@ordinatio/scheduling-api 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.2.0 (2026-10-28)
+
+- **Organization brand.** Set `host.brand` to turn it on. Public route: `GET /brand` (what a visitor may see, never an email
+  address). Staff routes: `GET`, `PUT` and `DELETE /admin/brand`. A brand with any problem is a 400 listing every problem with its
+  field. `host.brand.isSendingDomainVerified(domain, organizationId)` decides which domains an organization may send from; without
+  it no sending address is accepted. Queued messages carry the brand fields, and the manual follow-up and reminder texts sign with the
+  brand name. With `host.brand` unset the routes answer 501 and messages are unchanged.
+- **Calendar-file event ids** now end in `@ordinatio-scheduling` instead of the name of the business the package was first built for.
+  Set `host.icalUidDomain()` to keep an id that calendars have already subscribed to.
+- **Data export and erasure.** Set `host.privacy` to turn them on. Staff routes: `POST /admin/privacy/export` (a JSON file of
+  everything held about one person), `POST /admin/privacy/erase` (a preview, or the erasure with `"confirm": true`; 409 while the
+  person has upcoming bookings or an open waitlist offer) and `GET /admin/privacy/requests` (the log). The person is named in the
+  body, not the address. With `host.privacy` unset the routes answer 501.
+- **Routing forms.** Set `host.routingForms` to turn them on. Public routes: `GET /routing-forms?slug=` (the questions, never
+  the rules) and `POST /routing-forms/route` (the answers; the answer is where to send the client, or the form's fallback
+  message). Staff routes: `GET` and `POST /admin/routing-forms`, `GET`, `PUT` and `DELETE /admin/routing-forms/[id]`, and
+  `POST /admin/routing-forms/[id]/test` (try sample answers, even on a form that is switched off). A form with any problem is
+  refused with a 400 that lists every problem with its place. With `host.routingForms` unset the routes answer 501.
+- **Waitlist.** Set `host.waitlist` to turn it on. Public routes: `POST /waitlist` (join a full slot or day; the answer
+  holds the client's own `token`), `DELETE /waitlist?token=` (leave), `GET /waitlist/offer?token=` (what was offered),
+  `POST /waitlist/offer/accept` (take it; this books through the normal booking route). Staff routes: `GET /admin/waitlist`,
+  `DELETE /admin/waitlist/[id]`. Worker route: `POST /internal/waitlist/sweep`. A cancelled, rejected or moved booking
+  offers its slot to the first person in line. `host.waitlist.notify` sends the client their link; the
+  `waitlist.offered` webhook announces it too. With `host.waitlist` unset the routes answer 501.
+- A client who leaves, or staff who remove someone, while they hold an offer passes the slot to the next person. A failed
+  accept leaves the offer open (busy or server error), keeps the client's place (slot taken, 409), or ends it and re-offers
+  the slot (a booking rule refuses them). The sweep also settles an accept that never finished.
+- Needs the engine release with the waitlist table.
+
 ## 0.1.0
 
 The first release.

package/README.md

@@ -256,7 +256,93 @@ Events are queued for you. Sending is done by a timer you run: call `deliverDueW
 `@ordinatio/scheduling` every few seconds, or have your worker `POST /internal/webhooks/deliver` (it needs
 `host.internalAccess`). Without `webhooks` on the host the routes answer 501 and nothing is queued. In local
 development, `webhooks: { allowInsecureTargets: true }` lets an endpoint point at `http://localhost`. The engine
-README explains the retry schedule and how a receiver checks the signature.
+README explains the retry schedule and how a receiver checks the signature. The events are `appointment.booked`,
+`appointment.rescheduled`, `appointment.cancelled`, `appointment.no_show` and `waitlist.offered`; `reminder.sent` is sent when
+the worker that sends reminders passes `webhooks: true` to `processPendingNotifications`.
+
+## Waitlist
+
+Set `waitlist: {}` on the host to let clients wait for a full slot or day. A cancelled, rejected or moved booking offers
+the slot it held to the person who has waited longest.
+
+| Route | Who | What it does |
+|---|---|---|
+| `POST /waitlist` | public | Joins: `{ "typeId": "...", "day": "2026-11-03", "slotStart": "...", "clientName": "...", "clientEmail": "..." }` (`slotStart`, `calendarId` and `orgSlug` are optional). Refused with 409 while the slot or day still has room. The answer holds the client's own `token`. |
+| `DELETE /waitlist?token=` | public | Leaves the list. |
+| `GET /waitlist/offer?token=` | public | What was offered, until when, and the name the client gave. No email or phone. |
+| `POST /waitlist/offer/accept` | public | `{ "token": "..." }` books the offered slot through the normal booking route, so your rules, messages and calendar sync apply. 409 `SLOT_UNAVAILABLE` if someone booked it first; the client keeps their place. |
+| `GET /admin/waitlist` | admin | The people waiting, oldest first. `?status=` filters. |
+| `DELETE /admin/waitlist/[id]` | admin | Takes someone off. |
+| `POST /internal/waitlist/sweep` | worker | Ends offers whose time ran out, settles an accept that never finished (booked, or back in line), and offers each freed slot to the next person. Call it every minute or so; it answers `{ lapsed, released, booked, reoffered }` (offers ended, accepts sent back in line, accepts found already booked, slots offered onward). A person sent back in line from a stuck accept is first in line again, so they may be offered the same slot. It serves the host's public database; a host with a database per organization calls `expireWaitlistOffers` and `offerFreedSlot` from the engine itself for each one. |
+
+`host.waitlist.notify(offer)` is where you send the client their link (put `offer.token` in it and open the offer page, which
+calls the two offer routes). The `waitlist.offered` webhook announces the same thing. `host.waitlist.offerMinutes` sets the
+length of an offer (default 30; never past the start of the slot). An offer is first dibs, not a hold. A type that needs payment
+or with required intake questions has no waitlist. A client who leaves, or staff who remove someone, while they hold an offer
+passes the slot to the next person. If accepting fails because the server is busy the offer stays open; if the slot was
+taken the client keeps their place; if a booking rule refuses them they come off the list and the slot is re-offered.
+Joining does not check that the email belongs to the person joining, and the `waitlist.offered` webhook body contains the
+client's private token (visible to admins in the delivery log), so protect the join page and the endpoint accordingly.
+Without `waitlist` on the host the routes answer 501.
+
+## Routing forms
+
+Set `routingForms: {}` on the host to let admins build short forms that send a client to the right appointment type or
+calendar. The engine README explains question types, operators and how a form is checked.
+
+| Route | Who | What it does |
+|---|---|---|
+| `GET /routing-forms?slug=` | public | The form's questions. Never the rules or the fallback. `orgSlug` names the organization when one database holds several. |
+| `POST /routing-forms/route` | public | `{ "slug": "...", "answers": { "service": "Suit" } }` (send `answers: {}` when every question is optional and unanswered) answers with `{ destination, message, matchedRuleId, usedFallback }`. `destination` has the type and calendar ids, slugs and names to build a booking link from; it is null when the form's fallback is a message. 400 with `details` when the answers do not fit. |
+| `GET /admin/routing-forms`, `POST /admin/routing-forms` | admin | List the forms; save a new one. A form with any problem is refused with a 400 whose `details` list every problem with its place (`rules[1].conditions[0].questionId`). |
+| `GET /admin/routing-forms/[id]`, `PUT`, `DELETE` | admin | Read one in full; change it (the whole result is checked again); remove it. |
+| `POST /admin/routing-forms/[id]/test` | admin | `{ "answers": { ... } }` tries sample answers, even on a form that is switched off, and lists every rule that matched. |
+
+A slug is unique across the organizations of one database, so a link by slug alone is not ambiguous; a host with a database per
+organization passes `orgSlug`. The public routes answer 404 for an unknown, switched-off or ambiguous form, and the staff routes
+answer 409 for a slug already in use in the organization (`SCHED_1202`) or the 50-form limit (`SCHED_1204`) and 404 for another organization's form. The test route's
+answer adds `allMatchedRuleIds`, every rule the answers satisfy. `matchedRuleId` is the rule id the admin chose, so pick ids that are
+safe to show. Routing does not stop a client from booking something else: it only suggests where to go. Without
+`routingForms` on the host the routes answer 501.
+
+## Organization brand
+
+Set `brand: {}` on the host to let each organization carry a name, logo, colours, font and footer on its booking page and in its
+messages, and a sender identity. The engine README explains what each field accepts.
+
+| Route | Who | What it does |
+|---|---|---|
+| `GET /brand` | public | The brand a visitor may see: name, logo, colours, font, footer. Never an email address. `orgSlug` names the organization when one database holds several; with none named, the brand of the only organization that has one. 404 when there is none. |
+| `GET /admin/brand`, `PUT /admin/brand`, `DELETE /admin/brand` | admin | Read the whole brand including its email settings (`{ brand: null }` when none); replace it; remove it. A brand with any problem is a 400 whose `details` list every problem with its field. |
+
+**Sending from the organization's own domain.** `fromEmail` is accepted only if the host says it may send from that domain:
+
+```ts
+brand: { isSendingDomainVerified: async (domain, organizationId) => myMailProvider.isVerified(domain) }
+```
+
+With no `isSendingDomainVerified`, every `fromEmail` is refused (`replyToEmail` and the rest are still fine). Your message sender then
+decides how to use the identity (see the engine README). Messages queued when a booking is made, moved or cancelled carry the brand
+fields for templates, and the manual follow-up and reminder texts sign with the brand name when a calendar has no staff name.
+
+The booking widget loads `GET /brand` by itself and applies it; a colour the page sets in `theme` always wins over the brand's.
+`icalUidDomain()` on the host sets the domain in calendar-file event ids (default `ordinatio-scheduling`); once calendars have subscribed, keep it unchanged.
+Without `brand` on the host the routes answer 501.
+
+## Data export and erasure
+
+Set `privacy: {}` on the host to let an admin export or erase everything held about one person. The engine README explains what
+each does, what it keeps, and what it does not reach. The person is named in the request body, never in the address, so an email
+does not end up in access logs.
+
+| Route | Who | What it does |
+|---|---|---|
+| `POST /admin/privacy/export` | admin | `{ "email": "..." }` and/or `{ "clientId": "..." }`. Answers with the export as a JSON file to save (`content-disposition: attachment`, never cached). |
+| `POST /admin/privacy/erase` | admin | The same body. Without `"confirm": true` it only previews: `{ erased: false, preview: { counts, blockers, canErase, warnings } }`. With it, erases and answers `{ erased: true, counts }`. 409 (`SCHED_1301`) while the person has upcoming bookings or an open waitlist offer, with the numbers in `details.blockers`. |
+| `GET /admin/privacy/requests` | admin | The log of exports and erasures: when, who asked, how many rows. It holds no names or addresses. |
+
+A body that names nobody, names an invalid address, or carries other fields is a 400. Both actions are rate limited and written to
+the host's activity feed with counts only. Without `privacy` on the host the routes answer 501.
 
 ## Serving the routes
 

package/dist/{chunk-IAQBLF5F.mjs → chunk-MQO3VRMU.mjs}

@@ -376,6 +376,57 @@ var CreateWebhookEndpointSchema = z5.object({
   description: optionalString(200, "Description")
 });
 
+// src/schemas/routing.schema.ts
+import { z as z6 } from "zod";
+var bounded = {
+  name: z6.string().max(200),
+  slug: z6.string().max(100),
+  description: z6.string().max(1e3).nullable().optional(),
+  isActive: z6.boolean().optional(),
+  questions: z6.array(z6.unknown()).max(30),
+  rules: z6.array(z6.unknown()).max(60),
+  fallback: z6.unknown()
+};
+var CreateRoutingFormSchema = z6.object({
+  ...bounded,
+  fallback: z6.record(z6.string(), z6.unknown())
+});
+var UpdateRoutingFormSchema = z6.object({ ...bounded, fallback: z6.record(z6.string(), z6.unknown()) }).partial().refine((value) => Object.keys(value).length > 0, { message: "Send at least one field to change" });
+var RouteClientSchema = z6.object({
+  slug: z6.string().min(1).max(100),
+  orgSlug: z6.string().min(1).max(100).optional(),
+  answers: z6.record(z6.string(), z6.unknown())
+});
+var TestRoutingFormSchema = z6.object({ answers: z6.record(z6.string(), z6.unknown()) });
+
+// src/schemas/privacy.schema.ts
+import { z as z7 } from "zod";
+var subject = {
+  email: z7.string().max(320).optional(),
+  clientId: z7.string().max(200).optional()
+};
+var namesSomeone = (value) => Boolean(value.email?.trim() || value.clientId?.trim());
+var namesSomeoneMessage = { message: "Send an email address, a client id, or both" };
+var PrivacySubjectSchema = z7.object(subject).strict().refine(namesSomeone, namesSomeoneMessage);
+var PrivacyEraseSchema = z7.object({ ...subject, confirm: z7.boolean().optional() }).strict().refine(namesSomeone, namesSomeoneMessage);
+
+// src/schemas/brand.schema.ts
+import { z as z8 } from "zod";
+var optionalText = (max) => z8.string().max(max).nullable().optional();
+var BrandSchema = z8.object({
+  displayName: z8.string().max(200),
+  logoUrl: optionalText(1e3),
+  primaryColor: optionalText(20),
+  accentColor: optionalText(20),
+  backgroundColor: optionalText(20),
+  textColor: optionalText(20),
+  fontFamily: optionalText(200),
+  footerText: optionalText(1e3),
+  replyToEmail: optionalText(400),
+  fromName: optionalText(200),
+  fromEmail: optionalText(400)
+}).strict();
+
 export {
   IntakeFormFieldSchema,
   CreateAppointmentTypeSchema,
@@ -407,5 +458,12 @@ export {
   CreateRecurringSeriesSchema,
   CancelRecurringScopeSchema,
   CancelRecurringSeriesSchema,
-  CreateWebhookEndpointSchema
+  CreateWebhookEndpointSchema,
+  CreateRoutingFormSchema,
+  UpdateRoutingFormSchema,
+  RouteClientSchema,
+  TestRoutingFormSchema,
+  PrivacySubjectSchema,
+  PrivacyEraseSchema,
+  BrandSchema
 };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { SchedulingDb, CalendarSyncAdapter, WebhookTransport, PaymentAdapter, AppointmentStatus, CalendarEventRef, CalendarEvent } from '@ordinatio/scheduling';
-export { BookingPageConfig, BookingPageConfigSchema, BookingPageTheme, BookingPageThemeSchema, CancelRecurringScopeSchema, CancelRecurringSeriesInput, CancelRecurringSeriesSchema, CreateAppointmentCategoryInput, CreateAppointmentCategorySchema, CreateAppointmentTypeInput, CreateAppointmentTypeSchema, CreateAvailabilityRuleInput, CreateAvailabilityRuleSchema, CreateCalendarInput, CreateCalendarSchema, CreateCouponCodeInput, CreateCouponCodeSchema, CreateNotificationTemplateInput, CreateNotificationTemplateSchema, CreatePackagePurchaseInput, CreatePackagePurchaseSchema, CreateRecurringSeriesInput, CreateRecurringSeriesSchema, CreateServicePackageInput, CreateServicePackageSchema, CreateWebhookEndpointInput, CreateWebhookEndpointSchema, DEFAULT_CANCELLATION_POLICY, IntakeFormFieldSchema, NoShowPrevention, NoShowPreventionAction, NoShowPreventionActionSchema, NotificationChannelSchema, NotificationTriggerSchema, OrgCancellationPolicy, OrgCancellationPolicySchema, RecurringFrequencySchema, SLOT_GRANULARITY_DEFAULT, SLOT_GRANULARITY_OPTIONS, SlotGranularityMinutes, UpdateAppointmentCategoryInput, UpdateAppointmentCategorySchema, UpdateAppointmentTypeInput, UpdateAppointmentTypeSchema, UpdateBookingPageInput, UpdateBookingPageSchema, UpdateCalendarInput, UpdateCalendarSchema, UpdateCouponCodeInput, UpdateCouponCodeSchema, UpdateNotificationTemplateInput, UpdateNotificationTemplateSchema, UpdatePackagePurchaseInput, UpdatePackagePurchaseSchema, UpdateServicePackageInput, UpdateServicePackageSchema } from './schemas/index.mjs';
+export { BookingPageConfig, BookingPageConfigSchema, BookingPageTheme, BookingPageThemeSchema, BrandSchema, CancelRecurringScopeSchema, CancelRecurringSeriesInput, CancelRecurringSeriesSchema, CreateAppointmentCategoryInput, CreateAppointmentCategorySchema, CreateAppointmentTypeInput, CreateAppointmentTypeSchema, CreateAvailabilityRuleInput, CreateAvailabilityRuleSchema, CreateCalendarInput, CreateCalendarSchema, CreateCouponCodeInput, CreateCouponCodeSchema, CreateNotificationTemplateInput, CreateNotificationTemplateSchema, CreatePackagePurchaseInput, CreatePackagePurchaseSchema, CreateRecurringSeriesInput, CreateRecurringSeriesSchema, CreateRoutingFormInput, CreateRoutingFormSchema, CreateServicePackageInput, CreateServicePackageSchema, CreateWebhookEndpointInput, CreateWebhookEndpointSchema, DEFAULT_CANCELLATION_POLICY, IntakeFormFieldSchema, NoShowPrevention, NoShowPreventionAction, NoShowPreventionActionSchema, NotificationChannelSchema, NotificationTriggerSchema, OrgCancellationPolicy, OrgCancellationPolicySchema, PrivacyEraseSchema, PrivacySubjectSchema, RecurringFrequencySchema, RouteClientSchema, SLOT_GRANULARITY_DEFAULT, SLOT_GRANULARITY_OPTIONS, SlotGranularityMinutes, TestRoutingFormSchema, UpdateAppointmentCategoryInput, UpdateAppointmentCategorySchema, UpdateAppointmentTypeInput, UpdateAppointmentTypeSchema, UpdateBookingPageInput, UpdateBookingPageSchema, UpdateCalendarInput, UpdateCalendarSchema, UpdateCouponCodeInput, UpdateCouponCodeSchema, UpdateNotificationTemplateInput, UpdateNotificationTemplateSchema, UpdatePackagePurchaseInput, UpdatePackagePurchaseSchema, UpdateRoutingFormInput, UpdateRoutingFormSchema, UpdateServicePackageInput, UpdateServicePackageSchema } from './schemas/index.mjs';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import 'zod';
 
@@ -224,6 +224,45 @@ interface WebhookSettings {
     /** Sends one request. Default: Node's own http client, which refuses names that resolve to private addresses. */
     transport?: WebhookTransport;
 }
+/** What the host does with a waitlist offer. Switching the waitlist on is what supplies this object. */
+interface WaitlistSettings {
+    /** How long an offer lasts, in minutes, and never past the start of the slot. Default 30. */
+    offerMinutes?: number;
+    /**
+     * Tells the client that a slot is theirs to take: send `token` in a link to the page that calls
+     * `GET /waitlist/offer` and `POST /waitlist/offer/accept`. It runs inside the request that cancelled the booking, so it
+     * should only queue the message, not wait for it to be delivered. It must not throw; a rejection is logged and the offer
+     * stays open until it expires. Without it, only the `waitlist.offered` webhook announces the offer.
+     */
+    notify?(offer: {
+        organizationId: string;
+        token: string;
+        clientName: string;
+        clientEmail: string;
+        clientPhone: string | null;
+        typeName: string;
+        calendarName: string;
+        startTime: Date;
+        timezone: string;
+        expiresAt: Date;
+    }): Promise<void>;
+}
+/** Switches routing forms on. A host that supplies none has them off: the routes answer 501. */
+type RoutingFormSettings = Record<string, never>;
+/**
+ * Switches organization branding on: a name, logo and colours for the booking page and messages, and a sender identity.
+ * A host that supplies none has it off: the routes answer 501 and no message carries a brand.
+ */
+interface BrandSettings {
+    /**
+     * Says whether the host may send mail from `domain` (lower case, such as "mail.acme.com"), usually because it has been
+     * verified with the mail provider. Without it no organization can set a sending address; it can still set a reply-to.
+     * A rejection counts as "no".
+     */
+    isSendingDomainVerified?(domain: string, organizationId: string): boolean | Promise<boolean>;
+}
+/** Switches data export and erasure on. A host that supplies none has them off: the routes answer 501. */
+type PrivacySettings = Record<string, never>;
 interface SchedulingHost {
     /**
      * The database for routes that have no signed-in user. Such a route reads the system database before it knows
@@ -260,6 +299,28 @@ interface SchedulingHost {
      * runs on a timer. Needs the webhook tables. Default: off.
      */
     webhooks?: WebhookSettings | null;
+    /**
+     * Turns on the waitlist: clients can wait for a full slot or day, and a cancelled or moved booking offers its slot
+     * to the first person in line. Needs the waitlist table. Default: off, so the routes answer 501.
+     */
+    waitlist?: WaitlistSettings | null;
+    /**
+     * Turns on routing forms: an admin defines questions and rules, and a public route sends a client to the right
+     * appointment type or calendar. Needs the routing form table. Default: off, so the routes answer 501.
+     */
+    routingForms?: RoutingFormSettings | null;
+    /**
+     * Turns on exporting and erasing one person's data (admin only, every request recorded). Needs the data request table.
+     * Default: off, so the routes answer 501.
+     */
+    privacy?: PrivacySettings | null;
+    /**
+     * Turns on organization branding. Needs the brand table. Messages carry the brand only if the host's message sender
+     * also asks for it (see `processPendingNotifications`' `brand` option). Default: off, so the routes answer 501.
+     */
+    brand?: BrandSettings | null;
+    /** The domain used after the "@" in calendar-file event ids. Keep it unchanged once calendars have subscribed. Default: ordinatio-scheduling. */
+    icalUidDomain?(): string | null | undefined;
     /** Records what happened in the activity feed. Default: nothing is recorded. */
     activity?: ActivityLog;
     /** Finds the organization named by an `orgSlug` query value. Default: one organization, nothing scoped. */
@@ -608,4 +669,4 @@ declare function createNodeListener(api: {
     handle(request: Request): Promise<Response>;
 }, options: NodeListenerOptions): (incoming: IncomingMessage, outgoing: ServerResponse) => void;
 
-export { ALL_REFUND_STATUSES, type ActivityEntry, type ActivityLog, type AppointmentEventSink, type AvailabilityCache, BALANCE_APPOINTMENT_SELECT, BALANCE_BLOCKED_APPOINTMENT_STATUS, BALANCE_REQUIRED_PAYMENT_STATUS, BALANCE_REQUIRED_REFUND_STATUS, BalanceIntentGenerationsExhaustedError, type BalancePaymentControl, BalanceRequestInProgressError, type BearerStaffResolverInput, type BookingClientResolver, type BookingPolicy, type CacheOptions, type CalendarConnectOutcome, type CalendarConnector, type CalendarConnectors, type CalendarVisibility, type HttpMethod, type InternalAccess, type NoShowPolicy, type NodeListenerOptions, type Pagination, type PublicBookingContext, type PublicBookingKind, type PublicBookingResolver, type PublicOrganization, type PublicOrganizationResolver, RETRYABLE_REFUND_STATUSES, type RateLimitTier, RefundOutcomePersistenceError, type ResolvedHost, type Route, type RouteContext, type RouteHandler, type SchedulingApi, type SchedulingApiConfig, type SchedulingCache, type SchedulingHost, type SchedulingServiceError, type SignedInPerson, type StaffContext, type StaffContextInput, type StaffDirectory, type StaffResolver, TERMINAL_SUCCESS_STATUSES, TOKEN_TTL_DAYS, UnverifiedPaymentError, type WebhookSettings, type WorkerCommands, attemptLegRefund, createBalanceIntent, createBearerStaffResolver, createMemoryAvailabilityCache, createMemoryCache, createMemoryRateLimiter, createNoBalancePaymentControl, createNoPaymentAdapter, createNodeListener, createSchedulingApi, createSingleOrganizationDirectory, createSingleOrganizationResolver, createStaffContext, decimalToCents, defaultCorsHeaders, getErrorCode, getErrorMessage, getErrorRef, isSchedulingServiceError, isTokenExpired, parsePagination, persistRefundOutcome, recordBalanceIntent, runCalendarRemoveWithoutBlocking, runCalendarSyncWithoutBlocking };
+export { ALL_REFUND_STATUSES, type ActivityEntry, type ActivityLog, type AppointmentEventSink, type AvailabilityCache, BALANCE_APPOINTMENT_SELECT, BALANCE_BLOCKED_APPOINTMENT_STATUS, BALANCE_REQUIRED_PAYMENT_STATUS, BALANCE_REQUIRED_REFUND_STATUS, BalanceIntentGenerationsExhaustedError, type BalancePaymentControl, BalanceRequestInProgressError, type BearerStaffResolverInput, type BookingClientResolver, type BookingPolicy, type BrandSettings, type CacheOptions, type CalendarConnectOutcome, type CalendarConnector, type CalendarConnectors, type CalendarVisibility, type HttpMethod, type InternalAccess, type NoShowPolicy, type NodeListenerOptions, type Pagination, type PrivacySettings, type PublicBookingContext, type PublicBookingKind, type PublicBookingResolver, type PublicOrganization, type PublicOrganizationResolver, RETRYABLE_REFUND_STATUSES, type RateLimitTier, RefundOutcomePersistenceError, type ResolvedHost, type Route, type RouteContext, type RouteHandler, type RoutingFormSettings, type SchedulingApi, type SchedulingApiConfig, type SchedulingCache, type SchedulingHost, type SchedulingServiceError, type SignedInPerson, type StaffContext, type StaffContextInput, type StaffDirectory, type StaffResolver, TERMINAL_SUCCESS_STATUSES, TOKEN_TTL_DAYS, UnverifiedPaymentError, type WaitlistSettings, type WebhookSettings, type WorkerCommands, attemptLegRefund, createBalanceIntent, createBearerStaffResolver, createMemoryAvailabilityCache, createMemoryCache, createMemoryRateLimiter, createNoBalancePaymentControl, createNoPaymentAdapter, createNodeListener, createSchedulingApi, createSingleOrganizationDirectory, createSingleOrganizationResolver, createStaffContext, decimalToCents, defaultCorsHeaders, getErrorCode, getErrorMessage, getErrorRef, isSchedulingServiceError, isTokenExpired, parsePagination, persistRefundOutcome, recordBalanceIntent, runCalendarRemoveWithoutBlocking, runCalendarSyncWithoutBlocking };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { SchedulingDb, CalendarSyncAdapter, WebhookTransport, PaymentAdapter, AppointmentStatus, CalendarEventRef, CalendarEvent } from '@ordinatio/scheduling';
-export { BookingPageConfig, BookingPageConfigSchema, BookingPageTheme, BookingPageThemeSchema, CancelRecurringScopeSchema, CancelRecurringSeriesInput, CancelRecurringSeriesSchema, CreateAppointmentCategoryInput, CreateAppointmentCategorySchema, CreateAppointmentTypeInput, CreateAppointmentTypeSchema, CreateAvailabilityRuleInput, CreateAvailabilityRuleSchema, CreateCalendarInput, CreateCalendarSchema, CreateCouponCodeInput, CreateCouponCodeSchema, CreateNotificationTemplateInput, CreateNotificationTemplateSchema, CreatePackagePurchaseInput, CreatePackagePurchaseSchema, CreateRecurringSeriesInput, CreateRecurringSeriesSchema, CreateServicePackageInput, CreateServicePackageSchema, CreateWebhookEndpointInput, CreateWebhookEndpointSchema, DEFAULT_CANCELLATION_POLICY, IntakeFormFieldSchema, NoShowPrevention, NoShowPreventionAction, NoShowPreventionActionSchema, NotificationChannelSchema, NotificationTriggerSchema, OrgCancellationPolicy, OrgCancellationPolicySchema, RecurringFrequencySchema, SLOT_GRANULARITY_DEFAULT, SLOT_GRANULARITY_OPTIONS, SlotGranularityMinutes, UpdateAppointmentCategoryInput, UpdateAppointmentCategorySchema, UpdateAppointmentTypeInput, UpdateAppointmentTypeSchema, UpdateBookingPageInput, UpdateBookingPageSchema, UpdateCalendarInput, UpdateCalendarSchema, UpdateCouponCodeInput, UpdateCouponCodeSchema, UpdateNotificationTemplateInput, UpdateNotificationTemplateSchema, UpdatePackagePurchaseInput, UpdatePackagePurchaseSchema, UpdateServicePackageInput, UpdateServicePackageSchema } from './schemas/index.js';
+export { BookingPageConfig, BookingPageConfigSchema, BookingPageTheme, BookingPageThemeSchema, BrandSchema, CancelRecurringScopeSchema, CancelRecurringSeriesInput, CancelRecurringSeriesSchema, CreateAppointmentCategoryInput, CreateAppointmentCategorySchema, CreateAppointmentTypeInput, CreateAppointmentTypeSchema, CreateAvailabilityRuleInput, CreateAvailabilityRuleSchema, CreateCalendarInput, CreateCalendarSchema, CreateCouponCodeInput, CreateCouponCodeSchema, CreateNotificationTemplateInput, CreateNotificationTemplateSchema, CreatePackagePurchaseInput, CreatePackagePurchaseSchema, CreateRecurringSeriesInput, CreateRecurringSeriesSchema, CreateRoutingFormInput, CreateRoutingFormSchema, CreateServicePackageInput, CreateServicePackageSchema, CreateWebhookEndpointInput, CreateWebhookEndpointSchema, DEFAULT_CANCELLATION_POLICY, IntakeFormFieldSchema, NoShowPrevention, NoShowPreventionAction, NoShowPreventionActionSchema, NotificationChannelSchema, NotificationTriggerSchema, OrgCancellationPolicy, OrgCancellationPolicySchema, PrivacyEraseSchema, PrivacySubjectSchema, RecurringFrequencySchema, RouteClientSchema, SLOT_GRANULARITY_DEFAULT, SLOT_GRANULARITY_OPTIONS, SlotGranularityMinutes, TestRoutingFormSchema, UpdateAppointmentCategoryInput, UpdateAppointmentCategorySchema, UpdateAppointmentTypeInput, UpdateAppointmentTypeSchema, UpdateBookingPageInput, UpdateBookingPageSchema, UpdateCalendarInput, UpdateCalendarSchema, UpdateCouponCodeInput, UpdateCouponCodeSchema, UpdateNotificationTemplateInput, UpdateNotificationTemplateSchema, UpdatePackagePurchaseInput, UpdatePackagePurchaseSchema, UpdateRoutingFormInput, UpdateRoutingFormSchema, UpdateServicePackageInput, UpdateServicePackageSchema } from './schemas/index.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import 'zod';
 
@@ -224,6 +224,45 @@ interface WebhookSettings {
     /** Sends one request. Default: Node's own http client, which refuses names that resolve to private addresses. */
     transport?: WebhookTransport;
 }
+/** What the host does with a waitlist offer. Switching the waitlist on is what supplies this object. */
+interface WaitlistSettings {
+    /** How long an offer lasts, in minutes, and never past the start of the slot. Default 30. */
+    offerMinutes?: number;
+    /**
+     * Tells the client that a slot is theirs to take: send `token` in a link to the page that calls
+     * `GET /waitlist/offer` and `POST /waitlist/offer/accept`. It runs inside the request that cancelled the booking, so it
+     * should only queue the message, not wait for it to be delivered. It must not throw; a rejection is logged and the offer
+     * stays open until it expires. Without it, only the `waitlist.offered` webhook announces the offer.
+     */
+    notify?(offer: {
+        organizationId: string;
+        token: string;
+        clientName: string;
+        clientEmail: string;
+        clientPhone: string | null;
+        typeName: string;
+        calendarName: string;
+        startTime: Date;
+        timezone: string;
+        expiresAt: Date;
+    }): Promise<void>;
+}
+/** Switches routing forms on. A host that supplies none has them off: the routes answer 501. */
+type RoutingFormSettings = Record<string, never>;
+/**
+ * Switches organization branding on: a name, logo and colours for the booking page and messages, and a sender identity.
+ * A host that supplies none has it off: the routes answer 501 and no message carries a brand.
+ */
+interface BrandSettings {
+    /**
+     * Says whether the host may send mail from `domain` (lower case, such as "mail.acme.com"), usually because it has been
+     * verified with the mail provider. Without it no organization can set a sending address; it can still set a reply-to.
+     * A rejection counts as "no".
+     */
+    isSendingDomainVerified?(domain: string, organizationId: string): boolean | Promise<boolean>;
+}
+/** Switches data export and erasure on. A host that supplies none has them off: the routes answer 501. */
+type PrivacySettings = Record<string, never>;
 interface SchedulingHost {
     /**
      * The database for routes that have no signed-in user. Such a route reads the system database before it knows
@@ -260,6 +299,28 @@ interface SchedulingHost {
      * runs on a timer. Needs the webhook tables. Default: off.
      */
     webhooks?: WebhookSettings | null;
+    /**
+     * Turns on the waitlist: clients can wait for a full slot or day, and a cancelled or moved booking offers its slot
+     * to the first person in line. Needs the waitlist table. Default: off, so the routes answer 501.
+     */
+    waitlist?: WaitlistSettings | null;
+    /**
+     * Turns on routing forms: an admin defines questions and rules, and a public route sends a client to the right
+     * appointment type or calendar. Needs the routing form table. Default: off, so the routes answer 501.
+     */
+    routingForms?: RoutingFormSettings | null;
+    /**
+     * Turns on exporting and erasing one person's data (admin only, every request recorded). Needs the data request table.
+     * Default: off, so the routes answer 501.
+     */
+    privacy?: PrivacySettings | null;
+    /**
+     * Turns on organization branding. Needs the brand table. Messages carry the brand only if the host's message sender
+     * also asks for it (see `processPendingNotifications`' `brand` option). Default: off, so the routes answer 501.
+     */
+    brand?: BrandSettings | null;
+    /** The domain used after the "@" in calendar-file event ids. Keep it unchanged once calendars have subscribed. Default: ordinatio-scheduling. */
+    icalUidDomain?(): string | null | undefined;
     /** Records what happened in the activity feed. Default: nothing is recorded. */
     activity?: ActivityLog;
     /** Finds the organization named by an `orgSlug` query value. Default: one organization, nothing scoped. */
@@ -608,4 +669,4 @@ declare function createNodeListener(api: {
     handle(request: Request): Promise<Response>;
 }, options: NodeListenerOptions): (incoming: IncomingMessage, outgoing: ServerResponse) => void;
 
-export { ALL_REFUND_STATUSES, type ActivityEntry, type ActivityLog, type AppointmentEventSink, type AvailabilityCache, BALANCE_APPOINTMENT_SELECT, BALANCE_BLOCKED_APPOINTMENT_STATUS, BALANCE_REQUIRED_PAYMENT_STATUS, BALANCE_REQUIRED_REFUND_STATUS, BalanceIntentGenerationsExhaustedError, type BalancePaymentControl, BalanceRequestInProgressError, type BearerStaffResolverInput, type BookingClientResolver, type BookingPolicy, type CacheOptions, type CalendarConnectOutcome, type CalendarConnector, type CalendarConnectors, type CalendarVisibility, type HttpMethod, type InternalAccess, type NoShowPolicy, type NodeListenerOptions, type Pagination, type PublicBookingContext, type PublicBookingKind, type PublicBookingResolver, type PublicOrganization, type PublicOrganizationResolver, RETRYABLE_REFUND_STATUSES, type RateLimitTier, RefundOutcomePersistenceError, type ResolvedHost, type Route, type RouteContext, type RouteHandler, type SchedulingApi, type SchedulingApiConfig, type SchedulingCache, type SchedulingHost, type SchedulingServiceError, type SignedInPerson, type StaffContext, type StaffContextInput, type StaffDirectory, type StaffResolver, TERMINAL_SUCCESS_STATUSES, TOKEN_TTL_DAYS, UnverifiedPaymentError, type WebhookSettings, type WorkerCommands, attemptLegRefund, createBalanceIntent, createBearerStaffResolver, createMemoryAvailabilityCache, createMemoryCache, createMemoryRateLimiter, createNoBalancePaymentControl, createNoPaymentAdapter, createNodeListener, createSchedulingApi, createSingleOrganizationDirectory, createSingleOrganizationResolver, createStaffContext, decimalToCents, defaultCorsHeaders, getErrorCode, getErrorMessage, getErrorRef, isSchedulingServiceError, isTokenExpired, parsePagination, persistRefundOutcome, recordBalanceIntent, runCalendarRemoveWithoutBlocking, runCalendarSyncWithoutBlocking };
+export { ALL_REFUND_STATUSES, type ActivityEntry, type ActivityLog, type AppointmentEventSink, type AvailabilityCache, BALANCE_APPOINTMENT_SELECT, BALANCE_BLOCKED_APPOINTMENT_STATUS, BALANCE_REQUIRED_PAYMENT_STATUS, BALANCE_REQUIRED_REFUND_STATUS, BalanceIntentGenerationsExhaustedError, type BalancePaymentControl, BalanceRequestInProgressError, type BearerStaffResolverInput, type BookingClientResolver, type BookingPolicy, type BrandSettings, type CacheOptions, type CalendarConnectOutcome, type CalendarConnector, type CalendarConnectors, type CalendarVisibility, type HttpMethod, type InternalAccess, type NoShowPolicy, type NodeListenerOptions, type Pagination, type PrivacySettings, type PublicBookingContext, type PublicBookingKind, type PublicBookingResolver, type PublicOrganization, type PublicOrganizationResolver, RETRYABLE_REFUND_STATUSES, type RateLimitTier, RefundOutcomePersistenceError, type ResolvedHost, type Route, type RouteContext, type RouteHandler, type RoutingFormSettings, type SchedulingApi, type SchedulingApiConfig, type SchedulingCache, type SchedulingHost, type SchedulingServiceError, type SignedInPerson, type StaffContext, type StaffContextInput, type StaffDirectory, type StaffResolver, TERMINAL_SUCCESS_STATUSES, TOKEN_TTL_DAYS, UnverifiedPaymentError, type WaitlistSettings, type WebhookSettings, type WorkerCommands, attemptLegRefund, createBalanceIntent, createBearerStaffResolver, createMemoryAvailabilityCache, createMemoryCache, createMemoryRateLimiter, createNoBalancePaymentControl, createNoPaymentAdapter, createNodeListener, createSchedulingApi, createSingleOrganizationDirectory, createSingleOrganizationResolver, createStaffContext, decimalToCents, defaultCorsHeaders, getErrorCode, getErrorMessage, getErrorRef, isSchedulingServiceError, isTokenExpired, parsePagination, persistRefundOutcome, recordBalanceIntent, runCalendarRemoveWithoutBlocking, runCalendarSyncWithoutBlocking };