
+import addBookingAttendee from "./add-booking-attendee.js";
+import addBookingNote from "./add-booking-note.js";
+import confirmBooking from "./confirm-booking.js";
+import markNoShow from "./mark-no-show.js";
+import removeBookingAttendee from "./remove-booking-attendee.js";
+import sendRescheduleLink from "./send-reschedule-link.js";
+
+const HOST_EMAIL = "host@example.com";
+const OUTSIDER_EMAIL = "outsider@example.com";
+const BOOKING_UID = "booking-uid-1";
+const ATTENDEE_EMAIL = "attendee@example.com";
+
+let client: Client;
+let dbDir: string;
+let currentUserEmail: string | undefined;
+
+beforeEach(async () => {
+  dbDir = mkdtempSync(join(tmpdir(), "scheduling-booking-authz-test-"));
+  client = createClient({ url: `file:${join(dbDir, `${randomUUID()}.db`)}` });
+  await client.execute(`
+    CREATE TABLE bookings (
+      id TEXT PRIMARY KEY,
+      uid TEXT NOT NULL UNIQUE,
+      event_type_id TEXT NOT NULL,
+      host_email TEXT NOT NULL,
+      title TEXT NOT NULL,
+      description TEXT,
+      start_time TEXT NOT NULL,
+      end_time TEXT NOT NULL,
+      timezone TEXT NOT NULL DEFAULT 'UTC',
+      status TEXT NOT NULL DEFAULT 'confirmed',
+      location TEXT,
+      custom_responses TEXT,
+      cancel_token TEXT,
+      reschedule_token TEXT,
+      from_reschedule TEXT,
+      cancellation_reason TEXT,
+      rescheduling_reason TEXT,
+      ical_uid TEXT NOT NULL,
+      ical_sequence INTEGER NOT NULL DEFAULT 0,
+      recurring_event_id TEXT,
+      paid INTEGER NOT NULL DEFAULT 0,
+      no_show_host INTEGER NOT NULL DEFAULT 0,
+      metadata TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      owner_email TEXT NOT NULL DEFAULT 'local@localhost',
+      org_id TEXT,
+      visibility TEXT NOT NULL DEFAULT 'private'
+    );
+  `);
+  await client.execute(`
+    CREATE TABLE booking_attendees (
+      id TEXT PRIMARY KEY,
+      booking_id TEXT NOT NULL,
+      email TEXT NOT NULL,
+      name TEXT NOT NULL,
+      timezone TEXT,
+      locale TEXT,
+      no_show INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL
+    );
+  `);
+  await client.execute(`
+    CREATE TABLE booking_references (
+      id TEXT PRIMARY KEY,
+      booking_id TEXT NOT NULL,
+      type TEXT NOT NULL,
+      external_id TEXT NOT NULL,
+      meeting_url TEXT,
+      meeting_password TEXT,
+      credential_id TEXT,
+      created_at TEXT NOT NULL
+    );
+  `);
+  await client.execute(`
+    CREATE TABLE booking_notes (
+      id TEXT PRIMARY KEY,
+      booking_id TEXT NOT NULL,
+      author_email TEXT NOT NULL,
+      content TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    );
+  `);
+
+  const db = drizzle(client, { schema });
+  currentUserEmail = HOST_EMAIL;
+  setSchedulingContext({
+    getDb: () => db,
+    schema,
+    getCurrentUserEmail: () => currentUserEmail,
+  });
+
+  const now = new Date().toISOString();
+  await client.execute({
+    sql: `INSERT INTO bookings (
+      id, uid, event_type_id, host_email, title, start_time, end_time,
+      timezone, status, cancel_token, reschedule_token, ical_uid, created_at, updated_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      "booking-1",
+      BOOKING_UID,
+      "event-type-1",
+      HOST_EMAIL,
+      "Test Meeting",
+      "2026-08-01T10:00:00.000Z",
+      "2026-08-01T10:30:00.000Z",
+      "UTC",
+      "pending",
+      "cancel-token-1",
+      "reschedule-token-1",
+      "ical-uid-1",
+      now,
+      now,
+    ],
+  });
+  await client.execute({
+    sql: `INSERT INTO booking_attendees (id, booking_id, email, name, created_at) VALUES (?, ?, ?, ?, ?)`,
+    args: ["attendee-1", "booking-1", ATTENDEE_EMAIL, "Attendee One", now],
+  });
+});
+
+afterEach(() => {
+  client.close();
+  rmSync(dbDir, { recursive: true, force: true });
+});
+
+async function bookingStatus(): Promise<string> {
+  const { rows } = await client.execute({
+    sql: "SELECT status FROM bookings WHERE uid = ?",
+    args: [BOOKING_UID],
+  });
+  return String(rows[0]?.status);
+}
+
+async function attendeeEmails(): Promise<string[]> {
+  const { rows } = await client.execute({
+    sql: "SELECT email FROM booking_attendees WHERE booking_id = 'booking-1'",
+  });
+  return rows.map((r: any) => String(r.email)).sort();
+}
+
+async function attendeeNoShow(email: string): Promise<boolean> {
+  const { rows } = await client.execute({
+    sql: "SELECT no_show FROM booking_attendees WHERE booking_id = 'booking-1' AND email = ?",
+    args: [email],
+  });
+  return Boolean(rows[0]?.no_show);
+}
+
+async function noteCount(): Promise<number> {
+  const { rows } = await client.execute("SELECT * FROM booking_notes");
+  return rows.length;
+}
+
+describe("confirm-booking authorization", () => {
+  it("rejects a non-host caller and leaves the booking unchanged", async () => {
+    currentUserEmail = OUTSIDER_EMAIL;
+    await expect(confirmBooking.run({ uid: BOOKING_UID })).rejects.toThrow(
+      /not authorized/i,
+    );
+    expect(await bookingStatus()).toBe("pending");
+  });
+
+  it("allows the host to confirm the booking", async () => {
+    currentUserEmail = HOST_EMAIL;
+    const result: any = await confirmBooking.run({ uid: BOOKING_UID });
+    expect(result.booking?.status).toBe("confirmed");
+    expect(await bookingStatus()).toBe("confirmed");
+  });
+});
+
+describe("mark-no-show authorization", () => {
+  it("rejects a non-host caller and leaves the attendee unchanged", async () => {
+    currentUserEmail = OUTSIDER_EMAIL;
+    await expect(
+      markNoShow.run({ uid: BOOKING_UID, attendeeEmail: ATTENDEE_EMAIL }),
+    ).rejects.toThrow(/not authorized/i);
+    expect(await attendeeNoShow(ATTENDEE_EMAIL)).toBe(false);
+  });
+
+  it("allows the host to mark an attendee no-show", async () => {
+    currentUserEmail = HOST_EMAIL;
+    const result: any = await markNoShow.run({
+      uid: BOOKING_UID,
+      attendeeEmail: ATTENDEE_EMAIL,
+    });
+    expect(result.ok).toBe(true);
+    expect(await attendeeNoShow(ATTENDEE_EMAIL)).toBe(true);
+  });
+});
+
+describe("add-booking-attendee authorization", () => {
+  it("rejects a non-host caller and does not add the attendee", async () => {
+    currentUserEmail = OUTSIDER_EMAIL;
+    await expect(
+      addBookingAttendee.run({
+        uid: BOOKING_UID,
+        name: "Intruder",
+        email: "intruder@example.com",
+      }),
+    ).rejects.toThrow(/not authorized/i);
+    expect(await attendeeEmails()).toEqual([ATTENDEE_EMAIL]);
+  });
+
+  it("allows the host to add an attendee", async () => {
+    currentUserEmail = HOST_EMAIL;
+    await addBookingAttendee.run({
+      uid: BOOKING_UID,
+      name: "New Guest",
+      email: "guest@example.com",
+    });
+    expect(await attendeeEmails()).toEqual(
+      [ATTENDEE_EMAIL, "guest@example.com"].sort(),
+    );
+  });
+});
+
+describe("remove-booking-attendee authorization", () => {
+  it("rejects a non-host caller and does not remove the attendee", async () => {
+    currentUserEmail = OUTSIDER_EMAIL;
+    await expect(
+      removeBookingAttendee.run({ uid: BOOKING_UID, email: ATTENDEE_EMAIL }),
+    ).rejects.toThrow(/not authorized/i);
+    expect(await attendeeEmails()).toEqual([ATTENDEE_EMAIL]);
+  });
+
+  it("allows the host to remove an attendee", async () => {
+    currentUserEmail = HOST_EMAIL;
+    await removeBookingAttendee.run({
+      uid: BOOKING_UID,
+      email: ATTENDEE_EMAIL,
+    });
+    expect(await attendeeEmails()).toEqual([]);
+  });
+});
+
+describe("add-booking-note authorization", () => {
+  it("rejects a non-host caller and does not create a note", async () => {
+    currentUserEmail = OUTSIDER_EMAIL;
+    await expect(
+      addBookingNote.run({ uid: BOOKING_UID, content: "snooping" }),
+    ).rejects.toThrow(/not authorized/i);
+    expect(await noteCount()).toBe(0);
+  });
+
+  it("allows the host to add a note", async () => {
+    currentUserEmail = HOST_EMAIL;
+    const result: any = await addBookingNote.run({
+      uid: BOOKING_UID,
+      content: "host note",
+    });
+    expect(result.id).toBeTruthy();
+    expect(await noteCount()).toBe(1);
+  });
+});
+
+describe("send-reschedule-link authorization", () => {
+  it("rejects a non-host caller and never returns the reschedule token", async () => {
+    currentUserEmail = OUTSIDER_EMAIL;
+    await expect(sendRescheduleLink.run({ uid: BOOKING_UID })).rejects.toThrow(
+      /not authorized/i,
+    );
+  });
+
+  it("returns the reschedule URL with token for the host", async () => {
+    currentUserEmail = HOST_EMAIL;
+    const result: any = await sendRescheduleLink.run({ uid: BOOKING_UID });
+    expect(result.url).toContain("reschedule-token-1");
+  });
+});

package/src/actions/confirm-booking.ts

@@ -5,11 +5,15 @@ import {
   updateBookingStatus,
   getBookingByUid,
 } from "../server/bookings-repo.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description: "Confirm a pending booking (requires-confirmation flow)",
   schema: z.object({ uid: z.string() }),
   run: async (args) => {
+    const booking = await getBookingByUid(args.uid);
+    if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "confirm this booking");
     await updateBookingStatus(args.uid, "confirmed");
     return { booking: await getBookingByUid(args.uid) };
   },

package/src/actions/duplicate-event-type.ts

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core";
+import { assertAccess } from "@agent-native/core/sharing";
 import { z } from "zod";
 
 import {
@@ -17,6 +18,7 @@ export default defineAction({
   run: async (args) => {
     const source = await getEventTypeById(args.id);
     if (!source) throw new Error("Event type not found");
+    await assertAccess("event-type", args.id, "editor");
     return {
       eventType: await createEventType({
         ownerEmail: source.teamId ? undefined : currentUserEmail(),

package/src/actions/event-type-authz.spec.ts

@@ -0,0 +1,209 @@
+/**
+ * Cross-tenant write (IDOR) regression tests for event-type-scoped actions
+ * that mutate a resource owned by another tenant: revoking a private hashed
+ * link and duplicating an event type. Mirrors the `assertAccess("event-type",
+ * ..., <role>)` guard already used by `add-private-link.ts` /
+ * `delete-event-type.ts`.
+ */
+import { randomUUID } from "node:crypto";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  getRequestUserEmail,
+  runWithRequestContext,
+} from "@agent-native/core/server/request-context";
+import {
+  ForbiddenError,
+  registerShareableResource,
+} from "@agent-native/core/sharing";
+import { createClient, type Client } from "@libsql/client";
+import { drizzle } from "drizzle-orm/libsql";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import * as schema from "../schema/index.js";
+import { setSchedulingContext } from "../server/context.js";
+import duplicateEventType from "./duplicate-event-type.js";
+import revokePrivateLink from "./revoke-private-link.js";
+
+const OWNER_EMAIL = "owner@example.com";
+const OUTSIDER_EMAIL = "outsider@example.com";
+const EVENT_TYPE_ID = "event-type-1";
+const HASH = "private-link-hash-1";
+
+let client: Client;
+let dbDir: string;
+
+beforeEach(async () => {
+  dbDir = mkdtempSync(join(tmpdir(), "scheduling-eventtype-authz-test-"));
+  client = createClient({ url: `file:${join(dbDir, `${randomUUID()}.db`)}` });
+  await client.execute(`
+    CREATE TABLE event_types (
+      id TEXT PRIMARY KEY,
+      title TEXT NOT NULL,
+      slug TEXT NOT NULL,
+      description TEXT,
+      length INTEGER NOT NULL DEFAULT 30,
+      durations TEXT,
+      position INTEGER NOT NULL DEFAULT 0,
+      hidden INTEGER NOT NULL DEFAULT 0,
+      color TEXT,
+      scheduling_type TEXT NOT NULL DEFAULT 'personal',
+      team_id TEXT,
+      locations TEXT,
+      custom_fields TEXT,
+      schedule_id TEXT,
+      minimum_booking_notice INTEGER NOT NULL DEFAULT 0,
+      before_event_buffer INTEGER NOT NULL DEFAULT 0,
+      after_event_buffer INTEGER NOT NULL DEFAULT 0,
+      slot_interval INTEGER,
+      period_type TEXT NOT NULL DEFAULT 'rolling',
+      period_days INTEGER DEFAULT 60,
+      period_start_date TEXT,
+      period_end_date TEXT,
+      seats_per_time_slot INTEGER,
+      requires_confirmation INTEGER NOT NULL DEFAULT 0,
+      disable_guests INTEGER NOT NULL DEFAULT 0,
+      hide_calendar_notes INTEGER NOT NULL DEFAULT 0,
+      success_redirect_url TEXT,
+      booking_limits TEXT,
+      lock_time_zone_toggle INTEGER NOT NULL DEFAULT 0,
+      recurring_event TEXT,
+      event_name TEXT,
+      metadata TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      owner_email TEXT NOT NULL DEFAULT 'local@localhost',
+      org_id TEXT,
+      visibility TEXT NOT NULL DEFAULT 'private'
+    );
+  `);
+  await client.execute(`
+    CREATE TABLE hashed_links (
+      id TEXT PRIMARY KEY,
+      hash TEXT NOT NULL UNIQUE,
+      event_type_id TEXT NOT NULL,
+      expires_at TEXT,
+      is_single_use INTEGER NOT NULL DEFAULT 0,
+      used_at TEXT,
+      created_at TEXT NOT NULL
+    );
+  `);
+  await client.execute(`
+    CREATE TABLE event_type_shares (
+      id TEXT PRIMARY KEY,
+      resource_id TEXT NOT NULL,
+      principal_type TEXT NOT NULL,
+      principal_id TEXT NOT NULL,
+      role TEXT NOT NULL DEFAULT 'viewer',
+      created_by TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    );
+  `);
+
+  const db = drizzle(client, { schema });
+  setSchedulingContext({
+    getDb: () => db,
+    schema,
+    // Mirrors real app wiring (templates/scheduling's server plugin): the
+    // scheduling package's own "current user" and the framework's
+    // request-context ALS (used by `assertAccess`) both resolve to the same
+    // identity.
+    getCurrentUserEmail: () => getRequestUserEmail(),
+  });
+  registerShareableResource({
+    type: "event-type",
+    resourceTable: schema.eventTypes,
+    sharesTable: schema.eventTypeShares,
+    displayName: "Event Type",
+    getDb: () => db,
+  });
+
+  const now = new Date().toISOString();
+  await client.execute({
+    sql: `INSERT INTO event_types (
+      id, title, slug, length, created_at, updated_at, owner_email, visibility
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    args: [
+      EVENT_TYPE_ID,
+      "30 Min Meeting",
+      "30min",
+      30,
+      now,
+      now,
+      OWNER_EMAIL,
+      "private",
+    ],
+  });
+  await client.execute({
+    sql: `INSERT INTO hashed_links (id, hash, event_type_id, created_at) VALUES (?, ?, ?, ?)`,
+    args: ["link-1", HASH, EVENT_TYPE_ID, now],
+  });
+});
+
+afterEach(() => {
+  client.close();
+  rmSync(dbDir, { recursive: true, force: true });
+});
+
+async function hashedLinkExists(): Promise<boolean> {
+  const { rows } = await client.execute({
+    sql: "SELECT 1 FROM hashed_links WHERE hash = ?",
+    args: [HASH],
+  });
+  return rows.length > 0;
+}
+
+async function eventTypeCount(): Promise<number> {
+  const { rows } = await client.execute("SELECT * FROM event_types");
+  return rows.length;
+}
+
+describe("revoke-private-link authorization", () => {
+  it("returns the same idempotent result for an inaccessible link and keeps it", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OUTSIDER_EMAIL },
+      () => revokePrivateLink.run({ hash: HASH }),
+    );
+    expect(result.ok).toBe(true);
+    expect(await hashedLinkExists()).toBe(true);
+  });
+
+  it("allows the owning event type's editor (the owner) to revoke the link", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OWNER_EMAIL },
+      () => revokePrivateLink.run({ hash: HASH }),
+    );
+    expect(result.ok).toBe(true);
+    expect(await hashedLinkExists()).toBe(false);
+  });
+
+  it("is idempotent for an unknown hash without requiring access", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OUTSIDER_EMAIL },
+      () => revokePrivateLink.run({ hash: "does-not-exist" }),
+    );
+    expect(result.ok).toBe(true);
+  });
+});
+
+describe("duplicate-event-type authorization", () => {
+  it("rejects a caller with no access to the source event type and does not duplicate it", async () => {
+    await expect(
+      runWithRequestContext({ userEmail: OUTSIDER_EMAIL }, () =>
+        duplicateEventType.run({ id: EVENT_TYPE_ID, newSlug: "copy" }),
+      ),
+    ).rejects.toBeInstanceOf(ForbiddenError);
+    expect(await eventTypeCount()).toBe(1);
+  });
+
+  it("allows the owner to duplicate their own event type", async () => {
+    const result: any = await runWithRequestContext(
+      { userEmail: OWNER_EMAIL },
+      () => duplicateEventType.run({ id: EVENT_TYPE_ID, newSlug: "copy" }),
+    );
+    expect(result.eventType?.slug).toBe("copy");
+    expect(await eventTypeCount()).toBe(2);
+  });
+});

package/src/actions/get-booking.ts

@@ -2,9 +2,15 @@ import { defineAction } from "@agent-native/core";
 import { z } from "zod";
 
 import { getBookingByUid } from "../server/bookings-repo.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description: "Get a booking by uid",
   schema: z.object({ uid: z.string() }),
-  run: async (args) => ({ booking: await getBookingByUid(args.uid) }),
+  run: async (args) => {
+    const booking = await getBookingByUid(args.uid);
+    if (!booking) return { booking: null };
+    assertBookingHost(booking, "view this booking");
+    return { booking };
+  },
 });

package/src/actions/mark-no-show.ts

@@ -2,6 +2,8 @@ import { defineAction } from "@agent-native/core";
 import { z } from "zod";
 
 import { markNoShow } from "../server/booking-service.js";
+import { getBookingByUid } from "../server/bookings-repo.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description: "Mark an attendee as no-show on a booking",
@@ -10,6 +12,9 @@ export default defineAction({
     attendeeEmail: z.string(),
   }),
   run: async (args) => {
+    const booking = await getBookingByUid(args.uid);
+    if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "mark no-show on this booking");
     await markNoShow(args.uid, args.attendeeEmail);
     return { ok: true };
   },

package/src/actions/remove-booking-attendee.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description: "Remove an attendee from a booking",
@@ -11,6 +12,7 @@ export default defineAction({
   run: async (args) => {
     const booking = await getBookingByUid(args.uid);
     if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "remove an attendee from this booking");
     const { getDb, schema } = getSchedulingContext();
     await getDb()
       .delete(schema.bookingAttendees)

package/src/actions/revoke-private-link.ts

@@ -1,4 +1,5 @@
 import { defineAction } from "@agent-native/core";
+import { assertAccess } from "@agent-native/core/sharing";
 import { eq } from "drizzle-orm";
 import { z } from "zod";
 
@@ -9,7 +10,21 @@ export default defineAction({
   schema: z.object({ hash: z.string() }),
   run: async (args) => {
     const { getDb, schema } = getSchedulingContext();
-    await getDb()
+    const db = getDb();
+    const [link] = await db
+      .select({ eventTypeId: schema.hashedLinks.eventTypeId })
+      .from(schema.hashedLinks)
+      .where(eq(schema.hashedLinks.hash, args.hash))
+      .limit(1);
+    if (!link) return { ok: true };
+    try {
+      await assertAccess("event-type", link.eventTypeId, "editor");
+    } catch {
+      // Keep private-link hashes unprobeable: callers without access receive
+      // the same idempotent result as callers presenting an unknown hash.
+      return { ok: true };
+    }
+    await db
       .delete(schema.hashedLinks)
       .where(eq(schema.hashedLinks.hash, args.hash));
     return { ok: true };

package/src/actions/send-reschedule-link.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 
 import { getBookingByUid } from "../server/bookings-repo.js";
 import { getSchedulingContext } from "../server/context.js";
+import { assertBookingHost } from "./_helpers.js";
 
 export default defineAction({
   description:
@@ -11,6 +12,7 @@ export default defineAction({
   run: async (args) => {
     const booking = await getBookingByUid(args.uid);
     if (!booking) throw new Error(`Booking ${args.uid} not found`);
+    assertBookingHost(booking, "view the reschedule link for this booking");
     const baseUrl = getSchedulingContext().publicBaseUrl ?? "";
     return {
       url: `${baseUrl}/reschedule/${booking.uid}?token=${booking.rescheduleToken}`,