@ordinatio/scheduling-api 0.1.0 → 0.2.0

package/dist/index.js

@@ -39,6 +39,7 @@ __export(index_exports, {
   BalanceRequestInProgressError: () => BalanceRequestInProgressError,
   BookingPageConfigSchema: () => BookingPageConfigSchema,
   BookingPageThemeSchema: () => BookingPageThemeSchema,
+  BrandSchema: () => BrandSchema,
   CancelRecurringScopeSchema: () => CancelRecurringScopeSchema,
   CancelRecurringSeriesSchema: () => CancelRecurringSeriesSchema,
   CreateAppointmentCategorySchema: () => CreateAppointmentCategorySchema,
@@ -49,6 +50,7 @@ __export(index_exports, {
   CreateNotificationTemplateSchema: () => CreateNotificationTemplateSchema,
   CreatePackagePurchaseSchema: () => CreatePackagePurchaseSchema,
   CreateRecurringSeriesSchema: () => CreateRecurringSeriesSchema,
+  CreateRoutingFormSchema: () => CreateRoutingFormSchema,
   CreateServicePackageSchema: () => CreateServicePackageSchema,
   CreateWebhookEndpointSchema: () => CreateWebhookEndpointSchema,
   DEFAULT_CANCELLATION_POLICY: () => DEFAULT_CANCELLATION_POLICY,
@@ -57,13 +59,17 @@ __export(index_exports, {
   NotificationChannelSchema: () => NotificationChannelSchema,
   NotificationTriggerSchema: () => NotificationTriggerSchema,
   OrgCancellationPolicySchema: () => OrgCancellationPolicySchema,
+  PrivacyEraseSchema: () => PrivacyEraseSchema,
+  PrivacySubjectSchema: () => PrivacySubjectSchema,
   RETRYABLE_REFUND_STATUSES: () => RETRYABLE_REFUND_STATUSES,
   RecurringFrequencySchema: () => RecurringFrequencySchema,
   RefundOutcomePersistenceError: () => RefundOutcomePersistenceError,
+  RouteClientSchema: () => RouteClientSchema,
   SLOT_GRANULARITY_DEFAULT: () => SLOT_GRANULARITY_DEFAULT,
   SLOT_GRANULARITY_OPTIONS: () => SLOT_GRANULARITY_OPTIONS,
   TERMINAL_SUCCESS_STATUSES: () => TERMINAL_SUCCESS_STATUSES,
   TOKEN_TTL_DAYS: () => TOKEN_TTL_DAYS,
+  TestRoutingFormSchema: () => TestRoutingFormSchema,
   UnverifiedPaymentError: () => UnverifiedPaymentError,
   UpdateAppointmentCategorySchema: () => UpdateAppointmentCategorySchema,
   UpdateAppointmentTypeSchema: () => UpdateAppointmentTypeSchema,
@@ -72,6 +78,7 @@ __export(index_exports, {
   UpdateCouponCodeSchema: () => UpdateCouponCodeSchema,
   UpdateNotificationTemplateSchema: () => UpdateNotificationTemplateSchema,
   UpdatePackagePurchaseSchema: () => UpdatePackagePurchaseSchema,
+  UpdateRoutingFormSchema: () => UpdateRoutingFormSchema,
   UpdateServicePackageSchema: () => UpdateServicePackageSchema,
   attemptLegRefund: () => attemptLegRefund,
   createBalanceIntent: () => createBalanceIntent,
@@ -322,8 +329,87 @@ function withWebhooks(inner, host) {
   };
 }
 
+// src/waitlist/announce-offer.ts
+var import_scheduling2 = require("@ordinatio/scheduling");
+async function offerAndAnnounce(host, settings, db, slot) {
+  const offer = await (0, import_scheduling2.tryOfferFreedSlot)(db, { ...slot, offerMinutes: settings.offerMinutes });
+  if (!offer) return false;
+  const details = {
+    organizationId: slot.organizationId,
+    token: offer.token,
+    clientName: offer.entry.clientName,
+    clientEmail: offer.entry.clientEmail,
+    clientPhone: offer.entry.clientPhone,
+    typeName: offer.typeName,
+    calendarName: offer.calendarName,
+    startTime: offer.startTime,
+    timezone: offer.timezone,
+    expiresAt: offer.expiresAt
+  };
+  if (settings.notify) {
+    try {
+      await settings.notify(details);
+    } catch (error) {
+      console.error("[waitlist] the host could not send the offer; it stays open until it expires:", error);
+    }
+  }
+  if (host.webhooks) {
+    try {
+      await (0, import_scheduling2.enqueueWebhookEvent)(db, {
+        organizationId: slot.organizationId,
+        type: "waitlist.offered",
+        // Each offering has its own id, so offering the same slot to the same person again still reaches subscribers.
+        eventId: `waitlist_offer_${offer.entry.id}_${offer.startTime.getTime()}_${offer.expiresAt.getTime()}`,
+        data: {
+          offer: {
+            entryId: offer.entry.id,
+            token: offer.token,
+            clientName: details.clientName,
+            clientEmail: details.clientEmail,
+            clientPhone: details.clientPhone,
+            typeName: details.typeName,
+            calendarName: details.calendarName,
+            calendarId: offer.calendarId,
+            startTime: offer.startTime.toISOString(),
+            expiresAt: offer.expiresAt.toISOString()
+          }
+        }
+      });
+    } catch (error) {
+      console.error("[waitlist] could not queue the waitlist.offered webhook:", error);
+    }
+  }
+  return true;
+}
+
+// src/waitlist/waitlist-events.ts
+var FREED_BY = /* @__PURE__ */ new Set(["appointment.cancelled", "appointment.rejected", "appointment.updated"]);
+function withWaitlist(inner, host) {
+  return {
+    async emit(organizationId, type, data) {
+      const appointmentId = data.appointmentId;
+      if (host.waitlist && FREED_BY.has(type) && typeof appointmentId === "string") {
+        try {
+          const db = await host.tenantDb(organizationId, "waitlist");
+          const appointment = db ? await db.appointment.findUnique({
+            where: { id: appointmentId },
+            select: { calendarId: true, startTime: true, rescheduledFrom: true, status: true, calendar: { select: { organizationId: true } } }
+          }) : null;
+          if (db && appointment && (appointment.calendar.organizationId ?? organizationId) === organizationId) {
+            const freed = type === "appointment.updated" ? appointment.rescheduledFrom : appointment.status === "CANCELLED" ? appointment.startTime : null;
+            if (freed) await offerAndAnnounce(host, host.waitlist, db, { organizationId, calendarId: appointment.calendarId, startTime: freed });
+          }
+        } catch (error) {
+          console.error("[scheduling-api] could not offer a freed slot to the waitlist:", error);
+        }
+      }
+      await inner.emit(organizationId, type, data);
+    }
+  };
+}
+
 // src/handlers/manage-cancel.ts
-var import_scheduling5 = require("@ordinatio/scheduling");
+var import_scheduling6 = require("@ordinatio/scheduling");
 
 // src/client-address.ts
 function forwardedAddress(request) {
@@ -334,7 +420,7 @@ function clientAddress(request) {
 }
 
 // src/error-guards.ts
-var import_scheduling2 = require("@ordinatio/scheduling");
+var import_scheduling3 = require("@ordinatio/scheduling");
 function getErrorCode(error) {
   if (typeof error === "object" && error !== null && "code" in error) {
     const code = error.code;
@@ -361,20 +447,20 @@ function getErrorMessage(error, fallback) {
   return fallback;
 }
 function schedErrorStatus(code) {
-  return import_scheduling2.SCHEDULING_ERRORS[code]?.httpStatus ?? 400;
+  return import_scheduling3.SCHEDULING_ERRORS[code]?.httpStatus ?? 400;
 }
 
 // src/manage/cancel-via-token.ts
-var import_scheduling4 = require("@ordinatio/scheduling");
+var import_scheduling5 = require("@ordinatio/scheduling");
 
 // src/calendar-sync.ts
-var import_scheduling3 = require("@ordinatio/scheduling");
+var import_scheduling4 = require("@ordinatio/scheduling");
 async function runWithoutBlocking(code, appointmentId, step, recordFailure) {
   try {
     await step();
     return { queued: true };
   } catch (error) {
-    const diagnostic = (0, import_scheduling3.schedError)(code, { error, appointmentId });
+    const diagnostic = (0, import_scheduling4.schedError)(code, { error, appointmentId });
     console.error("[calendar-sync]", diagnostic.ref, error instanceof Error ? error.message : error);
     try {
       await recordFailure?.(diagnostic.ref);
@@ -394,7 +480,7 @@ function runCalendarRemoveWithoutBlocking(sync, ref, recordFailure) {
 // src/manage/cancel-via-token.ts
 async function cancelViaToken(host, db, organizationId, appointment) {
   const hasPayment = !!(appointment.paymentId && (appointment.paymentStatus === "PAID" || appointment.paymentStatus === "DEPOSIT_PAID"));
-  await (0, import_scheduling4.cancelAppointment)(db, {
+  await (0, import_scheduling5.cancelAppointment)(db, {
     appointmentId: appointment.id,
     cancelledBy: "client",
     reason: "Cancelled via self-service link"
@@ -405,7 +491,7 @@ async function cancelViaToken(host, db, organizationId, appointment) {
       data: { refundStatus: hasPayment ? "PENDING_REVIEW" : "NO_PAYMENT" }
     });
   } catch (refundStatusError) {
-    const diagnostic = (0, import_scheduling4.schedError)("SCHED_602", {
+    const diagnostic = (0, import_scheduling5.schedError)("SCHED_602", {
       error: refundStatusError,
       appointmentId: appointment.id,
       context: "refundStatus write failed after cancellation already committed",
@@ -450,9 +536,9 @@ async function cancelViaToken(host, db, organizationId, appointment) {
   const baseUrl = host.appUrl();
   if (baseUrl) {
     try {
-      await (0, import_scheduling4.queueStaffNotification)(db, appointment.id, "CANCELLATION", baseUrl);
+      await (0, import_scheduling5.queueStaffNotification)(db, appointment.id, "CANCELLATION", baseUrl, { brand: Boolean(host.brand) });
     } catch (staffError) {
-      const diagnostic = (0, import_scheduling4.schedError)("SCHED_607", { error: staffError, appointmentId: appointment.id });
+      const diagnostic = (0, import_scheduling5.schedError)("SCHED_607", { error: staffError, appointmentId: appointment.id });
       console.error("[DELETE /manage]", diagnostic.ref, staffError instanceof Error ? staffError.message : staffError);
     }
   }
@@ -526,14 +612,14 @@ async function cancelManagedAppointment(request, { host }) {
         { status: 409 }
       );
     }
-    const diagnostic = (0, import_scheduling5.schedError)("SCHED_602", { error, token: token ?? "unknown", appointmentId });
+    const diagnostic = (0, import_scheduling6.schedError)("SCHED_602", { error, token: token ?? "unknown", appointmentId });
     console.error("[DELETE /manage]", diagnostic.ref, error instanceof Error ? error.message : error);
     return Response.json({ error: "Failed to cancel", ref: diagnostic.ref }, { status: 500 });
   }
 }
 
 // src/handlers/manage-get.ts
-var import_scheduling6 = require("@ordinatio/scheduling");
+var import_scheduling7 = require("@ordinatio/scheduling");
 async function getManagedAppointment(request, { host }) {
   let token = null;
   try {
@@ -567,24 +653,24 @@ async function getManagedAppointment(request, { host }) {
       staffName: appointment.calendar.staffName,
       calendarId: appointment.calendarId,
       allowReschedule: appointment.type.allowReschedule,
-      location: (0, import_scheduling6.resolveLocation)(appointment),
+      location: (0, import_scheduling7.resolveLocation)(appointment),
       meetingUrl: appointment.meetingUrl ?? null,
       theme: appointment.calendar.theme ?? null
     });
   } catch (error) {
-    const diagnostic = (0, import_scheduling6.schedError)("SCHED_601", { error, token: token ?? "unknown" });
+    const diagnostic = (0, import_scheduling7.schedError)("SCHED_601", { error, token: token ?? "unknown" });
     console.error("[GET /manage]", diagnostic.ref, error instanceof Error ? error.message : error);
     return Response.json({ error: "Failed to fetch appointment", ref: diagnostic.ref }, { status: 500 });
   }
 }
 
 // src/handlers/manage-reschedule.ts
-var import_scheduling8 = require("@ordinatio/scheduling");
+var import_scheduling9 = require("@ordinatio/scheduling");
 
 // src/manage/reschedule-via-token.ts
-var import_scheduling7 = require("@ordinatio/scheduling");
+var import_scheduling8 = require("@ordinatio/scheduling");
 async function rescheduleViaToken(host, db, organizationId, appointment, newTime) {
-  const result = await (0, import_scheduling7.rescheduleAppointment)(db, {
+  const result = await (0, import_scheduling8.rescheduleAppointment)(db, {
     appointmentId: appointment.id,
     newStartTime: newTime,
     reason: "Rescheduled via self-service link"
@@ -609,21 +695,21 @@ async function rescheduleViaToken(host, db, organizationId, appointment, newTime
   );
   const baseUrl = host.appUrl() ?? void 0;
   if (baseUrl) {
-    await (0, import_scheduling7.queueImmediateNotification)(db, appointment.id, "RESCHEDULE", baseUrl);
+    await (0, import_scheduling8.queueImmediateNotification)(db, appointment.id, "RESCHEDULE", baseUrl, { brand: Boolean(host.brand) });
   } else {
     console.warn("[manage] no appUrl \u2014 RESCHEDULE notification skipped");
   }
   try {
-    await (0, import_scheduling7.scheduleNotifications)(db, appointment.id, baseUrl, { excludeTriggers: ["CONFIRMATION"] });
+    await (0, import_scheduling8.scheduleNotifications)(db, appointment.id, baseUrl, { excludeTriggers: ["CONFIRMATION"], brand: Boolean(host.brand) });
   } catch (error) {
-    const diagnostic = (0, import_scheduling7.schedError)("SCHED_604", { error, appointmentId: appointment.id });
+    const diagnostic = (0, import_scheduling8.schedError)("SCHED_604", { error, appointmentId: appointment.id });
     console.error("[PATCH /manage] scheduleNotifications failed (non-blocking):", diagnostic.ref, error instanceof Error ? error.message : error);
   }
   if (baseUrl) {
     try {
-      await (0, import_scheduling7.queueStaffNotification)(db, appointment.id, "RESCHEDULE", baseUrl);
+      await (0, import_scheduling8.queueStaffNotification)(db, appointment.id, "RESCHEDULE", baseUrl, { brand: Boolean(host.brand) });
     } catch (staffError) {
-      const diagnostic = (0, import_scheduling7.schedError)("SCHED_607", { error: staffError, appointmentId: appointment.id });
+      const diagnostic = (0, import_scheduling8.schedError)("SCHED_607", { error: staffError, appointmentId: appointment.id });
       console.error("[PATCH /manage]", diagnostic.ref, staffError instanceof Error ? staffError.message : staffError);
     }
   }
@@ -682,7 +768,7 @@ async function rescheduleManagedAppointment(request, { host }) {
     if (target instanceof Response) return target;
     return await rescheduleViaToken(host, target.db, target.organizationId, appointment, newTime);
   } catch (error) {
-    if (error instanceof import_scheduling8.SchedulingValidationError) {
+    if (error instanceof import_scheduling9.SchedulingValidationError) {
       return Response.json({ error: error.message, ref: error.ref }, { status: 400 });
     }
     const code = getErrorCode(error);
@@ -701,14 +787,14 @@ async function rescheduleManagedAppointment(request, { host }) {
       console.error("[PATCH /manage]", ref, "SCHED_306", error);
       return Response.json({ error: "Appointment status prevents rescheduling", ...ref && { ref } }, { status: 400 });
     }
-    const diagnostic = (0, import_scheduling8.schedError)("SCHED_603", { error, token: token ?? "unknown", appointmentId });
+    const diagnostic = (0, import_scheduling9.schedError)("SCHED_603", { error, token: token ?? "unknown", appointmentId });
     console.error("[PATCH /manage]", diagnostic.ref, error instanceof Error ? error.message : error);
     return Response.json({ error: "Failed to reschedule", ref: diagnostic.ref }, { status: 500 });
   }
 }
 
 // src/handlers/capacity.ts
-var import_scheduling9 = require("@ordinatio/scheduling");
+var import_scheduling10 = require("@ordinatio/scheduling");
 
 // src/respond.ts
 var WIDGET_CACHE_HEADERS = {
@@ -755,7 +841,7 @@ async function getCapacity(request, { host }) {
       select: { isGroup: true }
     });
     if (!type || !type.isGroup) return corsJson(cors, NOT_FOUND, { status: 404 });
-    return corsJson(cors, await (0, import_scheduling9.getGroupCapacity)(db, { typeId, calendarId, startTime }));
+    return corsJson(cors, await (0, import_scheduling10.getGroupCapacity)(db, { typeId, calendarId, startTime }));
   } catch (error) {
     console.error("[group-capacity] unexpected error:", error instanceof Error ? error.message : error);
     return corsJson(cors, { error: "Failed to fetch capacity" }, { status: 500 });
@@ -763,7 +849,7 @@ async function getCapacity(request, { host }) {
 }
 
 // src/handlers/payment-intent.ts
-var import_scheduling10 = require("@ordinatio/scheduling");
+var import_scheduling11 = require("@ordinatio/scheduling");
 var import_zod = require("zod");
 
 // src/payments/create-payment-intent.ts
@@ -879,7 +965,7 @@ async function createPaymentIntentRoute(request, { host }) {
     if (!result.ok) return corsJson(cors, { error: result.error }, { status: result.status });
     return corsJson(cors, result.body, { status: result.status });
   } catch (error) {
-    const err = (0, import_scheduling10.schedError)("SCHED_407", {
+    const err = (0, import_scheduling11.schedError)("SCHED_407", {
       typeId,
       calendarId,
       error: error instanceof Error ? error.message : String(error)
@@ -890,7 +976,7 @@ async function createPaymentIntentRoute(request, { host }) {
 }
 
 // src/handlers/appointment-cancel.ts
-var import_scheduling12 = require("@ordinatio/scheduling");
+var import_scheduling13 = require("@ordinatio/scheduling");
 
 // src/appointments/owned-appointment.ts
 async function verifyAppointmentOwnership(db, appointmentId, organizationId) {
@@ -943,7 +1029,7 @@ async function writeRefundStatusAfterCancel(host, db, input) {
 }
 
 // src/staff/require-staff.ts
-var import_scheduling11 = require("@ordinatio/scheduling");
+var import_scheduling12 = require("@ordinatio/scheduling");
 async function requireAdminStaff(host, request, options) {
   const staff = await host.staff.resolve(request);
   if (!staff) return Response.json({ error: "Unauthorized" }, { status: 401 });
@@ -952,7 +1038,7 @@ async function requireAdminStaff(host, request, options) {
     if (limited) return limited;
   }
   if (!staff.isAdmin && !options.allowAnyRole) {
-    const err = (0, import_scheduling11.schedError)("SCHED_900", { userId: staff.userId, role: staff.role });
+    const err = (0, import_scheduling12.schedError)("SCHED_900", { userId: staff.userId, role: staff.role });
     return Response.json({ error: "Forbidden", ref: err.ref }, { status: 403 });
   }
   if (!staff.schedulingEnabled && !options.ignoreSchedulingSwitch) {
@@ -988,7 +1074,7 @@ async function cancelByStaff(request, { host, params }) {
     const appointment = await verifyAppointmentOwnership(db, id, organizationId);
     if (!appointment) return Response.json({ error: "Appointment not found" }, { status: 404 });
     const hasPayment = hasPendingPayment(appointment.paymentId, appointment.paymentStatus);
-    const result = await (0, import_scheduling12.cancelAppointment)(db, { appointmentId: id, cancelledBy: "staff", reason });
+    const result = await (0, import_scheduling13.cancelAppointment)(db, { appointmentId: id, cancelledBy: "staff", reason });
     await writeRefundStatusAfterCancel(host, db, { appointmentId: id, hasPayment, clientName: appointment.clientName });
     if (hasPayment) {
       await host.activity.log(db, {
@@ -1008,7 +1094,7 @@ async function cancelByStaff(request, { host, params }) {
     const baseUrl = host.appUrl();
     if (baseUrl) {
       try {
-        await (0, import_scheduling12.queueStaffNotification)(db, id, "CANCELLATION", baseUrl);
+        await (0, import_scheduling13.queueStaffNotification)(db, id, "CANCELLATION", baseUrl, { brand: Boolean(host.brand) });
       } catch (error) {
         await host.activity.log(db, {
           action: "scheduling.staff_notification_failed",
@@ -1035,7 +1121,7 @@ async function cancelByStaff(request, { host, params }) {
     });
     return Response.json(result);
   } catch (error) {
-    if (error instanceof import_scheduling12.SchedulingNotFoundError) {
+    if (error instanceof import_scheduling13.SchedulingNotFoundError) {
       return Response.json({ error: error.message, ref: error.ref }, { status: 404 });
     }
     const ref = getErrorRef(error);
@@ -1240,7 +1326,7 @@ function finishOutlookConnection(request, { host }) {
 }
 
 // src/handlers/appointment-cancel-sync.ts
-var import_scheduling13 = require("@ordinatio/scheduling");
+var import_scheduling14 = require("@ordinatio/scheduling");
 var import_zod2 = require("zod");
 var Schema2 = import_zod2.z.object({
   source: import_zod2.z.enum(["google", "outlook"]),
@@ -1283,13 +1369,13 @@ async function cancelFromCalendarSync(request, { host, params }) {
     return Response.json({ error: "Appointment not available for sync" }, { status: 503 });
   }
   try {
-    await (0, import_scheduling13.cancelAppointment)(db, {
+    await (0, import_scheduling14.cancelAppointment)(db, {
       appointmentId: id,
       cancelledBy: "system",
       reason: reason ?? `Cancelled via ${source === "google" ? "Google" : "Outlook"} Calendar`
     });
   } catch (error) {
-    if (error instanceof import_scheduling13.SchedulingNotFoundError) {
+    if (error instanceof import_scheduling14.SchedulingNotFoundError) {
       return Response.json({ error: "Appointment not found", ref: error.ref }, { status: 404 });
     }
     const ref = getErrorRef(error);
@@ -1323,7 +1409,7 @@ async function cancelFromCalendarSync(request, { host, params }) {
   await host.workerCommands.queue(source === "google" ? "delete-from-outlook" : "delete-from-google", { appointmentId: id });
   const baseUrl = host.appUrl();
   if (baseUrl) {
-    await (0, import_scheduling13.queueImmediateNotification)(db, id, "CANCELLATION", baseUrl).catch(
+    await (0, import_scheduling14.queueImmediateNotification)(db, id, "CANCELLATION", baseUrl, { brand: Boolean(host.brand) }).catch(
       (err) => console.warn("[cancel-sync] Failed to queue cancellation notification:", id, err instanceof Error ? err.message : err)
     );
   }
@@ -1336,10 +1422,10 @@ async function cancelFromCalendarSync(request, { host, params }) {
 }
 
 // src/handlers/appointment-approve.ts
-var import_scheduling14 = require("@ordinatio/scheduling");
+var import_scheduling15 = require("@ordinatio/scheduling");
 async function rejectAppointment(host, db, organizationId, appointment, reason) {
   const { id } = appointment;
-  const result = await (0, import_scheduling14.cancelAppointment)(db, {
+  const result = await (0, import_scheduling15.cancelAppointment)(db, {
     appointmentId: id,
     cancelledBy: "staff",
     reason: reason || "Appointment request rejected"
@@ -1421,10 +1507,10 @@ async function approveOrReject(request, { host, params }) {
     if (confirmed.count === 0) {
       return Response.json({ error: "Appointment was already processed by a concurrent request" }, { status: 409 });
     }
-    await (0, import_scheduling14.cancelPendingNotifications)(db, id);
+    await (0, import_scheduling15.cancelPendingNotifications)(db, id);
     const baseUrl = host.appUrl();
     if (!baseUrl) throw new Error("NEXT_PUBLIC_APP_URL is required");
-    await (0, import_scheduling14.scheduleNotifications)(db, id, baseUrl);
+    await (0, import_scheduling15.scheduleNotifications)(db, id, baseUrl, { brand: Boolean(host.brand) });
     await host.availabilityCache.invalidate(appointment.calendarId);
     await host.events.emit(organizationId, "appointment.confirmed", { appointmentId: id });
     await host.activity.log(db, {
@@ -1432,7 +1518,7 @@ async function approveOrReject(request, { host, params }) {
       description: `approved ${appointment.clientName}'s appointment`,
       metadata: { appointmentId: id, clientName: appointment.clientName }
     });
-    const confirmedAppointment = await (0, import_scheduling14.getAppointment)(db, id);
+    const confirmedAppointment = await (0, import_scheduling15.getAppointment)(db, id);
     return Response.json({ success: true, status: "CONFIRMED", appointment: confirmedAppointment });
   } catch (error) {
     if (getErrorCode(error) === "SCHED_306") {
@@ -1445,7 +1531,7 @@ async function approveOrReject(request, { host, params }) {
 }
 
 // src/handlers/appointment-reschedule.ts
-var import_scheduling15 = require("@ordinatio/scheduling");
+var import_scheduling16 = require("@ordinatio/scheduling");
 var RESCHEDULE_BLOCKER_CODES = ["SCHED_301", "SCHED_307", "SCHED_309", "SCHED_802"];
 async function rescheduleByStaff(request, { host, params }) {
   try {
@@ -1473,21 +1559,21 @@ async function rescheduleByStaff(request, { host, params }) {
     if (newTime < /* @__PURE__ */ new Date()) {
       return Response.json({ error: "Cannot reschedule to a past time" }, { status: 400 });
     }
-    const result = await (0, import_scheduling15.rescheduleAppointment)(db, {
+    const result = await (0, import_scheduling16.rescheduleAppointment)(db, {
       appointmentId: id,
       newStartTime: newTime,
       reason: "Rescheduled via calendar drag"
     });
     const baseUrl = host.appUrl();
     if (!baseUrl) throw new Error("NEXT_PUBLIC_APP_URL is required");
-    await (0, import_scheduling15.queueImmediateNotification)(db, id, "RESCHEDULE", baseUrl);
+    await (0, import_scheduling16.queueImmediateNotification)(db, id, "RESCHEDULE", baseUrl, { brand: Boolean(host.brand) });
     try {
-      await (0, import_scheduling15.scheduleNotifications)(db, id, baseUrl, { excludeTriggers: ["CONFIRMATION"] });
+      await (0, import_scheduling16.scheduleNotifications)(db, id, baseUrl, { excludeTriggers: ["CONFIRMATION"], brand: Boolean(host.brand) });
     } catch (error) {
       console.warn("[reschedule] scheduleNotifications failed:", error instanceof Error ? error.message : error);
     }
     try {
-      await (0, import_scheduling15.queueStaffNotification)(db, id, "RESCHEDULE", baseUrl);
+      await (0, import_scheduling16.queueStaffNotification)(db, id, "RESCHEDULE", baseUrl, { brand: Boolean(host.brand) });
     } catch (error) {
       await host.activity.log(db, {
         action: "scheduling.staff_notification_failed",
@@ -1525,8 +1611,8 @@ async function rescheduleByStaff(request, { host, params }) {
     });
     return Response.json(result);
   } catch (error) {
-    if (error instanceof import_scheduling15.SchedulingValidationError) return Response.json({ error: error.message }, { status: 400 });
-    if (error instanceof import_scheduling15.SchedulingNotFoundError) return Response.json({ error: error.message }, { status: 404 });
+    if (error instanceof import_scheduling16.SchedulingValidationError) return Response.json({ error: error.message }, { status: 400 });
+    if (error instanceof import_scheduling16.SchedulingNotFoundError) return Response.json({ error: error.message }, { status: 404 });
     const errorCode = getErrorCode(error) ?? "";
     const status = errorCode === "SCHED_306" ? 400 : RESCHEDULE_BLOCKER_CODES.includes(errorCode) ? 409 : 500;
     return Response.json({ error: getErrorMessage(error, "Failed to reschedule") }, { status });
@@ -1534,7 +1620,7 @@ async function rescheduleByStaff(request, { host, params }) {
 }
 
 // src/handlers/appointment-reassign.ts
-var import_scheduling16 = require("@ordinatio/scheduling");
+var import_scheduling17 = require("@ordinatio/scheduling");
 var import_zod3 = require("zod");
 var REASSIGNABLE_STATUSES = ["PENDING", "CONFIRMED"];
 var REASSIGN_MAX_ATTEMPTS = 2;
@@ -1585,7 +1671,7 @@ async function reassignAppointment(request, { host, params }) {
       if (!current || !REASSIGNABLE_STATUSES.includes(current.status)) {
         return { outcome: "statusChanged", currentStatus: current?.status ?? "unknown" };
       }
-      const available = await (0, import_scheduling16.isSlotAvailable)(txDb, calendarId, current.startTime, current.duration, id);
+      const available = await (0, import_scheduling17.isSlotAvailable)(txDb, calendarId, current.startTime, current.duration, id);
       if (!available) return { outcome: "conflict" };
       const updated2 = await tx.appointment.update({
         where: { id, status: { in: [...REASSIGNABLE_STATUSES] } },
@@ -1611,14 +1697,14 @@ async function reassignAppointment(request, { host, params }) {
     };
     const result = await attemptReassign();
     if (result.outcome === "statusChanged") {
-      const diagnostic = (0, import_scheduling16.schedError)("SCHED_309", { appointmentId: id, calendarId, currentStatus: result.currentStatus });
+      const diagnostic = (0, import_scheduling17.schedError)("SCHED_309", { appointmentId: id, calendarId, currentStatus: result.currentStatus });
       return Response.json(
         { error: "Appointment status changed before the reassignment could commit", ref: diagnostic.ref },
         { status: 409 }
       );
     }
     if (result.outcome === "conflict") {
-      const diagnostic = (0, import_scheduling16.schedError)("SCHED_301", { appointmentId: id, calendarId });
+      const diagnostic = (0, import_scheduling17.schedError)("SCHED_301", { appointmentId: id, calendarId });
       return Response.json(
         { error: "Target calendar is not available at this appointment's time", ref: diagnostic.ref },
         { status: 409 }
@@ -1781,7 +1867,7 @@ async function listNotifications(request, { host, params }) {
 }
 
 // src/handlers/appointment-no-show.ts
-var import_scheduling17 = require("@ordinatio/scheduling");
+var import_scheduling18 = require("@ordinatio/scheduling");
 async function markAppointmentNoShow(request, { host, params }) {
   try {
     const staff = await requireAdminStaff(host, request, {
@@ -1798,7 +1884,7 @@ async function markAppointmentNoShow(request, { host, params }) {
     }
     const appointment = await verifyAppointmentOwnership(db, id, organizationId);
     if (!appointment) return Response.json({ error: "Appointment not found" }, { status: 404 });
-    const result = await (0, import_scheduling17.markNoShow)(db, { appointmentId: id });
+    const result = await (0, import_scheduling18.markNoShow)(db, { appointmentId: id });
     await host.events.emit(organizationId, "appointment.no_show", { appointmentId: id });
     await host.activity.log(db, {
       action: "scheduling.appointment_no_show",
@@ -1807,7 +1893,7 @@ async function markAppointmentNoShow(request, { host, params }) {
     });
     return Response.json(result);
   } catch (error) {
-    if (error instanceof import_scheduling17.SchedulingNotFoundError) {
+    if (error instanceof import_scheduling18.SchedulingNotFoundError) {
       return Response.json({ error: error.message, ref: error.ref }, { status: 404 });
     }
     const ref = getErrorRef(error);
@@ -1817,7 +1903,7 @@ async function markAppointmentNoShow(request, { host, params }) {
 }
 
 // src/handlers/appointment-collect-balance.ts
-var import_scheduling20 = require("@ordinatio/scheduling");
+var import_scheduling21 = require("@ordinatio/scheduling");
 
 // src/payments/balance/eligibility.ts
 var BALANCE_BLOCKED_APPOINTMENT_STATUS = "CANCELLED";
@@ -1913,7 +1999,7 @@ function resolveBalanceEligibility(appointment, organizationId) {
 }
 
 // src/payments/balance/record-intent.ts
-var import_scheduling18 = require("@ordinatio/scheduling");
+var import_scheduling19 = require("@ordinatio/scheduling");
 var BALANCE_OUTCOME_TRACE = {
   cancelled: {
     action: "scheduling.balance_intent_cancelled",
@@ -1956,7 +2042,7 @@ async function recordBalanceIntent(db, payments, target) {
       data: { balancePaymentId: intentId }
     });
   } catch (writeError) {
-    const diagnostic = (0, import_scheduling18.schedError)("SCHED_605", {
+    const diagnostic = (0, import_scheduling19.schedError)("SCHED_605", {
       error: writeError,
       appointmentId,
       paymentIntentId: intentId,
@@ -1978,7 +2064,7 @@ async function recordBalanceIntent(db, payments, target) {
       select: { balancePaymentId: true, status: true, refundStatus: true, paymentStatus: true }
     });
   } catch (rereadError) {
-    const diagnostic = (0, import_scheduling18.schedError)("SCHED_605", {
+    const diagnostic = (0, import_scheduling19.schedError)("SCHED_605", {
       error: rereadError,
       appointmentId,
       paymentIntentId: intentId,
@@ -1995,7 +2081,7 @@ async function recordBalanceIntent(db, payments, target) {
   const stillEligible = current !== null && !isBalanceBlockedByStatus(current.status) && !hasBalanceRefundStarted(current.refundStatus);
   if (current?.balancePaymentId === intentId) {
     if (stillEligible) return { ok: true };
-    const diagnostic = (0, import_scheduling18.schedError)("SCHED_605", {
+    const diagnostic = (0, import_scheduling19.schedError)("SCHED_605", {
       appointmentId,
       paymentIntentId: intentId,
       status: current.status,
@@ -2037,7 +2123,7 @@ async function recordBalanceIntent(db, payments, target) {
       outcome = "cancel-failed";
     }
     if (outcome !== cancelledOutcome) {
-      const diagnostic = (0, import_scheduling18.schedError)("SCHED_605", {
+      const diagnostic = (0, import_scheduling19.schedError)("SCHED_605", {
         error: cancelError,
         appointmentId,
         paymentIntentId: intentId,
@@ -2085,7 +2171,7 @@ async function recordBalanceIntent(db, payments, target) {
 }
 
 // src/payments/balance/create-intent.ts
-var import_scheduling19 = require("@ordinatio/scheduling");
+var import_scheduling20 = require("@ordinatio/scheduling");
 
 // src/payments/unverified-payment-error.ts
 var UnverifiedPaymentError = class extends Error {
@@ -2131,7 +2217,7 @@ async function createBalanceIntent(payments, input, appointmentId) {
       });
     } catch (error) {
       if (error instanceof UnverifiedPaymentError) {
-        const diagnostic2 = (0, import_scheduling19.schedError)("SCHED_605", {
+        const diagnostic2 = (0, import_scheduling20.schedError)("SCHED_605", {
           error,
           appointmentId,
           paymentIntentId: error.paymentId,
@@ -2151,7 +2237,7 @@ async function createBalanceIntent(payments, input, appointmentId) {
       return { paymentId: result.paymentId, clientSecret: result.clientSecret ?? null };
     }
     if (result.code === "IN_PROGRESS") {
-      const diagnostic2 = (0, import_scheduling19.schedError)("SCHED_605", {
+      const diagnostic2 = (0, import_scheduling20.schedError)("SCHED_605", {
         error: result.error,
         appointmentId,
         key,
@@ -2161,7 +2247,7 @@ async function createBalanceIntent(payments, input, appointmentId) {
       throw new BalanceRequestInProgressError(diagnostic2.ref);
     }
     if (result.code === "KEY_REUSED") {
-      const diagnostic2 = (0, import_scheduling19.schedError)("SCHED_605", {
+      const diagnostic2 = (0, import_scheduling20.schedError)("SCHED_605", {
         error: result.error,
         appointmentId,
         abandonedKey: key,
@@ -2177,7 +2263,7 @@ async function createBalanceIntent(payments, input, appointmentId) {
     if (result.code === "CANCELED") continue;
     throw new Error(result.error ?? "The payment provider did not create the balance payment");
   }
-  const diagnostic = (0, import_scheduling19.schedError)("SCHED_605", {
+  const diagnostic = (0, import_scheduling20.schedError)("SCHED_605", {
     appointmentId,
     phase: "balance-key-generations-exhausted",
     generations: MAX_KEY_GENERATIONS2
@@ -2269,7 +2355,7 @@ async function collectAppointmentBalance(request, { host, params }) {
     if (error instanceof BalanceRequestInProgressError || error instanceof BalanceIntentGenerationsExhaustedError) {
       return Response.json({ error: error.message, ref: error.ref }, { status: 409 });
     }
-    const diagnostic = (0, import_scheduling20.schedError)("SCHED_605", { error, appointmentId });
+    const diagnostic = (0, import_scheduling21.schedError)("SCHED_605", { error, appointmentId });
     console.error("[POST /collect-balance]", diagnostic.ref, error instanceof Error ? error.message : error);
     return Response.json({ error: "Failed to create balance payment", ref: diagnostic.ref }, { status: 500 });
   }
@@ -2279,7 +2365,7 @@ async function collectAppointmentBalance(request, { host, params }) {
 var import_zod6 = require("zod");
 
 // src/payments/refund/refund-status.ts
-var import_scheduling21 = require("@ordinatio/scheduling");
+var import_scheduling22 = require("@ordinatio/scheduling");
 var REFUND_STATUS_BUCKET = {
   PENDING_REVIEW: "retryable",
   REFUND_FAILED: "retryable",
@@ -2301,7 +2387,7 @@ var CREDIT_REFUSED_NEXT_STEP = "Retry the refund to resolve the remaining balanc
 var CREDIT_REFUSED_NO_AMOUNT_NEXT_STEP = "Check the refunded amount in Stripe, then retry the refund or resolve this manually before issuing a credit.";
 function checkCreditGuard(action, refundAmount, refundStatus) {
   if (refundStatus == null) {
-    const diagnostic = (0, import_scheduling21.schedError)("SCHED_610", {
+    const diagnostic = (0, import_scheduling22.schedError)("SCHED_610", {
       action,
       refundAmount,
       error: "checkCreditGuard was called without a refundStatus"
@@ -2347,10 +2433,10 @@ function checkCreditGuard(action, refundAmount, refundStatus) {
 }
 
 // src/money.ts
-var import_scheduling22 = require("@ordinatio/scheduling");
+var import_scheduling23 = require("@ordinatio/scheduling");
 function decimalToCents(value, field = "unknown") {
   if (value === null || value === void 0) {
-    throw new import_scheduling22.SchedulingValidationError(
+    throw new import_scheduling23.SchedulingValidationError(
       `Could not convert ${field} to cents \u2014 value is ${value}`,
       "SCHED_406",
       { field, value }
@@ -2358,7 +2444,7 @@ function decimalToCents(value, field = "unknown") {
   }
   const cents = Math.round(Number(value) * 100);
   if (!Number.isFinite(cents)) {
-    throw new import_scheduling22.SchedulingValidationError(
+    throw new import_scheduling23.SchedulingValidationError(
       `Could not convert ${field} to cents \u2014 value is not numeric`,
       "SCHED_406",
       { field, value }
@@ -2369,7 +2455,7 @@ function decimalToCents(value, field = "unknown") {
 
 // src/payments/refund/refund-leg.ts
 var import_node_crypto2 = require("crypto");
-var import_scheduling23 = require("@ordinatio/scheduling");
+var import_scheduling24 = require("@ordinatio/scheduling");
 async function attemptLegRefund(payments, paymentIntentId, idempotencyKeySuffix, appointmentId, errorCode, logLabel) {
   const baseKey = `refund:${appointmentId}:${idempotencyKeySuffix}`;
   let idempotencyKey = baseKey;
@@ -2402,7 +2488,7 @@ async function attemptLegRefund(payments, paymentIntentId, idempotencyKeySuffix,
       return { succeeded: true, amountCents: null };
     }
     if (result.code === "IN_PROGRESS") {
-      const inFlight = (0, import_scheduling23.schedError)(errorCode, { error: result.error, appointmentId, paymentIntentId, kind: "idempotency_key_in_use" });
+      const inFlight = (0, import_scheduling24.schedError)(errorCode, { error: result.error, appointmentId, paymentIntentId, kind: "idempotency_key_in_use" });
       console.warn(
         `[resolve-refund] ${logLabel} leg is already being refunded by another in-flight request (idempotency key in use) \u2014 its outcome is unknown, so this leg is recorded as retryable:`,
         inFlight.ref,
@@ -2428,7 +2514,7 @@ async function attemptLegRefund(payments, paymentIntentId, idempotencyKeySuffix,
   }
 }
 function failedLeg(errorCode, logLabel, appointmentId, paymentIntentId, idempotencyKey, retriedAfterReplay, failure3) {
-  const diagnostic = (0, import_scheduling23.schedError)(errorCode, { error: failure3.error, appointmentId, paymentIntentId });
+  const diagnostic = (0, import_scheduling24.schedError)(errorCode, { error: failure3.error, appointmentId, paymentIntentId });
   console.error(
     `[resolve-refund] ${logLabel} refund failed${retriedAfterReplay ? " (after a fresh-key re-attempt)" : ""} \u2014 manual refund may be required:`,
     diagnostic.ref,
@@ -2442,7 +2528,7 @@ function failedLeg(errorCode, logLabel, appointmentId, paymentIntentId, idempote
 }
 
 // src/payments/refund/persist-refund-outcome.ts
-var import_scheduling24 = require("@ordinatio/scheduling");
+var import_scheduling25 = require("@ordinatio/scheduling");
 var WEBHOOK_RACE_OUTCOMES = ["REFUNDED", "PARTIAL_REFUND"];
 var SUCCESS_RANK = {
   REFUND_FAILED: 0,
@@ -2487,7 +2573,7 @@ async function persistRefundOutcome(db, id, refundOutcome, refundAmount, legs) {
     });
   } catch (writeErr) {
     const dbMessage = writeErr instanceof Error ? writeErr.message : String(writeErr);
-    const diagnostic = (0, import_scheduling24.schedError)("SCHED_610", {
+    const diagnostic = (0, import_scheduling25.schedError)("SCHED_610", {
       error: writeErr,
       dbMessage,
       appointmentId: id,
@@ -2511,7 +2597,7 @@ async function persistRefundOutcome(db, id, refundOutcome, refundAmount, legs) {
   }
   if (writeResult.count === 0) {
     const buildLostRaceError = () => {
-      const diagnostic = (0, import_scheduling24.schedError)("SCHED_610", {
+      const diagnostic = (0, import_scheduling25.schedError)("SCHED_610", {
         appointmentId: id,
         phase: "persist-cas-lost-race",
         refundOutcome,
@@ -2550,7 +2636,7 @@ async function persistRefundOutcome(db, id, refundOutcome, refundAmount, legs) {
     if (reconcileResult.count === 0) {
       throw buildLostRaceError();
     }
-    const reconcileDiagnostic = (0, import_scheduling24.schedError)("SCHED_610", {
+    const reconcileDiagnostic = (0, import_scheduling25.schedError)("SCHED_610", {
       appointmentId: id,
       phase: "persist-cas-reconciled",
       refundOutcome,
@@ -2649,7 +2735,7 @@ async function executeRefundLegs(db, id, preClaimSnapshot, payments) {
 }
 
 // src/payments/refund/refund-housekeeping.ts
-var import_scheduling25 = require("@ordinatio/scheduling");
+var import_scheduling26 = require("@ordinatio/scheduling");
 async function runHousekeeping(db, activity, appointment, id, action, newRefundStatus, userId) {
   const isTerminalSuccess = TERMINAL_SUCCESS_STATUSES.includes(newRefundStatus);
   try {
@@ -2665,7 +2751,7 @@ async function runHousekeeping(db, activity, appointment, id, action, newRefundS
     });
     return void 0;
   } catch (err) {
-    const diagnostic = (0, import_scheduling25.schedError)("SCHED_606", { error: err, appointmentId: id, phase: "housekeeping" });
+    const diagnostic = (0, import_scheduling26.schedError)("SCHED_606", { error: err, appointmentId: id, phase: "housekeeping" });
     console.error(
       isTerminalSuccess ? "[resolve-refund] Sticky-activity resolution or audit log failed after a successful refund/credit:" : "[resolve-refund] Sticky-activity resolution or audit log failed after a non-terminal refund outcome (REFUND_FAILED/PARTIAL_REFUND):",
       diagnostic.ref,
@@ -2750,9 +2836,9 @@ async function evaluatePreClaimState(input) {
 }
 
 // src/payments/refund/refund-failure-response.ts
-var import_scheduling26 = require("@ordinatio/scheduling");
+var import_scheduling27 = require("@ordinatio/scheduling");
 function refundFailureResponse({ error, id, stripeMayHaveMoved }) {
-  const diagnostic = (0, import_scheduling26.schedError)("SCHED_610", { error, appointmentId: id, stripeMayHaveMoved });
+  const diagnostic = (0, import_scheduling27.schedError)("SCHED_610", { error, appointmentId: id, stripeMayHaveMoved });
   console.error("[POST /resolve-refund]", diagnostic.ref, error instanceof Error ? error.message : error);
   if (!stripeMayHaveMoved) {
     return Response.json({ error: "Failed to resolve refund", ref: diagnostic.ref }, { status: 500 });
@@ -3229,6 +3315,57 @@ var CreateWebhookEndpointSchema = import_zod11.z.object({
   description: optionalString(200, "Description")
 });
 
+// src/schemas/routing.schema.ts
+var import_zod12 = require("zod");
+var bounded = {
+  name: import_zod12.z.string().max(200),
+  slug: import_zod12.z.string().max(100),
+  description: import_zod12.z.string().max(1e3).nullable().optional(),
+  isActive: import_zod12.z.boolean().optional(),
+  questions: import_zod12.z.array(import_zod12.z.unknown()).max(30),
+  rules: import_zod12.z.array(import_zod12.z.unknown()).max(60),
+  fallback: import_zod12.z.unknown()
+};
+var CreateRoutingFormSchema = import_zod12.z.object({
+  ...bounded,
+  fallback: import_zod12.z.record(import_zod12.z.string(), import_zod12.z.unknown())
+});
+var UpdateRoutingFormSchema = import_zod12.z.object({ ...bounded, fallback: import_zod12.z.record(import_zod12.z.string(), import_zod12.z.unknown()) }).partial().refine((value) => Object.keys(value).length > 0, { message: "Send at least one field to change" });
+var RouteClientSchema = import_zod12.z.object({
+  slug: import_zod12.z.string().min(1).max(100),
+  orgSlug: import_zod12.z.string().min(1).max(100).optional(),
+  answers: import_zod12.z.record(import_zod12.z.string(), import_zod12.z.unknown())
+});
+var TestRoutingFormSchema = import_zod12.z.object({ answers: import_zod12.z.record(import_zod12.z.string(), import_zod12.z.unknown()) });
+
+// src/schemas/privacy.schema.ts
+var import_zod13 = require("zod");
+var subject = {
+  email: import_zod13.z.string().max(320).optional(),
+  clientId: import_zod13.z.string().max(200).optional()
+};
+var namesSomeone = (value) => Boolean(value.email?.trim() || value.clientId?.trim());
+var namesSomeoneMessage = { message: "Send an email address, a client id, or both" };
+var PrivacySubjectSchema = import_zod13.z.object(subject).strict().refine(namesSomeone, namesSomeoneMessage);
+var PrivacyEraseSchema = import_zod13.z.object({ ...subject, confirm: import_zod13.z.boolean().optional() }).strict().refine(namesSomeone, namesSomeoneMessage);
+
+// src/schemas/brand.schema.ts
+var import_zod14 = require("zod");
+var optionalText = (max) => import_zod14.z.string().max(max).nullable().optional();
+var BrandSchema = import_zod14.z.object({
+  displayName: import_zod14.z.string().max(200),
+  logoUrl: optionalText(1e3),
+  primaryColor: optionalText(20),
+  accentColor: optionalText(20),
+  backgroundColor: optionalText(20),
+  textColor: optionalText(20),
+  fontFamily: optionalText(200),
+  footerText: optionalText(1e3),
+  replyToEmail: optionalText(400),
+  fromName: optionalText(200),
+  fromEmail: optionalText(400)
+}).strict();
+
 // src/pagination.ts
 var DEFAULT_LIMIT = 50;
 var MAX_LIMIT = 200;
@@ -3250,12 +3387,12 @@ function parsePagination(request, maxLimit = MAX_LIMIT, defaultLimit = DEFAULT_L
 }
 
 // src/validation.ts
-var import_zod12 = require("zod");
+var import_zod15 = require("zod");
 async function parseBody(request, schema) {
   try {
     return { success: true, data: schema.parse(await request.json()) };
   } catch (error) {
-    if (error instanceof import_zod12.ZodError) {
+    if (error instanceof import_zod15.ZodError) {
       const details = error.issues.map((issue) => ({ field: issue.path.join("."), message: issue.message }));
       return { success: false, response: Response.json({ error: "Validation failed", details }, { status: 400 }) };
     }
@@ -3269,7 +3406,7 @@ function validateData(data, schema) {
   try {
     return { success: true, data: schema.parse(data) };
   } catch (error) {
-    if (error instanceof import_zod12.ZodError) {
+    if (error instanceof import_zod15.ZodError) {
       return { success: false, errors: error.issues.map((issue) => ({ field: issue.path.join("."), message: issue.message })) };
     }
     return { success: false, errors: [{ field: "", message: "Validation failed" }] };
@@ -3739,7 +3876,7 @@ async function updatePackagePurchase(request, { host, params }) {
 }
 
 // src/handlers/admin-group-sessions.ts
-var import_scheduling27 = require("@ordinatio/scheduling");
+var import_scheduling28 = require("@ordinatio/scheduling");
 var MAX_RANGE_MS = 366 * 24 * 60 * 60 * 1e3;
 async function listGroupSessions(request, { host }) {
   try {
@@ -3757,29 +3894,29 @@ async function listGroupSessions(request, { host }) {
       return Response.json({ error: "Invalid date format \u2014 use ISO 8601" }, { status: 400 });
     }
     if (startDate >= endDate) {
-      const err = (0, import_scheduling27.schedError)("SCHED_310", { startDateStr, endDateStr });
+      const err = (0, import_scheduling28.schedError)("SCHED_310", { startDateStr, endDateStr });
       return Response.json({ error: "startDate must be before endDate", ref: err.ref }, { status: 400 });
     }
     if (endDate.getTime() - startDate.getTime() > MAX_RANGE_MS) {
-      const err = (0, import_scheduling27.schedError)("SCHED_312", { startDateStr, endDateStr });
+      const err = (0, import_scheduling28.schedError)("SCHED_312", { startDateStr, endDateStr });
       return Response.json({ error: "Date range exceeds maximum allowed (366 days)", ref: err.ref }, { status: 400 });
     }
     const calendarId = params.get("calendarId") || void 0;
     const visibleCalendarIds = await staff.visibleCalendarIds();
-    const { sessions, hasMore } = await (0, import_scheduling27.getGroupSessions)(staff.db, { startDate, endDate, calendarId, visibleCalendarIds });
+    const { sessions, hasMore } = await (0, import_scheduling28.getGroupSessions)(staff.db, { startDate, endDate, calendarId, visibleCalendarIds });
     return Response.json({ sessions, total: sessions.length, hasMore });
   } catch (error) {
-    const err = (0, import_scheduling27.schedError)("SCHED_311", { error });
+    const err = (0, import_scheduling28.schedError)("SCHED_311", { error });
     console.error("[group-sessions]", err.ref, error);
     return Response.json({ error: "Failed to fetch group sessions", ref: err.ref }, { status: 500 });
   }
 }
 
 // src/handlers/admin-recurring.ts
-var import_scheduling30 = require("@ordinatio/scheduling");
+var import_scheduling31 = require("@ordinatio/scheduling");
 
 // src/recurring/series-side-effects.ts
-var import_scheduling28 = require("@ordinatio/scheduling");
+var import_scheduling29 = require("@ordinatio/scheduling");
 
 // src/recurring/failure-collector.ts
 function createFailureCollector() {
@@ -3843,7 +3980,7 @@ async function runSeriesSideEffects(host, db, organizationId, seriesId, client)
   const sendConfirmation = async (url, appointmentId) => {
     for (let tryNumber = 1; tryNumber <= 2; tryNumber += 1) {
       try {
-        await (0, import_scheduling28.scheduleNotifications)(db, appointmentId, url);
+        await (0, import_scheduling29.scheduleNotifications)(db, appointmentId, url, { brand: Boolean(host.brand) });
         return;
       } catch (error) {
         if (tryNumber === 2) record("Client confirmation", error);
@@ -3855,10 +3992,9 @@ async function runSeriesSideEffects(host, db, organizationId, seriesId, client)
       if (visit === confirmationVisit) {
         await sendConfirmation(baseUrl, visit.id);
       } else {
-        await attempt(
-          "Client notices",
-          () => (0, import_scheduling28.scheduleNotifications)(db, visit.id, baseUrl, { excludeTriggers: ["CONFIRMATION"] })
-        );
+        await attempt("Client notices", async () => {
+          await (0, import_scheduling29.scheduleNotifications)(db, visit.id, baseUrl, { excludeTriggers: ["CONFIRMATION"], brand: Boolean(host.brand) });
+        });
       }
     }
     await attempt(
@@ -3877,7 +4013,7 @@ async function runSeriesSideEffects(host, db, organizationId, seriesId, client)
     await Promise.all(visits.slice(from, from + VISITS_PER_GROUP).map(handleVisit));
   }
   if (baseUrl && confirmationVisit) {
-    await attempt("Staff alert", () => (0, import_scheduling28.queueStaffNotification)(db, confirmationVisit.id, "CONFIRMATION", baseUrl));
+    await attempt("Staff alert", () => (0, import_scheduling29.queueStaffNotification)(db, confirmationVisit.id, "CONFIRMATION", baseUrl, { brand: Boolean(host.brand) }));
   }
   await attempt("Availability cache", () => host.availabilityCache.invalidate(first.calendarId));
   await attempt(
@@ -3893,11 +4029,11 @@ async function runSeriesSideEffects(host, db, organizationId, seriesId, client)
 }
 
 // src/recurring/validate-timezone.ts
-var import_scheduling29 = require("@ordinatio/scheduling");
+var import_scheduling30 = require("@ordinatio/scheduling");
 var SUPPORTED_TIMEZONES = new Set(Intl.supportedValuesOf("timeZone"));
 function validateRecurringTimezone(timezone) {
   if (isValidIanaTimezone(timezone)) return null;
-  const err = (0, import_scheduling29.schedError)("SCHED_704", { timezone });
+  const err = (0, import_scheduling30.schedError)("SCHED_704", { timezone });
   return Response.json({ error: err.description, ref: err.ref }, { status: 422 });
 }
 function isValidIanaTimezone(timezone) {
@@ -3950,12 +4086,12 @@ async function createRecurringSeries(request, { host }) {
     const validation = await parseBody(request, CreateRecurringSeriesSchema);
     if (!validation.success) return validation.response;
     const input = validation.data;
-    if (input.occurrences < 1 || input.occurrences > import_scheduling30.RECURRING_MAX_OCCURRENCES) {
-      const err = (0, import_scheduling30.schedError)("SCHED_701", { occurrences: input.occurrences });
+    if (input.occurrences < 1 || input.occurrences > import_scheduling31.RECURRING_MAX_OCCURRENCES) {
+      const err = (0, import_scheduling31.schedError)("SCHED_701", { occurrences: input.occurrences });
       return Response.json({ error: err.description, ref: err.ref }, { status: 422 });
     }
-    if (!(0, import_scheduling30.parseTimeLocal)(input.startTimeLocal)) {
-      const err = (0, import_scheduling30.schedError)("SCHED_700", { startTimeLocal: input.startTimeLocal });
+    if (!(0, import_scheduling31.parseTimeLocal)(input.startTimeLocal)) {
+      const err = (0, import_scheduling31.schedError)("SCHED_700", { startTimeLocal: input.startTimeLocal });
       return Response.json({ error: err.description, ref: err.ref }, { status: 422 });
     }
     const tzError = validateRecurringTimezone(input.timezone);
@@ -3984,7 +4120,7 @@ async function createRecurringSeries(request, { host }) {
     });
     const firstDate = new Date(input.firstDate);
     const endsAt = input.endsAt ? new Date(input.endsAt) : void 0;
-    const slots = (0, import_scheduling30.buildRecurringSlots)(
+    const slots = (0, import_scheduling31.buildRecurringSlots)(
       firstDate,
       input.frequency,
       input.occurrences,
@@ -4065,17 +4201,17 @@ async function createRecurringSeries(request, { host }) {
 }
 
 // src/handlers/admin-recurring-detail.ts
-var import_scheduling32 = require("@ordinatio/scheduling");
+var import_scheduling33 = require("@ordinatio/scheduling");
 
 // src/recurring/series-cancel-side-effects.ts
-var import_scheduling31 = require("@ordinatio/scheduling");
+var import_scheduling32 = require("@ordinatio/scheduling");
 var OCCURRENCES_PER_GROUP = 8;
 async function runSeriesCancelSideEffects(host, db, organizationId, seriesId, seriesCalendarId, occurrences) {
   if (occurrences.length === 0) return { failures: [] };
   const { attempt, record, lines } = createFailureCollector();
   const handle = async (occurrence) => {
     const { id } = occurrence;
-    await attempt("Pending reminders", () => (0, import_scheduling31.cancelPendingNotifications)(db, id));
+    await attempt("Pending reminders", () => (0, import_scheduling32.cancelPendingNotifications)(db, id));
     const hasPayment = hasPendingPayment(occurrence.paymentId, occurrence.paymentStatus);
     await attempt("Refund review flag", async () => {
       await writeRefundStatusAfterCancel(host, db, { appointmentId: id, hasPayment, clientName: occurrence.clientName });
@@ -4107,7 +4243,7 @@ async function runSeriesCancelSideEffects(host, db, organizationId, seriesId, se
   }
   const baseUrl = host.appUrl()?.trim();
   if (baseUrl) {
-    await attempt("Staff notice", () => (0, import_scheduling31.queueStaffNotification)(db, occurrences[0].id, "CANCELLATION", baseUrl));
+    await attempt("Staff notice", () => (0, import_scheduling32.queueStaffNotification)(db, occurrences[0].id, "CANCELLATION", baseUrl, { brand: Boolean(host.brand) }));
   } else {
     record("Staff notice", "skipped because the application address is not set");
   }
@@ -4153,7 +4289,7 @@ async function getRecurringSeries(request, { host, params }) {
       }
     });
     if (!series || !await staff.canSeeCalendar(series.calendar.id)) {
-      const err = (0, import_scheduling32.schedError)("SCHED_702", { seriesId: id, organizationId });
+      const err = (0, import_scheduling33.schedError)("SCHED_702", { seriesId: id, organizationId });
       return Response.json({ error: err.description, ref: err.ref }, { status: 404 });
     }
     return Response.json({ series });
@@ -4180,14 +4316,14 @@ async function cancelRecurringSeries(request, { host, params }) {
       select: { id: true, status: true, clientName: true, clientEmail: true, frequency: true, occurrences: true, calendarId: true }
     });
     if (!series) {
-      const err = (0, import_scheduling32.schedError)("SCHED_702", { seriesId: id, organizationId });
+      const err = (0, import_scheduling33.schedError)("SCHED_702", { seriesId: id, organizationId });
       return Response.json({ error: err.description, ref: err.ref }, { status: 404 });
     }
     if (!await staff.canSeeCalendar(series.calendarId)) {
       return Response.json({ error: "Calendar not found" }, { status: 404 });
     }
     if ((input.scope === "ONE" || input.scope === "THIS_AND_FOLLOWING") && !input.fromAppointmentId) {
-      const err = (0, import_scheduling32.schedError)("SCHED_703", { scope: input.scope });
+      const err = (0, import_scheduling33.schedError)("SCHED_703", { scope: input.scope });
       return Response.json({ error: err.description, ref: err.ref }, { status: 422 });
     }
     const NON_CANCELLABLE_STATUSES = ["CANCELLED", "COMPLETED", "NO_SHOW"];
@@ -4215,7 +4351,7 @@ async function cancelRecurringSeries(request, { host, params }) {
     if (hiddenCalendars) {
       const hidden = await db.appointment.count({ where: { ...open, calendar: { organizationId, NOT: hiddenCalendars } } });
       if (hidden > 0) {
-        const err = (0, import_scheduling32.schedError)("SCHED_702", { seriesId: id, organizationId, reason: "open occurrence on a calendar outside the viewer scope" });
+        const err = (0, import_scheduling33.schedError)("SCHED_702", { seriesId: id, organizationId, reason: "open occurrence on a calendar outside the viewer scope" });
         return Response.json({ error: err.description, ref: err.ref }, { status: 404 });
       }
     }
@@ -4248,7 +4384,7 @@ async function cancelRecurringSeries(request, { host, params }) {
     return Response.json({ cancelledCount, newSeriesStatus, ...warnings.length > 0 && { warnings } });
   } catch (error) {
     if (error?.code === "P2025") {
-      const err = (0, import_scheduling32.schedError)("SCHED_702", { race: "series vanished between org-scoped pre-check and cancellation transaction" });
+      const err = (0, import_scheduling33.schedError)("SCHED_702", { race: "series vanished between org-scoped pre-check and cancellation transaction" });
       return Response.json({ error: err.description, ref: err.ref }, { status: 404 });
     }
     return Response.json({ error: getErrorMessage(error, "Failed to cancel recurring series") }, { status: 500 });
@@ -4256,7 +4392,7 @@ async function cancelRecurringSeries(request, { host, params }) {
 }
 
 // src/handlers/booking-analytics.ts
-var import_scheduling33 = require("@ordinatio/scheduling");
+var import_scheduling34 = require("@ordinatio/scheduling");
 async function getAnalytics(request, { host }) {
   try {
     const staff = await host.staff.resolve(request);
@@ -4268,7 +4404,7 @@ async function getAnalytics(request, { host }) {
     const limited = await host.rateLimit(`analytics:${ip}`, "GENERAL");
     if (limited) return limited;
     if (!staff.isAdmin) {
-      const err = (0, import_scheduling33.schedError)("SCHED_900", { userId: staff.userId, role: staff.role });
+      const err = (0, import_scheduling34.schedError)("SCHED_900", { userId: staff.userId, role: staff.role });
       return Response.json({ error: "Forbidden", ref: err.ref }, { status: 403 });
     }
     const params = new URL(request.url).searchParams;
@@ -4294,7 +4430,7 @@ async function getAnalytics(request, { host }) {
       }
     }
     const visibleCalendarIds = await staff.visibleCalendarIds();
-    const analytics = await (0, import_scheduling33.getBookingAnalytics)(staff.db, { days, calendarId, visibleCalendarIds });
+    const analytics = await (0, import_scheduling34.getBookingAnalytics)(staff.db, { days, calendarId, visibleCalendarIds });
     return Response.json(analytics);
   } catch (error) {
     const ref = getErrorRef(error);
@@ -4312,6 +4448,36 @@ function escapeHtml(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
 }
 
+// src/brand/brand-http.ts
+var import_scheduling35 = require("@ordinatio/scheduling");
+var NOT_ENABLED = { error: "Branding is not enabled on this server" };
+function brandErrorResponse(error, fallback, cors) {
+  const send = (payload, status) => cors ? corsJson(cors, payload, { status }) : Response.json(payload, { status });
+  if (error instanceof import_scheduling35.SchedulingValidationError) {
+    const details = error.context.errors;
+    return send({ error: error.message, code: error.code, ref: getErrorRef(error), ...details ? { details } : {} }, 400);
+  }
+  console.error("[brand]", error);
+  return send({ error: fallback }, 500);
+}
+async function requireBrandAdmin(host, request, options) {
+  const staff = await requireAdminStaff(host, request, options);
+  if (staff instanceof Response) return staff;
+  if (!host.brand) return Response.json(NOT_ENABLED, { status: 501 });
+  return staff;
+}
+async function businessName(host, db, organizationId) {
+  if (host.brand) {
+    try {
+      const brand = await (0, import_scheduling35.getBrand)(db, organizationId);
+      if (brand) return brand.displayName;
+    } catch (error) {
+      console.error("[brand] could not read the brand for a message:", error);
+    }
+  }
+  return host.appName() || null;
+}
+
 // src/handlers/appointment-messages.ts
 var NOT_FOUND4 = () => Response.json({ error: "Appointment not found" }, { status: 404 });
 function failure2(label, error, fallback) {
@@ -4352,7 +4518,7 @@ async function sendFollowup(request, { host, params }) {
         { status: 400 }
       );
     }
-    const staffName = appointment.calendar.staffName || host.appName() || "Your provider";
+    const staffName = appointment.calendar.staffName || await businessName(host, db, organizationId) || "Your provider";
     const serviceName = appointment.type.name;
     await db.scheduledNotification.deleteMany({
       where: { appointmentId: id, trigger: "FOLLOWUP_MANUAL", status: "PENDING" }
@@ -4423,6 +4589,7 @@ async function sendReminder(request, { host, params }) {
       month: "long",
       day: "numeric"
     }) + " at " + time;
+    const providerName = appointment.calendar.staffName || await businessName(host, db, organizationId);
     await db.scheduledNotification.deleteMany({
       where: { appointmentId: id, trigger: "REMINDER_MANUAL", status: "PENDING" }
     });
@@ -4433,7 +4600,7 @@ async function sendReminder(request, { host, params }) {
           channel: "SMS",
           trigger: "REMINDER_MANUAL",
           recipient: appointment.clientPhone,
-          body: `Reminder: Your ${appointment.type.name} with ${appointment.calendar.staffName || host.appName() || "your provider"} is on ${dateTime}.`,
+          body: `Reminder: Your ${appointment.type.name} with ${providerName || "your provider"} is on ${dateTime}.`,
           scheduledFor: /* @__PURE__ */ new Date()
         }
       });
@@ -4454,7 +4621,7 @@ Date: ${dateTime}
 
 We look forward to seeing you!
 
-\u2014 ${escapeHtml(appointment.calendar.staffName || host.appName() || "Your provider")}`,
+\u2014 ${escapeHtml(providerName || "Your provider")}`,
         scheduledFor: /* @__PURE__ */ new Date()
       }
     });
@@ -4470,7 +4637,7 @@ We look forward to seeing you!
 }
 
 // src/handlers/calendar-ownership.ts
-var import_scheduling34 = require("@ordinatio/scheduling");
+var import_scheduling36 = require("@ordinatio/scheduling");
 async function getOwnedCalendarForRoute(db, id, organizationId) {
   const calendar = await db.schedulingCalendar.findUnique({
     where: { id },
@@ -4501,7 +4668,7 @@ async function getOwnedCalendarForRoute(db, id, organizationId) {
 async function validateStaffLink(host, userId, organizationId) {
   if (!userId) return null;
   if (await host.staffDirectory.isMember(organizationId, userId)) return null;
-  const err = (0, import_scheduling34.schedError)("SCHED_104", { userId, organizationId });
+  const err = (0, import_scheduling36.schedError)("SCHED_104", { userId, organizationId });
   return Response.json({ error: "That staff member is not part of this organization", ref: err.ref }, { status: 400 });
 }
 function buildCalendarUpdateData(input) {
@@ -4634,7 +4801,7 @@ async function createCalendar(request, { host }) {
 }
 
 // src/handlers/admin-calendar-update.ts
-var import_scheduling35 = require("@ordinatio/scheduling");
+var import_scheduling37 = require("@ordinatio/scheduling");
 var NOT_FOUND5 = () => Response.json({ error: "Calendar not found" }, { status: 404 });
 async function getCalendar(request, { host, params }) {
   try {
@@ -4664,7 +4831,7 @@ async function putCalendar(request, { host, params }) {
     const input = validation.data;
     const linkError = input.userId === void 0 ? null : await validateStaffLink(host, input.userId, organizationId);
     if (linkError) return linkError;
-    const { calendar: updated, wasActive } = await (0, import_scheduling35.updateCalendar)(db, id, organizationId, buildCalendarUpdateData(input));
+    const { calendar: updated, wasActive } = await (0, import_scheduling37.updateCalendar)(db, id, organizationId, buildCalendarUpdateData(input));
     if (input.slotGranularityMinutes !== void 0) await host.availabilityCache.invalidate(id);
     if (input.isActive === false && wasActive) {
       await releaseCalendarSlugIfStillInactive(host, db, id, organizationId, existing.slug);
@@ -4689,7 +4856,7 @@ async function deleteCalendar(request, { host, params }) {
     if (!await staff.canSeeCalendar(id)) return NOT_FOUND5();
     const existing = await getOwnedCalendarForRoute(db, id, organizationId);
     if (!existing) return NOT_FOUND5();
-    await (0, import_scheduling35.archiveCalendar)(db, id, organizationId);
+    await (0, import_scheduling37.archiveCalendar)(db, id, organizationId);
     await releaseCalendarSlugIfStillInactive(host, db, id, organizationId, existing.slug);
     await bustCalendarCachesOnArchive(host, organizationId, existing.slug, id);
     await host.activity.log(db, {
@@ -4846,7 +5013,7 @@ async function disconnectOutlook(request, { host, params }) {
 }
 
 // src/handlers/admin-calendar-location-recents.ts
-var import_scheduling36 = require("@ordinatio/scheduling");
+var import_scheduling38 = require("@ordinatio/scheduling");
 async function getLocationRecents(request, { host, params }) {
   try {
     const staff = await requireAdminStaff(host, request, {
@@ -4891,14 +5058,14 @@ async function getLocationRecents(request, { host, params }) {
     }
     return Response.json({ locations });
   } catch (error) {
-    const diagnostic = (0, import_scheduling36.schedError)("SCHED_207", { error });
+    const diagnostic = (0, import_scheduling38.schedError)("SCHED_207", { error });
     console.error("[location-recents]", diagnostic.ref, error);
     return Response.json({ error: "Failed to fetch location recents", ref: diagnostic.ref }, { status: 500 });
   }
 }
 
 // src/handlers/admin-availability-rules.ts
-var import_scheduling37 = require("@ordinatio/scheduling");
+var import_scheduling39 = require("@ordinatio/scheduling");
 
 // src/availability/admin-calendar.ts
 async function verifyCalendar(db, calendarId, organizationId) {
@@ -4963,7 +5130,7 @@ async function listRules(request, { host, params }) {
     const calendar = await requireOwnedVisibleCalendar(staff, calendarId);
     if (calendar instanceof Response) return calendar;
     const { limit, offset } = parsePagination(request, 500, 200);
-    const { rules, total, hasMore } = await (0, import_scheduling37.listAvailabilityRules)(staff.db, calendarId, { limit, offset });
+    const { rules, total, hasMore } = await (0, import_scheduling39.listAvailabilityRules)(staff.db, calendarId, { limit, offset });
     return Response.json({ rules, total, hasMore });
   } catch (error) {
     return Response.json({ error: getErrorMessage(error, "Failed to fetch availability") }, { status: 500 });
@@ -4982,7 +5149,7 @@ async function setWeeklyRules(request, { host, params }) {
     if (!Array.isArray(rules)) return Response.json({ error: "rules must be an array" }, { status: 400 });
     const validationError = validateWeeklyRules(rules);
     if (validationError) return Response.json({ error: validationError }, { status: 400 });
-    const created = await (0, import_scheduling37.setWeeklyAvailability)(db, calendarId, rules);
+    const created = await (0, import_scheduling39.setWeeklyAvailability)(db, calendarId, rules);
     const activeDays = rules.map((r) => ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"][r.dayOfWeek]).join(", ");
     await host.activity.log(db, {
       action: "scheduling.availability_updated",
@@ -4992,7 +5159,7 @@ async function setWeeklyRules(request, { host, params }) {
     return Response.json(created);
   } catch (error) {
     const msg = getErrorMessage(error, "Failed to update availability");
-    if (error instanceof import_scheduling37.SchedulingValidationError) {
+    if (error instanceof import_scheduling39.SchedulingValidationError) {
       console.error("[PUT /admin/availability]", error.ref, error.code, error.context);
       return Response.json({ error: msg, ref: error.ref }, { status: 400 });
     }
@@ -5001,18 +5168,18 @@ async function setWeeklyRules(request, { host, params }) {
 }
 
 // src/handlers/admin-availability-overrides.ts
-var import_scheduling39 = require("@ordinatio/scheduling");
+var import_scheduling41 = require("@ordinatio/scheduling");
 
 // src/availability/override-helpers.ts
-var import_scheduling38 = require("@ordinatio/scheduling");
+var import_scheduling40 = require("@ordinatio/scheduling");
 function sanitizeBlockReason(raw) {
   if (!raw) return void 0;
   return String(raw).replace(/<script[^>]*>[\s\S]*?<\/script>/gi, "").replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "").replace(/<[^>]*>/g, "").slice(0, 500).trim() || void 0;
 }
 async function checkOverlappingAppointments(db, calendarId, calendarTimezone, dateStr, startTime, endTime) {
   const tz = calendarTimezone ?? "America/New_York";
-  const blockStart = (0, import_scheduling38.localToUTC)(dateStr, startTime, tz);
-  const blockEnd = (0, import_scheduling38.localToUTC)(dateStr, endTime, tz);
+  const blockStart = (0, import_scheduling40.localToUTC)(dateStr, startTime, tz);
+  const blockEnd = (0, import_scheduling40.localToUTC)(dateStr, endTime, tz);
   const conflictCount = await db.appointment.count({
     where: {
       calendarId,
@@ -5042,14 +5209,14 @@ async function addOverride(request, { host, params }) {
     const isBlockedFlag = body.isBlocked ?? true;
     let override;
     if (isBlockedFlag && body.startTime && body.endTime) {
-      override = await (0, import_scheduling39.addTimeBlock)(db, calendarId, {
+      override = await (0, import_scheduling41.addTimeBlock)(db, calendarId, {
         date,
         startTime: body.startTime,
         endTime: body.endTime,
         reason: blockReason
       });
     } else {
-      override = await (0, import_scheduling39.addDateOverride)(db, calendarId, {
+      override = await (0, import_scheduling41.addDateOverride)(db, calendarId, {
         date,
         isBlocked: isBlockedFlag,
         blockReason,
@@ -5085,7 +5252,7 @@ async function addOverride(request, { host, params }) {
     return Response.json({ ...override, ...overlapWarning && { warning: overlapWarning } }, { status: 201 });
   } catch (error) {
     const msg = getErrorMessage(error, "Failed to add override");
-    if (error instanceof import_scheduling39.SchedulingValidationError) {
+    if (error instanceof import_scheduling41.SchedulingValidationError) {
       console.error("[POST /admin/availability]", error.ref, error.code, error.context);
       return Response.json({ error: msg, ref: error.ref }, { status: 400 });
     }
@@ -5102,7 +5269,7 @@ async function removeOverride(request, { host, params }) {
     if (calendar instanceof Response) return calendar;
     const { ruleId } = await request.json();
     if (!ruleId) return Response.json({ error: "ruleId is required" }, { status: 400 });
-    const deletedRule = await (0, import_scheduling39.removeDateOverride)(db, calendarId, ruleId);
+    const deletedRule = await (0, import_scheduling41.removeDateOverride)(db, calendarId, ruleId);
     const deletedIsTimeBlock = deletedRule?.isBlocked && !(deletedRule.startTime === "00:00" && deletedRule.endTime === "00:00");
     await host.activity.log(db, {
       action: "scheduling.date_override_removed",
@@ -5112,7 +5279,7 @@ async function removeOverride(request, { host, params }) {
     return Response.json({ success: true });
   } catch (error) {
     const msg = getErrorMessage(error, "Failed to remove override");
-    if (error instanceof import_scheduling39.SchedulingNotFoundError) {
+    if (error instanceof import_scheduling41.SchedulingNotFoundError) {
       console.error("[DELETE /admin/availability]", error.ref, error.code, error.context);
       return Response.json({ error: msg, ref: error.ref }, { status: 404 });
     }
@@ -5121,7 +5288,7 @@ async function removeOverride(request, { host, params }) {
 }
 
 // src/handlers/admin-templates.ts
-var import_scheduling40 = require("@ordinatio/scheduling");
+var import_scheduling42 = require("@ordinatio/scheduling");
 
 // src/sanitize/notification-body.ts
 var import_sanitize_html = __toESM(require("sanitize-html"));
@@ -5145,7 +5312,7 @@ async function listTemplates(request, { host }) {
   try {
     const staff = await requireAdminStaff(host, request, { action: "admin-templates-list", tier: "GENERAL" });
     if (staff instanceof Response) return staff;
-    return Response.json(await (0, import_scheduling40.listNotificationTemplates)(staff.db, staff.organizationId));
+    return Response.json(await (0, import_scheduling42.listNotificationTemplates)(staff.db, staff.organizationId));
   } catch (error) {
     return Response.json({ error: getErrorMessage(error, "Failed to fetch templates") }, { status: 500 });
   }
@@ -5170,7 +5337,7 @@ async function createTemplate(request, { host }) {
     if (input.channel === "EMAIL" && !input.subject?.trim()) {
       return Response.json({ error: "EMAIL templates require a subject" }, { status: 400 });
     }
-    const template = await (0, import_scheduling40.createNotificationTemplate)(db, organizationId, {
+    const template = await (0, import_scheduling42.createNotificationTemplate)(db, organizationId, {
       name: input.name,
       channel: input.channel,
       trigger: input.trigger,
@@ -5196,7 +5363,7 @@ async function createTemplate(request, { host }) {
 }
 
 // src/handlers/admin-template-update.ts
-var import_scheduling41 = require("@ordinatio/scheduling");
+var import_scheduling43 = require("@ordinatio/scheduling");
 async function updateTemplate(request, { host, params }) {
   try {
     const staff = await requireAdminStaff(host, request, { action: "admin-templates-update", tier: "UPDATE" });
@@ -5228,7 +5395,7 @@ async function updateTemplate(request, { host, params }) {
         return Response.json({ error: "EMAIL templates require a subject" }, { status: 400 });
       }
     }
-    const updated = await (0, import_scheduling41.updateNotificationTemplate)(db, organizationId, id, {
+    const updated = await (0, import_scheduling43.updateNotificationTemplate)(db, organizationId, id, {
       name: input.name,
       subject: sanitizedSubject,
       body: input.body !== void 0 ? sanitizeNotificationBody(input.body, existing.channel) : void 0,
@@ -5242,11 +5409,11 @@ async function updateTemplate(request, { host, params }) {
     return Response.json(updated);
   } catch (error) {
     const msg = getErrorMessage(error, "Failed to update template");
-    if (error instanceof import_scheduling41.SchedulingValidationError) {
+    if (error instanceof import_scheduling43.SchedulingValidationError) {
       console.error("[PUT /admin/templates]", error.ref, error.code, error.context);
       return Response.json({ error: msg, ref: error.ref }, { status: 400 });
     }
-    if (error instanceof import_scheduling41.SchedulingNotFoundError) {
+    if (error instanceof import_scheduling43.SchedulingNotFoundError) {
       console.error("[PUT /admin/templates]", error.ref, error.code, error.context);
       return Response.json({ error: msg, ref: error.ref }, { status: 404 });
     }
@@ -5263,7 +5430,7 @@ async function deleteTemplate(request, { host, params }) {
       where: { id, organizationId },
       select: { name: true }
     });
-    await (0, import_scheduling41.deleteNotificationTemplate)(db, organizationId, id);
+    await (0, import_scheduling43.deleteNotificationTemplate)(db, organizationId, id);
     await host.activity.log(db, {
       action: "scheduling.template_deleted",
       description: `deleted notification template "${template?.name || id}"`,
@@ -5272,7 +5439,7 @@ async function deleteTemplate(request, { host, params }) {
     return Response.json({ success: true });
   } catch (error) {
     const msg = getErrorMessage(error, "Failed to delete template");
-    if (error instanceof import_scheduling41.SchedulingNotFoundError) {
+    if (error instanceof import_scheduling43.SchedulingNotFoundError) {
       console.error("[DELETE /admin/templates]", error.ref, error.code, error.context);
       return Response.json({ error: msg, ref: error.ref }, { status: 404 });
     }
@@ -5281,7 +5448,7 @@ async function deleteTemplate(request, { host, params }) {
 }
 
 // src/handlers/admin-types.ts
-var import_scheduling42 = require("@ordinatio/scheduling");
+var import_scheduling44 = require("@ordinatio/scheduling");
 async function listTypes(request, { host }) {
   try {
     const staff = await requireAdminStaff(host, request, { action: "admin-types-list", tier: "GENERAL" });
@@ -5311,7 +5478,7 @@ async function createType(request, { host }) {
     if (!validation.success) return validation.response;
     if (!organizationId) return Response.json({ error: "Organization context required" }, { status: 400 });
     const input = validation.data;
-    const type = await (0, import_scheduling42.createAppointmentType)(db, {
+    const type = await (0, import_scheduling44.createAppointmentType)(db, {
       name: input.name,
       slug: input.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, ""),
       description: input.description || void 0,
@@ -5370,7 +5537,7 @@ async function createType(request, { host }) {
 }
 
 // src/handlers/admin-type-update.ts
-var import_scheduling43 = require("@ordinatio/scheduling");
+var import_scheduling45 = require("@ordinatio/scheduling");
 
 // src/handlers/type-ownership.ts
 async function getOwnedAppointmentType(db, id, organizationId) {
@@ -5451,7 +5618,7 @@ async function updateType(request, { host, params }) {
     const validation = await parseBody(request, UpdateAppointmentTypeSchema);
     if (!validation.success) return validation.response;
     const input = validation.data;
-    const { type: updated, wasActive } = await (0, import_scheduling43.updateAppointmentType)(db, id, organizationId, input);
+    const { type: updated, wasActive } = await (0, import_scheduling45.updateAppointmentType)(db, id, organizationId, input);
     if (input.isActive === false && wasActive && typeToUpdate.organizationId) {
       await releaseTypeSlugIfStillInactive(host, db, id, typeToUpdate.organizationId, typeToUpdate.slug);
     }
@@ -5468,7 +5635,7 @@ async function updateType(request, { host, params }) {
       return Response.json({ error: getErrorMessage(error, "Validation error") }, { status: schedErrorStatus(code) });
     }
     const message = isSchedulingServiceError(error) ? error.description || error.message : getErrorMessage(error, "Failed to update appointment type");
-    if (error instanceof import_scheduling43.SchedulingValidationError) return Response.json({ error: message }, { status: 400 });
+    if (error instanceof import_scheduling45.SchedulingValidationError) return Response.json({ error: message }, { status: 400 });
     return Response.json({ error: message }, { status: 500 });
   }
 }
@@ -5720,7 +5887,7 @@ async function getStaffOptions(request, { host }) {
 
 // src/handlers/appointment-ical.ts
 var import_ical_generator = __toESM(require("ical-generator"));
-var import_scheduling44 = require("@ordinatio/scheduling");
+var import_scheduling46 = require("@ordinatio/scheduling");
 async function getAppointmentIcal(request, { host }) {
   let token = null;
   try {
@@ -5748,13 +5915,13 @@ async function getAppointmentIcal(request, { host }) {
     const description = [appointment.type.description ?? "", `Manage your appointment: ${manageUrl}`].filter(Boolean).join("\n");
     const calendar = (0, import_ical_generator.default)({ name: appointment.calendar.name });
     calendar.createEvent({
-      id: `${appointment.id}@system1701`,
+      id: `${appointment.id}@${host.icalUidDomain() || "ordinatio-scheduling"}`,
       start: appointment.startTime,
       end: appointment.endTime,
       timezone: appointment.timezone,
       summary,
       description,
-      location: (0, import_scheduling44.resolveLocation)(appointment) ?? void 0,
+      location: (0, import_scheduling46.resolveLocation)(appointment) ?? void 0,
       url: manageUrl,
       organizer: staffName && staffEmail ? { name: staffName, email: staffEmail } : void 0
     });
@@ -5766,17 +5933,17 @@ async function getAppointmentIcal(request, { host }) {
       }
     });
   } catch (error) {
-    const diagnostic = (0, import_scheduling44.schedError)("SCHED_600", { error, token: token ?? "unknown" });
+    const diagnostic = (0, import_scheduling46.schedError)("SCHED_600", { error, token: token ?? "unknown" });
     console.error("[GET /ical]", diagnostic.ref, error instanceof Error ? error.message : error);
     return Response.json({ error: "Failed to generate calendar file", ref: diagnostic.ref }, { status: 500 });
   }
 }
 
 // src/handlers/admin-webhooks.ts
-var import_scheduling46 = require("@ordinatio/scheduling");
+var import_scheduling48 = require("@ordinatio/scheduling");
 
 // src/webhooks/require-webhooks.ts
-var import_scheduling45 = require("@ordinatio/scheduling");
+var import_scheduling47 = require("@ordinatio/scheduling");
 async function requireWebhooksAdmin(host, request, options) {
   const staff = await requireAdminStaff(host, request, options);
   if (staff instanceof Response) return staff;
@@ -5784,10 +5951,10 @@ async function requireWebhooksAdmin(host, request, options) {
   return { staff, settings: host.webhooks };
 }
 function webhookErrorResponse(error, fallback) {
-  if (error instanceof import_scheduling45.SchedulingValidationError) {
+  if (error instanceof import_scheduling47.SchedulingValidationError) {
     return Response.json({ error: error.message, ref: getErrorRef(error) }, { status: 400 });
   }
-  if (error instanceof import_scheduling45.SchedulingNotFoundError) {
+  if (error instanceof import_scheduling47.SchedulingNotFoundError) {
     return Response.json({ error: error.message, ref: getErrorRef(error) }, { status: 404 });
   }
   return Response.json({ error: getErrorMessage(error, fallback) }, { status: 500 });
@@ -5799,7 +5966,7 @@ async function listWebhooks(request, { host }) {
     const guard = await requireWebhooksAdmin(host, request, { action: "admin-webhooks-list", tier: "GENERAL" });
     if (guard instanceof Response) return guard;
     const { db, organizationId } = guard.staff;
-    return Response.json({ endpoints: await (0, import_scheduling46.listWebhookEndpoints)(db, organizationId), eventTypes: import_scheduling46.WEBHOOK_EVENT_TYPES });
+    return Response.json({ endpoints: await (0, import_scheduling48.listWebhookEndpoints)(db, organizationId), eventTypes: import_scheduling48.WEBHOOK_EVENT_TYPES });
   } catch (error) {
     return webhookErrorResponse(error, "Failed to list webhooks");
   }
@@ -5812,7 +5979,7 @@ async function createWebhook(request, { host }) {
     const validation = await parseBody(request, CreateWebhookEndpointSchema);
     if (!validation.success) return validation.response;
     const input = validation.data;
-    const { endpoint, secret } = await (0, import_scheduling46.createWebhookEndpoint)(
+    const { endpoint, secret } = await (0, import_scheduling48.createWebhookEndpoint)(
       db,
       { organizationId, url: input.url, eventTypes: input.eventTypes, description: input.description },
       { allowInsecureTargets: guard.settings.allowInsecureTargets }
@@ -5829,14 +5996,14 @@ async function createWebhook(request, { host }) {
 }
 
 // src/handlers/admin-webhook-detail.ts
-var import_scheduling47 = require("@ordinatio/scheduling");
+var import_scheduling49 = require("@ordinatio/scheduling");
 var STATUSES = /* @__PURE__ */ new Set(["PENDING", "PROCESSING", "SUCCEEDED", "DEAD_LETTER"]);
 async function deleteWebhook(request, { host, params }) {
   try {
     const guard = await requireWebhooksAdmin(host, request, { action: "admin-webhooks-delete", tier: "DELETE" });
     if (guard instanceof Response) return guard;
     const { db, organizationId } = guard.staff;
-    await (0, import_scheduling47.deleteWebhookEndpoint)(db, organizationId, params.id);
+    await (0, import_scheduling49.deleteWebhookEndpoint)(db, organizationId, params.id);
     await host.activity.log(db, {
       action: "scheduling.webhook_deleted",
       description: "removed a webhook endpoint",
@@ -5852,7 +6019,7 @@ async function testWebhook(request, { host, params }) {
     const guard = await requireWebhooksAdmin(host, request, { action: "admin-webhooks-test", tier: "CREATE" });
     if (guard instanceof Response) return guard;
     const { db, organizationId } = guard.staff;
-    const result = await (0, import_scheduling47.sendTestWebhook)(
+    const result = await (0, import_scheduling49.sendTestWebhook)(
       db,
       { organizationId, endpointId: params.id },
       { transport: guard.settings.transport, allowInsecureTargets: guard.settings.allowInsecureTargets }
@@ -5868,13 +6035,13 @@ async function listWebhookEndpointDeliveries(request, { host, params }) {
     if (guard instanceof Response) return guard;
     const { db, organizationId } = guard.staff;
     const owned = await db.webhookEndpoint.count({ where: { id: params.id, organizationId } });
-    if (owned === 0) throw new import_scheduling47.SchedulingNotFoundError("Webhook endpoint not found", "SCHED_1003", { endpointId: params.id });
+    if (owned === 0) throw new import_scheduling49.SchedulingNotFoundError("Webhook endpoint not found", "SCHED_1003", { endpointId: params.id });
     const status = new URL(request.url).searchParams.get("status");
     if (status && !STATUSES.has(status)) {
       return Response.json({ error: `status must be one of ${[...STATUSES].join(", ")}` }, { status: 400 });
     }
     const { limit, offset } = parsePagination(request);
-    const { deliveries, total } = await (0, import_scheduling47.listWebhookDeliveries)(db, {
+    const { deliveries, total } = await (0, import_scheduling49.listWebhookDeliveries)(db, {
       organizationId,
       endpointId: params.id,
       status: status ?? void 0,
@@ -5888,13 +6055,13 @@ async function listWebhookEndpointDeliveries(request, { host, params }) {
 }
 
 // src/handlers/admin-webhook-delivery-retry.ts
-var import_scheduling48 = require("@ordinatio/scheduling");
+var import_scheduling50 = require("@ordinatio/scheduling");
 async function retryWebhook(request, { host, params }) {
   try {
     const guard = await requireWebhooksAdmin(host, request, { action: "admin-webhooks-retry", tier: "UPDATE" });
     if (guard instanceof Response) return guard;
     const { db, organizationId } = guard.staff;
-    await (0, import_scheduling48.retryWebhookDelivery)(db, organizationId, params.id);
+    await (0, import_scheduling50.retryWebhookDelivery)(db, organizationId, params.id);
     return Response.json({ success: true });
   } catch (error) {
     return webhookErrorResponse(error, "Failed to retry the delivery");
@@ -5902,7 +6069,7 @@ async function retryWebhook(request, { host, params }) {
 }
 
 // src/handlers/internal-webhooks-deliver.ts
-var import_scheduling49 = require("@ordinatio/scheduling");
+var import_scheduling51 = require("@ordinatio/scheduling");
 async function deliverWebhooks(request, { host }) {
   if (!await host.internalAccess.isAuthorized(request)) {
     return Response.json({ error: "Unauthorized" }, { status: 401 });
@@ -5911,7 +6078,7 @@ async function deliverWebhooks(request, { host }) {
   const limited = await host.rateLimit(`${request.headers.get("x-forwarded-for") ?? "worker"}:webhooks-deliver`, "INTERNAL");
   if (limited) return limited;
   try {
-    const summary = await (0, import_scheduling49.deliverDueWebhooks)(await host.publicDb(), {
+    const summary = await (0, import_scheduling51.deliverDueWebhooks)(await host.publicDb(), {
       transport: host.webhooks.transport,
       allowInsecureTargets: host.webhooks.allowInsecureTargets
     });
@@ -5922,37 +6089,140 @@ async function deliverWebhooks(request, { host }) {
   }
 }
 
-// src/handlers/appointments-book.ts
+// src/handlers/waitlist-join.ts
 var import_scheduling53 = require("@ordinatio/scheduling");
+var import_zod16 = require("zod");
+
+// src/waitlist/waitlist-http.ts
+var import_scheduling52 = require("@ordinatio/scheduling");
+var NOT_ENABLED2 = { error: "The waitlist is not enabled on this server" };
+var STATUS_BY_CODE = {
+  SCHED_1100: 404,
+  SCHED_1103: 409,
+  SCHED_1104: 409,
+  SCHED_1106: 404,
+  SCHED_1107: 410,
+  SCHED_1108: 409
+};
+async function resolveWaitlistDb(host, orgSlug) {
+  if (!orgSlug) return { db: await host.publicDb(), organizationId: null };
+  return host.organizations.resolve({ orgSlug, logPrefix: "[waitlist]" });
+}
+function waitlistErrorResponse(cors, error, fallback) {
+  if (error instanceof import_scheduling52.SchedulingValidationError || error instanceof import_scheduling52.SchedulingNotFoundError) {
+    const status = STATUS_BY_CODE[error.code] ?? (error instanceof import_scheduling52.SchedulingNotFoundError ? 404 : 400);
+    return corsJson(cors, { error: error.message, code: error.code, ref: getErrorRef(error) }, { status });
+  }
+  console.error("[waitlist]", error);
+  return corsJson(cors, { error: fallback }, { status: 500 });
+}
+async function requireWaitlistAdmin(host, request, options) {
+  const staff = await requireAdminStaff(host, request, options);
+  if (staff instanceof Response) return staff;
+  if (!host.waitlist) return Response.json(NOT_ENABLED2, { status: 501 });
+  return { staff, settings: host.waitlist };
+}
+
+// src/handlers/waitlist-join.ts
+var JoinWaitlistSchema = import_zod16.z.object({
+  orgSlug: import_zod16.z.string().min(1).max(100).optional(),
+  typeId: import_zod16.z.string().min(1),
+  calendarId: import_zod16.z.string().min(1).optional(),
+  day: import_zod16.z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Day must be YYYY-MM-DD"),
+  slotStart: import_zod16.z.string().datetime({ message: "Invalid date/time format" }).optional(),
+  clientName: import_zod16.z.string().trim().min(1, "Name is required").max(200),
+  clientEmail: import_zod16.z.string().email("Invalid email").max(254),
+  clientPhone: import_zod16.z.string().max(30).optional()
+});
+async function joinWaitlistRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.waitlist) return corsJson(cors, NOT_ENABLED2, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`waitlist-join:${clientAddress(request)}`, "PUBLIC_BOOKING");
+    if (limited) return limited;
+    const parsed = JoinWaitlistSchema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) {
+      const details = parsed.error.issues.map((issue) => ({ field: issue.path.join("."), message: issue.message }));
+      return corsJson(cors, { error: "Validation failed", details }, { status: 400 });
+    }
+    const body = parsed.data;
+    const context = await resolveWaitlistDb(host, body.orgSlug);
+    if (!context) return corsJson(cors, { error: "Appointment type not found" }, { status: 404 });
+    let organizationId = context.organizationId;
+    if (!organizationId) {
+      const type = await context.db.appointmentType.findUnique({ where: { id: body.typeId }, select: { organizationId: true } });
+      organizationId = type?.organizationId ?? null;
+    }
+    if (!organizationId) return corsJson(cors, { error: "Appointment type not found" }, { status: 404 });
+    const { entry, token } = await (0, import_scheduling53.joinWaitlist)(context.db, {
+      organizationId,
+      typeId: body.typeId,
+      calendarId: body.calendarId,
+      day: body.day,
+      slotStart: body.slotStart ? new Date(body.slotStart) : void 0,
+      clientName: body.clientName,
+      clientEmail: body.clientEmail,
+      clientPhone: body.clientPhone
+    });
+    return corsJson(cors, { entry, token }, { status: 201, headers: { "Cache-Control": "no-store" } });
+  } catch (error) {
+    return waitlistErrorResponse(cors, error, "Failed to join the waitlist");
+  }
+}
+async function leaveWaitlistRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.waitlist) return corsJson(cors, NOT_ENABLED2, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`waitlist-leave:${clientAddress(request)}`, "GENERAL");
+    if (limited) return limited;
+    const url = new URL(request.url);
+    const token = url.searchParams.get("token");
+    if (!token) return corsJson(cors, { error: "token is required" }, { status: 400 });
+    const context = await resolveWaitlistDb(host, url.searchParams.get("orgSlug"));
+    if (!context) return corsJson(cors, { error: "No waitlist entry for this link", code: "SCHED_1106" }, { status: 404 });
+    const freed = await (0, import_scheduling53.leaveWaitlist)(context.db, token);
+    if (freed) await offerAndAnnounce(host, host.waitlist, context.db, freed);
+    return corsJson(cors, { success: true });
+  } catch (error) {
+    return waitlistErrorResponse(cors, error, "Failed to leave the waitlist");
+  }
+}
+
+// src/handlers/waitlist-offer.ts
+var import_scheduling58 = require("@ordinatio/scheduling");
+var import_zod18 = require("zod");
+
+// src/handlers/appointments-book.ts
+var import_scheduling57 = require("@ordinatio/scheduling");
 
 // src/booking/booking-schema.ts
-var import_zod13 = require("zod");
-var BookingSchema = import_zod13.z.object({
-  calendarId: import_zod13.z.string().min(1).optional(),
-  preferredCalendarId: import_zod13.z.string().min(1).optional(),
-  typeId: import_zod13.z.string().min(1),
-  startTime: import_zod13.z.string().datetime({ message: "Invalid date/time format" }),
-  timezone: import_zod13.z.string().max(50).optional(),
-  clientName: import_zod13.z.string().trim().min(1, "Name is required").max(200),
-  clientEmail: import_zod13.z.string().email("Invalid email").max(254),
-  clientPhone: import_zod13.z.string().max(30).optional(),
+var import_zod17 = require("zod");
+var BookingSchema = import_zod17.z.object({
+  calendarId: import_zod17.z.string().min(1).optional(),
+  preferredCalendarId: import_zod17.z.string().min(1).optional(),
+  typeId: import_zod17.z.string().min(1),
+  startTime: import_zod17.z.string().datetime({ message: "Invalid date/time format" }),
+  timezone: import_zod17.z.string().max(50).optional(),
+  clientName: import_zod17.z.string().trim().min(1, "Name is required").max(200),
+  clientEmail: import_zod17.z.string().email("Invalid email").max(254),
+  clientPhone: import_zod17.z.string().max(30).optional(),
   // Untrusted: the host's client resolver decides whether to honor it.
-  clientId: import_zod13.z.string().optional(),
-  notes: import_zod13.z.string().max(1e3).optional(),
+  clientId: import_zod17.z.string().optional(),
+  notes: import_zod17.z.string().max(1e3).optional(),
   // Only the primitive types a form field produces; z.unknown() would accept anything.
-  intakeResponses: import_zod13.z.record(
-    import_zod13.z.string(),
-    import_zod13.z.union([import_zod13.z.string().max(1e3), import_zod13.z.number(), import_zod13.z.boolean(), import_zod13.z.null()])
+  intakeResponses: import_zod17.z.record(
+    import_zod17.z.string(),
+    import_zod17.z.union([import_zod17.z.string().max(1e3), import_zod17.z.number(), import_zod17.z.boolean(), import_zod17.z.null()])
   ).optional(),
-  paymentId: import_zod13.z.string().optional(),
-  couponCode: import_zod13.z.string().min(1).max(50).transform((value) => value.trim().toUpperCase()).optional(),
-  packagePurchaseId: import_zod13.z.string().optional(),
+  paymentId: import_zod17.z.string().optional(),
+  couponCode: import_zod17.z.string().min(1).max(50).transform((value) => value.trim().toUpperCase()).optional(),
+  packagePurchaseId: import_zod17.z.string().optional(),
   // Names the organization, so the calendar and type lookups can run against its own database.
-  orgSlug: import_zod13.z.string().min(1).max(100).optional()
+  orgSlug: import_zod17.z.string().min(1).max(100).optional()
 });
 
 // src/booking/finalize-booking.ts
-var import_scheduling50 = require("@ordinatio/scheduling");
+var import_scheduling54 = require("@ordinatio/scheduling");
 async function finalizeBooking(host, cors, db, organizationId, body, appointment, appointmentType, discountCents, appliedCouponCode, noShowApprovalOverride, clientId) {
   const logActivity = (action, description, metadata) => host.activity.log(db, { action, description, metadata });
   if (noShowApprovalOverride && appointment.status === "CONFIRMED") {
@@ -5995,7 +6265,7 @@ async function finalizeBooking(host, cors, db, organizationId, body, appointment
         AND  ("expiresAt" IS NULL OR "expiresAt" > NOW())
     `;
     if (counted === 0) {
-      await (0, import_scheduling50.cancelAppointment)(db, {
+      await (0, import_scheduling54.cancelAppointment)(db, {
         appointmentId: appointment.id,
         cancelledBy: "system",
         reason: "Coupon exhausted by concurrent booking during payment"
@@ -6014,7 +6284,7 @@ async function finalizeBooking(host, cors, db, organizationId, body, appointment
   }
   let meetingUrl = null;
   if (appointmentType.locationType === "VIRTUAL") {
-    meetingUrl = (0, import_scheduling50.buildJitsiUrl)(appointment.id);
+    meetingUrl = (0, import_scheduling54.buildJitsiUrl)(appointment.id);
     try {
       await db.appointment.update({ where: { id: appointment.id }, data: { meetingUrl } });
     } catch (meetingError) {
@@ -6039,7 +6309,7 @@ async function finalizeBooking(host, cors, db, organizationId, body, appointment
   const baseUrl = host.appUrl();
   if (!baseUrl) throw new Error("The host must supply appUrl() to book appointments");
   try {
-    await (0, import_scheduling50.scheduleNotifications)(db, appointment.id, baseUrl);
+    await (0, import_scheduling54.scheduleNotifications)(db, appointment.id, baseUrl, { brand: Boolean(host.brand) });
   } catch (error) {
     await logActivity(
       "scheduling.notification_schedule_failed",
@@ -6048,7 +6318,7 @@ async function finalizeBooking(host, cors, db, organizationId, body, appointment
     );
   }
   try {
-    await (0, import_scheduling50.queueStaffNotification)(db, appointment.id, "CONFIRMATION", baseUrl);
+    await (0, import_scheduling54.queueStaffNotification)(db, appointment.id, "CONFIRMATION", baseUrl, { brand: Boolean(host.brand) });
   } catch (error) {
     await logActivity(
       "scheduling.staff_notification_failed",
@@ -6102,7 +6372,7 @@ async function finalizeBooking(host, cors, db, organizationId, body, appointment
 }
 
 // src/booking/refund-blocked-booking.ts
-var import_scheduling51 = require("@ordinatio/scheduling");
+var import_scheduling55 = require("@ordinatio/scheduling");
 var REFUND_ON_CODES = ["SCHED_301", "SCHED_307", "SCHED_802", "SCHED_800", "SCHED_801", "SCHED_201", "SCHED_100", "SCHED_200", "SCHED_102"];
 function isBlockedBookingCode(code) {
   return code !== void 0 && REFUND_ON_CODES.includes(code);
@@ -6117,12 +6387,12 @@ async function respondToBlockedPaidBooking(db, payments, cors, paymentId, blocke
   try {
     existingBooking = await db.appointment.findFirst({ where: { paymentId }, select: { id: true } });
   } catch (lookupError) {
-    const err = (0, import_scheduling51.schedError)("SCHED_409", { paymentId, blockerCode, error: lookupError });
+    const err = (0, import_scheduling55.schedError)("SCHED_409", { paymentId, blockerCode, error: lookupError });
     console.error("[booking] Could not check for an existing booking before refunding:", err.ref, lookupError);
     return corsJson(cors, { error: "We could not confirm your booking just now. Please try again.", ref: err.ref }, { status: 503 });
   }
   if (existingBooking) {
-    const err = (0, import_scheduling51.schedError)("SCHED_404", { paymentId, existingAppointmentId: existingBooking.id });
+    const err = (0, import_scheduling55.schedError)("SCHED_404", { paymentId, existingAppointmentId: existingBooking.id });
     return corsJson(
       cors,
       { error: "This payment has already been used for a booking", ref: err.ref, code: "PAYMENT_ALREADY_USED" },
@@ -6249,7 +6519,7 @@ async function resolveBookingContext(host, cors, body) {
 }
 
 // src/booking/verify-booking-payment.ts
-var import_scheduling52 = require("@ordinatio/scheduling");
+var import_scheduling56 = require("@ordinatio/scheduling");
 async function verifyBookingPayment(db, payments, cors, organizationId, appointmentType, body) {
   const refuse = (status, payload) => ({
     ok: false,
@@ -6266,7 +6536,7 @@ async function verifyBookingPayment(db, payments, cors, organizationId, appointm
     select: { id: true }
   });
   if (existingBooking) {
-    const err = (0, import_scheduling52.schedError)("SCHED_404", { paymentId: body.paymentId, existingAppointmentId: existingBooking.id });
+    const err = (0, import_scheduling56.schedError)("SCHED_404", { paymentId: body.paymentId, existingAppointmentId: existingBooking.id });
     return refuse(409, {
       error: "This payment has already been used for a booking",
       ref: err.ref,
@@ -6276,7 +6546,7 @@ async function verifyBookingPayment(db, payments, cors, organizationId, appointm
   const metaTypeId = payment.metadata?.typeId;
   const metaClientEmail = payment.metadata?.clientEmail;
   if (metaTypeId !== body.typeId || metaClientEmail && metaClientEmail.toLowerCase() !== body.clientEmail.toLowerCase()) {
-    const err = (0, import_scheduling52.schedError)("SCHED_405", {
+    const err = (0, import_scheduling56.schedError)("SCHED_405", {
       paymentId: body.paymentId,
       metaTypeId,
       bodyTypeId: body.typeId,
@@ -6306,7 +6576,7 @@ async function verifyBookingPayment(db, payments, cors, organizationId, appointm
     }
   }
   if (payment.amount === void 0) {
-    const err = (0, import_scheduling52.schedError)("SCHED_405", { paymentId: body.paymentId, currency: payment.currency });
+    const err = (0, import_scheduling56.schedError)("SCHED_405", { paymentId: body.paymentId, currency: payment.currency });
     return refuse(400, { error: "Payment currency is not supported", ref: err.ref });
   }
   if (Math.round(payment.amount * 100) !== expectedCents) {
@@ -6347,7 +6617,7 @@ async function bookAppointmentRoute(request, { host }) {
     } catch (linkError) {
       console.error("[booking] client link lookup failed \u2014 saving the appointment unlinked:", linkError instanceof Error ? linkError.message : linkError);
     }
-    const appointment = await (0, import_scheduling53.bookAppointment)(db, {
+    const appointment = await (0, import_scheduling57.bookAppointment)(db, {
       calendarId: body.calendarId,
       preferredCalendarId: body.preferredCalendarId,
       typeId: body.typeId,
@@ -6409,8 +6679,466 @@ async function bookAppointmentRoute(request, { host }) {
   }
 }
 
+// src/handlers/waitlist-offer.ts
+async function getWaitlistOfferRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.waitlist) return corsJson(cors, NOT_ENABLED2, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`waitlist-offer:${clientAddress(request)}`, "AVAILABILITY");
+    if (limited) return limited;
+    const url = new URL(request.url);
+    const token = url.searchParams.get("token");
+    if (!token) return corsJson(cors, { error: "token is required" }, { status: 400 });
+    const context = await resolveWaitlistDb(host, url.searchParams.get("orgSlug"));
+    if (!context) return corsJson(cors, { error: "No open offer for this link", code: "SCHED_1106" }, { status: 404 });
+    const offer = await (0, import_scheduling58.getWaitlistOffer)(context.db, token);
+    return corsJson(cors, {
+      typeName: offer.typeName,
+      calendarName: offer.calendarName,
+      startTime: offer.startTime,
+      timezone: offer.timezone,
+      expiresAt: offer.expiresAt,
+      clientName: offer.clientName
+    });
+  } catch (error) {
+    return waitlistErrorResponse(cors, error, "Failed to read the offer");
+  }
+}
+var AcceptSchema = import_zod18.z.object({ token: import_zod18.z.string().min(1).max(200), orgSlug: import_zod18.z.string().min(1).max(100).optional() });
+async function acceptWaitlistOfferRoute(request, context) {
+  const { host } = context;
+  const cors = host.cors(request);
+  const settings = host.waitlist;
+  if (!settings) return corsJson(cors, NOT_ENABLED2, { status: 501 });
+  let entryId = null;
+  let db = null;
+  let booked = false;
+  try {
+    const limited = await host.rateLimit(`waitlist-accept:${clientAddress(request)}`, "GENERAL");
+    if (limited) return limited;
+    const parsed = AcceptSchema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) return corsJson(cors, { error: "token is required" }, { status: 400 });
+    db = await resolveWaitlistDb(host, parsed.data.orgSlug);
+    if (!db) return corsJson(cors, { error: "No open offer for this link", code: "SCHED_1106" }, { status: 404 });
+    const offer = await (0, import_scheduling58.beginWaitlistAccept)(db.db, parsed.data.token);
+    entryId = offer.entryId;
+    const headers = new Headers(request.headers);
+    headers.set("content-type", "application/json");
+    const response = await bookAppointmentRoute(
+      new Request(request.url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          calendarId: offer.calendarId,
+          typeId: offer.typeId,
+          startTime: offer.startTime.toISOString(),
+          timezone: offer.timezone,
+          clientName: offer.clientName,
+          clientEmail: offer.clientEmail,
+          ...offer.clientPhone ? { clientPhone: offer.clientPhone } : {},
+          ...parsed.data.orgSlug ? { orgSlug: parsed.data.orgSlug } : {}
+        })
+      }),
+      context
+    );
+    if (response.status === 201) {
+      booked = true;
+      const appointment = await response.clone().json().catch(() => null);
+      try {
+        await (0, import_scheduling58.completeWaitlistAccept)(db.db, entryId, appointment?.id ?? "");
+      } catch (completeError) {
+        console.error("[waitlist] the booking was saved but its waitlist entry could not be marked booked:", completeError);
+      }
+      return response;
+    }
+    const saved = await (0, import_scheduling58.settleBookedAccept)(db.db, entryId);
+    if (saved) return corsJson(cors, saved, { status: 201 });
+    await endFailedAccept(host, settings, db.db, entryId, releaseFor(response.status));
+    return response;
+  } catch (error) {
+    if (entryId && db && !booked) {
+      try {
+        const saved = await (0, import_scheduling58.settleBookedAccept)(db.db, entryId);
+        if (saved) return corsJson(cors, saved, { status: 201 });
+        await endFailedAccept(host, settings, db.db, entryId, "KEEP_OFFER");
+      } catch (releaseError) {
+        console.error("[waitlist] could not settle or release an accept:", releaseError);
+      }
+    }
+    return waitlistErrorResponse(cors, error, "Failed to accept the offer");
+  }
+}
+function releaseFor(status) {
+  if (status === 409) return "BACK_IN_LINE";
+  if (status === 429 || status >= 500) return "KEEP_OFFER";
+  return "DROP";
+}
+async function endFailedAccept(host, settings, db, entryId, outcome) {
+  const freed = await (0, import_scheduling58.releaseWaitlistAccept)(db, entryId, outcome);
+  if (freed) await offerAndAnnounce(host, settings, db, freed);
+}
+
+// src/handlers/admin-waitlist.ts
+var import_scheduling59 = require("@ordinatio/scheduling");
+var STATUSES2 = /* @__PURE__ */ new Set(["WAITING", "OFFERED", "ACCEPTING", "BOOKED", "EXPIRED"]);
+async function listWaitlistEntries(request, { host }) {
+  try {
+    const guard = await requireWaitlistAdmin(host, request, { action: "admin-waitlist-list", tier: "GENERAL" });
+    if (guard instanceof Response) return guard;
+    const status = new URL(request.url).searchParams.get("status");
+    if (status && !STATUSES2.has(status)) {
+      return Response.json({ error: `status must be one of ${[...STATUSES2].join(", ")}` }, { status: 400 });
+    }
+    const { limit, offset } = parsePagination(request);
+    const { entries, total } = await (0, import_scheduling59.listWaitlist)(guard.staff.db, {
+      organizationId: guard.staff.organizationId,
+      status: status ?? void 0,
+      limit,
+      offset
+    });
+    return Response.json({ entries, total, hasMore: offset + entries.length < total });
+  } catch (error) {
+    return webhookErrorResponse(error, "Failed to list the waitlist");
+  }
+}
+async function removeWaitlistEntryRoute(request, { host, params }) {
+  try {
+    const guard = await requireWaitlistAdmin(host, request, { action: "admin-waitlist-remove", tier: "DELETE" });
+    if (guard instanceof Response) return guard;
+    const { db, organizationId } = guard.staff;
+    const freed = await (0, import_scheduling59.removeWaitlistEntry)(db, organizationId, params.id);
+    await host.activity.log(db, {
+      action: "scheduling.waitlist_entry_removed",
+      description: "removed someone from the waitlist",
+      metadata: { entryId: params.id }
+    });
+    if (freed) await offerAndAnnounce(host, guard.settings, db, freed);
+    return Response.json({ success: true });
+  } catch (error) {
+    return webhookErrorResponse(error, "Failed to remove the waitlist entry");
+  }
+}
+
+// src/handlers/internal-waitlist-sweep.ts
+var import_scheduling60 = require("@ordinatio/scheduling");
+async function sweepWaitlist(request, { host }) {
+  if (!await host.internalAccess.isAuthorized(request)) return Response.json({ error: "Unauthorized" }, { status: 401 });
+  if (!host.waitlist) return Response.json(NOT_ENABLED2, { status: 501 });
+  const limited = await host.rateLimit(`${request.headers.get("x-forwarded-for") ?? "worker"}:waitlist-sweep`, "INTERNAL");
+  if (limited) return limited;
+  try {
+    const db = await host.publicDb();
+    const { lapsed, released, booked } = await (0, import_scheduling60.expireWaitlistOffers)(db);
+    let reoffered = 0;
+    for (const slot of lapsed) {
+      if (await offerAndAnnounce(host, host.waitlist, db, slot)) reoffered++;
+    }
+    return Response.json({ lapsed: lapsed.length, released, booked, reoffered });
+  } catch (error) {
+    console.error("[scheduling-api] waitlist sweep failed:", error);
+    return Response.json({ error: "Waitlist sweep failed" }, { status: 500 });
+  }
+}
+
+// src/handlers/routing-forms-public.ts
+var import_scheduling62 = require("@ordinatio/scheduling");
+
+// src/routing/routing-http.ts
+var import_scheduling61 = require("@ordinatio/scheduling");
+var NOT_ENABLED3 = { error: "Routing forms are not enabled on this server" };
+var STATUS_BY_CODE2 = { SCHED_1201: 404, SCHED_1202: 409, SCHED_1204: 409 };
+function routingErrorResponse(error, fallback, cors) {
+  const send = (payload, status) => cors ? corsJson(cors, payload, { status }) : Response.json(payload, { status });
+  if (error instanceof import_scheduling61.SchedulingValidationError || error instanceof import_scheduling61.SchedulingNotFoundError) {
+    const details = error.context.errors;
+    const status = STATUS_BY_CODE2[error.code] ?? 400;
+    return send({ error: error.message, code: error.code, ref: getErrorRef(error), ...details ? { details } : {} }, status);
+  }
+  console.error("[routing-forms]", error);
+  return send({ error: fallback }, 500);
+}
+async function requireRoutingAdmin(host, request, options) {
+  const staff = await requireAdminStaff(host, request, options);
+  if (staff instanceof Response) return staff;
+  if (!host.routingForms) return Response.json(NOT_ENABLED3, { status: 501 });
+  return staff;
+}
+
+// src/handlers/routing-forms-public.ts
+async function resolveOrganization(host, orgSlug) {
+  if (!orgSlug) return { db: await host.publicDb(), organizationId: null };
+  return host.organizations.resolve({ orgSlug, logPrefix: "[routing-forms]" });
+}
+async function getRoutingFormRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.routingForms) return corsJson(cors, NOT_ENABLED3, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`routing-form:${clientAddress(request)}`, "AVAILABILITY");
+    if (limited) return limited;
+    const url = new URL(request.url);
+    const slug = url.searchParams.get("slug");
+    if (!slug) return corsJson(cors, { error: "slug is required" }, { status: 400 });
+    const context = await resolveOrganization(host, url.searchParams.get("orgSlug"));
+    if (!context) return corsJson(cors, { error: "Routing form not found", code: "SCHED_1201" }, { status: 404 });
+    return corsJson(cors, await (0, import_scheduling62.getPublicRoutingForm)(context.db, { organizationId: context.organizationId, slug }));
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to read the form", cors);
+  }
+}
+async function routeClientRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.routingForms) return corsJson(cors, NOT_ENABLED3, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`routing-route:${clientAddress(request)}`, "AVAILABILITY");
+    if (limited) return limited;
+    const parsed = RouteClientSchema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) {
+      const details = parsed.error.issues.map((issue) => ({ field: issue.path.join("."), message: issue.message }));
+      return corsJson(cors, { error: "Validation failed", details }, { status: 400 });
+    }
+    const context = await resolveOrganization(host, parsed.data.orgSlug);
+    if (!context) return corsJson(cors, { error: "Routing form not found", code: "SCHED_1201" }, { status: 404 });
+    const outcome = await (0, import_scheduling62.routeClient)(context.db, { organizationId: context.organizationId, slug: parsed.data.slug, answers: parsed.data.answers });
+    return corsJson(cors, outcome);
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to route the answers", cors);
+  }
+}
+
+// src/handlers/admin-routing-forms.ts
+var import_scheduling63 = require("@ordinatio/scheduling");
+async function listRoutingFormsRoute(request, { host }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-list", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    return Response.json({ forms: await (0, import_scheduling63.listRoutingForms)(staff.db, staff.organizationId) });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to list the forms");
+  }
+}
+async function createRoutingFormRoute(request, { host }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-create", tier: "CREATE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, CreateRoutingFormSchema);
+    if (!validation.success) return validation.response;
+    const form = await (0, import_scheduling63.createRoutingForm)(staff.db, staff.organizationId, validation.data);
+    await host.activity.log(staff.db, {
+      action: "scheduling.routing_form_created",
+      description: `created routing form "${form.name}"`,
+      metadata: { formId: form.id, slug: form.slug }
+    });
+    return Response.json({ form }, { status: 201 });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to save the form");
+  }
+}
+
+// src/handlers/brand-public.ts
+var import_scheduling64 = require("@ordinatio/scheduling");
+async function getBrandRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.brand) return corsJson(cors, NOT_ENABLED, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`brand:${clientAddress(request)}`, "AVAILABILITY");
+    if (limited) return limited;
+    const orgSlug = new URL(request.url).searchParams.get("orgSlug");
+    const context = orgSlug ? await host.organizations.resolve({ orgSlug, logPrefix: "[brand]" }) : { db: await host.publicDb(), organizationId: null };
+    const brand = context ? await (0, import_scheduling64.getPublicBrand)(context.db, context.organizationId) : null;
+    if (!brand) return corsJson(cors, { error: "No brand set" }, { status: 404 });
+    return corsJson(cors, { brand }, { headers: WIDGET_CACHE_HEADERS });
+  } catch (error) {
+    return brandErrorResponse(error, "Failed to read the brand", cors);
+  }
+}
+
+// src/handlers/admin-brand.ts
+var import_scheduling65 = require("@ordinatio/scheduling");
+async function getBrandAdminRoute(request, { host }) {
+  try {
+    const staff = await requireBrandAdmin(host, request, { action: "admin-brand-get", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    return Response.json({ brand: await (0, import_scheduling65.getBrand)(staff.db, staff.organizationId) });
+  } catch (error) {
+    return brandErrorResponse(error, "Failed to read the brand");
+  }
+}
+async function saveBrandRoute(request, { host }) {
+  try {
+    const staff = await requireBrandAdmin(host, request, { action: "admin-brand-save", tier: "UPDATE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, BrandSchema);
+    if (!validation.success) return validation.response;
+    const verifier = host.brand?.isSendingDomainVerified;
+    const brand = await (0, import_scheduling65.saveBrand)(staff.db, staff.organizationId, validation.data, {
+      isSendingDomainVerified: verifier ? async (domain) => Boolean(await verifier.call(host.brand, domain, staff.organizationId)) : void 0
+    });
+    await host.activity.log(staff.db, {
+      action: "scheduling.brand_saved",
+      description: "changed the brand",
+      metadata: { displayName: brand.displayName, sendsFromOwnDomain: Boolean(brand.fromEmail) }
+    });
+    return Response.json({ brand });
+  } catch (error) {
+    return brandErrorResponse(error, "Failed to save the brand");
+  }
+}
+async function deleteBrandRoute(request, { host }) {
+  try {
+    const staff = await requireBrandAdmin(host, request, { action: "admin-brand-delete", tier: "DELETE" });
+    if (staff instanceof Response) return staff;
+    const removed = await (0, import_scheduling65.deleteBrand)(staff.db, staff.organizationId);
+    if (removed) await host.activity.log(staff.db, { action: "scheduling.brand_removed", description: "removed the brand", metadata: {} });
+    return Response.json({ removed });
+  } catch (error) {
+    return brandErrorResponse(error, "Failed to remove the brand");
+  }
+}
+
+// src/handlers/admin-privacy.ts
+var import_scheduling67 = require("@ordinatio/scheduling");
+
+// src/privacy/privacy-http.ts
+var import_scheduling66 = require("@ordinatio/scheduling");
+var NOT_ENABLED4 = { error: "Data export and erasure are not enabled on this server" };
+var STATUS_BY_CODE3 = { SCHED_1300: 400, SCHED_1301: 409 };
+function privacyErrorResponse(error, fallback) {
+  if (error instanceof import_scheduling66.SchedulingValidationError) {
+    return Response.json(
+      { error: error.message, code: error.code, ref: getErrorRef(error), details: error.context },
+      { status: STATUS_BY_CODE3[error.code] ?? 400 }
+    );
+  }
+  console.error("[privacy]", error);
+  return Response.json({ error: fallback }, { status: 500 });
+}
+async function requirePrivacyAdmin(host, request, options) {
+  const staff = await requireAdminStaff(host, request, options);
+  if (staff instanceof Response) return staff;
+  if (!host.privacy) return Response.json(NOT_ENABLED4, { status: 501 });
+  return staff;
+}
+
+// src/handlers/admin-privacy.ts
+async function logQuietly(host, db, entry) {
+  try {
+    await host.activity.log(db, entry);
+  } catch (error) {
+    console.error("[privacy] could not write the activity entry:", error);
+  }
+}
+async function exportPrivacyRoute(request, { host }) {
+  try {
+    const staff = await requirePrivacyAdmin(host, request, { action: "admin-privacy-export", tier: "CREATE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, PrivacySubjectSchema);
+    if (!validation.success) return validation.response;
+    const result = await (0, import_scheduling67.exportSubject)(staff.db, { organizationId: staff.organizationId, requestedBy: staff.userId, ...validation.data });
+    await logQuietly(host, staff.db, {
+      action: "scheduling.privacy_export",
+      description: "exported the data held about one person",
+      metadata: { counts: result.counts }
+    });
+    const stamp = result.exportedAt.slice(0, 10);
+    return new Response(JSON.stringify(result, null, 2), {
+      status: 200,
+      headers: {
+        "content-type": "application/json; charset=utf-8",
+        "content-disposition": `attachment; filename="scheduling-data-export-${stamp}.json"`,
+        "cache-control": "no-store"
+      }
+    });
+  } catch (error) {
+    return privacyErrorResponse(error, "Failed to export the data");
+  }
+}
+async function erasePrivacyRoute(request, { host }) {
+  try {
+    const staff = await requirePrivacyAdmin(host, request, { action: "admin-privacy-erase", tier: "DELETE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, PrivacyEraseSchema);
+    if (!validation.success) return validation.response;
+    const { confirm, ...subject2 } = validation.data;
+    if (confirm !== true) {
+      const preview = await (0, import_scheduling67.previewErase)(staff.db, { organizationId: staff.organizationId, ...subject2 });
+      return Response.json({ erased: false, preview }, { headers: { "cache-control": "no-store" } });
+    }
+    const { counts } = await (0, import_scheduling67.eraseSubject)(staff.db, { organizationId: staff.organizationId, requestedBy: staff.userId, ...subject2 });
+    await logQuietly(host, staff.db, {
+      action: "scheduling.privacy_erase",
+      description: "erased the data held about one person",
+      metadata: { counts }
+    });
+    return Response.json({ erased: true, counts }, { headers: { "cache-control": "no-store" } });
+  } catch (error) {
+    return privacyErrorResponse(error, "Failed to erase the data");
+  }
+}
+async function listPrivacyRequestsRoute(request, { host }) {
+  try {
+    const staff = await requirePrivacyAdmin(host, request, { action: "admin-privacy-requests", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    const { limit, offset } = parsePagination(request);
+    const { requests, total } = await (0, import_scheduling67.listPrivacyRequests)(staff.db, { organizationId: staff.organizationId, limit, offset });
+    return Response.json({ requests, total, hasMore: offset + requests.length < total });
+  } catch (error) {
+    return privacyErrorResponse(error, "Failed to list the requests");
+  }
+}
+
+// src/handlers/admin-routing-form-detail.ts
+var import_scheduling68 = require("@ordinatio/scheduling");
+async function getRoutingFormAdminRoute(request, { host, params }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-get", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    return Response.json({ form: await (0, import_scheduling68.getRoutingForm)(staff.db, staff.organizationId, params.id) });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to read the form");
+  }
+}
+async function updateRoutingFormRoute(request, { host, params }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-update", tier: "UPDATE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, UpdateRoutingFormSchema);
+    if (!validation.success) return validation.response;
+    const form = await (0, import_scheduling68.updateRoutingForm)(staff.db, staff.organizationId, params.id, validation.data);
+    await host.activity.log(staff.db, {
+      action: "scheduling.routing_form_updated",
+      description: `changed routing form "${form.name}"`,
+      metadata: { formId: form.id, fields: Object.keys(validation.data) }
+    });
+    return Response.json({ form });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to save the form");
+  }
+}
+async function deleteRoutingFormRoute(request, { host, params }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-delete", tier: "DELETE" });
+    if (staff instanceof Response) return staff;
+    await (0, import_scheduling68.deleteRoutingForm)(staff.db, staff.organizationId, params.id);
+    await host.activity.log(staff.db, { action: "scheduling.routing_form_deleted", description: "removed a routing form", metadata: { formId: params.id } });
+    return Response.json({ success: true });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to remove the form");
+  }
+}
+async function testRoutingFormRoute(request, { host, params }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-test", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, TestRoutingFormSchema);
+    if (!validation.success) return validation.response;
+    return Response.json(await (0, import_scheduling68.testRoutingForm)(staff.db, { organizationId: staff.organizationId, id: params.id, answers: validation.data.answers }));
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to test the form");
+  }
+}
+
 // src/handlers/appointments-list.ts
-var import_scheduling54 = require("@ordinatio/scheduling");
+var import_scheduling69 = require("@ordinatio/scheduling");
 var DEFAULT_LIMIT2 = 50;
 var MAX_LIMIT2 = 500;
 async function listAppointments(request, { host }) {
@@ -6422,7 +7150,7 @@ async function listAppointments(request, { host }) {
     const clientId = params.get("clientId") || void 0;
     const status = params.get("status") || void 0;
     if (!clientId && !staff.isAdmin) {
-      const err = (0, import_scheduling54.schedError)("SCHED_900", { role: staff.role });
+      const err = (0, import_scheduling69.schedError)("SCHED_900", { role: staff.role });
       return Response.json({ error: "Forbidden", ref: err.ref }, { status: 403 });
     }
     const startDate = params.get("startDate");
@@ -6502,7 +7230,7 @@ async function listAppointments(request, { host }) {
 }
 
 // src/handlers/availability.ts
-var import_scheduling55 = require("@ordinatio/scheduling");
+var import_scheduling70 = require("@ordinatio/scheduling");
 
 // src/availability/picked-day.ts
 var CALENDAR_DAY_SHAPE = /^\d{4}-\d{2}-\d{2}$/;
@@ -6615,7 +7343,7 @@ async function getAvailability(request, { host }) {
       const cached = await readCache(host.availabilityCache, calendarId, cacheDay, typeDuration);
       if (cached != null) return corsJson(cors, cached);
     }
-    const result = await (0, import_scheduling55.getAvailableSlots)(db, {
+    const result = await (0, import_scheduling70.getAvailableSlots)(db, {
       calendarId,
       date: dateObj,
       localDate: pickedDay,
@@ -6636,7 +7364,7 @@ async function getAvailability(request, { host }) {
 }
 
 // src/handlers/availability-team.ts
-var import_scheduling56 = require("@ordinatio/scheduling");
+var import_scheduling71 = require("@ordinatio/scheduling");
 
 // src/loaders/team-type.ts
 async function loadTeamType(db, typeId, organizationId) {
@@ -6684,7 +7412,7 @@ async function getTeamAvailability(request, { host }) {
         { status: 400 }
       );
     }
-    const result = await (0, import_scheduling56.getTeamAvailableSlots)(db, {
+    const result = await (0, import_scheduling71.getTeamAvailableSlots)(db, {
       typeId,
       date: dateObj,
       localDate: pickedCalendarDay(date),
@@ -6707,7 +7435,7 @@ async function getTeamAvailability(request, { host }) {
 }
 
 // src/handlers/appointment-types.ts
-var import_scheduling57 = require("@ordinatio/scheduling");
+var import_scheduling72 = require("@ordinatio/scheduling");
 
 // src/loaders/types-by-calendar.ts
 function loadTypesByCalendarSlug(cache, db, organizationId, calendarSlug) {
@@ -6781,19 +7509,19 @@ async function getAppointmentTypes(request, { host }) {
     }));
     return corsJson(cors, response, { headers: WIDGET_CACHE_HEADERS });
   } catch (error) {
-    const diagnostic = (0, import_scheduling57.schedError)("SCHED_202", { error });
+    const diagnostic = (0, import_scheduling72.schedError)("SCHED_202", { error });
     console.error("[appointment-types]", diagnostic.ref, error);
     return corsJson(cors, { error: "Failed to fetch appointment types", ref: diagnostic.ref }, { status: 500 });
   }
 }
 
 // src/handlers/coupons-validate.ts
-var import_zod14 = require("zod");
-var import_scheduling58 = require("@ordinatio/scheduling");
-var Schema4 = import_zod14.z.object({
-  code: import_zod14.z.string().min(1).max(50).transform((v) => v.trim().toUpperCase()),
-  calendarId: import_zod14.z.string().min(1),
-  price: import_zod14.z.number().positive()
+var import_zod19 = require("zod");
+var import_scheduling73 = require("@ordinatio/scheduling");
+var Schema4 = import_zod19.z.object({
+  code: import_zod19.z.string().min(1).max(50).transform((v) => v.trim().toUpperCase()),
+  calendarId: import_zod19.z.string().min(1),
+  price: import_zod19.z.number().positive()
 });
 function calculateDiscount(price, discountType, discountValue) {
   if (discountType === "PERCENTAGE") {
@@ -6851,7 +7579,7 @@ async function validateCoupon(request, { host }) {
       { headers: host.cors(request) }
     );
   } catch (error) {
-    const err = (0, import_scheduling58.schedError)("SCHED_408", {
+    const err = (0, import_scheduling73.schedError)("SCHED_408", {
       calendarId,
       error: error instanceof Error ? error.message : String(error)
     });
@@ -6906,7 +7634,7 @@ async function getPublicCalendar(request, { host }) {
 }
 
 // src/handlers/type.ts
-var import_scheduling59 = require("@ordinatio/scheduling");
+var import_scheduling74 = require("@ordinatio/scheduling");
 
 // src/loaders/type-by-slug.ts
 function loadTypeBySlug(cache, db, organizationId, slug) {
@@ -7011,14 +7739,14 @@ async function getType(request, { host }) {
       { headers: WIDGET_CACHE_HEADERS }
     );
   } catch (error) {
-    const diagnostic = (0, import_scheduling59.schedError)("SCHED_207", { error });
+    const diagnostic = (0, import_scheduling74.schedError)("SCHED_207", { error });
     console.error("[type]", diagnostic.ref, error);
     return corsJson(cors, { error: "Failed to fetch appointment type", ref: diagnostic.ref }, { status: 500 });
   }
 }
 
 // src/handlers/widget-init.ts
-var import_scheduling60 = require("@ordinatio/scheduling");
+var import_scheduling75 = require("@ordinatio/scheduling");
 
 // src/loaders/widget-data.ts
 function loadWidgetData(cache, db, organizationId, calendarSlug) {
@@ -7107,7 +7835,7 @@ async function getWidgetInit(request, { host }) {
     }));
     return corsJson(cors, { calendar, types: sanitizedTypes }, { headers: WIDGET_CACHE_HEADERS });
   } catch (error) {
-    const diagnostic = (0, import_scheduling60.schedError)("SCHED_206", { error });
+    const diagnostic = (0, import_scheduling75.schedError)("SCHED_206", { error });
     console.error("[widget-init]", diagnostic.ref, error);
     return corsJson(cors, { error: "Failed to load widget data", ref: diagnostic.ref }, { status: 500 });
   }
@@ -7124,6 +7852,13 @@ var ROUTES = [
   { method: "GET", path: "/availability", public: true, handler: getAvailability },
   { method: "GET", path: "/availability/team", public: true, handler: getTeamAvailability },
   { method: "POST", path: "/appointments", public: true, handler: bookAppointmentRoute },
+  { method: "GET", path: "/routing-forms", public: true, handler: getRoutingFormRoute },
+  { method: "POST", path: "/routing-forms/route", public: true, handler: routeClientRoute },
+  { method: "GET", path: "/brand", public: true, handler: getBrandRoute },
+  { method: "POST", path: "/waitlist", public: true, handler: joinWaitlistRoute },
+  { method: "DELETE", path: "/waitlist", public: true, handler: leaveWaitlistRoute },
+  { method: "GET", path: "/waitlist/offer", public: true, handler: getWaitlistOfferRoute },
+  { method: "POST", path: "/waitlist/offer/accept", public: true, handler: acceptWaitlistOfferRoute },
   { method: "GET", path: "/appointments", public: false, handler: listAppointments },
   { method: "GET", path: "/appointments/capacity", public: true, handler: getCapacity },
   { method: "GET", path: "/appointments/ical", public: false, handler: getAppointmentIcal },
@@ -7165,6 +7900,21 @@ var ROUTES = [
   { method: "GET", path: "/admin/webhooks/[id]/deliveries", public: false, handler: listWebhookEndpointDeliveries },
   { method: "POST", path: "/admin/webhook-deliveries/[id]/retry", public: false, handler: retryWebhook },
   { method: "POST", path: "/internal/webhooks/deliver", public: false, handler: deliverWebhooks },
+  { method: "GET", path: "/admin/routing-forms", public: false, handler: listRoutingFormsRoute },
+  { method: "POST", path: "/admin/routing-forms", public: false, handler: createRoutingFormRoute },
+  { method: "GET", path: "/admin/routing-forms/[id]", public: false, handler: getRoutingFormAdminRoute },
+  { method: "PUT", path: "/admin/routing-forms/[id]", public: false, handler: updateRoutingFormRoute },
+  { method: "DELETE", path: "/admin/routing-forms/[id]", public: false, handler: deleteRoutingFormRoute },
+  { method: "POST", path: "/admin/routing-forms/[id]/test", public: false, handler: testRoutingFormRoute },
+  { method: "GET", path: "/admin/brand", public: false, handler: getBrandAdminRoute },
+  { method: "PUT", path: "/admin/brand", public: false, handler: saveBrandRoute },
+  { method: "DELETE", path: "/admin/brand", public: false, handler: deleteBrandRoute },
+  { method: "POST", path: "/admin/privacy/export", public: false, handler: exportPrivacyRoute },
+  { method: "POST", path: "/admin/privacy/erase", public: false, handler: erasePrivacyRoute },
+  { method: "GET", path: "/admin/privacy/requests", public: false, handler: listPrivacyRequestsRoute },
+  { method: "GET", path: "/admin/waitlist", public: false, handler: listWaitlistEntries },
+  { method: "DELETE", path: "/admin/waitlist/[id]", public: false, handler: removeWaitlistEntryRoute },
+  { method: "POST", path: "/internal/waitlist/sweep", public: false, handler: sweepWaitlist },
   { method: "GET", path: "/analytics", public: false, handler: getAnalytics },
   { method: "GET", path: "/admin/types", public: false, handler: listTypes },
   { method: "POST", path: "/admin/types", public: false, handler: createType },
@@ -7243,6 +7993,11 @@ function createSchedulingApi(config) {
     tenantDb: config.host.tenantDb?.bind(config.host) ?? (() => config.host.publicDb()),
     events: { emit: async () => void 0 },
     webhooks: config.host.webhooks ?? null,
+    waitlist: config.host.waitlist ?? null,
+    routingForms: config.host.routingForms ?? null,
+    privacy: config.host.privacy ?? null,
+    brand: config.host.brand ?? null,
+    icalUidDomain: config.host.icalUidDomain?.bind(config.host) ?? (() => null),
     calendarSync: config.host.calendarSync ?? { upsertEvent: async () => ({}), removeEvent: async () => void 0 },
     activity: config.host.activity ?? { log: async () => void 0, isOpen: async () => false, resolve: async () => void 0 },
     appUrl: config.host.appUrl?.bind(config.host) ?? (() => null),
@@ -7268,7 +8023,7 @@ function createSchedulingApi(config) {
     jsonNull: config.host.jsonNull?.bind(config.host) ?? (() => null),
     cors: config.host.cors?.bind(config.host) ?? defaultCorsHeaders
   };
-  host.events = withWebhooks(config.host.events ?? { emit: async () => void 0 }, host);
+  host.events = withWebhooks(withWaitlist(config.host.events ?? { emit: async () => void 0 }, host), host);
   async function handle(request) {
     const { pathname } = new URL(request.url);
     if (pathname !== basePath && !pathname.startsWith(`${basePath}/`)) return notFound();
@@ -7423,6 +8178,7 @@ function createNodeListener(api, options) {
   BalanceRequestInProgressError,
   BookingPageConfigSchema,
   BookingPageThemeSchema,
+  BrandSchema,
   CancelRecurringScopeSchema,
   CancelRecurringSeriesSchema,
   CreateAppointmentCategorySchema,
@@ -7433,6 +8189,7 @@ function createNodeListener(api, options) {
   CreateNotificationTemplateSchema,
   CreatePackagePurchaseSchema,
   CreateRecurringSeriesSchema,
+  CreateRoutingFormSchema,
   CreateServicePackageSchema,
   CreateWebhookEndpointSchema,
   DEFAULT_CANCELLATION_POLICY,
@@ -7441,13 +8198,17 @@ function createNodeListener(api, options) {
   NotificationChannelSchema,
   NotificationTriggerSchema,
   OrgCancellationPolicySchema,
+  PrivacyEraseSchema,
+  PrivacySubjectSchema,
   RETRYABLE_REFUND_STATUSES,
   RecurringFrequencySchema,
   RefundOutcomePersistenceError,
+  RouteClientSchema,
   SLOT_GRANULARITY_DEFAULT,
   SLOT_GRANULARITY_OPTIONS,
   TERMINAL_SUCCESS_STATUSES,
   TOKEN_TTL_DAYS,
+  TestRoutingFormSchema,
   UnverifiedPaymentError,
   UpdateAppointmentCategorySchema,
   UpdateAppointmentTypeSchema,
@@ -7456,6 +8217,7 @@ function createNodeListener(api, options) {
   UpdateCouponCodeSchema,
   UpdateNotificationTemplateSchema,
   UpdatePackagePurchaseSchema,
+  UpdateRoutingFormSchema,
   UpdateServicePackageSchema,
   attemptLegRefund,
   createBalanceIntent,