slotlock 0.8.0 → 0.9.0

package/dashboard.js

@@ -16,12 +16,12 @@
 import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import { SLOTLOCK_TEST_TENANT_SUFFIX, } from './api-keys.js';
 import { describeSlotlockAgentWrite, invokeSlotlockAgentOperation, slotlockAgentTools, } from './agent-server.js';
-import { SLOTLOCK_ASSISTANT_API_KEY, SLOTLOCK_ASSISTANT_MAX_ACTION_BYTES, SLOTLOCK_ASSISTANT_MAX_MESSAGE, SLOTLOCK_ASSISTANT_MAX_PENDING, SLOTLOCK_ASSISTANT_MAX_PREVIOUS_SECRETS, SLOTLOCK_ASSISTANT_MODEL_NAME, SLOTLOCK_ASSISTANT_PRESETS, SLOTLOCK_ASSISTANT_TOOL_USE, boundSlotlockAssistantEntries, createSlotlockAssistantStore, openSlotlockAssistantKeyWithAny, pendingSlotlockAssistantActions, pruneSlotlockAssistantActions, checkSlotlockAssistantHost, readSlotlockAssistantBaseUrl, slotlockAssistantUrlAllowed, readSlotlockAssistantEntries, runSlotlockAssistantTurn, sealSlotlockAssistantKey, slotlockAssistantProviderMessage, slotlockAssistantSystemPrompt, testSlotlockAssistantModel, listSlotlockAssistantModels, } from './assistant.js';
+import { SLOTLOCK_ASSISTANT_API_KEY, SLOTLOCK_ASSISTANT_MAX_ACTION_BYTES, SLOTLOCK_ASSISTANT_MAX_MESSAGE, SLOTLOCK_ASSISTANT_MAX_PENDING, SLOTLOCK_ASSISTANT_MAX_PREVIOUS_SECRETS, SLOTLOCK_ASSISTANT_MODEL_NAME, SLOTLOCK_ASSISTANT_PRESETS, SLOTLOCK_ASSISTANT_TOOL_USE, boundSlotlockAssistantEntries, createSlotlockAssistantStore, openSlotlockAssistantKeyWithAny, pendingSlotlockAssistantActions, pruneSlotlockAssistantActions, checkSlotlockAssistantHost, readSlotlockAssistantBaseUrl, slotlockAssistantUrlAllowed, readSlotlockAssistantEntries, runSlotlockAssistantTurn, sealSlotlockAssistantKey, slotlockAssistantProviderMessage, SLOTLOCK_ASSISTANT_DIRECTORY_SIZE, slotlockAssistantSystemPrompt, testSlotlockAssistantModel, listSlotlockAssistantModels, } from './assistant.js';
 import { SLOTLOCK_DASHBOARD_NAME_PATTERN } from './config.js';
 import { createSlotlockRateLimiter } from './rate-limit.js';
 import { createSlotlockGuardedFetch } from './webhooks.js';
 import { lookup as dnsLookup } from 'node:dns/promises';
-import { SLOTLOCK_DASHBOARD_FORM_LIMIT } from './ddl.js';
+import { SLOTLOCK_ASSISTANT_CHAT_ID, SLOTLOCK_DASHBOARD_FORM_LIMIT } from './ddl.js';
 import { ignoreRejection } from './hooks.js';
 import { SLOTLOCK_BOOKING_RULE_LIMITS } from './booking-rules.js';
 import { SLOTLOCK_DASHBOARD_ICON_SVG } from './dashboard-icon.js';
@@ -33,12 +33,19 @@ import { SLOTLOCK_MAX_GROUPS_PER_RESOURCE, SLOTLOCK_MAX_LOCATION_DEPTH, SLOTLOCK
 import { slotlockQuotaPeriod } from './quotas.js';
 import { slotlockUsageMonthToDate, summarizeSlotlockUsage } from './usage.js';
 import { SLOTLOCK_CHANGE_TYPES, } from './event-feed.js';
+import { dayToDate } from './hours.js';
+import { SLOTLOCK_MAX_HOLIDAY_CALENDAR_BYTES } from './holidays.js';
+import { readSlotlockHolidayCalendar } from './holiday-import.js';
 import { SlotlockAgentOperationError } from './agent-server.js';
 import { runSlotlockApprovalGrant } from './agent-store-backend.js';
 import { SLOTLOCK_SANDBOX_SCENARIOS, fastForwardSlotlockSandbox, resetSlotlockSandbox, seedSlotlockSandbox, } from './sandbox.js';
 import { WEEKDAYS, WEEKDAY_NAMES as DAY_NAMES, rulesToWeeklyHours, weeklyHoursToRules, } from './weekly-hours.js';
 /** Resources one dashboard tenant may hold. */
 export const SLOTLOCK_DASHBOARD_MAX_RESOURCES = 500;
+/** Closures the Closures page shows. */
+const SLOTLOCK_DASHBOARD_MAX_EXCEPTIONS = 200;
+/** Contacts the Contacts page shows at once. */
+const SLOTLOCK_DASHBOARD_CONTACTS_PAGE = 100;
 const SESSION_TTL_MS = 12 * 3_600_000;
 const SIGN_IN_TTL_MS = 10 * 60_000;
 /**
@@ -51,6 +58,8 @@ const GOOGLE_KEYS_DEFAULT_TTL_MS = 3_600_000;
 const MAX_FORM_BYTES = 8_192;
 /** A message to the assistant: 2,000 characters, each up to 9 bytes as a form encodes it. */
 const MAX_ASSISTANT_FORM_BYTES = 24_576;
+/** A holiday calendar import's form: the calendar (SLOTLOCK_MAX_HOLIDAY_CALENDAR_BYTES) and its fields. */
+const MAX_IMPORT_FORM_BYTES = SLOTLOCK_MAX_HOLIDAY_CALENDAR_BYTES + 65_536;
 /**
  * Sign-ins (record, then GitHub's token and user) one instance runs at once; more are told to retry.
  * This also bounds how fast unauthenticated callbacks can write sign-in records.
@@ -87,6 +96,11 @@ const POST_ROUTES = new Set([
     '/sandbox/reset',
     '/sandbox/fast-forward',
     '/hours',
+    '/closures',
+    '/closures/delete',
+    '/closures/import',
+    '/closures/calendars/delete',
+    '/contacts/forget',
     '/organization',
     '/environment',
     '/teams/enable',
@@ -96,6 +110,8 @@ const POST_ROUTES = new Set([
     '/assistant/approve',
     '/assistant/dismiss',
     '/assistant/reset',
+    '/assistant/rename',
+    '/assistant/delete',
     '/settings/assistant',
     '/settings/assistant/test',
     '/settings/assistant/models',
@@ -221,12 +237,49 @@ export function createSlotlockDashboardResources(store, options = {}) {
             timezone,
             maxTenantResources: SLOTLOCK_DASHBOARD_MAX_RESOURCES,
         }), { isolation: 'read committed', ...by(actor) }),
-        setHours: (tenantRef, target, rules, actor) => store.withTenant(tenantRef, async (tenant) => {
-            if (target === 'all')
-                return tenant.setTenantAvailability({ tenantRef, rules });
+        setHours: (tenantRef, target, rules, actor, override) => store.withTenant(tenantRef, async (tenant) => {
+            if (target === 'all') {
+                return (await tenant.storeTenantAvailability({ tenantRef, rules, overrideResources: override ?? 'none' })).inheriting;
+            }
+            if ('location' in target) {
+                const result = await tenant.setLocationAvailability({ tenantRef, location: target.location, rules });
+                return result === null ? 0 : Math.max(1, result.inheriting);
+            }
             const updated = await tenant.setResourceAvailability({ tenantRef, id: target.id, rules });
             return updated ? 1 : 0;
         }, by(actor)),
+        contacts: {
+            list: (tenantRef, limit, after) => store.withTenant(tenantRef, (tenant) => tenant.listContacts({ tenantRef, limit, ...(after ? { after } : {}) })),
+            forget: (tenantRef, ref, actor) => store.withTenant(tenantRef, (tenant) => tenant.deleteContact({ tenantRef, ref }), { isolation: 'read committed', ...by(actor) }),
+        },
+        hours: {
+            defaults: (tenantRef) => store.withTenant(tenantRef, (tenant) => tenant.getAvailabilityDefaults({ tenantRef })),
+            exceptions: (tenantRef, limit) => store.withTenant(tenantRef, (tenant) => tenant.listAvailabilityExceptions({
+                tenantRef,
+                from: dayToDate(Math.floor(Date.now() / 86_400_000) - 1),
+                limit,
+            })),
+            addException: (tenantRef, exception, actor) => store.withTenant(tenantRef, (tenant) => tenant.createAvailabilityException({ ...exception, tenantRef }), by(actor)),
+            deleteException: (tenantRef, id, actor) => store.withTenant(tenantRef, (tenant) => tenant.deleteAvailabilityException({ tenantRef, id }), by(actor)),
+            importHolidays: async (tenantRef, source, scope, actor) => {
+                // Read (a URL fetched) before the transaction opens.
+                const read = await readSlotlockHolidayCalendar(source, options.holidayFetch);
+                return store.withTenant(tenantRef, async (tenant) => {
+                    const result = await tenant.importHolidayCalendar({
+                        tenantRef,
+                        ...scope,
+                        name: read.name,
+                        ...(read.url !== undefined ? { url: read.url } : {}),
+                        holidays: read.holidays,
+                        span: read.span,
+                    });
+                    return { imported: result.imported, skipped: read.skipped, removed: result.removed };
+                }, by(actor));
+            },
+            byUrl: options.holidayFetch !== undefined,
+            calendars: (tenantRef) => store.withTenant(tenantRef, (tenant) => tenant.listHolidayCalendars({ tenantRef })),
+            deleteCalendar: (tenantRef, id, actor) => store.withTenant(tenantRef, async (tenant) => (await tenant.deleteHolidayCalendar({ tenantRef, id })) !== null, by(actor)),
+        },
         agenda: (tenantRef, window, limit) => store.withTenant(tenantRef, (tenant) => tenant.listAgenda({ tenantRef, window, limit })),
         recentChanges: (tenantRef, limit) => store.withTenant(tenantRef, (tenant) => tenant.listRecentChanges({ tenantRef, limit })),
         setRules: (tenantRef, id, rules, actor) => store.withTenant(tenantRef, (tenant) => tenant.setResourceBookingRules({ tenantRef, id, rules }), by(actor)),
@@ -463,6 +516,11 @@ const RULE_NAMES = Object.freeze({
     bufferBeforeMinutes: 'Buffer before',
     turnaroundMinutes: 'Turnaround',
     checkInMinutes: 'Check-in release',
+    minDurationMinutes: 'Shortest booking',
+    maxDurationMinutes: 'Longest booking',
+    defaultDurationMinutes: 'Usual length',
+    cancelCutoffMinutes: 'Cancel cutoff',
+    rescheduleCutoffMinutes: 'Move cutoff',
 });
 /** The booking rules form's fields, by rule. */
 const RULE_FIELDS = Object.freeze({
@@ -473,6 +531,11 @@ const RULE_FIELDS = Object.freeze({
     bufferBeforeMinutes: 'buffer_before_minutes',
     turnaroundMinutes: 'turnaround_minutes',
     checkInMinutes: 'check_in_minutes',
+    minDurationMinutes: 'min_duration_minutes',
+    maxDurationMinutes: 'max_duration_minutes',
+    defaultDurationMinutes: 'default_duration_minutes',
+    cancelCutoffMinutes: 'cancel_cutoff_minutes',
+    rescheduleCutoffMinutes: 'reschedule_cutoff_minutes',
 });
 /** How the inherited-rules note names each rule, with its unit. */
 const INHERITED_NAMES = Object.freeze({
@@ -480,7 +543,28 @@ const INHERITED_NAMES = Object.freeze({
     maxAdvanceDays: 'Book up to (days ahead)',
     enforceHours: 'Only inside bookable hours',
     requireCertain: 'Only in time its calendar syncs have read today',
+    allowedDurations: 'Lengths (min)',
+    pickupTimes: 'Pick-up times',
+    returnTimes: 'Return times',
+    cancellationFee: 'Cancellation fee',
+    hoursApply: 'Hours hold a hire at',
 });
+/** A rule's value as the dashboard shows it. */
+function ruleValueText(value) {
+    if (typeof value === 'number')
+        return value.toLocaleString('en');
+    if (typeof value === 'boolean')
+        return value ? 'on' : 'off';
+    if (typeof value === 'string')
+        return value === 'ends' ? 'its start and end' : 'all of it';
+    if (!Array.isArray(value)) {
+        const fee = value;
+        return `${(fee.amountMinor / 100).toFixed(2)} ${fee.currency}${fee.withinMinutes !== undefined ? ` within ${fee.withinMinutes.toLocaleString('en')} min` : ''}`;
+    }
+    return value
+        .map((item) => (typeof item === 'number' ? item.toLocaleString('en') : hoursOf(item.startMinutes, item.durationMinutes)))
+        .join(', ');
+}
 /**
  * The rules a resource takes from defaults, each with where it comes from: a rule its pool's
  * defaults set, else one the tenant's set, where its own rules do not. Without the defaults, the
@@ -508,7 +592,7 @@ function inheritedNote(inherited) {
         return html ``;
     const parts = [...inherited].map(([name, { value, from }]) => typeof value === 'boolean'
         ? `${INHERITED_NAMES[name]}${value ? '' : ': off'} (${from})`
-        : `${INHERITED_NAMES[name]} ${value.toLocaleString('en')} (${from})`);
+        : `${INHERITED_NAMES[name]} ${ruleValueText(value)} (${from})`);
     return html `<p class="fine">Inherited: ${parts.join('; ')}.</p>`;
 }
 const icon = (paths) => new Html(`<svg class="icon" viewBox="0 0 24 24" aria-hidden="true" focusable="false">${paths}</svg>`);
@@ -916,6 +1000,25 @@ function weekFromForm(form) {
     }
     return week;
 }
+/** Minutes after midnight for `HH:MM`, or null. */
+function minutesOf(value) {
+    const match = TIME.exec(value);
+    return match ? Number(match[1]) * 60 + Number(match[2]) : null;
+}
+/**
+ * A resource's hours in one line: its own, or what it inherits and from where (RFC 0004 B2), or the
+ * server's.
+ */
+function resourceHours(resource, server) {
+    if (resource.availabilityRules !== undefined)
+        return hoursSummary(resource.availabilityRules);
+    const inherited = resource.inheritedAvailability;
+    if (inherited) {
+        const from = inherited.source === 'location' ? `${inherited.location ?? 'Location'}'s hours` : 'Your hours';
+        return `${from}: ${hoursSummary(inherited.rules)}`;
+    }
+    return server.length === 0 ? "Server's hours (none)" : `Server's hours: ${hoursSummary(server)}`;
+}
 export function createSlotlockDashboard(options) {
     const publicUrl = new URL(options.publicUrl);
     const origin = publicUrl.origin;
@@ -1393,11 +1496,13 @@ ${options.termsUrl
                 runs.push({ change, times: 1 });
             }
         }
+        // Own entries only: a type such as `constructor` names nothing here.
+        const own = (map, type) => (Object.hasOwn(map, type) ? map[type] : undefined);
         return html `<ol class="feed">${runs.map(({ change, times }) => {
-            const tone = CHANGE_LABELS[change.type]?.tone ?? 'neutral';
+            const tone = own(CHANGE_LABELS, change.type)?.tone ?? 'neutral';
             const where = change.resourceId ? resourceName(byId.get(change.resourceId), change.resourceId) : null;
             const object = where ?? (ABOUT_A_RESOURCE.test(change.type) ? 'a resource' : null);
-            const words = ACTIVITY[change.type];
+            const words = own(ACTIVITY, change.type);
             let sentence;
             if (change.type === 'usage.threshold_reached') {
                 const metric = typeof change.data.metric === 'string' ? change.data.metric : 'use';
@@ -1412,9 +1517,11 @@ ${options.termsUrl
                 sentence = rest === undefined ? html `${before}` : html `${before}<strong>${object ?? 'a resource'}</strong>${rest}`;
             }
             else {
-                // A change type this dashboard does not know yet: its label, or its name in words.
-                const label = CHANGE_LABELS[change.type]?.text ?? change.type.replace(/[._]/g, ' ').replace(/^./, (first) => first.toUpperCase());
-                sentence = html `${label}${object ? html ` <span class="on">on</span> <strong>${object}</strong>` : html ``}`;
+                // A change this dashboard has no words for (a newer server's): its label, never its type.
+                const label = own(CHANGE_LABELS, change.type)?.text;
+                sentence = label
+                    ? html `${label}${object ? html ` <span class="on">on</span> <strong>${object}</strong>` : html ``}`
+                    : html `Something changed${where ? html ` on <strong>${where}</strong>` : html ``}`;
             }
             return html `<li class="event"><span class="dot ${tone}" aria-hidden="true"></span><span class="what"><span class="title">${sentence}${times > 1 ? html ` <span class="times">${times === 2 ? 'twice' : `${String(times)} times`}</span>` : html ``}</span></span><time class="when" datetime="${change.occurredAt.toISOString()}" title="${formatDate(change.occurredAt)}">${ago(change.occurredAt, now())}</time></li>`;
         })}</ol>`;
@@ -1618,12 +1725,16 @@ ${keys.length === 0
             archived: Math.max(0, counted - resources.length),
         };
     }
-    async function resourcesPage(session, status = 200, notice) {
-        const resources = await options.resources.list(tenantOf(session));
-        const allowance = await resourceAllowance(tenantOf(session), resources);
+    async function resourcesPage(session, status = 200, notice, ownHoursOnly = false) {
+        const every = await options.resources.list(tenantOf(session));
+        const allowance = await resourceAllowance(tenantOf(session), every);
+        // `?hours=own`: those that keep hours of their own, which the tenant's hours do not reach.
+        const resources = ownHoursOnly
+            ? every.filter((resource) => resource.archivedAt === undefined && resource.availabilityRules !== undefined)
+            : every;
         const token = csrfToken(session);
         const content = html `${noticeOf(notice, status)}
-${pageHead('Resources', html `<div class="row-actions">${options.resources.grouping ? html `<a class="button" href="${root}/locations">Locations and groups</a>` : html ``}${resources.length > 0 ? html `<a class="button" href="${root}/hours">Set hours for every resource</a>` : html ``}</div>`)}
+${pageHead('Resources', html `<div class="row-actions">${options.resources.grouping ? html `<a class="button" href="${root}/locations">Locations and groups</a>` : html ``}<a class="button" href="${root}/hours">Your hours</a>${options.resources.hours ? html `<a class="button" href="${root}/closures">Closures</a>` : html ``}${options.resources.contacts ? html `<a class="button" href="${root}/contacts">Contacts</a>` : html ``}</div>`)}
 <section class="panel" id="add-resource">
 <h2>Add a resource</h2>
 <form class="create" method="post" action="${root}/resources">
@@ -1635,9 +1746,11 @@ ${pageHead('Resources', html `<div class="row-actions">${options.resources.group
 </form>
 <p class="fine">${String(allowance.used)} of ${String(allowance.limit)}${allowance.planned ? html ` on your plan${allowance.archived > 0 ? html `, ${String(allowance.archived)} of them archived (archived resources count until deleted)` : html ``}` : html ``}. Adding a reference you have changes its time zone.</p>
 </section>
-${resources.length === 0
+${ownHoursOnly
+            ? html `<p class="notice" role="status">${String(resources.length)} ${resources.length === 1 ? 'resource keeps hours of its own' : 'resources keep hours of their own'}, so <a href="${root}/hours">your hours</a> do not reach ${resources.length === 1 ? 'it' : 'them'}. <a href="${root}/resources">Show every resource</a></p>`
+            : html ``}${resources.length === 0 && !ownHoursOnly
             ? emptyState(ICONS.resources, 'No resources yet. Agents can only book what is listed here.', { href: '#reference', label: 'Add a resource' })
-            : html `<div class="table"><table><thead><tr><th>Reference</th><th>Time zone</th><th>Bookable hours</th><th>Resource id</th></tr></thead><tbody>${resources.map((resource) => html `<tr><td data-label="Reference" class="strong"><span class="cell"><a class="truncate" href="${root}/resources/${resource.id}" title="${resourceName(resource, resource.id)}">${resourceName(resource, resource.id)}</a>${resource.name && resource.externalRef ? html `<span class="meta" title="Reference ${resource.externalRef}">${resource.externalRef}</span>` : html ``}${resource.pool ? html `<span class="meta" title="Pool ${resource.pool}">Pool ${resource.pool}</span>` : html ``}</span></td><td data-label="Time zone">${resource.timezone}</td><td data-label="Bookable hours"><span class="cell"><span>${hoursSummary(resource.availabilityRules)}</span><a class="meta-link" href="${root}/hours?resource=${resource.id}">Set hours</a></span></td><td data-label="Resource id"><code class="muted truncate id" title="${resource.id}">${resource.id}</code></td></tr>`)}</tbody></table></div>`}`;
+            : html `<div class="table"><table><thead><tr><th>Reference</th><th>Time zone</th><th>Bookable hours</th><th>Resource id</th></tr></thead><tbody>${resources.map((resource) => html `<tr><td data-label="Reference" class="strong"><span class="cell"><a class="truncate" href="${root}/resources/${resource.id}" title="${resourceName(resource, resource.id)}">${resourceName(resource, resource.id)}</a>${resource.name && resource.externalRef ? html `<span class="meta" title="Reference ${resource.externalRef}">${resource.externalRef}</span>` : html ``}${resource.pool ? html `<span class="meta" title="Pool ${resource.pool}">Pool ${resource.pool}</span>` : html ``}</span></td><td data-label="Time zone">${resource.timezone}</td><td data-label="Bookable hours"><span class="cell"><span>${resourceHours(resource, options.availability ?? [])}</span><a class="meta-link" href="${root}/hours?resource=${resource.id}">Set hours</a></span></td><td data-label="Resource id"><code class="muted truncate id" title="${resource.id}">${resource.id}</code></td></tr>`)}</tbody></table></div>`}`;
         return respond(status, layout('Resources', content, session, 'resources'));
     }
     /** The tenant's locations and groups (RFC 0003 G2, G3): what they are, and adding and changing them. */
@@ -1663,7 +1776,7 @@ ${resources.length === 0
 <td data-label="Location" class="strong"><span class="cell"><span class="truncate" title="${paths.get(location.ref) ?? location.name}">${location.name}</span><span class="meta">${location.ref}${parent ? ` · in ${parent}` : ''}</span></span></td>
 <td data-label="Time zone">${zone ? (zone.from === location ? zone.timezone : html `<span class="cell"><span>${zone.timezone}</span><span class="meta">from ${zone.from.name}</span></span>`) : html `<span class="muted">None</span>`}</td>
 <td data-label="Resources">${String(location.resources)}</td>
-<td class="actions"><details class="act"><summary>Edit</summary><div class="pop"><form method="post" action="${root}/locations">${sent()}<input type="hidden" name="ref" value="${location.ref}">
+<td class="actions">${options.resources.hours ? html `<a class="button" href="${root}/hours?location=${location.ref}">Hours</a>` : html ``}<details class="act"><summary>Edit</summary><div class="pop"><form method="post" action="${root}/locations">${sent()}<input type="hidden" name="ref" value="${location.ref}">
 <label>Name<input name="name" required maxlength="${nameLimit}" value="${location.name}"></label>
 <label>Inside<select name="parent">${insideChoices(location.parentRef, location.ref)}</select></label>
 <label>Time zone<input name="timezone" maxlength="100" value="${location.timezone ?? ''}" placeholder="As where it is"></label>
@@ -1713,6 +1826,8 @@ ${groups.length === 0
 </section>`;
         return respond(status, layout('Locations and groups', content, session, 'resources'));
     }
+    /** Resources with hours of their own the tenant's hours page names; the rest are counted. */
+    const OWN_HOURS_NAMED = 8;
     /** Settings' sections, each its own page: the assistant's form apart from what is only read. */
     const SETTINGS_SECTIONS = Object.freeze([
         { id: 'assistant', label: 'Assistant', path: '/settings' },
@@ -1736,8 +1851,8 @@ ${groups.length === 0
         else if (shown === 'hours') {
             const rules = options.availability ?? [];
             body = html `${noticeOf(notice, status)}<div class="set-card"><div class="row"><span class="row-label">Default hours</span><div class="row-value${rules.length === 0 ? ' muted' : ''}">${rules.length === 0
-                ? 'None. Agents find free time only on resources with hours of their own.'
-                : html `${rules.map((rule, index) => html `${index > 0 ? html `<br>` : html ``}${daysOf(rule.rrule)}: ${hoursOf(rule.startMinutes, rule.durationMinutes)}`)}`}</div></div></div><p class="fine">In each resource's own time zone, for resources without hours of their own. Set by the server's operator.</p>`;
+                ? "None. Agents find free time only on resources with hours of their own, their location's or yours."
+                : html `${rules.map((rule, index) => html `${index > 0 ? html `<br>` : html ``}${daysOf(rule.rrule)}: ${hoursOf(rule.startMinutes, rule.durationMinutes)}`)}`}</div></div></div><p class="fine">In each resource's own time zone, for resources with no hours of their own, their location's or <a href="${root}/hours">yours</a>. Set by the server's operator.</p>`;
         }
         else {
             const current = session.orgs?.find((org) => org.id === session.org);
@@ -1799,7 +1914,7 @@ ${groups.length === 0
 <p><a class="back" href="${root}/resources">Resources</a></p>
 ${pageHead(resourceName(resource, resource.id))}
 ${resource.description ? html `<p>${resource.description}</p>` : html ``}
-<dl class="facts">${resource.name && resource.externalRef ? html `<dt>Reference</dt><dd>${resource.externalRef}</dd>` : html ``}${resource.kind ? html `<dt>Kind</dt><dd>${KIND_NAMES[resource.kind]}</dd>` : html ``}${resource.capacity !== undefined ? html `<dt>Capacity</dt><dd>${String(resource.capacity)}</dd>` : html ``}${resource.labels ? html `<dt>Labels</dt><dd>${resource.labels.join(', ')}</dd>` : html ``}${resource.location ? html `<dt>Location</dt><dd>${paths.get(resource.location) ?? resource.locationName ?? resource.location}</dd>` : html ``}${resource.groups ? html `<dt>Groups</dt><dd>${resource.groups.map((ref) => groupNames.get(ref) ?? ref).join(', ')}</dd>` : html ``}<dt>Time zone</dt><dd>${resource.timezone}</dd><dt>Bookable hours</dt><dd>${hoursSummary(resource.availabilityRules)} <a href="${root}/hours?resource=${resource.id}">Set hours</a></dd><dt>Resource id</dt><dd><code class="muted">${resource.id}</code></dd></dl>
+<dl class="facts">${resource.name && resource.externalRef ? html `<dt>Reference</dt><dd>${resource.externalRef}</dd>` : html ``}${resource.kind ? html `<dt>Kind</dt><dd>${KIND_NAMES[resource.kind]}</dd>` : html ``}${resource.capacity !== undefined ? html `<dt>Capacity</dt><dd>${String(resource.capacity)}</dd>` : html ``}${resource.labels ? html `<dt>Labels</dt><dd>${resource.labels.join(', ')}</dd>` : html ``}${resource.location ? html `<dt>Location</dt><dd>${paths.get(resource.location) ?? resource.locationName ?? resource.location}</dd>` : html ``}${resource.groups ? html `<dt>Groups</dt><dd>${resource.groups.map((ref) => groupNames.get(ref) ?? ref).join(', ')}</dd>` : html ``}<dt>Time zone</dt><dd>${resource.timezone}</dd><dt>Bookable hours</dt><dd>${resourceHours(resource, options.availability ?? [])} <a href="${root}/hours?resource=${resource.id}">Set hours</a></dd><dt>Resource id</dt><dd><code class="muted">${resource.id}</code></dd></dl>
 <div class="split">
 <div class="stack">
 ${options.resources.setRules
@@ -1817,7 +1932,18 @@ ${field('stepOffsetMinutes', 'Steps start past each step by', 'min')}
 ${field('bufferBeforeMinutes', 'Kept free before each booking', 'min')}
 ${field('turnaroundMinutes', 'Turnaround after each booking', 'min')}
 ${field('checkInMinutes', 'Release if not checked in after', 'min')}
+${field('minDurationMinutes', 'Shortest booking', 'min')}
+${field('maxDurationMinutes', 'Longest booking', 'min')}
+${field('defaultDurationMinutes', 'Usual length, offered when none is asked', 'min')}
+${field('cancelCutoffMinutes', 'Cancel up to, before the start', 'min')}
+${field('rescheduleCutoffMinutes', 'Move up to, before the start', 'min')}
 </div>
+${resource.bookingRules?.allowedDurations || resource.bookingRules?.pickupTimes || resource.bookingRules?.returnTimes || resource.bookingRules?.cancellationFee ? html `<p class="fine">Set through the API, and kept when you save: ${[
+                resource.bookingRules.allowedDurations ? `lengths ${ruleValueText(resource.bookingRules.allowedDurations)} min` : '',
+                resource.bookingRules.pickupTimes ? `pick-up ${ruleValueText(resource.bookingRules.pickupTimes)}` : '',
+                resource.bookingRules.returnTimes ? `return ${ruleValueText(resource.bookingRules.returnTimes)}` : '',
+                resource.bookingRules.cancellationFee ? `cancellation fee ${ruleValueText(resource.bookingRules.cancellationFee)}` : '',
+            ].filter(Boolean).join('; ')}.</p>` : html ``}
 ${toggle('enforceHours', 'enforce_hours', 'Only inside bookable hours')}
 ${toggle('requireCertain', 'require_certain', 'Only in time its calendar syncs have read today')}
 ${inheritedNote(inherited)}
@@ -1926,6 +2052,12 @@ ${activity ? html `<section class="panel"><h2>Activity</h2>${activityPanel(activ
         const requireCertain = choice('require_certain');
         if (requireCertain !== undefined)
             rules.requireCertain = requireCertain;
+        // Rules the form does not edit (set through the API) are kept.
+        for (const name of ['allowedDurations', 'pickupTimes', 'returnTimes', 'cancellationFee']) {
+            const kept = resource.bookingRules?.[name];
+            if (kept !== undefined)
+                rules[name] = kept;
+        }
         try {
             await options.resources.setRules(tenantOf(session), id, Object.keys(rules).length === 0 ? null : rules, personOf(session));
         }
@@ -2360,7 +2492,35 @@ ${decided.length === 0
     const OWN_HOST_REFUSAL = 'That URL is this Slotlock deployment’s own address. Give the address of the model’s API.';
     const assistantTimeout = assistantOptions?.timeoutMs ?? 30_000;
     const assistantTurnTimeout = assistantOptions?.turnTimeoutMs ?? 90_000;
-    const conversationTtl = assistantOptions?.conversationTtlMs ?? 2 * 3_600_000;
+    // Kept until the member deletes a conversation, unless the deployment gives them a lifetime.
+    const conversationTtl = assistantOptions?.conversationTtlMs ?? null;
+    /** How recently a conversation was used for the assistant page to open on it rather than a new one. */
+    const CHAT_RESUME_MS = 2 * 3_600_000;
+    const newChatId = () => randomBytes(12).toString('base64url');
+    /** The conversation a page or form names, or null for a new one. */
+    const chatOf = (value) => value && SLOTLOCK_ASSISTANT_CHAT_ID.test(value) ? value : null;
+    const chatUrl = (id) => `${root}/assistant?c=${id ?? 'new'}`;
+    /**
+     * The conversation a form goes to: the one its `chat` names, a new one when it is empty, and with
+     * no `chat` at all (a page of an earlier release), the one the page would open: the member's most
+     * recent, used in the past two hours (`anyAge`: however long ago).
+     */
+    async function chatOfForm(store, session, form, anyAge = false) {
+        if (form.has('chat'))
+            return chatOf(form.get('chat'));
+        const [latest] = await store.listChats(tenantOf(session), personOf(session), 1);
+        return latest && (anyAge || now() - latest.updatedAt.getTime() < CHAT_RESUME_MS) ? latest.id : null;
+    }
+    /** A conversation's first title: its first message on one line, cut at a word near 60 characters. */
+    const chatTitle = (text) => {
+        const line = text.replace(/\s+/gu, ' ').trim();
+        const chars = [...line];
+        if (chars.length <= 60)
+            return line || 'New chat';
+        const cut = chars.slice(0, 60).join('');
+        const space = cut.lastIndexOf(' ');
+        return `${(space > 30 ? cut.slice(0, space) : cut).replace(/[\s.,;:!?-]+$/u, '')}…`;
+    };
     if (assistantOptions && Buffer.byteLength(assistantOptions.secret, 'utf8') < 32) {
         throw new Error('Slotlock dashboard assistant secret must be at least 32 bytes');
     }
@@ -2584,6 +2744,7 @@ ${decided.length === 0
         external_ref: 'Reference',
         event_id: 'Booking',
         hold_id: 'Hold',
+        hold_group_id: 'Held together',
         ttl_seconds: 'Held for',
         notes: 'Note',
         description: 'Note',
@@ -2604,7 +2765,7 @@ ${decided.length === 0
         if (name === 'ttl_seconds' && typeof value === 'number') {
             return html `${value >= 60 ? `${Math.round(value / 60)} min` : `${value} s`}`;
         }
-        if ((name === 'event_id' || name === 'hold_id') && typeof value === 'string')
+        if ((name === 'event_id' || name === 'hold_id' || name === 'hold_group_id') && typeof value === 'string')
             return html `<code>${value}</code>`;
         if (typeof value === 'string')
             return html `<span class="wrap">${value}</span>`;
@@ -2634,7 +2795,7 @@ ${decided.length === 0
         approval_pending: 'it is waiting for an approval',
     });
     const refusal = (code) => REFUSALS[code] ?? code.replaceAll('_', ' ');
-    function actionCard(session, action, names, zones) {
+    function actionCard(session, action, names, zones, chatId) {
         const verb = slotlockAssistantActionVerb(action.operation);
         const title = action.summary || `${verb.verb}: ${toolTitles.get(action.operation) ?? action.operation}`;
         if (action.status !== 'pending') {
@@ -2666,7 +2827,7 @@ ${decided.length === 0
             const label = FACT_NAMES[name] ?? name.charAt(0).toUpperCase() + name.slice(1).replaceAll('_', ' ');
             (name in FACT_NAMES || name === 'attendees' ? facts : more).push(html `<dt>${label}</dt><dd>${fieldValue(name, value, names)}</dd>`);
         }
-        const hidden = (id) => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="action" value="${id}">`;
+        const hidden = (id) => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="chat" value="${chatId ?? ''}"><input type="hidden" name="action" value="${id}">`;
         return html `<li class="turn action" id="action-${action.id}"><div class="change"><p class="change-title">${title}</p>${facts.length > 0 ? html `<dl class="facts">${facts}</dl>` : html ``}${more.length > 0
             ? html `<details class="more"><summary>All details</summary><dl class="facts">${more}</dl></details>`
             : html ``}<div class="change-buttons"><form method="post" action="${root}/assistant/approve">${hidden(action.id)}<button class="${verb.danger ? 'danger' : 'primary'}" type="submit" data-busy="${verb.busy}">${verb.verb}</button></form><form method="post" action="${root}/assistant/dismiss">${hidden(action.id)}<button class="ghost" type="submit">Decline</button></form></div></div></li>`;
@@ -2701,7 +2862,7 @@ ${decided.length === 0
      * rendered Markdown, each run of tool steps folded into one line, proposed changes as cards, and
      * a failure that ends it with a way to send the last message again.
      */
-    function assistantItems(session, entries, actions, names, zones) {
+    function assistantItems(session, entries, actions, names, zones, chatId) {
         const items = [];
         let steps = [];
         let cards = [];
@@ -2736,7 +2897,7 @@ ${decided.length === 0
                     const write = SLOTLOCK_ASSISTANT_TOOL_USE[result.name] === 'propose';
                     const action = result.action ? readAction(result.action, actions[result.action]) : null;
                     if (action) {
-                        cards.push(actionCard(session, action, names, zones));
+                        cards.push(actionCard(session, action, names, zones, chatId));
                         continue;
                     }
                     const title = toolTitles.get(result.name) ?? result.name;
@@ -2752,7 +2913,7 @@ ${decided.length === 0
                 flush();
                 const last = index === entries.length - 1;
                 if (last && !quietNote(entry.text) && lastUser?.role === 'user') {
-                    items.push(html `<li class="turn error" role="alert"><span>${entry.text}</span><form method="post" action="${root}/assistant"><input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="message" value="${lastUser.text}"><button class="text-button" type="submit">Retry</button></form></li>`);
+                    items.push(html `<li class="turn error" role="alert"><span>${entry.text}</span><form method="post" action="${root}/assistant"><input type="hidden" name="csrf" value="${csrfToken(session)}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="chat" value="${chatId ?? ''}"><input type="hidden" name="message" value="${lastUser.text}"><button class="text-button" type="submit">Retry</button></form></li>`);
                 }
                 else {
                     items.push(html `<li class="turn note">${entry.text}</li>`);
@@ -2776,20 +2937,90 @@ ${decided.length === 0
         stop: new Html('<svg class="stop" viewBox="0 0 16 16" aria-hidden="true"><rect x="4" y="4" width="8" height="8" rx="1.5" fill="currentColor"/></svg>'),
         down: new Html('<svg viewBox="0 0 16 16" width="14" height="14" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M8 3v10M3.5 8.5 8 13l4.5-4.5"/></svg>'),
         plus: new Html('<svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" aria-hidden="true"><path d="M8 3v10M3 8h10"/></svg>'),
+        more: new Html('<svg viewBox="0 0 16 16" fill="currentColor" aria-hidden="true"><circle cx="3.5" cy="8" r="1.3"/><circle cx="8" cy="8" r="1.3"/><circle cx="12.5" cy="8" r="1.3"/></svg>'),
+        chats: new Html('<svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M3 4h10M3 8h10M3 12h6"/></svg>'),
     };
-    async function assistantPage(session, status = 200, notice) {
+    /** How long ago a chat was used, as briefly as the list has room for: 4m, 3h, 5d, then the date. */
+    function chatSince(at) {
+        const minutes = Math.max(0, Math.floor((now() - at.getTime()) / 60_000));
+        if (minutes < 1)
+            return 'now';
+        if (minutes < 60)
+            return `${String(minutes)}m`;
+        if (minutes < 24 * 60)
+            return `${String(Math.floor(minutes / 60))}h`;
+        if (minutes < 7 * 24 * 60)
+            return `${String(Math.floor(minutes / (24 * 60)))}d`;
+        return zoned('UTC', { day: 'numeric', month: 'short' }).format(at);
+    }
+    /** When a conversation was last used, as the Chats list groups them: by day, in UTC. */
+    function chatGroup(at) {
+        const day = (ms) => Math.floor(ms / DAY_MS);
+        const daysAgo = day(now()) - day(at.getTime());
+        if (daysAgo <= 0)
+            return 'Today';
+        if (daysAgo === 1)
+            return 'Yesterday';
+        if (daysAgo < 7)
+            return 'Previous 7 days';
+        if (daysAgo < 30)
+            return 'Previous 30 days';
+        return 'Older';
+    }
+    /**
+     * A member's conversations, the most recent first, grouped by when they were last used: each
+     * opens with a link, and has Rename and Delete behind its menu. `current` is the one shown.
+     */
+    function chatsPanel(session, chats, current) {
+        const token = csrfToken(session);
+        const hidden = (id) => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="chat" value="${id}">`;
+        const groups = [];
+        for (const chat of chats) {
+            const label = chatGroup(chat.updatedAt);
+            let group = groups.at(-1);
+            if (!group || group.label !== label) {
+                group = { label, rows: [] };
+                groups.push(group);
+            }
+            const here = chat.id === current;
+            group.rows.push(html `<li class="chat-row${here ? ' current' : ''}"><a class="chat-link" href="${chatUrl(chat.id)}"${here ? html ` aria-current="page"` : html ``}><span class="chat-title">${chat.title}</span><time class="chat-when" datetime="${chat.updatedAt.toISOString()}" title="${formatDate(chat.updatedAt)}">${chatSince(chat.updatedAt)}</time></a><details class="chat-menu"><summary aria-label="Options for ${chat.title}">${ASSISTANT_ICONS.more}</summary><div class="pop"><form class="chat-rename" method="post" action="${root}/assistant/rename">${hidden(chat.id)}<label class="visually-hidden" for="title-${chat.id}">Title</label><input id="title-${chat.id}" name="title" value="${chat.title}" maxlength="120" required><button type="submit">Rename</button></form><form method="post" action="${root}/assistant/delete">${hidden(chat.id)}<button class="danger" type="submit">Delete chat</button></form></div></details></li>`);
+        }
+        const list = groups.length === 0
+            ? html `<p class="empty chats-empty">No chats yet.</p>`
+            : html `${groups.map((group) => html `<h3 class="chat-group">${group.label}</h3><ul class="chat-rows">${group.rows}</ul>`)}`;
+        return html `<aside class="chats" aria-label="Chats"><div class="chats-head"><h2>Chats</h2><a class="icon-button" href="${chatUrl(null)}" aria-label="New chat" title="New chat">${ASSISTANT_ICONS.plus}</a></div><label class="visually-hidden" for="chats-filter">Search chats</label><input id="chats-filter" class="chats-filter" type="search" placeholder="Search chats" autocomplete="off" hidden><nav class="chat-list" aria-label="Your chats">${list}</nav></aside>`;
+    }
+    /**
+     * The assistant: a conversation, with the member's others beside it. `requested` is the page's
+     * `c`: a conversation's id, `new` for a new one, or nothing for the last one used in the past two
+     * hours (else a new one).
+     */
+    async function assistantPage(session, status = 200, notice, requested) {
         const store = assistantStore();
         if (!store)
             return notFound(session);
         const tenantRef = tenantOf(session);
-        const [settings, conversation] = await Promise.all([
-            store.getSettings(tenantRef),
-            store.getConversation(tenantRef, personOf(session)),
-        ]);
+        const member = personOf(session);
+        const [settings, chats] = await Promise.all([store.getSettings(tenantRef), store.listChats(tenantRef, member)]);
         if (!settings) {
             const content = html `${noticeOf(notice, status)}${pageHead('Assistant')}${emptyState(ICONS.assistant, isAdmin(session) ? 'Connect a model to use the assistant.' : 'An admin of this organization connects a model in Settings.', isAdmin(session) ? { href: `${root}/settings#assistant`, label: 'Connect a model' } : undefined)}`;
             return respond(status, layout('Assistant', content, session, 'assistant'));
         }
+        let chatId = chatOf(requested);
+        if (requested === undefined) {
+            const latest = chats[0];
+            if (latest && now() - latest.updatedAt.getTime() < CHAT_RESUME_MS)
+                chatId = latest.id;
+        }
+        const conversation = chatId ? await store.getChat(tenantRef, member, chatId) : null;
+        if (chatId && !conversation) {
+            // Deleted, or never this member's: a new one instead, saying so.
+            chatId = null;
+            if (requested !== undefined && notice === undefined) {
+                notice = 'That chat is not here: it was deleted.';
+                status = 404;
+            }
+        }
         const entries = readSlotlockAssistantEntries(conversation?.messages);
         const actions = conversation?.actions ?? {};
         const empty = entries.length === 0;
@@ -2797,7 +3028,7 @@ ${decided.length === 0
             ? await resourceLookups(tenantRef)
             : { resources: [], names: new Map(), zones: new Map() };
         const token = csrfToken(session);
-        const hidden = () => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}">`;
+        const hidden = () => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="chat" value="${chatId ?? ''}">`;
         const first = resources.find((resource) => !resource.archivedAt);
         const named = first ? resourceName(first, first.id) : null;
         // A read chip asks at once; a write chip fills the box to finish (app.js), or asks (no script).
@@ -2810,11 +3041,20 @@ ${decided.length === 0
         ];
         const chips = html `<div class="assistant-start"><div class="chips">${prompts.map((prompt) => html `<form method="post" action="${root}/assistant">${hidden()}<button class="chip" type="submit" name="message" value="${prompt.message}"${prompt.fill ? html ` data-fill="${prompt.message}"` : html ``}>${prompt.label}</button></form>`)}</div></div>`;
         const composer = html `<div class="dock"><button class="jump" type="button" hidden aria-label="Jump to the latest message">${ASSISTANT_ICONS.down}</button><form class="composer" method="post" action="${root}/assistant">${hidden()}<label class="visually-hidden" for="message">Message</label><textarea id="message" name="message" rows="2" maxlength="${String(SLOTLOCK_ASSISTANT_MAX_MESSAGE)}" required placeholder="${empty ? 'Ask about bookings' : 'Reply…'}"></textarea><div class="composer-bar"><span class="count" hidden></span><button class="send" type="submit" aria-label="Send">${ASSISTANT_ICONS.send}${ASSISTANT_ICONS.stop}</button></div></form></div>`;
-        const reset = html `<form class="inline new-chat" method="post" action="${root}/assistant/reset">${hidden()}<button class="ghost" type="submit">${ASSISTANT_ICONS.plus}New conversation</button></form>`;
+        const actionsHead = html `<div class="assistant-actions"><a class="button ghost chats-link" href="${root}/assistant/chats">${ASSISTANT_ICONS.chats}Chats</a><a class="button ghost new-chat" href="${chatUrl(null)}">${ASSISTANT_ICONS.plus}New chat</a></div>`;
         const flag = empty ? new Html(' data-empty') : html ``;
-        const content = html `${noticeOf(notice, status)}<div class="assistant-page"${flag}>${pageHead('Assistant', reset)}<div class="assistant" data-assistant data-stream="${root}/assistant/stream" data-page="${root}/assistant"${flag}><ol class="thread">${assistantItems(session, entries, actions, names, zones)}</ol><span id="latest"></span>${chips}${composer}</div></div>`;
+        const content = html `${noticeOf(notice, status)}<div class="assistant-shell">${chatsPanel(session, chats, chatId)}<div class="assistant-page"${flag}>${pageHead(conversation?.title ?? 'Assistant', actionsHead)}<div class="assistant" data-assistant data-stream="${root}/assistant/stream" data-page="${root}/assistant"${flag}><ol class="thread">${assistantItems(session, entries, actions, names, zones, chatId)}</ol><span id="latest"></span>${chips}${composer}</div></div></div>`;
         return respond(status, layout('Assistant', content, session, 'assistant'));
     }
+    /** The member's conversations on a page of their own: the Chats list where the page is narrow. */
+    async function chatsPage(session) {
+        const store = assistantStore();
+        if (!store)
+            return notFound(session);
+        const chats = await store.listChats(tenantOf(session), personOf(session));
+        const content = html `<div class="chats-page">${pageHead('Chats', html `<a class="button ghost" href="${chatUrl(null)}">${ASSISTANT_ICONS.plus}New chat</a>`)}${chatsPanel(session, chats, null)}</div>`;
+        return respond(200, layout('Chats', content, session, 'assistant'));
+    }
     /** The named provider a provider and base URL are, or none (Custom). */
     const presetOf = (provider, baseUrl) => SLOTLOCK_ASSISTANT_PRESETS.find((preset) => preset.id !== 'custom' && preset.provider === provider && preset.baseUrl === baseUrl);
     /**
@@ -3065,7 +3305,16 @@ ${decided.length === 0
         catch {
             // Metering never changes an answer.
         }
-        const stored = await store.getConversation(tenantRef, member);
+        // The conversation the form continues (a new one when it names none, or one deleted meanwhile),
+        // and the resources agents may see, so a name is matched to its id without a lookup.
+        const asked = await chatOfForm(store, session, form);
+        const [stored, listed] = await Promise.all([
+            asked ? store.getChat(tenantRef, member, asked) : Promise.resolve(null),
+            options.resources.list(tenantRef).catch(() => []),
+        ]);
+        const chatId = stored?.id ?? newChatId();
+        const title = stored?.title ?? chatTitle(text);
+        const bookable = listed.filter((resource) => resource.visibility !== 'private' && resource.archivedAt === undefined);
         const entries = boundSlotlockAssistantEntries([
             ...readSlotlockAssistantEntries(stored?.messages),
             { role: 'user', text },
@@ -3082,6 +3331,17 @@ ${decided.length === 0
                 workspace: current?.login ?? session.login,
                 login: session.login,
                 now: new Date(now()),
+                resources: bookable.slice(0, SLOTLOCK_ASSISTANT_DIRECTORY_SIZE).map((resource) => ({
+                    id: resource.id,
+                    ...(resource.name !== undefined ? { name: resource.name } : {}),
+                    ...(resource.externalRef ? { ref: resource.externalRef } : {}),
+                    ...(resource.kind !== undefined ? { kind: resource.kind } : {}),
+                    ...(resource.locationName !== undefined || resource.location !== undefined
+                        ? { location: (resource.locationName ?? resource.location) }
+                        : {}),
+                    timezone: resource.timezone,
+                })),
+                resourceCount: bookable.length,
             }),
             entries,
             fetch: assistantFetch,
@@ -3141,19 +3401,25 @@ ${decided.length === 0
         // Only this turn's proposals are added; the rest are kept as the row holds them now, so one
         // approved (or a conversation reset) while the turn ran is never put back as it stood.
         const kept = pruneSlotlockAssistantActions(messages, { ...(stored?.actions ?? {}), ...proposed });
-        await store.putConversation(tenantRef, member, {
+        await store.putChat(tenantRef, member, chatId, {
+            title,
             messages,
             added: Object.fromEntries(Object.entries(proposed).filter(([id]) => id in kept)),
             keep: Object.keys(kept),
+            // A chat it continued, only while it is still there: deleted during the turn, it stays so.
+            create: stored === null,
         }, conversationTtl);
-        return { ok: true, messages, actions: kept };
+        return { ok: true, messages, actions: kept, chatId, title };
     }
     /** The form's way (no script): run the turn, then show the conversation at its latest message. */
     async function sendToAssistant(session, form) {
         const run = await runAssistantMessage(session, form);
-        if (!run.ok)
-            return run.status === 404 ? notFound(session) : assistantPage(session, run.status, run.message);
-        return redirect(303, `${root}/assistant#latest`);
+        if (!run.ok) {
+            return run.status === 404
+                ? notFound(session)
+                : assistantPage(session, run.status, run.message, chatOf(form.get('chat')) ?? 'new');
+        }
+        return redirect(303, `${chatUrl(run.chatId)}#latest`);
     }
     /**
      * app.js's way: the same turn, answered as it happens, one JSON object a line. `text` carries a
@@ -3163,15 +3429,32 @@ ${decided.length === 0
      */
     async function streamToAssistant(session, form, request) {
         const encoder = new TextEncoder();
-        const pipe = new TransformStream();
-        const writer = pipe.writable.getWriter();
+        // Stop, or a client gone, cancels the body. That stops the turn, which keeps what it had, and
+        // the cancel settles only once it has: a Worker closes the request's connection then, and a
+        // runtime that never aborts request.signal on a disconnect stops the turn all the same.
+        const stop = new AbortController();
         let open = true;
+        let sink;
+        let work = Promise.resolve();
+        const body = new ReadableStream({
+            start(controller) {
+                sink = controller;
+            },
+            cancel() {
+                open = false;
+                stop.abort();
+                return work;
+            },
+        });
         const write = (event) => {
             if (!open)
                 return;
-            writer.write(encoder.encode(`${JSON.stringify(event)}\n`)).catch(() => {
+            try {
+                sink?.enqueue(encoder.encode(`${JSON.stringify(event)}\n`));
+            }
+            catch {
                 open = false;
-            });
+            }
         };
         const label = (name, state) => slotlockAssistantStepLabel(name, toolTitles.get(name) ?? name, state, SLOTLOCK_ASSISTANT_TOOL_USE[name] === 'propose');
         const failed = (message) => write({
@@ -3179,10 +3462,10 @@ ${decided.length === 0
             html: html `<li class="turn error" role="alert"><span>${message}</span></li>`.value,
             once: formNonce(session),
         });
-        const work = (async () => {
+        work = (async () => {
             try {
                 const run = await runAssistantMessage(session, form, {
-                    signal: request.signal,
+                    signal: AbortSignal.any([request.signal, stop.signal]),
                     onEvent: (event) => {
                         if (event.type === 'text')
                             write({ t: 'text', d: event.delta });
@@ -3202,10 +3485,16 @@ ${decided.length === 0
                 const lookups = Object.keys(run.actions).length > 0
                     ? await resourceLookups(tenantOf(session))
                     : { names: new Map(), zones: new Map() };
+                const chats = await assistantStore()?.listChats(tenantOf(session), personOf(session));
                 write({
                     t: 'done',
-                    html: assistantItems(session, turn, run.actions, lookups.names, lookups.zones).join(''),
+                    html: assistantItems(session, turn, run.actions, lookups.names, lookups.zones, run.chatId).join(''),
                     once: formNonce(session),
+                    // The conversation it went to (a new one has its id now), its address, and the list again.
+                    chat: run.chatId,
+                    title: run.title,
+                    url: chatUrl(run.chatId),
+                    chats: chats ? chatsPanel(session, chats, run.chatId).value : undefined,
                 });
             }
             catch (error) {
@@ -3213,8 +3502,15 @@ ${decided.length === 0
                 failed('Something went wrong. Reload the page and try again.');
             }
             finally {
-                await writer.close().catch(() => undefined);
-                open = false;
+                if (open) {
+                    open = false;
+                    try {
+                        sink?.close();
+                    }
+                    catch {
+                        // Cancelled meanwhile.
+                    }
+                }
             }
         })();
         ignoreRejection(work);
@@ -3223,54 +3519,88 @@ ${decided.length === 0
         headers.set('Content-Type', 'application/x-ndjson; charset=utf-8');
         // Proxies that buffer (nginx) send each line as it is written.
         headers.set('X-Accel-Buffering', 'no');
-        return new Response(pipe.readable, { status: 200, headers });
+        return new Response(body, { status: 200, headers });
     }
     async function settleAction(session, form, decision) {
         const store = assistantStore();
         if (!store || !assistantOptions)
             return notFound(session);
         const id = form.get('action') ?? '';
+        const chatId = await chatOfForm(store, session, form, true);
         const tenantRef = tenantOf(session);
         const member = personOf(session);
-        const claimed = ACTION_ID.test(id)
-            ? await store.settleAction(tenantRef, member, id, 'pending', decision === 'approve' ? { status: 'approved' } : { status: 'dismissed', input: {} })
+        const claimed = ACTION_ID.test(id) && chatId
+            ? await store.settleAction(tenantRef, member, chatId, id, 'pending', decision === 'approve' ? { status: 'approved' } : { status: 'dismissed', input: {} })
             : null;
         const action = claimed ? readAction(id, claimed) : null;
-        if (!action)
-            return assistantPage(session, 409, 'That change was already approved or dismissed.');
+        if (!action || !chatId) {
+            return assistantPage(session, 409, 'That change was already approved or dismissed.', chatId ?? undefined);
+        }
         const title = toolTitles.get(action.operation) ?? action.operation;
         let event;
         if (decision === 'dismiss') {
             event = `The member dismissed the proposed change ${id} (${title}); it did not run.`;
         }
         else if (SLOTLOCK_ASSISTANT_TOOL_USE[action.operation] !== 'propose') {
-            await store.settleAction(tenantRef, member, id, 'approved', { status: 'failed', outcome: 'tool_not_available', input: {} });
+            await store.settleAction(tenantRef, member, chatId, id, 'approved', { status: 'failed', outcome: 'tool_not_available', input: {} });
             event = `The proposed change ${id} (${title}) could not run: tool_not_available.`;
         }
         else {
             const outcome = await dispatch(session, action.operation, action.input, 'run');
             // Settled, the card keeps what it said, not the arguments: the actions stay small.
-            await store.settleAction(tenantRef, member, id, 'approved', outcome.ok ? { status: 'done', input: {} } : { status: 'failed', outcome: outcome.code, input: {} });
+            await store.settleAction(tenantRef, member, chatId, id, 'approved', outcome.ok ? { status: 'done', input: {} } : { status: 'failed', outcome: outcome.code, input: {} });
             const result = JSON.stringify(outcome.ok ? outcome.data : { error: { code: outcome.code } });
             event = `The member approved the proposed change ${id} (${title}). ${outcome.ok ? 'It ran' : 'It was refused'}: ${result.length > 4_000 ? `${result.slice(0, 4_000)} …[truncated]` : result}`;
         }
-        const stored = await store.getConversation(tenantRef, member);
+        const stored = await store.getChat(tenantRef, member, chatId);
         if (stored) {
             const entries = [
                 ...readSlotlockAssistantEntries(stored.messages),
                 { role: 'event', text: event },
             ];
             const messages = boundSlotlockAssistantEntries(entries);
-            await store.putConversation(tenantRef, member, { messages, added: {}, keep: Object.keys(pruneSlotlockAssistantActions(messages, stored.actions)) }, conversationTtl);
-        }
-        return redirect(303, `${root}/assistant#action-${id}`);
+            await store.putChat(tenantRef, member, chatId, {
+                title: stored.title,
+                messages,
+                added: {},
+                keep: Object.keys(pruneSlotlockAssistantActions(messages, stored.actions)),
+                create: false,
+            }, conversationTtl);
+        }
+        return redirect(303, `${chatUrl(chatId)}#action-${id}`);
     }
+    /** A new conversation: the others are kept, in Chats. (A form of an earlier release posts here.) */
     async function resetAssistant(session) {
+        if (!assistantStore())
+            return notFound(session);
+        return redirect(303, chatUrl(null));
+    }
+    /** Give one of the member's conversations a title of their own. */
+    async function renameChat(session, form) {
+        const store = assistantStore();
+        if (!store)
+            return notFound(session);
+        const chatId = chatOf(form.get('chat'));
+        const title = (form.get('title') ?? '').replace(/\s+/gu, ' ').trim();
+        if (!chatId)
+            return assistantPage(session, 404, 'That chat is not here: it was deleted.', 'new');
+        if ([...title].length < 1 || [...title].length > 120) {
+            return assistantPage(session, 400, 'Give the chat a title of 1 to 120 characters.', chatId);
+        }
+        const renamed = await store.renameChat(tenantOf(session), personOf(session), chatId, title);
+        if (!renamed)
+            return assistantPage(session, 404, 'That chat is not here: it was deleted.', 'new');
+        return redirect(303, chatUrl(chatId));
+    }
+    /** Delete one of the member's conversations, at once and for good. */
+    async function deleteChat(session, form) {
         const store = assistantStore();
         if (!store)
             return notFound(session);
-        await store.deleteConversation(tenantOf(session), personOf(session));
-        return redirect(303, `${root}/assistant`);
+        const chatId = chatOf(form.get('chat'));
+        if (chatId)
+            await store.deleteChat(tenantOf(session), personOf(session), chatId);
+        return redirect(303, chatUrl(null));
     }
     /**
      * A workspace's plan as both the Usage page and the overview show it: the plan (or the default it
@@ -3535,6 +3865,10 @@ ${contact
         if ((route.startsWith('/locations') || route.startsWith('/groups')) && options.resources.grouping) {
             return locationsPage;
         }
+        if (route.startsWith('/closures') && options.resources.hours)
+            return closuresPage;
+        if (route.startsWith('/contacts') && options.resources.contacts)
+            return contactsPage;
         if (route.startsWith('/resources') || route === '/hours')
             return resourcesPage;
         if (route.startsWith('/assistant') && assistantStore())
@@ -3547,13 +3881,38 @@ ${contact
             return teamsPage;
         return overviewPage;
     }
+    const isLocationTarget = (target) => typeof target === 'object' && 'location' in target && typeof target.location === 'object';
+    /** How many resources keep hours of their own, a few by name, and what saving does to them. */
+    function ownHoursChoice(own) {
+        if (own.length === 0)
+            return html ``;
+        const named = own.slice(0, OWN_HOURS_NAMED);
+        const word = own.length === 1 ? 'resource keeps hours of its own' : 'resources keep hours of their own';
+        return html `<fieldset class="modes"><legend>${String(own.length)} ${word}</legend>
+<p class="fine">${named.map((resource, index) => html `${index > 0 ? ', ' : ''}<a href="${root}/hours?resource=${resource.id}">${resourceName(resource, resource.id)}</a>`)}${own.length > named.length ? html ` and ${String(own.length - named.length)} more` : html ``}. <a href="${root}/resources?hours=own">See them all</a></p>
+<label class="choice"><input type="radio" name="override" value="none" checked> Keep them</label>
+<label class="choice"><input type="radio" name="override" value="matching"> Clear those with the same hours as yours were, or as these: copies an earlier version made when your hours were set</label>
+<label class="choice"><input type="radio" name="override" value="all"> Clear them all, so every resource uses these</label>
+</fieldset>`;
+    }
     function hoursPage(session, state) {
         const { target, mode } = state;
         const checked = (value) => (mode === value ? html ` checked` : html ``);
         const server = options.availability ?? [];
+        const place = isLocationTarget(target) ? target.location : null;
+        const resource = target !== 'all' && !place ? target : null;
         const title = target === 'all'
-            ? 'Hours for every resource'
-            : `Hours for ${target.externalRef ?? target.id}`;
+            ? 'Your hours'
+            : place
+                ? `Hours at ${place.name}`
+                : `Hours for ${resource?.externalRef ?? resource?.id ?? ''}`;
+        const inheritLabel = target === 'all'
+            ? html `The server's hours (${server.length === 0 ? 'none' : hoursSummary(server)})`
+            : place
+                ? html `Inherit: a location it is in, else your hours, else the server's`
+                : resource && resource.availabilityRules === undefined
+                    ? html `Inherit (${resourceHours(resource, server)})`
+                    : html `Inherit: its location's hours, else yours, else the server's`;
         const rows = WEEKDAYS.map((day) => {
             const cells = state.week[day].flatMap(({ from, to }, index) => {
                 const which = index + 1;
@@ -3567,30 +3926,50 @@ ${contact
         });
         const content = html `${state.notice ? html `<p class="notice" role="alert">${state.notice}</p>` : html ``}
 <section>
-<p><a class="back" href="${root}/resources">Resources</a></p>
+<p><a class="back" href="${root}/${place ? 'locations' : 'resources'}">${place ? 'Locations' : 'Resources'}</a></p>
 <h1>${title}</h1>
 <p>${target === 'all'
-            ? 'The same hours for every resource, each in its own time zone. Saving replaces their hours.'
-            : `When agents may book it, in its time zone: ${target.timezone}.`}</p>
+            ? 'Every resource without hours of its own uses these, each in its own time zone, unless its location has hours. Resources you add later too.'
+            : place
+                ? `Resources at ${place.name}, or at a location inside it, without hours of their own use these, each in its own time zone, unless a location nearer them has hours.`
+                : `When agents may book it, in its time zone: ${resource?.timezone ?? ''}.`}${options.resources.hours ? html ` <a href="${root}/closures">Closures and special days</a> change single days.` : html ``}</p>
 ${state.unshown
             ? html `<div class="notice warn" role="alert"><p>These hours were set outside the dashboard, so the week below cannot show them. Saving replaces them.</p><ul class="hours">${state.unshown.map((rule) => html `<li><code>${rule.rrule}</code> from ${formatMinutes(rule.startMinutes)} for ${String(rule.durationMinutes)} min</li>`)}</ul></div>`
             : html ``}
 <form method="post" action="${root}/hours">
 <input type="hidden" name="csrf" value="${csrfToken(session)}">
 <input type="hidden" name="once" value="${formNonce(session)}">
-<input type="hidden" name="resource" value="${target === 'all' ? 'all' : target.id}">
+${place ? html `<input type="hidden" name="location" value="${place.ref}">` : html `<input type="hidden" name="resource" value="${target === 'all' ? 'all' : (resource?.id ?? '')}">`}
 <fieldset class="modes"><legend>Bookable hours</legend>
-<label class="choice"><input type="radio" name="mode" value="server"${checked('server')}> The server's hours (${server.length === 0 ? 'none' : hoursSummary(server)})</label>
+<label class="choice"><input type="radio" name="mode" value="server"${checked('server')}> ${inheritLabel}</label>
 <label class="choice"><input type="radio" name="mode" value="closed"${checked('closed')}> Closed: agents find no free slot</label>
 <label class="choice"><input type="radio" name="mode" value="custom"${checked('custom')}> These hours</label>
 </fieldset>
 <div class="table"><table class="week"><thead><tr><th>Day</th><th>Opens</th><th>Closes</th><th>Opens</th><th>Closes</th></tr></thead><tbody>${rows}</tbody></table></div>
 <p class="fine">A closing time at or before the opening time closes the next day; 00:00 to 00:00 is the whole day. Leave a window empty for none.</p>
+${target === 'all' ? ownHoursChoice(state.own ?? []) : html ``}
 <button class="primary" type="submit">Save hours</button>
 </form>
 </section>`;
         return respond(state.status ?? 200, layout('Bookable hours', content, session, 'resources'));
     }
+    /** The editor's state for stored rules: inherit (null), closed ([]), or a week. */
+    function hoursState(rules) {
+        if (rules === undefined || rules === null) {
+            return { mode: 'server', week: weekFormOf(rulesToWeeklyHours(options.availability ?? [])) };
+        }
+        if (rules.length === 0)
+            return { mode: 'closed', week: emptyWeekForm() };
+        const week = rulesToWeeklyHours(rules);
+        return { mode: 'custom', week: weekFormOf(week), ...(week === null ? { unshown: rules } : {}) };
+    }
+    /** The tenant's location with that reference, or null. */
+    async function ownLocation(session, ref) {
+        const grouping = options.resources.grouping;
+        if (!grouping || !/^[a-z0-9][a-z0-9._-]{0,99}$/.test(ref))
+            return null;
+        return (await grouping.locations(tenantOf(session))).find((location) => location.ref === ref) ?? null;
+    }
     /** The tenant's resource with that id, or null for anything else. */
     async function ownResource(session, id) {
         if (!UUID_PATTERN.test(id))
@@ -3600,38 +3979,51 @@ ${state.unshown
     }
     const notFound = (session) => respond(404, layout('Not found', html `<p class="notice">That resource is not one of yours.</p>`, session));
     const nothingHere = (session) => respond(404, layout('Not found', html `<p class="notice">Nothing is here.</p>`, session));
+    /** The tenant's resources in use that keep hours of their own, by name. */
+    async function ownHoursOf(session) {
+        const resources = await options.resources.list(tenantOf(session));
+        return resources
+            .filter((resource) => resource.archivedAt === undefined && resource.availabilityRules !== undefined)
+            .sort((one, other) => resourceName(one, one.id).localeCompare(resourceName(other, other.id)));
+    }
     async function hoursEditor(session, url) {
+        const ref = url.searchParams.get('location');
+        if (ref !== null) {
+            const location = await ownLocation(session, ref);
+            if (!location || !options.resources.hours)
+                return nothingHere(session);
+            const defaults = await options.resources.hours.defaults(tenantOf(session));
+            const rules = defaults.locations.find((entry) => entry.location === ref)?.rules ?? null;
+            return hoursPage(session, { target: { location }, ...hoursState(rules) });
+        }
         const id = url.searchParams.get('resource');
         if (id === null) {
-            const server = rulesToWeeklyHours(options.availability ?? []);
-            return hoursPage(session, { target: 'all', mode: 'server', week: weekFormOf(server) });
+            const [defaults, own] = await Promise.all([options.resources.hours?.defaults(tenantOf(session)), ownHoursOf(session)]);
+            return hoursPage(session, { target: 'all', ...hoursState(defaults?.tenant ?? null), own });
         }
         const resource = await ownResource(session, id);
         if (!resource)
             return notFound(session);
-        const rules = resource.availabilityRules;
-        if (rules === undefined) {
-            const server = rulesToWeeklyHours(options.availability ?? []);
-            return hoursPage(session, { target: resource, mode: 'server', week: weekFormOf(server) });
-        }
-        if (rules.length === 0) {
-            return hoursPage(session, { target: resource, mode: 'closed', week: emptyWeekForm() });
-        }
-        const week = rulesToWeeklyHours(rules);
-        return hoursPage(session, {
-            target: resource,
-            mode: 'custom',
-            week: weekFormOf(week),
-            ...(week === null ? { unshown: rules } : {}),
-        });
+        return hoursPage(session, { target: resource, ...hoursState(resource.availabilityRules) });
     }
+    /** The form's choice for resources' own hours (`yes`: the checkbox of a page from before); anything else keeps them. */
+    const overrideOf = (value) => value === 'all' || value === 'yes' ? 'all' : value === 'matching' ? 'matching' : 'none';
     async function saveHours(session, form) {
+        const ref = form.get('location');
         const id = form.get('resource') ?? '';
-        const target = id === 'all' ? 'all' : await ownResource(session, id);
+        let target;
+        if (ref !== null) {
+            const location = await ownLocation(session, ref);
+            target = location && options.resources.hours ? { location } : null;
+        }
+        else {
+            target = id === 'all' ? 'all' : await ownResource(session, id);
+        }
         if (!target)
             return notFound(session);
         const mode = form.get('mode');
         const week = readWeekForm(form);
+        const own = target === 'all' ? await ownHoursOf(session) : undefined;
         if (mode !== 'server' && mode !== 'closed' && mode !== 'custom') {
             return hoursPage(session, {
                 target,
@@ -3639,6 +4031,7 @@ ${state.unshown
                 week,
                 status: 400,
                 notice: 'Choose which hours to use.',
+                own,
             });
         }
         let rules = mode === 'server' ? null : [];
@@ -3660,16 +4053,254 @@ ${state.unshown
                     week,
                     status: 400,
                     notice: error.message,
+                    own,
                 });
             }
         }
-        const changed = await options.resources.setHours(tenantOf(session), target === 'all' ? 'all' : { id: target.id }, rules, personOf(session));
-        if (changed === 0) {
-            return target === 'all'
-                ? resourcesPage(session, 409, 'Add a resource first, then set its hours.')
-                : notFound(session);
+        const place = isLocationTarget(target) ? target.location : null;
+        const changed = target === 'all'
+            ? await options.resources.setHours(tenantOf(session), 'all', rules, personOf(session), overrideOf(form.get('override')))
+            : await options.resources.setHours(tenantOf(session), place ? { location: place.ref } : { id: target.id }, rules, personOf(session));
+        if (changed === 0 && target !== 'all')
+            return notFound(session);
+        return redirect(303, `${root}/${place ? 'locations' : 'resources'}`);
+    }
+    /** A subscription's address as the page names it: its host, never its path or query (which may hold a token). */
+    const hostOfUrl = (url) => {
+        try {
+            return new URL(url).host;
+        }
+        catch {
+            return 'its address';
         }
-        return redirect(303, `${root}/resources`);
+    };
+    /** The tenant's closures and special days from yesterday on, with forms to add and import more. */
+    async function closuresPage(session, status = 200, notice) {
+        const hours = options.resources.hours;
+        if (!hours)
+            return nothingHere(session);
+        const tenantRef = tenantOf(session);
+        const [exceptions, locations, resources, calendars] = await Promise.all([
+            hours.exceptions(tenantRef, SLOTLOCK_DASHBOARD_MAX_EXCEPTIONS + 1),
+            options.resources.grouping?.locations(tenantRef) ?? Promise.resolve([]),
+            options.resources.list(tenantRef),
+            hours.calendars?.(tenantRef) ?? Promise.resolve([]),
+        ]);
+        const token = csrfToken(session);
+        const sent = () => html `<input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}">`;
+        const names = new Map(resources.map((resource) => [resource.id, resourceName(resource, resource.id)]));
+        const places = new Map(locations.map((location) => [location.ref, location.name]));
+        const scopeOf = (exception) => exception.resourceId
+            ? names.get(exception.resourceId) ?? exception.resourceId
+            : exception.location
+                ? `${places.get(exception.location) ?? exception.location} (location)`
+                : 'Everywhere';
+        const days = (exception) => exception.startsOn === exception.endsOn ? exception.startsOn : `${exception.startsOn} to ${exception.endsOn}`;
+        const what = (exception) => exception.outcome === 'closed'
+            ? 'Closed'
+            : `Open ${(exception.hours ?? []).map((window) => hoursOf(window.startMinutes, window.durationMinutes)).join(', ')}`;
+        const scopeOptions = html `<option value="">Everywhere</option>${locations.map((location) => html `<option value="location:${location.ref}">${location.name} (location)</option>`)}${resources.slice(0, SLOTLOCK_DASHBOARD_MAX_RESOURCES).map((resource) => html `<option value="resource:${resource.id}">${resourceName(resource, resource.id)}</option>`)}`;
+        const shown = exceptions.slice(0, SLOTLOCK_DASHBOARD_MAX_EXCEPTIONS);
+        const content = html `${noticeOf(notice)}
+<section>
+<p><a class="back" href="${root}/resources">Resources</a></p>
+<h1>Closures and special days</h1>
+<p>Each closes whole days, or gives them hours of their own instead of the weekly hours, read in each resource's time zone. Where several apply to a day, the nearest wins: a resource's own, then its location's, then everywhere's.</p>
+<div class="table"><table><thead><tr><th>Days</th><th>Applies to</th><th>Hours</th><th>Label</th><th></th></tr></thead><tbody>${shown.length === 0
+            ? html `<tr><td colspan="5" class="muted">No closures from today on.</td></tr>`
+            : shown.map((exception) => html `<tr><td data-label="Days">${days(exception)}</td><td data-label="Applies to">${scopeOf(exception)}</td><td data-label="Hours">${what(exception)}</td><td data-label="Label" class="wrap">${exception.label}${exception.source === 'ics' ? html ` <span class="meta">imported</span>` : html ``}</td><td class="actions"><form method="post" action="${root}/closures/delete">${sent()}<input type="hidden" name="id" value="${exception.id}"><button type="submit">Delete</button></form></td></tr>`)}</tbody></table></div>
+${exceptions.length > SLOTLOCK_DASHBOARD_MAX_EXCEPTIONS ? html `<p class="fine">The first ${String(SLOTLOCK_DASHBOARD_MAX_EXCEPTIONS)} are shown; the API lists them all.</p>` : html ``}
+<h2>Add a closure or special day</h2>
+<form method="post" action="${root}/closures" class="stack">${sent()}
+<label>Applies to <select name="scope">${scopeOptions}</select></label>
+<label>First day <input type="date" name="starts_on" required></label>
+<label>Last day <input type="date" name="ends_on"></label>
+<fieldset class="modes"><legend>Those days</legend>
+<label class="choice"><input type="radio" name="outcome" value="closed" checked> Closed</label>
+<label class="choice"><input type="radio" name="outcome" value="open"> Open only from <input type="time" name="opens" aria-label="Opens"> to <input type="time" name="closes" aria-label="Closes"></label>
+</fieldset>
+<label>Label <input name="label" maxlength="200" required placeholder="Christmas Day"></label>
+<button class="primary" type="submit">Add</button>
+</form>
+${calendars.length > 0 ? html `<h2>Holiday calendars</h2>
+<div class="table"><table><thead><tr><th>Calendar</th><th>Applies to</th><th>From</th><th>Closures</th><th></th></tr></thead><tbody>${calendars.map((calendar) => html `<tr><td data-label="Calendar" class="wrap">${calendar.name}${calendar.lastError ? html `<span class="meta bad" role="status">The last import failed: ${calendar.lastError}</span>` : html ``}</td><td data-label="Applies to">${calendar.resourceId
+            ? names.get(calendar.resourceId) ?? calendar.resourceId
+            : calendar.location
+                ? `${places.get(calendar.location) ?? calendar.location} (location)`
+                : 'Everywhere'}</td><td data-label="From" class="wrap">${calendar.url
+            ? html `${hostOfUrl(calendar.url)}<span class="meta">Imported again every 30 days${calendar.nextImportAt ? html `, next ${calendar.nextImportAt.toISOString().slice(0, 10)}` : html ``}</span>`
+            : html `Uploaded or pasted${calendar.importedAt ? html `<span class="meta">${calendar.importedAt.toISOString().slice(0, 10)}</span>` : html ``}`}</td><td data-label="Closures">${String(calendar.closures)}</td><td class="actions">${hours.deleteCalendar
+            ? html `<form method="post" action="${root}/closures/calendars/delete">${sent()}<input type="hidden" name="id" value="${calendar.id}"><button type="submit" class="danger">Delete</button></form>`
+            : html ``}</td></tr>`)}</tbody></table></div>
+<p class="fine">Deleting a calendar deletes its closures too.</p>` : html ``}
+<h2>Import a holiday calendar</h2>
+<p>Upload or paste an iCalendar file of days off${hours.byUrl ? html `, or give its address` : html ``}: each all-day event closes its days for the next two years. A calendar is kept by its name where it applies: importing it again updates its closures and removes the holidays it no longer has.</p>
+<form method="post" action="${root}/closures/import" class="stack" enctype="multipart/form-data">${sent()}
+<label>Applies to <select name="scope">${scopeOptions}</select></label>
+<label>Name <input name="name" maxlength="200" placeholder="Its own name, else its address, else Holidays"></label>
+<label>File <input type="file" name="icalendar_file" accept=".ics,text/calendar"></label>
+<label>Or paste it <textarea name="icalendar" rows="6" placeholder="BEGIN:VCALENDAR"></textarea></label>
+${hours.byUrl ? html `<label>Or its address <input type="url" name="url" maxlength="2000" placeholder="https://example.com/holidays.ics"></label>
+<label class="choice"><input type="checkbox" name="subscribe" value="on"> Import it again every 30 days</label>` : html ``}
+<button type="submit">Import</button>
+</form>
+</section>`;
+        return respond(status, layout('Closures', content, session, 'resources'));
+    }
+    /**
+     * The people the tenant keeps to tell about bookings (RFC 0004 P3): how to reach each, what they
+     * agreed to and when, and a button that forgets one (their reference leaves every booking too).
+     * Contacts are added by the tenant's own systems, through the API.
+     */
+    async function contactsPage(session, status = 200, notice, after) {
+        const contacts = options.resources.contacts;
+        if (!contacts)
+            return nothingHere(session);
+        const listed = await contacts.list(tenantOf(session), SLOTLOCK_DASHBOARD_CONTACTS_PAGE + 1, after);
+        const shown = listed.slice(0, SLOTLOCK_DASHBOARD_CONTACTS_PAGE);
+        const token = csrfToken(session);
+        const reach = (contact) => [contact.email, contact.phone ? `SMS ${contact.phone}` : null, contact.whatsapp ? `WhatsApp ${contact.whatsapp}` : null]
+            .filter(Boolean)
+            .join(', ') || 'No way to reach them';
+        const agreed = (contact) => ['email', 'sms', 'whatsapp']
+            .filter((channel) => contact.consent[channel] !== undefined)
+            .map((channel) => `${channel === 'sms' ? 'SMS' : channel === 'whatsapp' ? 'WhatsApp' : 'Email'}: ${contact.consent[channel] ? 'yes' : 'no'}${contact.consentAt[channel] ? ` (${contact.consentAt[channel]?.toISOString().slice(0, 10)})` : ''}`)
+            .join('; ') || 'Not asked';
+        const content = html `${noticeOf(notice)}
+<section>
+<p><a class="back" href="${root}/resources">Resources</a></p>
+<h1>Contacts</h1>
+<p>The people your bookings name to be told about them, kept by your own systems through the API (<code>PUT /v1/contacts/{contact_ref}</code>). Forgetting one deletes them and takes their reference off every booking, for an erasure request.</p>
+<table><thead><tr><th>Reference</th><th>Name</th><th>Reach by</th><th>Agreed to</th><th></th></tr></thead><tbody>${shown.length === 0
+            ? html `<tr><td colspan="5" class="muted">No contacts yet.</td></tr>`
+            : shown.map((contact) => html `<tr><td data-label="Reference"><code>${contact.ref}</code></td><td data-label="Name">${contact.name ?? ''}</td><td data-label="Reach by" class="wrap">${reach(contact)}</td><td data-label="Agreed to" class="wrap">${agreed(contact)}</td><td class="actions"><form method="post" action="${root}/contacts/forget"><input type="hidden" name="csrf" value="${token}"><input type="hidden" name="once" value="${formNonce(session)}"><input type="hidden" name="ref" value="${contact.ref}"><button type="submit" class="danger">Forget</button></form></td></tr>`)}</tbody></table>
+${listed.length > SLOTLOCK_DASHBOARD_CONTACTS_PAGE ? html `<p><a class="button" href="${root}/contacts?after=${encodeURIComponent(shown.at(-1)?.ref ?? '')}">More</a></p>` : html ``}
+</section>`;
+        return respond(status, layout('Contacts', content, session, 'resources'));
+    }
+    async function forgetContact(session, form) {
+        const contacts = options.resources.contacts;
+        if (!contacts)
+            return nothingHere(session);
+        const ref = form.get('ref') ?? '';
+        if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,199}$/.test(ref))
+            return contactsPage(session, 400, 'That is not a contact reference.');
+        const forgotten = await contacts.forget(tenantOf(session), ref, personOf(session));
+        if (!forgotten.deleted)
+            return contactsPage(session, 404, 'That contact is not one of yours.');
+        return contactsPage(session, 200, `Forgotten. ${forgotten.bookings} booking${forgotten.bookings === 1 ? '' : 's'} no longer name them.`);
+    }
+    /** `location:<ref>` or `resource:<id>` from a closures form, checked against the tenant's. */
+    async function closureScope(session, value) {
+        if (value === '')
+            return {};
+        if (value.startsWith('location:')) {
+            const location = await ownLocation(session, value.slice(9));
+            return location ? { location: location.ref } : null;
+        }
+        if (value.startsWith('resource:')) {
+            const resource = await ownResource(session, value.slice(9));
+            return resource ? { resourceId: resource.id } : null;
+        }
+        return null;
+    }
+    async function saveClosure(session, form) {
+        const hours = options.resources.hours;
+        if (!hours)
+            return nothingHere(session);
+        const scope = await closureScope(session, form.get('scope') ?? '');
+        if (!scope)
+            return closuresPage(session, 400, 'Choose where it applies.');
+        const outcome = form.get('outcome') === 'open' ? 'open' : 'closed';
+        const startsOn = form.get('starts_on') ?? '';
+        const endsOn = form.get('ends_on') || startsOn;
+        let windows;
+        if (outcome === 'open') {
+            const opens = minutesOf(form.get('opens') ?? '');
+            const closes = minutesOf(form.get('closes') ?? '');
+            if (opens === null || closes === null)
+                return closuresPage(session, 400, 'Give the hours those days open.');
+            windows = [{ startMinutes: opens, durationMinutes: closes > opens ? closes - opens : closes + 1_440 - opens }];
+        }
+        try {
+            await hours.addException(tenantOf(session), {
+                ...scope,
+                startsOn,
+                endsOn,
+                outcome,
+                ...(windows ? { hours: windows } : {}),
+                label: form.get('label') ?? '',
+            }, personOf(session));
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'invalid_availability_exception' || code === 'availability_exceptions_limit_reached') {
+                return closuresPage(session, code === 'invalid_availability_exception' ? 400 : 409, error.message);
+            }
+            throw error;
+        }
+        return redirect(303, `${root}/closures`);
+    }
+    async function deleteClosure(session, form) {
+        const hours = options.resources.hours;
+        if (!hours)
+            return nothingHere(session);
+        const id = form.get('id') ?? '';
+        if (!UUID_PATTERN.test(id) || !(await hours.deleteException(tenantOf(session), id, personOf(session)))) {
+            return closuresPage(session, 404, 'That closure is not one of yours.');
+        }
+        return redirect(303, `${root}/closures`);
+    }
+    async function importClosures(session, form) {
+        const hours = options.resources.hours;
+        if (!hours)
+            return nothingHere(session);
+        const scope = await closureScope(session, form.get('scope') ?? '');
+        if (!scope)
+            return closuresPage(session, 400, 'Choose where it applies.');
+        // An uploaded file, else what was pasted, else (where the server reads them) an address.
+        const text = (form.get('icalendar_file') ?? '').trim() || (form.get('icalendar') ?? '').trim();
+        const url = hours.byUrl ? (form.get('url') ?? '').trim() : '';
+        if ((text === '') === (url === '')) {
+            return closuresPage(session, 400, hours.byUrl ? 'Upload or paste a calendar, or give its address: one of them.' : 'Upload or paste a calendar.');
+        }
+        const name = (form.get('name') ?? '').trim();
+        const source = {
+            ...(text !== '' ? { icalendar: text } : { url }),
+            ...(name !== '' ? { name } : {}),
+            ...(url !== '' && form.get('subscribe') === 'on' ? { subscribe: true } : {}),
+        };
+        try {
+            const result = await hours.importHolidays(tenantOf(session), source, scope, personOf(session));
+            const plural = (count, word) => `${String(count)} ${word}${count === 1 ? '' : 's'}`;
+            return closuresPage(session, 200, `Imported ${plural(result.imported, 'closure')}${result.removed > 0 ? `; removed ${plural(result.removed, 'holiday')} the calendar no longer has` : ''}${result.skipped > 0 ? `; skipped ${plural(result.skipped, 'event')} that were not all-day or not in the next two years` : ''}.`);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'invalid_holiday_calendar' ||
+                code === 'invalid_availability_exception' ||
+                code === 'holiday_calendar_unreachable' ||
+                code === 'holiday_url_not_served' ||
+                code === 'location_not_found' ||
+                code === 'resource_not_found') {
+                return closuresPage(session, 400, error.message);
+            }
+            if (code === 'availability_exceptions_limit_reached' || code === 'holiday_calendars_limit_reached') {
+                return closuresPage(session, 409, error.message);
+            }
+            throw error;
+        }
+    }
+    /** Delete a holiday calendar and the closures it made. */
+    async function deleteHolidayCalendar(session, form) {
+        const hours = options.resources.hours;
+        if (!hours?.deleteCalendar)
+            return nothingHere(session);
+        const id = form.get('id') ?? '';
+        if (!(await hours.deleteCalendar(tenantOf(session), id, personOf(session)))) {
+            return closuresPage(session, 404, 'That calendar is not one of yours.');
+        }
+        return redirect(303, `${root}/closures`);
     }
     function shownOncePage(session, key, apiKey, rotated) {
         const org = session.orgs?.find((candidate) => candidate.id === session.org);
@@ -4120,9 +4751,11 @@ ${rows.length === 0
         ]);
     }
     /** The form, `'too_large'` past MAX_FORM_BYTES (read no further), or null for another type. */
-    async function readForm(request, maxBytes = MAX_FORM_BYTES) {
-        const type = request.headers.get('content-type')?.split(';')[0]?.trim();
-        if (type !== 'application/x-www-form-urlencoded')
+    async function readForm(request, maxBytes = MAX_FORM_BYTES, multipart = false) {
+        const header = request.headers.get('content-type') ?? '';
+        const type = header.split(';')[0]?.trim();
+        const isMultipart = multipart && type === 'multipart/form-data';
+        if (type !== 'application/x-www-form-urlencoded' && !isMultipart)
             return null;
         const declared = Number(request.headers.get('content-length'));
         if (Number.isFinite(declared) && declared > maxBytes)
@@ -4143,7 +4776,24 @@ ${rows.length === 0
             }
             chunks.push(value);
         }
-        return new URLSearchParams(Buffer.concat(chunks).toString('utf8'));
+        if (!isMultipart)
+            return new URLSearchParams(Buffer.concat(chunks).toString('utf8'));
+        // A file field is read as text under its name; nothing else a form sends is kept apart.
+        let data;
+        try {
+            data = await new Response(Buffer.concat(chunks), { headers: { 'content-type': header } }).formData();
+        }
+        catch {
+            return null;
+        }
+        const form = new URLSearchParams();
+        for (const [name, value] of data.entries()) {
+            if (typeof value === 'string')
+                form.append(name, value);
+            else if (value.size > 0)
+                form.append(name, await value.text());
+        }
+        return form;
     }
     async function createKey(session, form) {
         const scopes = KEY_ACCESS[form.get('access') ?? ''];
@@ -4290,7 +4940,13 @@ ${rows.length === 0
         const session = await readSession(request);
         if (!session)
             return redirect(303, root);
-        const form = await readForm(request, route === '/assistant' || route === '/assistant/stream' ? MAX_ASSISTANT_FORM_BYTES : MAX_FORM_BYTES);
+        // A holiday calendar may be uploaded, or pasted, up to its own limit.
+        const importing = route === '/closures/import';
+        const form = await readForm(request, importing
+            ? MAX_IMPORT_FORM_BYTES
+            : route === '/assistant' || route === '/assistant/stream'
+                ? MAX_ASSISTANT_FORM_BYTES
+                : MAX_FORM_BYTES, importing);
         if (form === 'too_large') {
             return respond(413, layout('Refused', html `<p class="notice">That form is too large.</p>`, session));
         }
@@ -4329,8 +4985,10 @@ ${rows.length === 0
             }
             if (!first) {
                 // The first one was taken: a second click, a reload or a resend shows what it did.
-                if (route.startsWith('/assistant'))
-                    return redirect(303, `${root}/assistant#latest`);
+                if (route.startsWith('/assistant')) {
+                    const chat = chatOf(form.get('chat'));
+                    return redirect(303, chat ? `${chatUrl(chat)}#latest` : `${root}/assistant#latest`);
+                }
                 return pageFor(route)(session, 409, 'That form was already sent. Reload the page to start again.');
             }
         }
@@ -4354,6 +5012,16 @@ ${rows.length === 0
                 return addResource(session, form);
             case '/hours':
                 return saveHours(session, form);
+            case '/closures':
+                return saveClosure(session, form);
+            case '/closures/delete':
+                return deleteClosure(session, form);
+            case '/closures/import':
+                return importClosures(session, form);
+            case '/closures/calendars/delete':
+                return deleteHolidayCalendar(session, form);
+            case '/contacts/forget':
+                return forgetContact(session, form);
             case '/organization':
                 return switchOrganization(session, form);
             case '/environment':
@@ -4402,6 +5070,10 @@ ${rows.length === 0
                 return settleAction(session, form, 'dismiss');
             case '/assistant/reset':
                 return resetAssistant(session);
+            case '/assistant/rename':
+                return renameChat(session, form);
+            case '/assistant/delete':
+                return deleteChat(session, form);
             case '/settings/assistant':
                 return saveAssistantSettings(session, form);
             case '/settings/assistant/models':
@@ -4443,6 +5115,7 @@ ${rows.length === 0
                         case '/waitlist':
                         case '/approvals':
                         case '/assistant':
+                        case '/assistant/chats':
                         case '/plan':
                         case '/teams':
                         case '/settings/endpoints':
@@ -4461,8 +5134,9 @@ ${rows.length === 0
                             }
                             if (route === '/keys')
                                 return await keysPage(session);
-                            if (route === '/resources')
-                                return await resourcesPage(session);
+                            if (route === '/resources') {
+                                return await resourcesPage(session, 200, undefined, url.searchParams.get('hours') === 'own');
+                            }
                             if (route === '/webhooks')
                                 return await webhooksPage(session);
                             if (route === '/waitlist')
@@ -4470,7 +5144,9 @@ ${rows.length === 0
                             if (route === '/approvals')
                                 return await approvalsPage(session);
                             if (route === '/assistant')
-                                return await assistantPage(session);
+                                return await assistantPage(session, 200, undefined, url.searchParams.get('c') ?? undefined);
+                            if (route === '/assistant/chats')
+                                return await chatsPage(session);
                             if (route === '/settings/endpoints')
                                 return await settingsPage(session, 200, undefined, undefined, 'endpoints');
                             if (route === '/settings/hours')
@@ -4497,6 +5173,15 @@ ${rows.length === 0
                             const session = await readSession(request);
                             return session ? await hoursEditor(session, url) : redirect(303, root);
                         }
+                        case '/closures': {
+                            const session = await readSession(request);
+                            return session ? await closuresPage(session) : redirect(303, root);
+                        }
+                        case '/contacts': {
+                            const session = await readSession(request);
+                            const after = url.searchParams.get('after') ?? undefined;
+                            return session ? await contactsPage(session, 200, undefined, after) : redirect(303, root);
+                        }
                         case '/locations': {
                             const session = await readSession(request);
                             return session ? await locationsPage(session) : redirect(303, root);