@ordinatio/scheduling-api 0.1.0 → 0.2.0

package/dist/index.mjs

@@ -1,6 +1,7 @@
 import {
   BookingPageConfigSchema,
   BookingPageThemeSchema,
+  BrandSchema,
   CancelRecurringScopeSchema,
   CancelRecurringSeriesSchema,
   CreateAppointmentCategorySchema,
@@ -11,6 +12,7 @@ import {
   CreateNotificationTemplateSchema,
   CreatePackagePurchaseSchema,
   CreateRecurringSeriesSchema,
+  CreateRoutingFormSchema,
   CreateServicePackageSchema,
   CreateWebhookEndpointSchema,
   DEFAULT_CANCELLATION_POLICY,
@@ -19,9 +21,13 @@ import {
   NotificationChannelSchema,
   NotificationTriggerSchema,
   OrgCancellationPolicySchema,
+  PrivacyEraseSchema,
+  PrivacySubjectSchema,
   RecurringFrequencySchema,
+  RouteClientSchema,
   SLOT_GRANULARITY_DEFAULT,
   SLOT_GRANULARITY_OPTIONS,
+  TestRoutingFormSchema,
   UpdateAppointmentCategorySchema,
   UpdateAppointmentTypeSchema,
   UpdateBookingPageSchema,
@@ -29,8 +35,9 @@ import {
   UpdateCouponCodeSchema,
   UpdateNotificationTemplateSchema,
   UpdatePackagePurchaseSchema,
+  UpdateRoutingFormSchema,
   UpdateServicePackageSchema
-} from "./chunk-IAQBLF5F.mjs";
+} from "./chunk-MQO3VRMU.mjs";
 
 // src/cors.ts
 function defaultCorsHeaders() {
@@ -253,6 +260,85 @@ function withWebhooks(inner, host) {
   };
 }
 
+// src/waitlist/announce-offer.ts
+import { enqueueWebhookEvent, tryOfferFreedSlot } from "@ordinatio/scheduling";
+async function offerAndAnnounce(host, settings, db, slot) {
+  const offer = await tryOfferFreedSlot(db, { ...slot, offerMinutes: settings.offerMinutes });
+  if (!offer) return false;
+  const details = {
+    organizationId: slot.organizationId,
+    token: offer.token,
+    clientName: offer.entry.clientName,
+    clientEmail: offer.entry.clientEmail,
+    clientPhone: offer.entry.clientPhone,
+    typeName: offer.typeName,
+    calendarName: offer.calendarName,
+    startTime: offer.startTime,
+    timezone: offer.timezone,
+    expiresAt: offer.expiresAt
+  };
+  if (settings.notify) {
+    try {
+      await settings.notify(details);
+    } catch (error) {
+      console.error("[waitlist] the host could not send the offer; it stays open until it expires:", error);
+    }
+  }
+  if (host.webhooks) {
+    try {
+      await enqueueWebhookEvent(db, {
+        organizationId: slot.organizationId,
+        type: "waitlist.offered",
+        // Each offering has its own id, so offering the same slot to the same person again still reaches subscribers.
+        eventId: `waitlist_offer_${offer.entry.id}_${offer.startTime.getTime()}_${offer.expiresAt.getTime()}`,
+        data: {
+          offer: {
+            entryId: offer.entry.id,
+            token: offer.token,
+            clientName: details.clientName,
+            clientEmail: details.clientEmail,
+            clientPhone: details.clientPhone,
+            typeName: details.typeName,
+            calendarName: details.calendarName,
+            calendarId: offer.calendarId,
+            startTime: offer.startTime.toISOString(),
+            expiresAt: offer.expiresAt.toISOString()
+          }
+        }
+      });
+    } catch (error) {
+      console.error("[waitlist] could not queue the waitlist.offered webhook:", error);
+    }
+  }
+  return true;
+}
+
+// src/waitlist/waitlist-events.ts
+var FREED_BY = /* @__PURE__ */ new Set(["appointment.cancelled", "appointment.rejected", "appointment.updated"]);
+function withWaitlist(inner, host) {
+  return {
+    async emit(organizationId, type, data) {
+      const appointmentId = data.appointmentId;
+      if (host.waitlist && FREED_BY.has(type) && typeof appointmentId === "string") {
+        try {
+          const db = await host.tenantDb(organizationId, "waitlist");
+          const appointment = db ? await db.appointment.findUnique({
+            where: { id: appointmentId },
+            select: { calendarId: true, startTime: true, rescheduledFrom: true, status: true, calendar: { select: { organizationId: true } } }
+          }) : null;
+          if (db && appointment && (appointment.calendar.organizationId ?? organizationId) === organizationId) {
+            const freed = type === "appointment.updated" ? appointment.rescheduledFrom : appointment.status === "CANCELLED" ? appointment.startTime : null;
+            if (freed) await offerAndAnnounce(host, host.waitlist, db, { organizationId, calendarId: appointment.calendarId, startTime: freed });
+          }
+        } catch (error) {
+          console.error("[scheduling-api] could not offer a freed slot to the waitlist:", error);
+        }
+      }
+      await inner.emit(organizationId, type, data);
+    }
+  };
+}
+
 // src/handlers/manage-cancel.ts
 import { schedError as schedError3 } from "@ordinatio/scheduling";
 
@@ -381,7 +467,7 @@ async function cancelViaToken(host, db, organizationId, appointment) {
   const baseUrl = host.appUrl();
   if (baseUrl) {
     try {
-      await queueStaffNotification(db, appointment.id, "CANCELLATION", baseUrl);
+      await queueStaffNotification(db, appointment.id, "CANCELLATION", baseUrl, { brand: Boolean(host.brand) });
     } catch (staffError) {
       const diagnostic = schedError2("SCHED_607", { error: staffError, appointmentId: appointment.id });
       console.error("[DELETE /manage]", diagnostic.ref, staffError instanceof Error ? staffError.message : staffError);
@@ -546,19 +632,19 @@ async function rescheduleViaToken(host, db, organizationId, appointment, newTime
   );
   const baseUrl = host.appUrl() ?? void 0;
   if (baseUrl) {
-    await queueImmediateNotification(db, appointment.id, "RESCHEDULE", baseUrl);
+    await queueImmediateNotification(db, appointment.id, "RESCHEDULE", baseUrl, { brand: Boolean(host.brand) });
   } else {
     console.warn("[manage] no appUrl \u2014 RESCHEDULE notification skipped");
   }
   try {
-    await scheduleNotifications(db, appointment.id, baseUrl, { excludeTriggers: ["CONFIRMATION"] });
+    await scheduleNotifications(db, appointment.id, baseUrl, { excludeTriggers: ["CONFIRMATION"], brand: Boolean(host.brand) });
   } catch (error) {
     const diagnostic = schedError5("SCHED_604", { error, appointmentId: appointment.id });
     console.error("[PATCH /manage] scheduleNotifications failed (non-blocking):", diagnostic.ref, error instanceof Error ? error.message : error);
   }
   if (baseUrl) {
     try {
-      await queueStaffNotification2(db, appointment.id, "RESCHEDULE", baseUrl);
+      await queueStaffNotification2(db, appointment.id, "RESCHEDULE", baseUrl, { brand: Boolean(host.brand) });
     } catch (staffError) {
       const diagnostic = schedError5("SCHED_607", { error: staffError, appointmentId: appointment.id });
       console.error("[PATCH /manage]", diagnostic.ref, staffError instanceof Error ? staffError.message : staffError);
@@ -945,7 +1031,7 @@ async function cancelByStaff(request, { host, params }) {
     const baseUrl = host.appUrl();
     if (baseUrl) {
       try {
-        await queueStaffNotification3(db, id, "CANCELLATION", baseUrl);
+        await queueStaffNotification3(db, id, "CANCELLATION", baseUrl, { brand: Boolean(host.brand) });
       } catch (error) {
         await host.activity.log(db, {
           action: "scheduling.staff_notification_failed",
@@ -1260,7 +1346,7 @@ async function cancelFromCalendarSync(request, { host, params }) {
   await host.workerCommands.queue(source === "google" ? "delete-from-outlook" : "delete-from-google", { appointmentId: id });
   const baseUrl = host.appUrl();
   if (baseUrl) {
-    await queueImmediateNotification2(db, id, "CANCELLATION", baseUrl).catch(
+    await queueImmediateNotification2(db, id, "CANCELLATION", baseUrl, { brand: Boolean(host.brand) }).catch(
       (err) => console.warn("[cancel-sync] Failed to queue cancellation notification:", id, err instanceof Error ? err.message : err)
     );
   }
@@ -1366,7 +1452,7 @@ async function approveOrReject(request, { host, params }) {
     await cancelPendingNotifications(db, id);
     const baseUrl = host.appUrl();
     if (!baseUrl) throw new Error("NEXT_PUBLIC_APP_URL is required");
-    await scheduleNotifications2(db, id, baseUrl);
+    await scheduleNotifications2(db, id, baseUrl, { brand: Boolean(host.brand) });
     await host.availabilityCache.invalidate(appointment.calendarId);
     await host.events.emit(organizationId, "appointment.confirmed", { appointmentId: id });
     await host.activity.log(db, {
@@ -1429,14 +1515,14 @@ async function rescheduleByStaff(request, { host, params }) {
     });
     const baseUrl = host.appUrl();
     if (!baseUrl) throw new Error("NEXT_PUBLIC_APP_URL is required");
-    await queueImmediateNotification3(db, id, "RESCHEDULE", baseUrl);
+    await queueImmediateNotification3(db, id, "RESCHEDULE", baseUrl, { brand: Boolean(host.brand) });
     try {
-      await scheduleNotifications3(db, id, baseUrl, { excludeTriggers: ["CONFIRMATION"] });
+      await scheduleNotifications3(db, id, baseUrl, { excludeTriggers: ["CONFIRMATION"], brand: Boolean(host.brand) });
     } catch (error) {
       console.warn("[reschedule] scheduleNotifications failed:", error instanceof Error ? error.message : error);
     }
     try {
-      await queueStaffNotification4(db, id, "RESCHEDULE", baseUrl);
+      await queueStaffNotification4(db, id, "RESCHEDULE", baseUrl, { brand: Boolean(host.brand) });
     } catch (error) {
       await host.activity.log(db, {
         action: "scheduling.staff_notification_failed",
@@ -3419,7 +3505,7 @@ async function runSeriesSideEffects(host, db, organizationId, seriesId, client)
   const sendConfirmation = async (url, appointmentId) => {
     for (let tryNumber = 1; tryNumber <= 2; tryNumber += 1) {
       try {
-        await scheduleNotifications4(db, appointmentId, url);
+        await scheduleNotifications4(db, appointmentId, url, { brand: Boolean(host.brand) });
         return;
       } catch (error) {
         if (tryNumber === 2) record("Client confirmation", error);
@@ -3431,10 +3517,9 @@ async function runSeriesSideEffects(host, db, organizationId, seriesId, client)
       if (visit === confirmationVisit) {
         await sendConfirmation(baseUrl, visit.id);
       } else {
-        await attempt(
-          "Client notices",
-          () => scheduleNotifications4(db, visit.id, baseUrl, { excludeTriggers: ["CONFIRMATION"] })
-        );
+        await attempt("Client notices", async () => {
+          await scheduleNotifications4(db, visit.id, baseUrl, { excludeTriggers: ["CONFIRMATION"], brand: Boolean(host.brand) });
+        });
       }
     }
     await attempt(
@@ -3453,7 +3538,7 @@ async function runSeriesSideEffects(host, db, organizationId, seriesId, client)
     await Promise.all(visits.slice(from, from + VISITS_PER_GROUP).map(handleVisit));
   }
   if (baseUrl && confirmationVisit) {
-    await attempt("Staff alert", () => queueStaffNotification5(db, confirmationVisit.id, "CONFIRMATION", baseUrl));
+    await attempt("Staff alert", () => queueStaffNotification5(db, confirmationVisit.id, "CONFIRMATION", baseUrl, { brand: Boolean(host.brand) }));
   }
   await attempt("Availability cache", () => host.availabilityCache.invalidate(first.calendarId));
   await attempt(
@@ -3683,7 +3768,7 @@ async function runSeriesCancelSideEffects(host, db, organizationId, seriesId, se
   }
   const baseUrl = host.appUrl()?.trim();
   if (baseUrl) {
-    await attempt("Staff notice", () => queueStaffNotification6(db, occurrences[0].id, "CANCELLATION", baseUrl));
+    await attempt("Staff notice", () => queueStaffNotification6(db, occurrences[0].id, "CANCELLATION", baseUrl, { brand: Boolean(host.brand) }));
   } else {
     record("Staff notice", "skipped because the application address is not set");
   }
@@ -3888,6 +3973,36 @@ function escapeHtml(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
 }
 
+// src/brand/brand-http.ts
+import { getBrand, SchedulingValidationError as SchedulingValidationError4 } from "@ordinatio/scheduling";
+var NOT_ENABLED = { error: "Branding is not enabled on this server" };
+function brandErrorResponse(error, fallback, cors) {
+  const send = (payload, status) => cors ? corsJson(cors, payload, { status }) : Response.json(payload, { status });
+  if (error instanceof SchedulingValidationError4) {
+    const details = error.context.errors;
+    return send({ error: error.message, code: error.code, ref: getErrorRef(error), ...details ? { details } : {} }, 400);
+  }
+  console.error("[brand]", error);
+  return send({ error: fallback }, 500);
+}
+async function requireBrandAdmin(host, request, options) {
+  const staff = await requireAdminStaff(host, request, options);
+  if (staff instanceof Response) return staff;
+  if (!host.brand) return Response.json(NOT_ENABLED, { status: 501 });
+  return staff;
+}
+async function businessName(host, db, organizationId) {
+  if (host.brand) {
+    try {
+      const brand = await getBrand(db, organizationId);
+      if (brand) return brand.displayName;
+    } catch (error) {
+      console.error("[brand] could not read the brand for a message:", error);
+    }
+  }
+  return host.appName() || null;
+}
+
 // src/handlers/appointment-messages.ts
 var NOT_FOUND4 = () => Response.json({ error: "Appointment not found" }, { status: 404 });
 function failure2(label, error, fallback) {
@@ -3928,7 +4043,7 @@ async function sendFollowup(request, { host, params }) {
         { status: 400 }
       );
     }
-    const staffName = appointment.calendar.staffName || host.appName() || "Your provider";
+    const staffName = appointment.calendar.staffName || await businessName(host, db, organizationId) || "Your provider";
     const serviceName = appointment.type.name;
     await db.scheduledNotification.deleteMany({
       where: { appointmentId: id, trigger: "FOLLOWUP_MANUAL", status: "PENDING" }
@@ -3999,6 +4114,7 @@ async function sendReminder(request, { host, params }) {
       month: "long",
       day: "numeric"
     }) + " at " + time;
+    const providerName = appointment.calendar.staffName || await businessName(host, db, organizationId);
     await db.scheduledNotification.deleteMany({
       where: { appointmentId: id, trigger: "REMINDER_MANUAL", status: "PENDING" }
     });
@@ -4009,7 +4125,7 @@ async function sendReminder(request, { host, params }) {
           channel: "SMS",
           trigger: "REMINDER_MANUAL",
           recipient: appointment.clientPhone,
-          body: `Reminder: Your ${appointment.type.name} with ${appointment.calendar.staffName || host.appName() || "your provider"} is on ${dateTime}.`,
+          body: `Reminder: Your ${appointment.type.name} with ${providerName || "your provider"} is on ${dateTime}.`,
           scheduledFor: /* @__PURE__ */ new Date()
         }
       });
@@ -4030,7 +4146,7 @@ Date: ${dateTime}
 
 We look forward to seeing you!
 
-\u2014 ${escapeHtml(appointment.calendar.staffName || host.appName() || "Your provider")}`,
+\u2014 ${escapeHtml(providerName || "Your provider")}`,
         scheduledFor: /* @__PURE__ */ new Date()
       }
     });
@@ -4474,7 +4590,7 @@ async function getLocationRecents(request, { host, params }) {
 }
 
 // src/handlers/admin-availability-rules.ts
-import { listAvailabilityRules, SchedulingValidationError as SchedulingValidationError4, setWeeklyAvailability } from "@ordinatio/scheduling";
+import { listAvailabilityRules, SchedulingValidationError as SchedulingValidationError5, setWeeklyAvailability } from "@ordinatio/scheduling";
 
 // src/availability/admin-calendar.ts
 async function verifyCalendar(db, calendarId, organizationId) {
@@ -4568,7 +4684,7 @@ async function setWeeklyRules(request, { host, params }) {
     return Response.json(created);
   } catch (error) {
     const msg = getErrorMessage(error, "Failed to update availability");
-    if (error instanceof SchedulingValidationError4) {
+    if (error instanceof SchedulingValidationError5) {
       console.error("[PUT /admin/availability]", error.ref, error.code, error.context);
       return Response.json({ error: msg, ref: error.ref }, { status: 400 });
     }
@@ -4582,7 +4698,7 @@ import {
   addTimeBlock,
   removeDateOverride,
   SchedulingNotFoundError as SchedulingNotFoundError5,
-  SchedulingValidationError as SchedulingValidationError5
+  SchedulingValidationError as SchedulingValidationError6
 } from "@ordinatio/scheduling";
 
 // src/availability/override-helpers.ts
@@ -4667,7 +4783,7 @@ async function addOverride(request, { host, params }) {
     return Response.json({ ...override, ...overlapWarning && { warning: overlapWarning } }, { status: 201 });
   } catch (error) {
     const msg = getErrorMessage(error, "Failed to add override");
-    if (error instanceof SchedulingValidationError5) {
+    if (error instanceof SchedulingValidationError6) {
       console.error("[POST /admin/availability]", error.ref, error.code, error.context);
       return Response.json({ error: msg, ref: error.ref }, { status: 400 });
     }
@@ -4778,7 +4894,7 @@ async function createTemplate(request, { host }) {
 }
 
 // src/handlers/admin-template-update.ts
-import { deleteNotificationTemplate, SchedulingNotFoundError as SchedulingNotFoundError6, SchedulingValidationError as SchedulingValidationError6, updateNotificationTemplate } from "@ordinatio/scheduling";
+import { deleteNotificationTemplate, SchedulingNotFoundError as SchedulingNotFoundError6, SchedulingValidationError as SchedulingValidationError7, updateNotificationTemplate } from "@ordinatio/scheduling";
 async function updateTemplate(request, { host, params }) {
   try {
     const staff = await requireAdminStaff(host, request, { action: "admin-templates-update", tier: "UPDATE" });
@@ -4824,7 +4940,7 @@ async function updateTemplate(request, { host, params }) {
     return Response.json(updated);
   } catch (error) {
     const msg = getErrorMessage(error, "Failed to update template");
-    if (error instanceof SchedulingValidationError6) {
+    if (error instanceof SchedulingValidationError7) {
       console.error("[PUT /admin/templates]", error.ref, error.code, error.context);
       return Response.json({ error: msg, ref: error.ref }, { status: 400 });
     }
@@ -4952,7 +5068,7 @@ async function createType(request, { host }) {
 }
 
 // src/handlers/admin-type-update.ts
-import { SchedulingValidationError as SchedulingValidationError7, updateAppointmentType } from "@ordinatio/scheduling";
+import { SchedulingValidationError as SchedulingValidationError8, updateAppointmentType } from "@ordinatio/scheduling";
 
 // src/handlers/type-ownership.ts
 async function getOwnedAppointmentType(db, id, organizationId) {
@@ -5050,7 +5166,7 @@ async function updateType(request, { host, params }) {
       return Response.json({ error: getErrorMessage(error, "Validation error") }, { status: schedErrorStatus(code) });
     }
     const message = isSchedulingServiceError(error) ? error.description || error.message : getErrorMessage(error, "Failed to update appointment type");
-    if (error instanceof SchedulingValidationError7) return Response.json({ error: message }, { status: 400 });
+    if (error instanceof SchedulingValidationError8) return Response.json({ error: message }, { status: 400 });
     return Response.json({ error: message }, { status: 500 });
   }
 }
@@ -5330,7 +5446,7 @@ async function getAppointmentIcal(request, { host }) {
     const description = [appointment.type.description ?? "", `Manage your appointment: ${manageUrl}`].filter(Boolean).join("\n");
     const calendar = ical({ name: appointment.calendar.name });
     calendar.createEvent({
-      id: `${appointment.id}@system1701`,
+      id: `${appointment.id}@${host.icalUidDomain() || "ordinatio-scheduling"}`,
       start: appointment.startTime,
       end: appointment.endTime,
       timezone: appointment.timezone,
@@ -5362,7 +5478,7 @@ import {
 } from "@ordinatio/scheduling";
 
 // src/webhooks/require-webhooks.ts
-import { SchedulingNotFoundError as SchedulingNotFoundError7, SchedulingValidationError as SchedulingValidationError8 } from "@ordinatio/scheduling";
+import { SchedulingNotFoundError as SchedulingNotFoundError7, SchedulingValidationError as SchedulingValidationError9 } from "@ordinatio/scheduling";
 async function requireWebhooksAdmin(host, request, options) {
   const staff = await requireAdminStaff(host, request, options);
   if (staff instanceof Response) return staff;
@@ -5370,7 +5486,7 @@ async function requireWebhooksAdmin(host, request, options) {
   return { staff, settings: host.webhooks };
 }
 function webhookErrorResponse(error, fallback) {
-  if (error instanceof SchedulingValidationError8) {
+  if (error instanceof SchedulingValidationError9) {
     return Response.json({ error: error.message, ref: getErrorRef(error) }, { status: 400 });
   }
   if (error instanceof SchedulingNotFoundError7) {
@@ -5508,33 +5624,142 @@ async function deliverWebhooks(request, { host }) {
   }
 }
 
-// src/handlers/appointments-book.ts
-import { bookAppointment } from "@ordinatio/scheduling";
-
-// src/booking/booking-schema.ts
+// src/handlers/waitlist-join.ts
+import { joinWaitlist, leaveWaitlist } from "@ordinatio/scheduling";
 import { z as z7 } from "zod";
-var BookingSchema = z7.object({
-  calendarId: z7.string().min(1).optional(),
-  preferredCalendarId: z7.string().min(1).optional(),
+
+// src/waitlist/waitlist-http.ts
+import { SchedulingNotFoundError as SchedulingNotFoundError9, SchedulingValidationError as SchedulingValidationError10 } from "@ordinatio/scheduling";
+var NOT_ENABLED2 = { error: "The waitlist is not enabled on this server" };
+var STATUS_BY_CODE = {
+  SCHED_1100: 404,
+  SCHED_1103: 409,
+  SCHED_1104: 409,
+  SCHED_1106: 404,
+  SCHED_1107: 410,
+  SCHED_1108: 409
+};
+async function resolveWaitlistDb(host, orgSlug) {
+  if (!orgSlug) return { db: await host.publicDb(), organizationId: null };
+  return host.organizations.resolve({ orgSlug, logPrefix: "[waitlist]" });
+}
+function waitlistErrorResponse(cors, error, fallback) {
+  if (error instanceof SchedulingValidationError10 || error instanceof SchedulingNotFoundError9) {
+    const status = STATUS_BY_CODE[error.code] ?? (error instanceof SchedulingNotFoundError9 ? 404 : 400);
+    return corsJson(cors, { error: error.message, code: error.code, ref: getErrorRef(error) }, { status });
+  }
+  console.error("[waitlist]", error);
+  return corsJson(cors, { error: fallback }, { status: 500 });
+}
+async function requireWaitlistAdmin(host, request, options) {
+  const staff = await requireAdminStaff(host, request, options);
+  if (staff instanceof Response) return staff;
+  if (!host.waitlist) return Response.json(NOT_ENABLED2, { status: 501 });
+  return { staff, settings: host.waitlist };
+}
+
+// src/handlers/waitlist-join.ts
+var JoinWaitlistSchema = z7.object({
+  orgSlug: z7.string().min(1).max(100).optional(),
   typeId: z7.string().min(1),
-  startTime: z7.string().datetime({ message: "Invalid date/time format" }),
-  timezone: z7.string().max(50).optional(),
+  calendarId: z7.string().min(1).optional(),
+  day: z7.string().regex(/^\d{4}-\d{2}-\d{2}$/, "Day must be YYYY-MM-DD"),
+  slotStart: z7.string().datetime({ message: "Invalid date/time format" }).optional(),
   clientName: z7.string().trim().min(1, "Name is required").max(200),
   clientEmail: z7.string().email("Invalid email").max(254),
-  clientPhone: z7.string().max(30).optional(),
+  clientPhone: z7.string().max(30).optional()
+});
+async function joinWaitlistRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.waitlist) return corsJson(cors, NOT_ENABLED2, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`waitlist-join:${clientAddress(request)}`, "PUBLIC_BOOKING");
+    if (limited) return limited;
+    const parsed = JoinWaitlistSchema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) {
+      const details = parsed.error.issues.map((issue) => ({ field: issue.path.join("."), message: issue.message }));
+      return corsJson(cors, { error: "Validation failed", details }, { status: 400 });
+    }
+    const body = parsed.data;
+    const context = await resolveWaitlistDb(host, body.orgSlug);
+    if (!context) return corsJson(cors, { error: "Appointment type not found" }, { status: 404 });
+    let organizationId = context.organizationId;
+    if (!organizationId) {
+      const type = await context.db.appointmentType.findUnique({ where: { id: body.typeId }, select: { organizationId: true } });
+      organizationId = type?.organizationId ?? null;
+    }
+    if (!organizationId) return corsJson(cors, { error: "Appointment type not found" }, { status: 404 });
+    const { entry, token } = await joinWaitlist(context.db, {
+      organizationId,
+      typeId: body.typeId,
+      calendarId: body.calendarId,
+      day: body.day,
+      slotStart: body.slotStart ? new Date(body.slotStart) : void 0,
+      clientName: body.clientName,
+      clientEmail: body.clientEmail,
+      clientPhone: body.clientPhone
+    });
+    return corsJson(cors, { entry, token }, { status: 201, headers: { "Cache-Control": "no-store" } });
+  } catch (error) {
+    return waitlistErrorResponse(cors, error, "Failed to join the waitlist");
+  }
+}
+async function leaveWaitlistRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.waitlist) return corsJson(cors, NOT_ENABLED2, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`waitlist-leave:${clientAddress(request)}`, "GENERAL");
+    if (limited) return limited;
+    const url = new URL(request.url);
+    const token = url.searchParams.get("token");
+    if (!token) return corsJson(cors, { error: "token is required" }, { status: 400 });
+    const context = await resolveWaitlistDb(host, url.searchParams.get("orgSlug"));
+    if (!context) return corsJson(cors, { error: "No waitlist entry for this link", code: "SCHED_1106" }, { status: 404 });
+    const freed = await leaveWaitlist(context.db, token);
+    if (freed) await offerAndAnnounce(host, host.waitlist, context.db, freed);
+    return corsJson(cors, { success: true });
+  } catch (error) {
+    return waitlistErrorResponse(cors, error, "Failed to leave the waitlist");
+  }
+}
+
+// src/handlers/waitlist-offer.ts
+import {
+  beginWaitlistAccept,
+  completeWaitlistAccept,
+  getWaitlistOffer,
+  releaseWaitlistAccept,
+  settleBookedAccept
+} from "@ordinatio/scheduling";
+import { z as z9 } from "zod";
+
+// src/handlers/appointments-book.ts
+import { bookAppointment } from "@ordinatio/scheduling";
+
+// src/booking/booking-schema.ts
+import { z as z8 } from "zod";
+var BookingSchema = z8.object({
+  calendarId: z8.string().min(1).optional(),
+  preferredCalendarId: z8.string().min(1).optional(),
+  typeId: z8.string().min(1),
+  startTime: z8.string().datetime({ message: "Invalid date/time format" }),
+  timezone: z8.string().max(50).optional(),
+  clientName: z8.string().trim().min(1, "Name is required").max(200),
+  clientEmail: z8.string().email("Invalid email").max(254),
+  clientPhone: z8.string().max(30).optional(),
   // Untrusted: the host's client resolver decides whether to honor it.
-  clientId: z7.string().optional(),
-  notes: z7.string().max(1e3).optional(),
+  clientId: z8.string().optional(),
+  notes: z8.string().max(1e3).optional(),
   // Only the primitive types a form field produces; z.unknown() would accept anything.
-  intakeResponses: z7.record(
-    z7.string(),
-    z7.union([z7.string().max(1e3), z7.number(), z7.boolean(), z7.null()])
+  intakeResponses: z8.record(
+    z8.string(),
+    z8.union([z8.string().max(1e3), z8.number(), z8.boolean(), z8.null()])
   ).optional(),
-  paymentId: z7.string().optional(),
-  couponCode: z7.string().min(1).max(50).transform((value) => value.trim().toUpperCase()).optional(),
-  packagePurchaseId: z7.string().optional(),
+  paymentId: z8.string().optional(),
+  couponCode: z8.string().min(1).max(50).transform((value) => value.trim().toUpperCase()).optional(),
+  packagePurchaseId: z8.string().optional(),
   // Names the organization, so the calendar and type lookups can run against its own database.
-  orgSlug: z7.string().min(1).max(100).optional()
+  orgSlug: z8.string().min(1).max(100).optional()
 });
 
 // src/booking/finalize-booking.ts
@@ -5630,7 +5855,7 @@ async function finalizeBooking(host, cors, db, organizationId, body, appointment
   const baseUrl = host.appUrl();
   if (!baseUrl) throw new Error("The host must supply appUrl() to book appointments");
   try {
-    await scheduleNotifications5(db, appointment.id, baseUrl);
+    await scheduleNotifications5(db, appointment.id, baseUrl, { brand: Boolean(host.brand) });
   } catch (error) {
     await logActivity(
       "scheduling.notification_schedule_failed",
@@ -5639,7 +5864,7 @@ async function finalizeBooking(host, cors, db, organizationId, body, appointment
     );
   }
   try {
-    await queueStaffNotification7(db, appointment.id, "CONFIRMATION", baseUrl);
+    await queueStaffNotification7(db, appointment.id, "CONFIRMATION", baseUrl, { brand: Boolean(host.brand) });
   } catch (error) {
     await logActivity(
       "scheduling.staff_notification_failed",
@@ -6000,6 +6225,464 @@ async function bookAppointmentRoute(request, { host }) {
   }
 }
 
+// src/handlers/waitlist-offer.ts
+async function getWaitlistOfferRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.waitlist) return corsJson(cors, NOT_ENABLED2, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`waitlist-offer:${clientAddress(request)}`, "AVAILABILITY");
+    if (limited) return limited;
+    const url = new URL(request.url);
+    const token = url.searchParams.get("token");
+    if (!token) return corsJson(cors, { error: "token is required" }, { status: 400 });
+    const context = await resolveWaitlistDb(host, url.searchParams.get("orgSlug"));
+    if (!context) return corsJson(cors, { error: "No open offer for this link", code: "SCHED_1106" }, { status: 404 });
+    const offer = await getWaitlistOffer(context.db, token);
+    return corsJson(cors, {
+      typeName: offer.typeName,
+      calendarName: offer.calendarName,
+      startTime: offer.startTime,
+      timezone: offer.timezone,
+      expiresAt: offer.expiresAt,
+      clientName: offer.clientName
+    });
+  } catch (error) {
+    return waitlistErrorResponse(cors, error, "Failed to read the offer");
+  }
+}
+var AcceptSchema = z9.object({ token: z9.string().min(1).max(200), orgSlug: z9.string().min(1).max(100).optional() });
+async function acceptWaitlistOfferRoute(request, context) {
+  const { host } = context;
+  const cors = host.cors(request);
+  const settings = host.waitlist;
+  if (!settings) return corsJson(cors, NOT_ENABLED2, { status: 501 });
+  let entryId = null;
+  let db = null;
+  let booked = false;
+  try {
+    const limited = await host.rateLimit(`waitlist-accept:${clientAddress(request)}`, "GENERAL");
+    if (limited) return limited;
+    const parsed = AcceptSchema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) return corsJson(cors, { error: "token is required" }, { status: 400 });
+    db = await resolveWaitlistDb(host, parsed.data.orgSlug);
+    if (!db) return corsJson(cors, { error: "No open offer for this link", code: "SCHED_1106" }, { status: 404 });
+    const offer = await beginWaitlistAccept(db.db, parsed.data.token);
+    entryId = offer.entryId;
+    const headers = new Headers(request.headers);
+    headers.set("content-type", "application/json");
+    const response = await bookAppointmentRoute(
+      new Request(request.url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          calendarId: offer.calendarId,
+          typeId: offer.typeId,
+          startTime: offer.startTime.toISOString(),
+          timezone: offer.timezone,
+          clientName: offer.clientName,
+          clientEmail: offer.clientEmail,
+          ...offer.clientPhone ? { clientPhone: offer.clientPhone } : {},
+          ...parsed.data.orgSlug ? { orgSlug: parsed.data.orgSlug } : {}
+        })
+      }),
+      context
+    );
+    if (response.status === 201) {
+      booked = true;
+      const appointment = await response.clone().json().catch(() => null);
+      try {
+        await completeWaitlistAccept(db.db, entryId, appointment?.id ?? "");
+      } catch (completeError) {
+        console.error("[waitlist] the booking was saved but its waitlist entry could not be marked booked:", completeError);
+      }
+      return response;
+    }
+    const saved = await settleBookedAccept(db.db, entryId);
+    if (saved) return corsJson(cors, saved, { status: 201 });
+    await endFailedAccept(host, settings, db.db, entryId, releaseFor(response.status));
+    return response;
+  } catch (error) {
+    if (entryId && db && !booked) {
+      try {
+        const saved = await settleBookedAccept(db.db, entryId);
+        if (saved) return corsJson(cors, saved, { status: 201 });
+        await endFailedAccept(host, settings, db.db, entryId, "KEEP_OFFER");
+      } catch (releaseError) {
+        console.error("[waitlist] could not settle or release an accept:", releaseError);
+      }
+    }
+    return waitlistErrorResponse(cors, error, "Failed to accept the offer");
+  }
+}
+function releaseFor(status) {
+  if (status === 409) return "BACK_IN_LINE";
+  if (status === 429 || status >= 500) return "KEEP_OFFER";
+  return "DROP";
+}
+async function endFailedAccept(host, settings, db, entryId, outcome) {
+  const freed = await releaseWaitlistAccept(db, entryId, outcome);
+  if (freed) await offerAndAnnounce(host, settings, db, freed);
+}
+
+// src/handlers/admin-waitlist.ts
+import { listWaitlist, removeWaitlistEntry } from "@ordinatio/scheduling";
+var STATUSES2 = /* @__PURE__ */ new Set(["WAITING", "OFFERED", "ACCEPTING", "BOOKED", "EXPIRED"]);
+async function listWaitlistEntries(request, { host }) {
+  try {
+    const guard = await requireWaitlistAdmin(host, request, { action: "admin-waitlist-list", tier: "GENERAL" });
+    if (guard instanceof Response) return guard;
+    const status = new URL(request.url).searchParams.get("status");
+    if (status && !STATUSES2.has(status)) {
+      return Response.json({ error: `status must be one of ${[...STATUSES2].join(", ")}` }, { status: 400 });
+    }
+    const { limit, offset } = parsePagination(request);
+    const { entries, total } = await listWaitlist(guard.staff.db, {
+      organizationId: guard.staff.organizationId,
+      status: status ?? void 0,
+      limit,
+      offset
+    });
+    return Response.json({ entries, total, hasMore: offset + entries.length < total });
+  } catch (error) {
+    return webhookErrorResponse(error, "Failed to list the waitlist");
+  }
+}
+async function removeWaitlistEntryRoute(request, { host, params }) {
+  try {
+    const guard = await requireWaitlistAdmin(host, request, { action: "admin-waitlist-remove", tier: "DELETE" });
+    if (guard instanceof Response) return guard;
+    const { db, organizationId } = guard.staff;
+    const freed = await removeWaitlistEntry(db, organizationId, params.id);
+    await host.activity.log(db, {
+      action: "scheduling.waitlist_entry_removed",
+      description: "removed someone from the waitlist",
+      metadata: { entryId: params.id }
+    });
+    if (freed) await offerAndAnnounce(host, guard.settings, db, freed);
+    return Response.json({ success: true });
+  } catch (error) {
+    return webhookErrorResponse(error, "Failed to remove the waitlist entry");
+  }
+}
+
+// src/handlers/internal-waitlist-sweep.ts
+import { expireWaitlistOffers } from "@ordinatio/scheduling";
+async function sweepWaitlist(request, { host }) {
+  if (!await host.internalAccess.isAuthorized(request)) return Response.json({ error: "Unauthorized" }, { status: 401 });
+  if (!host.waitlist) return Response.json(NOT_ENABLED2, { status: 501 });
+  const limited = await host.rateLimit(`${request.headers.get("x-forwarded-for") ?? "worker"}:waitlist-sweep`, "INTERNAL");
+  if (limited) return limited;
+  try {
+    const db = await host.publicDb();
+    const { lapsed, released, booked } = await expireWaitlistOffers(db);
+    let reoffered = 0;
+    for (const slot of lapsed) {
+      if (await offerAndAnnounce(host, host.waitlist, db, slot)) reoffered++;
+    }
+    return Response.json({ lapsed: lapsed.length, released, booked, reoffered });
+  } catch (error) {
+    console.error("[scheduling-api] waitlist sweep failed:", error);
+    return Response.json({ error: "Waitlist sweep failed" }, { status: 500 });
+  }
+}
+
+// src/handlers/routing-forms-public.ts
+import { getPublicRoutingForm, routeClient } from "@ordinatio/scheduling";
+
+// src/routing/routing-http.ts
+import { SchedulingNotFoundError as SchedulingNotFoundError10, SchedulingValidationError as SchedulingValidationError11 } from "@ordinatio/scheduling";
+var NOT_ENABLED3 = { error: "Routing forms are not enabled on this server" };
+var STATUS_BY_CODE2 = { SCHED_1201: 404, SCHED_1202: 409, SCHED_1204: 409 };
+function routingErrorResponse(error, fallback, cors) {
+  const send = (payload, status) => cors ? corsJson(cors, payload, { status }) : Response.json(payload, { status });
+  if (error instanceof SchedulingValidationError11 || error instanceof SchedulingNotFoundError10) {
+    const details = error.context.errors;
+    const status = STATUS_BY_CODE2[error.code] ?? 400;
+    return send({ error: error.message, code: error.code, ref: getErrorRef(error), ...details ? { details } : {} }, status);
+  }
+  console.error("[routing-forms]", error);
+  return send({ error: fallback }, 500);
+}
+async function requireRoutingAdmin(host, request, options) {
+  const staff = await requireAdminStaff(host, request, options);
+  if (staff instanceof Response) return staff;
+  if (!host.routingForms) return Response.json(NOT_ENABLED3, { status: 501 });
+  return staff;
+}
+
+// src/handlers/routing-forms-public.ts
+async function resolveOrganization(host, orgSlug) {
+  if (!orgSlug) return { db: await host.publicDb(), organizationId: null };
+  return host.organizations.resolve({ orgSlug, logPrefix: "[routing-forms]" });
+}
+async function getRoutingFormRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.routingForms) return corsJson(cors, NOT_ENABLED3, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`routing-form:${clientAddress(request)}`, "AVAILABILITY");
+    if (limited) return limited;
+    const url = new URL(request.url);
+    const slug = url.searchParams.get("slug");
+    if (!slug) return corsJson(cors, { error: "slug is required" }, { status: 400 });
+    const context = await resolveOrganization(host, url.searchParams.get("orgSlug"));
+    if (!context) return corsJson(cors, { error: "Routing form not found", code: "SCHED_1201" }, { status: 404 });
+    return corsJson(cors, await getPublicRoutingForm(context.db, { organizationId: context.organizationId, slug }));
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to read the form", cors);
+  }
+}
+async function routeClientRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.routingForms) return corsJson(cors, NOT_ENABLED3, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`routing-route:${clientAddress(request)}`, "AVAILABILITY");
+    if (limited) return limited;
+    const parsed = RouteClientSchema.safeParse(await request.json().catch(() => null));
+    if (!parsed.success) {
+      const details = parsed.error.issues.map((issue) => ({ field: issue.path.join("."), message: issue.message }));
+      return corsJson(cors, { error: "Validation failed", details }, { status: 400 });
+    }
+    const context = await resolveOrganization(host, parsed.data.orgSlug);
+    if (!context) return corsJson(cors, { error: "Routing form not found", code: "SCHED_1201" }, { status: 404 });
+    const outcome = await routeClient(context.db, { organizationId: context.organizationId, slug: parsed.data.slug, answers: parsed.data.answers });
+    return corsJson(cors, outcome);
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to route the answers", cors);
+  }
+}
+
+// src/handlers/admin-routing-forms.ts
+import { createRoutingForm, listRoutingForms } from "@ordinatio/scheduling";
+async function listRoutingFormsRoute(request, { host }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-list", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    return Response.json({ forms: await listRoutingForms(staff.db, staff.organizationId) });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to list the forms");
+  }
+}
+async function createRoutingFormRoute(request, { host }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-create", tier: "CREATE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, CreateRoutingFormSchema);
+    if (!validation.success) return validation.response;
+    const form = await createRoutingForm(staff.db, staff.organizationId, validation.data);
+    await host.activity.log(staff.db, {
+      action: "scheduling.routing_form_created",
+      description: `created routing form "${form.name}"`,
+      metadata: { formId: form.id, slug: form.slug }
+    });
+    return Response.json({ form }, { status: 201 });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to save the form");
+  }
+}
+
+// src/handlers/brand-public.ts
+import { getPublicBrand } from "@ordinatio/scheduling";
+async function getBrandRoute(request, { host }) {
+  const cors = host.cors(request);
+  if (!host.brand) return corsJson(cors, NOT_ENABLED, { status: 501 });
+  try {
+    const limited = await host.rateLimit(`brand:${clientAddress(request)}`, "AVAILABILITY");
+    if (limited) return limited;
+    const orgSlug = new URL(request.url).searchParams.get("orgSlug");
+    const context = orgSlug ? await host.organizations.resolve({ orgSlug, logPrefix: "[brand]" }) : { db: await host.publicDb(), organizationId: null };
+    const brand = context ? await getPublicBrand(context.db, context.organizationId) : null;
+    if (!brand) return corsJson(cors, { error: "No brand set" }, { status: 404 });
+    return corsJson(cors, { brand }, { headers: WIDGET_CACHE_HEADERS });
+  } catch (error) {
+    return brandErrorResponse(error, "Failed to read the brand", cors);
+  }
+}
+
+// src/handlers/admin-brand.ts
+import { deleteBrand, getBrand as getBrand2, saveBrand } from "@ordinatio/scheduling";
+async function getBrandAdminRoute(request, { host }) {
+  try {
+    const staff = await requireBrandAdmin(host, request, { action: "admin-brand-get", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    return Response.json({ brand: await getBrand2(staff.db, staff.organizationId) });
+  } catch (error) {
+    return brandErrorResponse(error, "Failed to read the brand");
+  }
+}
+async function saveBrandRoute(request, { host }) {
+  try {
+    const staff = await requireBrandAdmin(host, request, { action: "admin-brand-save", tier: "UPDATE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, BrandSchema);
+    if (!validation.success) return validation.response;
+    const verifier = host.brand?.isSendingDomainVerified;
+    const brand = await saveBrand(staff.db, staff.organizationId, validation.data, {
+      isSendingDomainVerified: verifier ? async (domain) => Boolean(await verifier.call(host.brand, domain, staff.organizationId)) : void 0
+    });
+    await host.activity.log(staff.db, {
+      action: "scheduling.brand_saved",
+      description: "changed the brand",
+      metadata: { displayName: brand.displayName, sendsFromOwnDomain: Boolean(brand.fromEmail) }
+    });
+    return Response.json({ brand });
+  } catch (error) {
+    return brandErrorResponse(error, "Failed to save the brand");
+  }
+}
+async function deleteBrandRoute(request, { host }) {
+  try {
+    const staff = await requireBrandAdmin(host, request, { action: "admin-brand-delete", tier: "DELETE" });
+    if (staff instanceof Response) return staff;
+    const removed = await deleteBrand(staff.db, staff.organizationId);
+    if (removed) await host.activity.log(staff.db, { action: "scheduling.brand_removed", description: "removed the brand", metadata: {} });
+    return Response.json({ removed });
+  } catch (error) {
+    return brandErrorResponse(error, "Failed to remove the brand");
+  }
+}
+
+// src/handlers/admin-privacy.ts
+import { eraseSubject, exportSubject, listPrivacyRequests, previewErase } from "@ordinatio/scheduling";
+
+// src/privacy/privacy-http.ts
+import { SchedulingValidationError as SchedulingValidationError12 } from "@ordinatio/scheduling";
+var NOT_ENABLED4 = { error: "Data export and erasure are not enabled on this server" };
+var STATUS_BY_CODE3 = { SCHED_1300: 400, SCHED_1301: 409 };
+function privacyErrorResponse(error, fallback) {
+  if (error instanceof SchedulingValidationError12) {
+    return Response.json(
+      { error: error.message, code: error.code, ref: getErrorRef(error), details: error.context },
+      { status: STATUS_BY_CODE3[error.code] ?? 400 }
+    );
+  }
+  console.error("[privacy]", error);
+  return Response.json({ error: fallback }, { status: 500 });
+}
+async function requirePrivacyAdmin(host, request, options) {
+  const staff = await requireAdminStaff(host, request, options);
+  if (staff instanceof Response) return staff;
+  if (!host.privacy) return Response.json(NOT_ENABLED4, { status: 501 });
+  return staff;
+}
+
+// src/handlers/admin-privacy.ts
+async function logQuietly(host, db, entry) {
+  try {
+    await host.activity.log(db, entry);
+  } catch (error) {
+    console.error("[privacy] could not write the activity entry:", error);
+  }
+}
+async function exportPrivacyRoute(request, { host }) {
+  try {
+    const staff = await requirePrivacyAdmin(host, request, { action: "admin-privacy-export", tier: "CREATE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, PrivacySubjectSchema);
+    if (!validation.success) return validation.response;
+    const result = await exportSubject(staff.db, { organizationId: staff.organizationId, requestedBy: staff.userId, ...validation.data });
+    await logQuietly(host, staff.db, {
+      action: "scheduling.privacy_export",
+      description: "exported the data held about one person",
+      metadata: { counts: result.counts }
+    });
+    const stamp = result.exportedAt.slice(0, 10);
+    return new Response(JSON.stringify(result, null, 2), {
+      status: 200,
+      headers: {
+        "content-type": "application/json; charset=utf-8",
+        "content-disposition": `attachment; filename="scheduling-data-export-${stamp}.json"`,
+        "cache-control": "no-store"
+      }
+    });
+  } catch (error) {
+    return privacyErrorResponse(error, "Failed to export the data");
+  }
+}
+async function erasePrivacyRoute(request, { host }) {
+  try {
+    const staff = await requirePrivacyAdmin(host, request, { action: "admin-privacy-erase", tier: "DELETE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, PrivacyEraseSchema);
+    if (!validation.success) return validation.response;
+    const { confirm, ...subject } = validation.data;
+    if (confirm !== true) {
+      const preview = await previewErase(staff.db, { organizationId: staff.organizationId, ...subject });
+      return Response.json({ erased: false, preview }, { headers: { "cache-control": "no-store" } });
+    }
+    const { counts } = await eraseSubject(staff.db, { organizationId: staff.organizationId, requestedBy: staff.userId, ...subject });
+    await logQuietly(host, staff.db, {
+      action: "scheduling.privacy_erase",
+      description: "erased the data held about one person",
+      metadata: { counts }
+    });
+    return Response.json({ erased: true, counts }, { headers: { "cache-control": "no-store" } });
+  } catch (error) {
+    return privacyErrorResponse(error, "Failed to erase the data");
+  }
+}
+async function listPrivacyRequestsRoute(request, { host }) {
+  try {
+    const staff = await requirePrivacyAdmin(host, request, { action: "admin-privacy-requests", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    const { limit, offset } = parsePagination(request);
+    const { requests, total } = await listPrivacyRequests(staff.db, { organizationId: staff.organizationId, limit, offset });
+    return Response.json({ requests, total, hasMore: offset + requests.length < total });
+  } catch (error) {
+    return privacyErrorResponse(error, "Failed to list the requests");
+  }
+}
+
+// src/handlers/admin-routing-form-detail.ts
+import { deleteRoutingForm, getRoutingForm, testRoutingForm, updateRoutingForm } from "@ordinatio/scheduling";
+async function getRoutingFormAdminRoute(request, { host, params }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-get", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    return Response.json({ form: await getRoutingForm(staff.db, staff.organizationId, params.id) });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to read the form");
+  }
+}
+async function updateRoutingFormRoute(request, { host, params }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-update", tier: "UPDATE" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, UpdateRoutingFormSchema);
+    if (!validation.success) return validation.response;
+    const form = await updateRoutingForm(staff.db, staff.organizationId, params.id, validation.data);
+    await host.activity.log(staff.db, {
+      action: "scheduling.routing_form_updated",
+      description: `changed routing form "${form.name}"`,
+      metadata: { formId: form.id, fields: Object.keys(validation.data) }
+    });
+    return Response.json({ form });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to save the form");
+  }
+}
+async function deleteRoutingFormRoute(request, { host, params }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-delete", tier: "DELETE" });
+    if (staff instanceof Response) return staff;
+    await deleteRoutingForm(staff.db, staff.organizationId, params.id);
+    await host.activity.log(staff.db, { action: "scheduling.routing_form_deleted", description: "removed a routing form", metadata: { formId: params.id } });
+    return Response.json({ success: true });
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to remove the form");
+  }
+}
+async function testRoutingFormRoute(request, { host, params }) {
+  try {
+    const staff = await requireRoutingAdmin(host, request, { action: "admin-routing-forms-test", tier: "GENERAL" });
+    if (staff instanceof Response) return staff;
+    const validation = await parseBody(request, TestRoutingFormSchema);
+    if (!validation.success) return validation.response;
+    return Response.json(await testRoutingForm(staff.db, { organizationId: staff.organizationId, id: params.id, answers: validation.data.answers }));
+  } catch (error) {
+    return routingErrorResponse(error, "Failed to test the form");
+  }
+}
+
 // src/handlers/appointments-list.ts
 import { schedError as schedError28 } from "@ordinatio/scheduling";
 var DEFAULT_LIMIT2 = 50;
@@ -6379,12 +7062,12 @@ async function getAppointmentTypes(request, { host }) {
 }
 
 // src/handlers/coupons-validate.ts
-import { z as z8 } from "zod";
+import { z as z10 } from "zod";
 import { schedError as schedError30 } from "@ordinatio/scheduling";
-var Schema4 = z8.object({
-  code: z8.string().min(1).max(50).transform((v) => v.trim().toUpperCase()),
-  calendarId: z8.string().min(1),
-  price: z8.number().positive()
+var Schema4 = z10.object({
+  code: z10.string().min(1).max(50).transform((v) => v.trim().toUpperCase()),
+  calendarId: z10.string().min(1),
+  price: z10.number().positive()
 });
 function calculateDiscount(price, discountType, discountValue) {
   if (discountType === "PERCENTAGE") {
@@ -6715,6 +7398,13 @@ var ROUTES = [
   { method: "GET", path: "/availability", public: true, handler: getAvailability },
   { method: "GET", path: "/availability/team", public: true, handler: getTeamAvailability },
   { method: "POST", path: "/appointments", public: true, handler: bookAppointmentRoute },
+  { method: "GET", path: "/routing-forms", public: true, handler: getRoutingFormRoute },
+  { method: "POST", path: "/routing-forms/route", public: true, handler: routeClientRoute },
+  { method: "GET", path: "/brand", public: true, handler: getBrandRoute },
+  { method: "POST", path: "/waitlist", public: true, handler: joinWaitlistRoute },
+  { method: "DELETE", path: "/waitlist", public: true, handler: leaveWaitlistRoute },
+  { method: "GET", path: "/waitlist/offer", public: true, handler: getWaitlistOfferRoute },
+  { method: "POST", path: "/waitlist/offer/accept", public: true, handler: acceptWaitlistOfferRoute },
   { method: "GET", path: "/appointments", public: false, handler: listAppointments },
   { method: "GET", path: "/appointments/capacity", public: true, handler: getCapacity },
   { method: "GET", path: "/appointments/ical", public: false, handler: getAppointmentIcal },
@@ -6756,6 +7446,21 @@ var ROUTES = [
   { method: "GET", path: "/admin/webhooks/[id]/deliveries", public: false, handler: listWebhookEndpointDeliveries },
   { method: "POST", path: "/admin/webhook-deliveries/[id]/retry", public: false, handler: retryWebhook },
   { method: "POST", path: "/internal/webhooks/deliver", public: false, handler: deliverWebhooks },
+  { method: "GET", path: "/admin/routing-forms", public: false, handler: listRoutingFormsRoute },
+  { method: "POST", path: "/admin/routing-forms", public: false, handler: createRoutingFormRoute },
+  { method: "GET", path: "/admin/routing-forms/[id]", public: false, handler: getRoutingFormAdminRoute },
+  { method: "PUT", path: "/admin/routing-forms/[id]", public: false, handler: updateRoutingFormRoute },
+  { method: "DELETE", path: "/admin/routing-forms/[id]", public: false, handler: deleteRoutingFormRoute },
+  { method: "POST", path: "/admin/routing-forms/[id]/test", public: false, handler: testRoutingFormRoute },
+  { method: "GET", path: "/admin/brand", public: false, handler: getBrandAdminRoute },
+  { method: "PUT", path: "/admin/brand", public: false, handler: saveBrandRoute },
+  { method: "DELETE", path: "/admin/brand", public: false, handler: deleteBrandRoute },
+  { method: "POST", path: "/admin/privacy/export", public: false, handler: exportPrivacyRoute },
+  { method: "POST", path: "/admin/privacy/erase", public: false, handler: erasePrivacyRoute },
+  { method: "GET", path: "/admin/privacy/requests", public: false, handler: listPrivacyRequestsRoute },
+  { method: "GET", path: "/admin/waitlist", public: false, handler: listWaitlistEntries },
+  { method: "DELETE", path: "/admin/waitlist/[id]", public: false, handler: removeWaitlistEntryRoute },
+  { method: "POST", path: "/internal/waitlist/sweep", public: false, handler: sweepWaitlist },
   { method: "GET", path: "/analytics", public: false, handler: getAnalytics },
   { method: "GET", path: "/admin/types", public: false, handler: listTypes },
   { method: "POST", path: "/admin/types", public: false, handler: createType },
@@ -6834,6 +7539,11 @@ function createSchedulingApi(config) {
     tenantDb: config.host.tenantDb?.bind(config.host) ?? (() => config.host.publicDb()),
     events: { emit: async () => void 0 },
     webhooks: config.host.webhooks ?? null,
+    waitlist: config.host.waitlist ?? null,
+    routingForms: config.host.routingForms ?? null,
+    privacy: config.host.privacy ?? null,
+    brand: config.host.brand ?? null,
+    icalUidDomain: config.host.icalUidDomain?.bind(config.host) ?? (() => null),
     calendarSync: config.host.calendarSync ?? { upsertEvent: async () => ({}), removeEvent: async () => void 0 },
     activity: config.host.activity ?? { log: async () => void 0, isOpen: async () => false, resolve: async () => void 0 },
     appUrl: config.host.appUrl?.bind(config.host) ?? (() => null),
@@ -6859,7 +7569,7 @@ function createSchedulingApi(config) {
     jsonNull: config.host.jsonNull?.bind(config.host) ?? (() => null),
     cors: config.host.cors?.bind(config.host) ?? defaultCorsHeaders
   };
-  host.events = withWebhooks(config.host.events ?? { emit: async () => void 0 }, host);
+  host.events = withWebhooks(withWaitlist(config.host.events ?? { emit: async () => void 0 }, host), host);
   async function handle(request) {
     const { pathname } = new URL(request.url);
     if (pathname !== basePath && !pathname.startsWith(`${basePath}/`)) return notFound();
@@ -7013,6 +7723,7 @@ export {
   BalanceRequestInProgressError,
   BookingPageConfigSchema,
   BookingPageThemeSchema,
+  BrandSchema,
   CancelRecurringScopeSchema,
   CancelRecurringSeriesSchema,
   CreateAppointmentCategorySchema,
@@ -7023,6 +7734,7 @@ export {
   CreateNotificationTemplateSchema,
   CreatePackagePurchaseSchema,
   CreateRecurringSeriesSchema,
+  CreateRoutingFormSchema,
   CreateServicePackageSchema,
   CreateWebhookEndpointSchema,
   DEFAULT_CANCELLATION_POLICY,
@@ -7031,13 +7743,17 @@ export {
   NotificationChannelSchema,
   NotificationTriggerSchema,
   OrgCancellationPolicySchema,
+  PrivacyEraseSchema,
+  PrivacySubjectSchema,
   RETRYABLE_REFUND_STATUSES,
   RecurringFrequencySchema,
   RefundOutcomePersistenceError,
+  RouteClientSchema,
   SLOT_GRANULARITY_DEFAULT,
   SLOT_GRANULARITY_OPTIONS,
   TERMINAL_SUCCESS_STATUSES,
   TOKEN_TTL_DAYS,
+  TestRoutingFormSchema,
   UnverifiedPaymentError,
   UpdateAppointmentCategorySchema,
   UpdateAppointmentTypeSchema,
@@ -7046,6 +7762,7 @@ export {
   UpdateCouponCodeSchema,
   UpdateNotificationTemplateSchema,
   UpdatePackagePurchaseSchema,
+  UpdateRoutingFormSchema,
   UpdateServicePackageSchema,
   attemptLegRefund,
   createBalanceIntent,