@aranova/tracking-next 1.1.0 → 1.2.1

package/README.md

@@ -407,7 +407,54 @@ its Origin allowlist is a browser-enforced header a script forges trivially. A j
 a database row you can delete; a junk **booking** puts an event on a real person's calendar
 and emails their contacts.
 
-`bookings.create()` returns a one-time `manage_token`. Put it in your confirmation email and
+Doing your own work around a booking (validation, emails, a CRM)? Call the write client from
+your own route instead of mounting the handler:
+
+```ts
+// app/api/book/route.ts
+import { createCalendarWriteClient } from "@aranova/tracking-next/calendar-server";
+import { isCalendarError } from "@aranova/tracking-next/calendar";
+
+const calendar = createCalendarWriteClient<AranovaCalendarKey>({
+  apiKey: process.env.ARANOVA_TRACKING_SECRET_KEY!,
+  endpoint: process.env.ARANOVA_TRACKING_ENDPOINT!,
+});
+
+const booking = await calendar.create({
+  calendar_key: "bookings",
+  start_at: "2026-10-14T13:00:00-04:00", // timed: start_at + duration_minutes (or end_at)
+  duration_minutes: 60,
+  // date: "2026-10-14",               // all-day instead: a local date, no start/end/buffers
+  time_zone: "America/Toronto",
+  customer: { email, name, phone },
+  description: "<b>Arrive 1–2 PM</b>", // reaches Google exactly as sent
+  idempotency_key: submissionId,
+  metadata: body.attribution, // getBookingAttribution(), sent from the browser
+});
+```
+
+- **Forward the visit.** `getBookingAttribution()` (from `./calendar`, browser only) returns the
+  visit's `session_id`, `visitor_id`, `gclid`/`fbclid` and `utm_*`. It is what ties a booking to the
+  visitor's journey and form submission in the dashboard, and what missed-booking detection matches
+  on. It reads browser storage, so a custom route can't compute it: the browser sends it with the
+  form and the route passes it into `create({ metadata })`. `useBookingForm` merges it in for you
+  (your `metadata` keys win).
+
+- **Overlaps are per calendar.** `ARANOVA_CALENDARS[].allowOverlaps` (from the CLI) says whether a
+  calendar accepts double bookings. When it is `false`, `create()` can throw `slot_unavailable`:
+  `isCalendarError(err, "slot_unavailable")`. Other codes: `calendar_not_connected`,
+  `calendar_disconnected`, `booking_not_found`, `booking_not_cancellable`,
+  `booking_not_reschedulable`, `manage_token_invalid`, `rate_limited`, `google_error`.
+- **No server-side booking window.** Notice and how far ahead customers may book are your policy.
+- **Your email can be the calendar invite.** The customer is always an attendee of the Google
+  event. Pass `send_invites: false` so Google sends nothing, then attach an ICS (`METHOD:REQUEST`)
+  with `UID` = `booking.ical_uid` and `ORGANIZER` = `booking.organizer_email`, so the customer's
+  copy is the same event as the calendar owner's. For `booking.all_day`, use
+  `DTSTART;VALUE=DATE`. `ical_uid` is null if Google hasn't confirmed the write; send a plain
+  confirmation then.
+- **All-day bookings** are moved in Google Calendar, not through `reschedule()`.
+
+`create()` returns a one-time `manage_token`. Put it in your confirmation email and
 send it as `X-Aranova-Manage-Token` to reschedule or cancel — it authorises exactly that one
 booking, which is why a public key alone still manages nothing.
 

package/dist/calendar-server.d.mts

@@ -1,4 +1,4 @@
-import { C as CalendarTransportConfig, B as BookingCreateInput, a as Booking, b as BookingRescheduleInput, c as BookingCancelInput } from './transport-I_cMSFQ6.mjs';
+import { C as CalendarTransportConfig, B as BookingCreateInput, a as Booking, b as BookingRescheduleInput, c as BookingCancelInput } from './transport-DvAEZ1xf.mjs';
 import 'zod/mini';
 import './request-Doq36Rt0.mjs';
 

package/dist/calendar-server.d.ts

@@ -1,4 +1,4 @@
-import { C as CalendarTransportConfig, B as BookingCreateInput, a as Booking, b as BookingRescheduleInput, c as BookingCancelInput } from './transport-CDmGOiCq.js';
+import { C as CalendarTransportConfig, B as BookingCreateInput, a as Booking, b as BookingRescheduleInput, c as BookingCancelInput } from './transport-ChCL6vPv.js';
 import 'zod/mini';
 import './request-Doq36Rt0.js';
 

package/dist/calendar.d.mts

@@ -1,10 +1,21 @@
+import { j as BookingMetadata, r as CalendarSummary, m as BusyResponse, C as CalendarTransportConfig, q as CalendarErrorCode, d as BusyInterval } from './transport-DvAEZ1xf.mjs';
+export { e as BOOKING_SOURCES, f as BOOKING_STATUSES, a as Booking, g as BookingAttendee, c as BookingCancelInput, B as BookingCreateInput, h as BookingCustomer, i as BookingLocation, k as BookingReminders, b as BookingRescheduleInput, l as BookingStatus, n as CALENDAR_ERROR_CODES, o as CALENDAR_METADATA_SCHEMA_VERSION, p as CALENDAR_SYNC_STATUSES, s as CalendarSyncStatus, G as GOOGLE_SYNC_STATES, t as GoogleSyncState, J as JsonScalar, M as MAX_ATTENDEES, u as MAX_BOOKING_MINUTES, v as MAX_REMINDER_MINUTES, w as MAX_REMINDER_OVERRIDES, x as bookingAttendeeSchema, y as bookingCancelSchema, z as bookingCreateSchema, A as bookingCustomerSchema, D as bookingLocationNullableSchema, E as bookingLocationSchema, F as bookingMetadataSchema, H as bookingReminderSchema, I as bookingRemindersSchema, K as bookingRescheduleSchema } from './transport-DvAEZ1xf.mjs';
 import { A as AranovaApiError } from './date-BHetnL7s.mjs';
 export { f as formatDateInTz } from './date-BHetnL7s.mjs';
-import { r as CalendarSummary, m as BusyResponse, C as CalendarTransportConfig, q as CalendarErrorCode, d as BusyInterval } from './transport-I_cMSFQ6.mjs';
-export { e as BOOKING_SOURCES, f as BOOKING_STATUSES, a as Booking, g as BookingAttendee, c as BookingCancelInput, B as BookingCreateInput, h as BookingCustomer, i as BookingLocation, j as BookingMetadata, k as BookingReminders, b as BookingRescheduleInput, l as BookingStatus, n as CALENDAR_ERROR_CODES, o as CALENDAR_METADATA_SCHEMA_VERSION, p as CALENDAR_SYNC_STATUSES, s as CalendarSyncStatus, G as GOOGLE_SYNC_STATES, t as GoogleSyncState, J as JsonScalar, M as MAX_ATTENDEES, u as MAX_BOOKING_MINUTES, v as MAX_REMINDER_MINUTES, w as MAX_REMINDER_OVERRIDES, x as bookingAttendeeSchema, y as bookingCancelSchema, z as bookingCreateSchema, A as bookingCustomerSchema, D as bookingLocationNullableSchema, E as bookingLocationSchema, F as bookingMetadataSchema, H as bookingReminderSchema, I as bookingRemindersSchema, K as bookingRescheduleSchema } from './transport-I_cMSFQ6.mjs';
 import 'zod/mini';
 import './request-Doq36Rt0.mjs';
 
+/** The metadata keys a browser can fill: which visit made the booking, and how it arrived. */
+type BookingAttribution = Pick<BookingMetadata, "session_id" | "visitor_id" | "gclid" | "fbclid" | "utm_source" | "utm_medium" | "utm_campaign" | "utm_term" | "utm_content">;
+/**
+ * This browser's visit and click attribution, for a booking's `metadata`.
+ *
+ * `useBookingForm` merges it in for you. A site posting to its own route (e.g. `/api/book`)
+ * sends it along from the browser and passes it into `create({ metadata })`: that is what lets
+ * the dashboard tie the booking to the visitor's journey. Only keys with a value are present.
+ */
+declare function getBookingAttribution(): BookingAttribution;
+
 /**
  * The browser-side calendar client — reads only.
  *
@@ -31,7 +42,10 @@ interface BusyQuery {
     timeZone?: string;
 }
 interface CalendarReadClient<TCalendarKey extends string = string> {
-    /** Labels, timezones and status — everything a widget needs before booking. */
+    /**
+     * Labels, timezones and status — everything a widget needs before booking.
+     * Sandboxes are listed too (`is_sandbox`); a real calendar names its own in `sandbox_key`.
+     */
     listCalendars(): Promise<CalendarSummary[]>;
     /** Busy intervals only. Never the contents of the grantee's events. */
     busy(calendarKey: TCalendarKey, query: BusyQuery): Promise<BusyResponse>;
@@ -109,4 +123,4 @@ declare function groupSlotsByDay(slots: Slot[], timeZone: string): {
     slots: Slot[];
 }[];
 
-export { AranovaApiError, BusyInterval, type BusyQuery, BusyResponse, CalendarErrorCode, type CalendarReadClient, type CalendarReadClientConfig, CalendarSummary, CalendarTransportConfig, type ComputeSlotsOptions, type ComputeSlotsResult, type OpeningHours, type OpeningInterval, type Slot, computeSlots, createCalendarReadClient, durationMinutes, endOfDayInTz, formatSlotRange, groupSlotsByDay, instantFromWallClock, isCalendarError, localDateKey, offsetMinutesAt, resolveBrowserTimeZone, startOfDayInTz };
+export { AranovaApiError, type BookingAttribution, BookingMetadata, BusyInterval, type BusyQuery, BusyResponse, CalendarErrorCode, type CalendarReadClient, type CalendarReadClientConfig, CalendarSummary, CalendarTransportConfig, type ComputeSlotsOptions, type ComputeSlotsResult, type OpeningHours, type OpeningInterval, type Slot, computeSlots, createCalendarReadClient, durationMinutes, endOfDayInTz, formatSlotRange, getBookingAttribution, groupSlotsByDay, instantFromWallClock, isCalendarError, localDateKey, offsetMinutesAt, resolveBrowserTimeZone, startOfDayInTz };

package/dist/calendar.d.ts

@@ -1,10 +1,21 @@
+import { j as BookingMetadata, r as CalendarSummary, m as BusyResponse, C as CalendarTransportConfig, q as CalendarErrorCode, d as BusyInterval } from './transport-ChCL6vPv.js';
+export { e as BOOKING_SOURCES, f as BOOKING_STATUSES, a as Booking, g as BookingAttendee, c as BookingCancelInput, B as BookingCreateInput, h as BookingCustomer, i as BookingLocation, k as BookingReminders, b as BookingRescheduleInput, l as BookingStatus, n as CALENDAR_ERROR_CODES, o as CALENDAR_METADATA_SCHEMA_VERSION, p as CALENDAR_SYNC_STATUSES, s as CalendarSyncStatus, G as GOOGLE_SYNC_STATES, t as GoogleSyncState, J as JsonScalar, M as MAX_ATTENDEES, u as MAX_BOOKING_MINUTES, v as MAX_REMINDER_MINUTES, w as MAX_REMINDER_OVERRIDES, x as bookingAttendeeSchema, y as bookingCancelSchema, z as bookingCreateSchema, A as bookingCustomerSchema, D as bookingLocationNullableSchema, E as bookingLocationSchema, F as bookingMetadataSchema, H as bookingReminderSchema, I as bookingRemindersSchema, K as bookingRescheduleSchema } from './transport-ChCL6vPv.js';
 import { A as AranovaApiError } from './date-BHetnL7s.js';
 export { f as formatDateInTz } from './date-BHetnL7s.js';
-import { r as CalendarSummary, m as BusyResponse, C as CalendarTransportConfig, q as CalendarErrorCode, d as BusyInterval } from './transport-CDmGOiCq.js';
-export { e as BOOKING_SOURCES, f as BOOKING_STATUSES, a as Booking, g as BookingAttendee, c as BookingCancelInput, B as BookingCreateInput, h as BookingCustomer, i as BookingLocation, j as BookingMetadata, k as BookingReminders, b as BookingRescheduleInput, l as BookingStatus, n as CALENDAR_ERROR_CODES, o as CALENDAR_METADATA_SCHEMA_VERSION, p as CALENDAR_SYNC_STATUSES, s as CalendarSyncStatus, G as GOOGLE_SYNC_STATES, t as GoogleSyncState, J as JsonScalar, M as MAX_ATTENDEES, u as MAX_BOOKING_MINUTES, v as MAX_REMINDER_MINUTES, w as MAX_REMINDER_OVERRIDES, x as bookingAttendeeSchema, y as bookingCancelSchema, z as bookingCreateSchema, A as bookingCustomerSchema, D as bookingLocationNullableSchema, E as bookingLocationSchema, F as bookingMetadataSchema, H as bookingReminderSchema, I as bookingRemindersSchema, K as bookingRescheduleSchema } from './transport-CDmGOiCq.js';
 import 'zod/mini';
 import './request-Doq36Rt0.js';
 
+/** The metadata keys a browser can fill: which visit made the booking, and how it arrived. */
+type BookingAttribution = Pick<BookingMetadata, "session_id" | "visitor_id" | "gclid" | "fbclid" | "utm_source" | "utm_medium" | "utm_campaign" | "utm_term" | "utm_content">;
+/**
+ * This browser's visit and click attribution, for a booking's `metadata`.
+ *
+ * `useBookingForm` merges it in for you. A site posting to its own route (e.g. `/api/book`)
+ * sends it along from the browser and passes it into `create({ metadata })`: that is what lets
+ * the dashboard tie the booking to the visitor's journey. Only keys with a value are present.
+ */
+declare function getBookingAttribution(): BookingAttribution;
+
 /**
  * The browser-side calendar client — reads only.
  *
@@ -31,7 +42,10 @@ interface BusyQuery {
     timeZone?: string;
 }
 interface CalendarReadClient<TCalendarKey extends string = string> {
-    /** Labels, timezones and status — everything a widget needs before booking. */
+    /**
+     * Labels, timezones and status — everything a widget needs before booking.
+     * Sandboxes are listed too (`is_sandbox`); a real calendar names its own in `sandbox_key`.
+     */
     listCalendars(): Promise<CalendarSummary[]>;
     /** Busy intervals only. Never the contents of the grantee's events. */
     busy(calendarKey: TCalendarKey, query: BusyQuery): Promise<BusyResponse>;
@@ -109,4 +123,4 @@ declare function groupSlotsByDay(slots: Slot[], timeZone: string): {
     slots: Slot[];
 }[];
 
-export { AranovaApiError, BusyInterval, type BusyQuery, BusyResponse, CalendarErrorCode, type CalendarReadClient, type CalendarReadClientConfig, CalendarSummary, CalendarTransportConfig, type ComputeSlotsOptions, type ComputeSlotsResult, type OpeningHours, type OpeningInterval, type Slot, computeSlots, createCalendarReadClient, durationMinutes, endOfDayInTz, formatSlotRange, groupSlotsByDay, instantFromWallClock, isCalendarError, localDateKey, offsetMinutesAt, resolveBrowserTimeZone, startOfDayInTz };
+export { AranovaApiError, type BookingAttribution, BookingMetadata, BusyInterval, type BusyQuery, BusyResponse, CalendarErrorCode, type CalendarReadClient, type CalendarReadClientConfig, CalendarSummary, CalendarTransportConfig, type ComputeSlotsOptions, type ComputeSlotsResult, type OpeningHours, type OpeningInterval, type Slot, computeSlots, createCalendarReadClient, durationMinutes, endOfDayInTz, formatSlotRange, getBookingAttribution, groupSlotsByDay, instantFromWallClock, isCalendarError, localDateKey, offsetMinutesAt, resolveBrowserTimeZone, startOfDayInTz };

package/dist/calendar.js

@@ -57,6 +57,7 @@ __export(calendar_exports, {
   endOfDayInTz: () => endOfDayInTz,
   formatDateInTz: () => formatDateInTz,
   formatSlotRange: () => formatSlotRange,
+  getBookingAttribution: () => getBookingAttribution,
   groupSlotsByDay: () => groupSlotsByDay,
   instantFromWallClock: () => instantFromWallClock,
   isCalendarError: () => isCalendarError,
@@ -67,6 +68,135 @@ __export(calendar_exports, {
 });
 module.exports = __toCommonJS(calendar_exports);
 
+// ../tracking-core/src/tracking.ts
+var TRACKING_PARAM_KEYS = [
+  "gclid",
+  // Google's iOS/Safari replacement click IDs — issued when privacy features
+  // withhold gclid (wbraid: web-to-web, gbraid: app-to-web). First-class
+  // citizens: captured, persisted, and attributed exactly like gclid.
+  "wbraid",
+  "gbraid",
+  // Yelp Ads click id (40 hex chars), appended to ad-click URLs.
+  "ylpcid",
+  "fbclid",
+  "utm_source",
+  "utm_medium",
+  "utm_campaign",
+  "utm_term",
+  "utm_content"
+];
+function createEmptyTrackingParams() {
+  return {
+    gclid: null,
+    wbraid: null,
+    gbraid: null,
+    ylpcid: null,
+    fbclid: null,
+    utm_source: null,
+    utm_medium: null,
+    utm_campaign: null,
+    utm_term: null,
+    utm_content: null
+  };
+}
+function normalizeTrackingCookieValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function getTrackingParamsFromCookieReader(readCookie) {
+  return TRACKING_PARAM_KEYS.reduce((params, key) => {
+    params[key] = normalizeTrackingCookieValue(readCookie(key));
+    return params;
+  }, createEmptyTrackingParams());
+}
+var FALLBACK_STORAGE_PREFIX = "_aranova_track_";
+function fallbackKey(name) {
+  return `${FALLBACK_STORAGE_PREFIX}${name}`;
+}
+function readCookieValue(name) {
+  if (typeof document !== "undefined") {
+    const cookies = document.cookie ? document.cookie.split("; ") : [];
+    const match = cookies.find((cookie) => cookie.startsWith(`${name}=`));
+    if (match) {
+      const [, rawValue = ""] = match.split("=");
+      return normalizeTrackingCookieValue(decodeURIComponent(rawValue));
+    }
+  }
+  if (typeof window !== "undefined") {
+    try {
+      const stored = window.localStorage.getItem(fallbackKey(name));
+      if (stored) return normalizeTrackingCookieValue(decodeURIComponent(stored));
+    } catch {
+    }
+  }
+  return null;
+}
+function getCookieValueFromDocument(key) {
+  return readCookieValue(key);
+}
+
+// ../tracking-core/src/session.ts
+var VISITOR_STORAGE_KEY = "aranova_tracking_visitor";
+var SESSION_STORAGE_KEY = "aranova_tracking_session";
+var SESSION_IDLE_MS = 30 * 60 * 1e3;
+function readLocalStorage(key) {
+  try {
+    return window.localStorage.getItem(key);
+  } catch {
+    return null;
+  }
+}
+function peekVisitorId() {
+  if (typeof window === "undefined") return null;
+  const existing = readLocalStorage(VISITOR_STORAGE_KEY);
+  return existing && existing.length > 0 ? existing : null;
+}
+function peekSessionId(now = Date.now()) {
+  if (typeof window === "undefined") return null;
+  const raw = readLocalStorage(SESSION_STORAGE_KEY);
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.id !== "string" || typeof parsed.last_event_at !== "number") return null;
+    return now - parsed.last_event_at <= SESSION_IDLE_MS ? parsed.id : null;
+  } catch {
+    return null;
+  }
+}
+
+// ../tracking-core/src/resources/calendar/attribution.ts
+var LIMITS = {
+  session_id: 64,
+  visitor_id: 64,
+  gclid: 256,
+  fbclid: 256,
+  utm_source: 128,
+  utm_medium: 128,
+  utm_campaign: 128,
+  utm_term: 128,
+  utm_content: 128
+};
+function getBookingAttribution() {
+  if (typeof window === "undefined") return {};
+  const params = getTrackingParamsFromCookieReader(getCookieValueFromDocument);
+  const values = {
+    session_id: peekSessionId(),
+    visitor_id: peekVisitorId(),
+    gclid: params.gclid,
+    fbclid: params.fbclid,
+    utm_source: params.utm_source,
+    utm_medium: params.utm_medium,
+    utm_campaign: params.utm_campaign,
+    utm_term: params.utm_term,
+    utm_content: params.utm_content
+  };
+  const attribution = {};
+  for (const key of Object.keys(LIMITS)) {
+    const value = values[key];
+    if (value) attribution[key] = value.slice(0, LIMITS[key]);
+  }
+  return attribution;
+}
+
 // ../tracking-core/src/capabilities.ts
 var registered = /* @__PURE__ */ new Set();
 function registerCapability(capability) {
@@ -280,22 +410,27 @@ var zBookingRescheduleSchema = z.strictObject({
   time_zone: z.string().check(z.minLength(1), z.maxLength(64), z.regex(/^[A-Za-z0-9_+\-\/]+$/))
 });
 var zBookingResponse = z.strictObject({
+  all_day: z.boolean(),
   appointment_type: z.nullable(z.string()),
   calendar_key: z.string(),
+  created_at: z.iso.datetime({ offset: true }),
   customer: zBookingCustomerOutput,
   end_at: z.iso.datetime({ offset: true }),
+  google_event_id: z.nullable(z.string()),
   google_html_link: z.nullable(z.string()),
-  google_sync_state: z.string(),
+  google_sync_state: z.enum(["queued", "synced", "uncertain", "failed", "drifted"]),
+  ical_uid: z.nullable(z.string()),
   id: z.string(),
   manage_token: z.nullable(z.string()),
   meet_url: z.nullable(z.string()),
+  organizer_email: z.nullable(z.string()),
   start_at: z.iso.datetime({ offset: true }),
-  status: z.string(),
+  status: z.enum(["pending", "confirmed", "cancelled", "no_show"]),
   time_zone: z.string(),
   title: z.string()
 });
 var zBookingSource = z.enum(["website", "phone", "walk_in", "import", "operator"]);
-var zBookingMetadata = z.strictObject({
+var zBookingMetadataInput = z.strictObject({
   custom: z.nullish(
     z.record(z.string(), z.nullable(z.union([z.string(), z.int(), z.number(), z.boolean()])))
   ),
@@ -315,6 +450,42 @@ var zBookingMetadata = z.strictObject({
   utm_term: z.nullish(z.string().check(z.maxLength(128))),
   visitor_id: z.nullish(z.string().check(z.maxLength(64)))
 });
+var zBusySource = z.enum(["google", "booking"]);
+var zBusyInterval = z.strictObject({
+  end_at: z.iso.datetime({ offset: true }),
+  source: zBusySource,
+  start_at: z.iso.datetime({ offset: true })
+});
+var zBusyWindow = z.strictObject({
+  since: z.iso.datetime({ offset: true }),
+  until: z.iso.datetime({ offset: true })
+});
+var zBusyResponse = z.strictObject({
+  busy: z.array(zBusyInterval),
+  calendar_key: z.string(),
+  generated_at: z.iso.datetime({ offset: true }),
+  time_zone: z.string(),
+  window: zBusyWindow
+});
+var zCalendarSummary = z.strictObject({
+  allow_overlaps: z.boolean(),
+  calendar_key: z.string(),
+  connected_at: z.nullable(z.iso.datetime({ offset: true })),
+  google_account_email: z.nullable(z.string()),
+  granted_scopes: z.nullable(z.array(z.string())),
+  is_sandbox: z.boolean(),
+  label: z.string(),
+  sandbox_key: z.nullable(z.string()),
+  status: z.enum([
+    "pending_invite",
+    "awaiting_calendar_selection",
+    "connected",
+    "needs_reconnect",
+    "revoked",
+    "disabled"
+  ]),
+  time_zone: z.string()
+});
 var zCustomLocation = z.strictObject({
   kind: z.literal("custom"),
   text: z.string().check(z.maxLength(1024))
@@ -334,9 +505,23 @@ var zErrorCode = z.enum([
   "bad_request",
   "not_found",
   "conflict",
+  "gone",
   "incompatible_payload",
   "repeat_confirmation_required",
   "idempotency_conflict",
+  "slot_unavailable",
+  "calendar_not_connected",
+  "calendar_disconnected",
+  "booking_not_found",
+  "booking_not_cancellable",
+  "booking_not_reschedulable",
+  "manage_token_invalid",
+  "google_error",
+  "calendar_not_owned",
+  "calendar_is_sandbox",
+  "sandbox_exists",
+  "sandbox_key_too_long",
+  "sandbox_not_found",
   "validation_error",
   "unknown_service",
   "invalid_sale_properties",
@@ -371,15 +556,16 @@ var zBookingCreateSchema = z.strictObject({
   buffer_before_minutes: z._default(z.optional(z.int().check(z.gte(0), z.lte(1440))), 0),
   calendar_key: z.string().check(z.minLength(1), z.maxLength(64)),
   customer: zBookingCustomerInput,
+  date: z.nullish(z.iso.date()),
   description: z.nullish(z.string().check(z.maxLength(8e3))),
   duration_minutes: z.nullish(z.int().check(z.gt(0), z.lte(1440))),
   end_at: z.nullish(z.iso.datetime({ offset: true })),
   idempotency_key: z.nullish(z.string().check(z.maxLength(128))),
   location: z.nullish(z.union([zMeetLocation, zPhysicalLocation, zPhoneLocation, zCustomLocation])),
-  metadata: z.nullish(zBookingMetadata),
+  metadata: z.nullish(zBookingMetadataInput),
   reminders: z.nullish(zBookingReminders),
   send_invites: z._default(z.optional(z.boolean()), true),
-  start_at: z.iso.datetime({ offset: true }),
+  start_at: z.nullish(z.iso.datetime({ offset: true })),
   time_zone: z.string().check(z.minLength(1), z.maxLength(64), z.regex(/^[A-Za-z0-9_+\-\/]+$/)),
   title: z.nullish(z.string().check(z.maxLength(300)))
 });
@@ -413,22 +599,17 @@ var MAX_REMINDER_OVERRIDES = 5;
 var MAX_REMINDER_MINUTES = 40320;
 var MAX_BOOKING_MINUTES = 1440;
 var BOOKING_SOURCES = ["website", "phone", "walk_in", "import", "operator"];
-var BOOKING_STATUSES = ["pending", "confirmed", "cancelled", "no_show"];
-var GOOGLE_SYNC_STATES = ["queued", "synced", "uncertain", "failed", "drifted"];
-var CALENDAR_SYNC_STATUSES = [
-  "pending_invite",
-  "awaiting_calendar_selection",
-  "connected",
-  "needs_reconnect",
-  "revoked",
-  "disabled"
-];
+var BOOKING_STATUSES = zBookingResponse.shape.status.options;
+var GOOGLE_SYNC_STATES = zBookingResponse.shape.google_sync_state.options;
+var CALENDAR_SYNC_STATUSES = zCalendarSummary.shape.status.options;
 var CALENDAR_ERROR_CODES = [
   "slot_unavailable",
   "calendar_not_connected",
   "calendar_disconnected",
   "booking_not_found",
-  "outside_booking_window",
+  "booking_not_cancellable",
+  "booking_not_reschedulable",
+  "manage_token_invalid",
   "rate_limited",
   "google_error"
 ];
@@ -449,7 +630,7 @@ var ianaTz = z2.string().check(
 var bookingAttendeeSchema = zBookingAttendee;
 var bookingReminderSchema = zBookingReminder;
 var bookingCustomerSchema = zBookingCustomerInput;
-var bookingMetadataSchema = z2.extend(zBookingMetadata, {
+var bookingMetadataSchema = z2.extend(zBookingMetadataInput, {
   custom: z2.nullish(
     z2.record(z2.string(), z2.union([z2.string(), z2.int(), z2.number(), z2.boolean(), z2.null()]))
   )
@@ -478,6 +659,24 @@ function refineEndXor(value, ctx) {
     addIssue(ctx, ["end_at"], "end_at must be after start_at");
   }
 }
+function refineStartXor(value, ctx) {
+  const hasStart = value.start_at !== void 0 && value.start_at !== null;
+  const hasDate = value.date !== void 0 && value.date !== null;
+  if (hasStart === hasDate) {
+    addIssue(ctx, ["start_at"], "provide exactly one of start_at or date");
+    return;
+  }
+  if (hasStart) {
+    refineEndXor(value, ctx);
+    return;
+  }
+  if (value.end_at != null || value.duration_minutes != null) {
+    addIssue(ctx, ["date"], "an all-day booking (date) takes no end_at or duration_minutes");
+  }
+  if (value.buffer_before_minutes || value.buffer_after_minutes) {
+    addIssue(ctx, ["date"], "an all-day booking (date) takes no buffers");
+  }
+}
 var bookingRemindersSchema = z2.extend(zBookingReminders, {
   overrides: z2._default(
     z2.array(bookingReminderSchema).check(z2.maxLength(MAX_REMINDER_OVERRIDES)),
@@ -496,7 +695,7 @@ var bookingCreateSchema = z2.extend(zBookingCreateSchema, {
   // our compositions into its own output.
   reminders: z2.nullish(bookingRemindersSchema),
   metadata: z2.nullish(bookingMetadataSchema)
-}).check((ctx) => refineEndXor(ctx.value, ctx));
+}).check((ctx) => refineStartXor(ctx.value, ctx));
 var bookingRescheduleSchema = z2.extend(zBookingRescheduleSchema, { time_zone: ianaTz }).check((ctx) => refineEndXor(ctx.value, ctx));
 var bookingCancelSchema = zBookingCancelSchema;
 
@@ -614,6 +813,7 @@ function groupSlotsByDay(slots, timeZone) {
   endOfDayInTz,
   formatDateInTz,
   formatSlotRange,
+  getBookingAttribution,
   groupSlotsByDay,
   instantFromWallClock,
   isCalendarError,