Add out of office and reassignment to Scheduling

.changeset/scheduling-delegates.md

@@ -0,0 +1,6 @@
+---
+"coss": minor
+"coss-mcp": minor
+---
+
+Name who covers while a scheduling host is away: `delegates` on `coss.scheduling.outOfOffice` entries can be booked in their place, inside the same event type, keeping to how a booking's routed. The MCP server's `create_scheduling_out_of_office` takes `delegates` and `existing_bookings`.

.changeset/scheduling-holidays.md

@@ -0,0 +1,5 @@
+---
+"coss": minor
+---
+
+Holiday calendars for scheduling: `coss.scheduling.holidayCalendars` applies a country's public holidays, or your own feed, to some hosts as out of office entries, kept up to date by coss.com. A host who removes a day keeps it removed.

.changeset/scheduling-manager-mcp.md

@@ -0,0 +1,6 @@
+---
+"coss-mcp": minor
+"coss-cli": minor
+---
+
+The MCP server's `create_scheduling_session` can make a team lead's page with `manager_hosts`, and `coss open` knows the out of office, holidays and reassignments pages.

.changeset/scheduling-manager.md

@@ -0,0 +1,5 @@
+---
+"coss": minor
+---
+
+Team pages for scheduling: `coss.scheduling.sessions.createForManager` gives a team lead a hosted, embeddable page (`mountTeamPortal` in `coss/scheduling`) for the hosts you name or everyone matching some attributes, showing who's away and what needs cover, and moving it. `host_reassignment` in settings lets hosts give away their own bookings.

.changeset/scheduling-out-of-office.md

@@ -0,0 +1,5 @@
+---
+"coss": minor
+---
+
+Add `coss.scheduling.outOfOffice`: mark hosts as away, for part of a day or whole dates, one at a time or many together. They stop being offered, existing bookings stay and are listed as conflicts, and `scheduling.out_of_office.*` webhooks say when it's created, changed, starts and ends.

.changeset/scheduling-reassign.md

@@ -0,0 +1,7 @@
+---
+"coss": minor
+"coss-mcp": minor
+"coss-cli": minor
+---
+
+Reassign scheduling bookings: `coss.scheduling.bookings.reassign` gives any kind of booking to another host, keeping its id and time, and `reassignCandidates` says who could take it and why not. Adds a `scheduling.booking.reassigned` webhook with `previous_host_ids`, `reassignment_enabled` on event types and `name_host_in_attendee_emails` in settings. The MCP server gets reassign and out of office tools, and the CLI `coss scheduling reassign`, `candidates` and `ooo`.

.changeset/scheduling-reassignments.md

@@ -0,0 +1,7 @@
+---
+"coss": minor
+"coss-mcp": minor
+"coss-cli": minor
+---
+
+Move many scheduling bookings at once: `coss.scheduling.reassignments` previews who each would go to, runs it in the background with an outcome per booking, and can cancel and undo. Out of office entries take `existing_bookings: "reassign"` to start one. Adds a `scheduling.reassignment.completed` webhook. The MCP server gets preview, create, get, cancel and undo tools, and the CLI `coss scheduling reassign-many`, `reassignments` and `reassignment`.

AGENTS.md

@@ -64,7 +64,7 @@ text it shows is a gist that must match `CLA.md`: change both together, as a new
 | `packages/sign` | `@coss/sign` | Sign (e-signatures): uploaded PDFs (`pdf.ts`: pdf-lib + pdf.js, page sizes and text anchors), signature requests with signers and fields placed by position or anchor, the hash-chained audit trail (`events.ts`) with its webhooks and log lines (`record.ts`), signing sessions (`sessions.ts`), the signer's actions (`signing.ts`: view, consent, sign, decline), email delivery (`notifications.ts`: invitations in signing order, reminders, expiry, signed copies through an injected `SignMailer`), completion (`complete.ts`: the completed document with its certificate pages, `completed-pdf.ts`, sealed as PAdES B-LT by `seal/`: KMS, a CA's CSC API or a local key, RFC 3161 timestamps, OCSP/CRLs in a DSS), templates (`templates.ts`: roles, merge fields, requests from a template) and builder sessions (`builder.ts`), settings (`settings.ts`: embedding origins, branding, consent text), the document store (`store.ts`: `DocumentStore`, `FakeDocumentStore`); `./schemas` (zod only, also `SIGN_WEBHOOK_EVENT_TYPES`), `./env` (zod only), `./runtime` (`sealerFromEnv`), `./testing` (`buildTestPdf`, `TEST_SIGNATURE_PNG`). See `packages/sign/AGENTS.md`. |
 | `packages/verify` | `@coss/verify` | Verify (one-time codes): `createVerifyService` (`start`: the fraud guard — `@coss/risk`'s `checkVerificationRisk` — before anything is paid for, then a code by SMS from the environment's own number or coss.com's shared numbers, or by email through an injected sender; `check` against an HMAC, never the code; `cancel`), settings (`settings.ts`), reads, shared-number metering (`recordDueVerifySmsUsage`), purges; `./schemas` (zod only, also `VERIFY_WEBHOOK_EVENT_TYPES`), `./testing`. Never imports `@coss/email` (email imports its schemas). See `packages/verify/AGENTS.md`. |
 | `packages/forms` | `@coss/forms` | Forms (hosted form endpoints): forms and their settings (`forms.ts`: field definitions, origins, spam, submitter verification, notifications, contacts mapping, uploads, hosted pages), taking a submission (`submit.ts`, `parse.ts`: origin, fields, honeypot, a Risk assessment, the content check, files, then `record.ts`: usage, `form.submission.*` webhooks, log lines, deliveries), the worker's deliveries (`deliveries.ts`: notification emails, contacts, verification links through an injected `FormMailer`/`FormContactSink`), release and confirmation (`release.ts`), reads (`submissions.ts`), hosted pages and their CSP (`hosted.ts`, `pages.ts`), the file store (`store.ts`, S3 under `./runtime`, cleanup), purges; `./schemas` (zod only, also `FORM_WEBHOOK_EVENT_TYPES`), `./env` (zod only), `./runtime`, `./testing`. See `packages/forms/AGENTS.md`. |
-| `packages/scheduling` | `@coss/scheduling` | Scheduling: hosts, schedules, event types (`one_on_one`, `pool`, `collective`, `group`), availability, the booking path (`claims.ts`: the only writer of `scheduling_claim`, whose exclusion constraint prevents double-booking), holds, approval, recurring series, sessions, the notification outbox with injected `SchedulingNotifier`, purges; `./engine` (pure: time zones, `isBookable`, ranking, recurrence), `calendar/` (`fetch`-based clients for Google, Microsoft and CalDAV, sync, write-back); `./schemas` (zod only, also `SCHEDULING_WEBHOOK_EVENT_TYPES`), `./env` (zod only), `./runtime`, `./testing`. See `packages/scheduling/AGENTS.md`. |
+| `packages/scheduling` | `@coss/scheduling` | Scheduling: hosts, schedules, out of office (`out-of-office.ts`), event types (`one_on_one`, `pool`, `collective`, `group`), availability, the booking path (`claims.ts`: the only writer of `scheduling_claim`, whose exclusion constraint prevents double-booking), holds, approval, recurring series, sessions, the notification outbox with injected `SchedulingNotifier`, purges; `./engine` (pure: time zones, `isBookable`, ranking, recurrence), `calendar/` (`fetch`-based clients for Google, Microsoft and CalDAV, sync, write-back); `./schemas` (zod only, also `SCHEDULING_WEBHOOK_EVENT_TYPES`), `./env` (zod only), `./runtime`, `./testing`. See `packages/scheduling/AGENTS.md`. |
 | `packages/support` | `@coss/support` | coss.com's support desk: tickets from email (`intake.ts`, reading `received_email` of `SUPPORT_ENVIRONMENT_ID`) and the dashboard, sender matching and trust (`matching.ts`, `sender.ts`: a match never grants access by itself), the SLA clock (`sla.ts`, targets in `@coss/billing/catalog`'s `SUPPORT_TIERS`), delivery through an injected `SupportMailer` (`delivery.ts`), the worker's housekeeping and rep alerts (`sweep.ts`), attachments (`store.ts`); `./admin` (reps' queue and actions, platform-level), `./format` and `./schemas` (client-safe), `./env` (zod only), `./testing`. See `packages/support/AGENTS.md`. |
 | `packages/push` | `@coss/push` | Push notifications to the iOS app: devices (one per app session), the outbox products enqueue into (`enqueuePush`, in the deciding transaction), recipients (role + `orgAccess`) and content resolved at send time, the worker's send loop; `./apns` (APNs over `node:http2`, ES256 provider tokens), `./schemas` (zod only: categories, kinds, registration), `./testing` (`FakePushSender`, `createTestPushDevice`). See `packages/push/AGENTS.md`. |
 | `packages/notifications` | `@coss/notifications` | coss.com's notification emails to organizations: the outbox products enqueue into (`enqueueNotification`, in the deciding transaction; once per dedupe key, optionally delayed), kinds rendered at send time (stale news is skipped), the worker's `notifications` loop, owner/admin recipients, retention; `./testing` (`recordingNotifier`). See `packages/notifications/AGENTS.md`. |
@@ -533,13 +533,13 @@ notification emails) and, if there is useful advice, to `ADVICE` (`packages/repu
   `recordOpen`/`recordClick` (from the email's tracking token), `trackingBaseUrlFor` (dispatch; reads domain names
   across orgs like `authorizeLiveSender`), `receiveEmail`/`routeRecipients` (receiving; from the envelope recipients), `recordSmsEvent`/`ingestSmsEvents` (from the `sms_id` of the callback URL), `receiveSms` (from the receiving number), `handleStatusCallback`/`handleInboundCallback` (from the callback's subaccount), `authorizeLiveSmsSender`, `ingestDmarcReports` (from the report address's token), `reencryptWebhookSecrets`, `reencryptSchedulingData` (operator scripts), `authenticateHookPortalSession` (from the session), `ingestSupportEmails` (one environment, across senders) and the rest of `@coss/support`'s worker functions, `submitForm`/`getHostedForm` (from the form id of `/f/:id`), `confirmFormSubmission`/`findConfirmation` (from the verification token), and the worker scans `runDueWebhookDeliveries`, `runDueLogDrainDeliveries`, `runDueHookDeliveries`, `parkHeldHookDeliveries`, `runDueHookRecoveries`, the Hooks purges, `recheckDueDomains`,
   `recheckDueTrackingDomains`, `recheckDueReceivingDomains`, `reconcileDedicatedIpPools`, `sweepStaleClaims`, `sweepUnclaimedEmails`, `runDueReputationEvaluations`, `runDueSubaccountEvaluations`, `runDueOrganizationDeletions`, `runDueOrganizationLogos`, `runDueSubaccountDeletions`, `runDueDmarcNotifications`, `runDueMigrations`, `EmailService.dispatchDue`,
-  `unclaimedEmailBacklog`, `unclaimedSmsBacklog` (the `dispatch-backlog` loop: counts only), `SmsService.dispatchDue`, `sweepStaleSmsClaims`, `sweepUnclaimedSms`, `advanceDueSmsRegistrations`, `chargeDueSmsFees`, `chargeDueInboxFees`, `chargeDueHostFees`, `recordDueVerifySmsUsage` (bills each organization for its codes from coss.com's shared numbers, reading coss.com's messages),
-  `authenticateSchedulingSession` (from the token), `handleCalendarPush`, `completeCalendarAuthorization` (from the push's channel and the consent's state), `runDueCalendarDelegations`, `handleZoomDeauthorization` (from Zoom's signed event), `refreshIdleZoomConnections`, `runDueCalendarSyncs`, `runDueCalendarWrites`, `renewDueCalendarChannels`, `checkHostEditedEvents`, `runDueSchedulingNotifications`, `runDueReminderSyncs`, `expireDueBookings`,
+  `unclaimedEmailBacklog`, `unclaimedSmsBacklog` (the `dispatch-backlog` loop: counts only), `SmsService.dispatchDue`, `sweepStaleSmsClaims`, `sweepUnclaimedSms`, `advanceDueSmsRegistrations`, `chargeDueSmsFees`, `chargeDueInboxFees`, `runDueReassignments`, `runDueHolidayCalendars`, `chargeDueHostFees`, `recordDueVerifySmsUsage` (bills each organization for its codes from coss.com's shared numbers, reading coss.com's messages),
+  `authenticateSchedulingSession` (from the token), `handleCalendarPush`, `completeCalendarAuthorization` (from the push's channel and the consent's state), `handleZoomDeauthorization` (from Zoom's signed event), `refreshIdleZoomConnections`, `runDueCalendarSyncs`, `runDueCalendarWrites`, `renewDueCalendarChannels`, `checkHostEditedEvents`, `runDueSchedulingNotifications`, `runDueCalendarDelegations`, `runDueReminderSyncs`, `expireDueBookings`, `announceDueOutOfOffice`,
   `runDueFormDeliveries`, `runDueFormStoreCleanup`
   (and the dispatch jobs, from the job's `organizationId`); `@coss/sms/admin` is platform-level like `@coss/email/admin`. Server actions take only slugs +
   target ids and derive the org from `requireOrgPermission`; every Better Auth organization call passes `organizationId`
   explicitly (never rely on `session.activeOrganizationId`).
-- **Client-safe modules** never import `@coss/db`: `@coss/compliance/catalog`, `@coss/dashboard-routes`, `@coss/risk/{schemas,env}`, `@coss/observability/*`, `@coss/auth/{permissions,slugs,constants,api-key-permissions,org-access}`, `@coss/push/schemas`, `@coss/forms/{schemas,env}`, `@coss/scheduling/branding`, `@coss/email/schemas`,
+- **Client-safe modules** never import `@coss/db`: `@coss/compliance/catalog`, `@coss/dashboard-routes`, `@coss/risk/{schemas,env}`, `@coss/observability/*`, `@coss/auth/{permissions,slugs,constants,api-key-permissions,org-access}`, `@coss/push/schemas`, `@coss/forms/{schemas,env}`, `@coss/scheduling/{branding,holiday-countries}`, `@coss/email/schemas`,
   `@coss/email/{broadcast-schemas,contact-schemas,inbox-schemas,subaccount-schemas,test-event-schemas,env,templates}`, `@coss/sms/{schemas,segments,env}`, `@coss/verify/schemas`, `@coss/hooks/{schemas,env}`, `@coss/reputation/schemas`, `@coss/screening/env`, `@coss/webhooks/{schemas,env}`, `@coss/ratelimit/buckets`, `@coss/versioning`, `@coss/retention`, `@coss/logs/{schemas,query}`, `@coss/billing/{catalog,schemas,engine,money,env,gate,wire}` (`gate` is types only), `@coss/ui/*`, `@coss/ui/theme.css`, `@coss/companion`, `@coss/migrate/templates`, `@coss/email-layout`. `@coss/webhooks`, `@coss/db/jobs`, `@coss/screening/{ai,runtime}`, `@coss/email/{runtime,ses,dispatch,domain-connect}`, `@coss/risk/{runtime,datasets}`, `@coss/signals/*`, `@coss/sms` (root, `./twilio`, `./runtime`, `./dispatch`, `./admin`), `@coss/push` (root, `./apns`), `@coss/notifications` and `@coss/billing` (root, `./metering`, `./runtime`, `./stripe`) are server-only; only `./stripe` (and `./runtime`) import the Stripe SDK. Server-only web
   modules start with `import "server-only"`.
 - **Rate limits** (`@coss/ratelimit`): buckets are defined only in `BUCKETS` (`src/buckets.ts`); GCRA state is one
@@ -702,6 +702,8 @@ notification emails) and, if there is useful advice, to `ADVICE` (`packages/repu
     addresses on verified domains; hosted pages refuse fields asking for credentials and are screened when
     published; `/f/*` is served only on `FORMS_PUBLIC_URL`'s host in production, never coss.com's.
   - **Scheduling** (`packages/scheduling/AGENTS.md`): only `claims.ts` writes claims, in the fixed lock order;
+    out of office stops new bookings and only moves an existing one if asked to, and its reason stays out of webhooks,
+    logs, calendars and anything a booker sees; a bulk reassignment never cancels a booking;
     slots are computed only in Bun, through `isBookable`; calendars contribute busy intervals and nothing else, and an
     unreadable one never reads as free; answers never leave `getBooking`; coss.com never auto-cancels a booking;
     plan gates and billing holds apply to live environments only, and refuse new setup and new bookings, never what
@@ -798,7 +800,7 @@ notification emails) and, if there is useful advice, to `ADVICE` (`packages/repu
 
 **Not built yet** (don't assume these exist; delete a line when it ships): OAuth for the hosted MCP server (it takes an API key in a header) and `COSS_MCP_TOOLSETS` there,
 these parts of Support: on-call paging (so 24x7 can't be sold yet), a holiday calendar, automatic SLA credits, a support role narrower than platform admin, satisfaction ratings, AI drafts, presence, iOS screens, a public API, MCP and CLI tools,
-these parts of Scheduling: public booking pages, built-in payments, customers' own OAuth apps, routing forms, a workflow builder, waitlists, travel schedules, imports from Cal.com Platform, reminders at a local time of day, reminder copy per locale, quiet hours, a built-in rating page, fixed SMS numbers as reminder recipients, sending a test reminder, undoing a no-show, a per-attendee opt-out of reminder emails, reminders in the iOS app,
+these parts of Scheduling: iOS screens for out of office and reassignment, recurring out of office, out of office detected from a calendar, delegates for required hosts, Slack and HR apps, adding a host to a booking without replacing one, public booking pages, built-in payments, customers' own OAuth apps, routing forms, a workflow builder, waitlists, travel schedules, imports from Cal.com Platform, reminders at a local time of day, reminder copy per locale, quiet hours, a built-in rating page, fixed SMS numbers as reminder recipients, sending a test reminder, undoing a no-show, a per-attendee opt-out of reminder emails, reminders in the iOS app,
 these parts of calendar delegation: automatic Microsoft secret rotation, coss.com-owned or keyless (`signJwt`) service accounts, certificate credentials, account-level Zoom, excluding one host while `match_host_email` is on, and delegation in the iOS app, MCP and CLI,
 customers granting staff temporary access in HIPAA mode,
 Verify's voice and WhatsApp channels, locales other than English, custom message templates,