@acms-subir/core 0.3.53 → 0.3.55

package/src/lib/legal/admin.ts

@@ -40,7 +40,7 @@ export async function legalAdminState(repo: ContentRepository, url: URL, locals?
     updated: LEGAL.enabled ? { privacy: await policyUpdated(repo, 'privacy', facts, settings), terms: await policyUpdated(repo, 'terms', facts, settings) } : null,
     covers: {
       calendar: facts.calendar, bookings: facts.bookings, guestSignIn: facts.guestSignIn, push: facts.push.enabled, auth: facts.auth,
-      email: facts.email, maps: facts.maps, live: facts.live, analytics: facts.analytics, ai: facts.ai,
+      email: facts.email, maps: facts.maps, live: facts.live, googleCalendar: facts.googleCalendar, analytics: facts.analytics, ai: facts.ai,
     },
     warnings,
     answers: appPrivacyAnswers(facts, link('privacy') ?? `${origin}/privacy`),

package/src/lib/legal/facts.ts

@@ -40,6 +40,8 @@ export interface LegalFacts {
   /** maps provider name, or '' */
   maps: string;
   live: boolean;
+  /** a Google account is connected for the two-way Google Calendar sync (lib/calendar/google/) */
+  googleCalendar: boolean;
   /** acms({ announcements }): urgent ones reach every device; read and closed state stays in the app */
   announcements: boolean;
   analytics: { umami: boolean; replay: boolean; meta: boolean; tiktok: boolean };
@@ -82,6 +84,7 @@ export async function legalFacts(repo: ContentRepository, settings: Settings, lo
     email: email && !email.error && email.provider !== 'none' && email.config.enabled ? EMAIL_NAMES[email.provider] ?? email.provider : '',
     maps: (() => { const m = mapsStatus(locals); return m.enabled ? m.label.replace(/ \(self-hosted\)$/, '') : ''; })(),
     live: settings.live.mode !== 'off',
+    googleCalendar: CALENDAR.enabled && await repo.gcal.account().then((a) => !!a && a.status !== 'setup').catch(() => false),
     announcements: ANNOUNCEMENTS.enabled,
     analytics: {
       umami: a.umami.enabled && !!a.umami.websiteId,

package/src/lib/legal/text-en.ts

@@ -14,6 +14,7 @@ function processors(f: LegalFacts): string[] {
     ...(f.push.enabled ? ['Expo, Apple and Google (app notifications)'] : []),
     ...(f.auth === 'clerk' ? ['Clerk (sign-in)'] : []),
     ...(f.maps ? [`${f.maps} (maps)`] : []),
+    ...(f.googleCalendar ? ['Google (Google Calendar)'] : []),
     ...(f.analytics.umami ? ['Umami (visit statistics)'] : []),
     ...(f.ai ? ['OpenAI or another AI service we choose (writing tools used by staff)'] : []),
     ...(f.offsiteBackups ? ['our backup storage provider'] : []),
@@ -61,6 +62,9 @@ export function privacyEn(f: LegalFacts, country: string): PolicySection[] {
   if (f.maps) s.push({ id: 'maps', title: 'Maps', text: [
     `When staff enter an event’s address, we look it up with ${f.maps}. Your browser doesn’t contact the map service: map images are stored on this site. Directions links open Google Maps only if you choose them.`,
   ] });
+  if (f.googleCalendar) s.push({ id: 'google-calendar', title: 'Google Calendar', text: [
+    'We keep a copy of our calendar in our own Google Calendar account, and changes made there come back to this site. That copy holds what our calendar shows: event titles, times, places and descriptions. It never includes your RSVPs, your name or what you tell us when you sign up for an event, and Google sends no invitations. Appointments booked through our Google booking pages show on this site only as “Booked”, without names. Google applies its own privacy policy to its copy.',
+  ] });
   if (f.live) s.push({ id: 'live', title: 'Live video', text: [
     'When we stream, the site shows our broadcast from YouTube or Twitch. Until you press play, your browser only contacts this site: preview images come through it. Pressing play, or opening the broadcast on YouTube or Twitch, loads that platform, which applies its own privacy policy.',
   ] });

package/src/lib/legal/text-es.ts

@@ -14,6 +14,7 @@ function processors(f: LegalFacts): string[] {
     ...(f.push.enabled ? ['Expo, Apple y Google (notificaciones de la app)'] : []),
     ...(f.auth === 'clerk' ? ['Clerk (inicio de sesión)'] : []),
     ...(f.maps ? [`${f.maps} (mapas)`] : []),
+    ...(f.googleCalendar ? ['Google (Google Calendar)'] : []),
     ...(f.analytics.umami ? ['Umami (estadísticas de visitas)'] : []),
     ...(f.ai ? ['OpenAI u otro servicio de inteligencia artificial que elijamos (herramientas de redacción que usa el personal)'] : []),
     ...(f.offsiteBackups ? ['nuestro proveedor de almacenamiento de respaldos'] : []),
@@ -62,6 +63,9 @@ export function privacyEs(f: LegalFacts, country: string): PolicySection[] {
   if (f.maps) s.push({ id: 'maps', title: 'Mapas', text: [
     `Cuando el personal escribe la dirección de un evento, la buscamos con ${f.maps}. Su navegador no se conecta con el servicio de mapas: las imágenes de los mapas se guardan en este sitio. Los enlaces para llegar abren Google Maps solo si usted los elige.`,
   ] });
+  if (f.googleCalendar) s.push({ id: 'google-calendar', title: 'Google Calendar', text: [
+    'Guardamos una copia de nuestro calendario en nuestra propia cuenta de Google Calendar, y los cambios que se hacen allí regresan a este sitio. Esa copia contiene lo que muestra nuestro calendario: títulos, horarios, lugares y descripciones de los eventos. Nunca incluye sus confirmaciones de asistencia, su nombre ni lo que nos dice al inscribirse en un evento, y Google no envía invitaciones. Las citas reservadas en nuestras páginas de reserva de Google aparecen en este sitio solo como “Reservado”, sin nombres. Google aplica su propia política de privacidad a su copia.',
+  ] });
   if (f.live) s.push({ id: 'live', title: 'Video en vivo', text: [
     'Cuando transmitimos, el sitio muestra nuestra transmisión de YouTube o Twitch. Hasta que usted presiona reproducir, su navegador solo se conecta con este sitio: las imágenes de vista previa pasan por él. Al presionar reproducir, o al abrir la transmisión en YouTube o Twitch, se carga esa plataforma, que aplica su propia política de privacidad.',
   ] });

package/src/lib/live/crypto.ts

@@ -1,28 +1,7 @@
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
-import { env } from '../env';
-import { ApiError } from '../api';
-function key(locals?: unknown) {
-  const runtime = (locals as { runtime?: { env?: Record<string, unknown> } } | undefined)?.runtime?.env;
-  const secret = String(runtime?.LIVE_ENCRYPTION_KEY || env('LIVE_ENCRYPTION_KEY') || runtime?.SESSION_SECRET || env('SESSION_SECRET'));
-  if (secret.length < 32) throw new ApiError(503, 'Set LIVE_ENCRYPTION_KEY or SESSION_SECRET to at least 32 random characters on your host before storing live credentials.');
-  return createHash('sha256').update(`acms:live:v1:${secret}`).digest();
-}
-export const hash = (value: string) => createHash('sha256').update(value).digest('hex');
-export const randomToken = () => randomBytes(32).toString('base64url');
-export function encryptionReady(locals?: unknown) { try { key(locals); return true; } catch { return false; } }
-export function encrypt(value: unknown, context: string, locals?: unknown) {
-  const iv = randomBytes(12), cipher = createCipheriv('aes-256-gcm', key(locals), iv);
-  cipher.setAAD(Buffer.from(`acms:live:${context}`));
-  const data = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
-  return [iv, cipher.getAuthTag(), data].map(v => v.toString('base64url')).join('.');
-}
-export function decrypt<T>(encrypted: string, context: string, locals?: unknown): T {
-  try {
-    const parts = encrypted.split('.');
-    if (parts.length !== 3) throw new Error();
-    const [iv, tag, data] = parts.map(v => Buffer.from(v, 'base64url'));
-    const cipher = createDecipheriv('aes-256-gcm', key(locals), iv);
-    cipher.setAAD(Buffer.from(`acms:live:${context}`)); cipher.setAuthTag(tag);
-    return JSON.parse(Buffer.concat([cipher.update(data), cipher.final()]).toString('utf8'));
-  } catch { throw new ApiError(503, 'Saved live credentials cannot be decrypted. Re-enter the credentials and reconnect.'); }
-}
+import { sealer } from '../sealed';
+// Live video credentials (lib/sealed.ts): the same key and wire format as before it was shared.
+const live = sealer('live', 'live credentials');
+export { hash, randomToken } from '../sealed';
+export const encryptionReady = (locals?: unknown) => live.ready(locals);
+export const encrypt = (value: unknown, context: string, locals?: unknown) => live.encrypt(value, context, locals);
+export const decrypt = <T>(encrypted: string, context: string, locals?: unknown): T => live.decrypt<T>(encrypted, context, locals);

package/src/lib/repo/migrations.ts

@@ -11,6 +11,8 @@ import { ROLES_MIGRATION } from '../permissions/migration';
 import { SYNC_MIGRATION } from '../sync/migration';
 import { ANNOUNCEMENT_TABLE, ANNOUNCEMENT_VISIBLE_COLUMNS } from '../announcements/migration';
 import { SCREENS_MIGRATION } from '../display/store';
+import { REQUEST_TABLE } from '../calendar/request-migration';
+import { GCAL_MIGRATION } from '../calendar/google/migration';
 // Versioned schema migrations shared by the two SQLite-dialect adapters
 // (D1 and libSQL). Applied versions are recorded in the `migrations` table;
 // each adapter's runner applies whatever is newer, in order, at startup.
@@ -730,6 +732,12 @@ export const MIGRATIONS: Migration[] = [
   MOVED_DATES_MIGRATION(contentVersionTriggers('events', [...CONTENT_VERSION_COLUMNS.events, 'cancelled_dates', 'moved_dates'])[2]),
   // saved TV screens (Admin → Calendar → Screens, lib/display/store.ts)
   SCREENS_MIGRATION,
+  // calendar requests on their own rows (RequestRecord): new events and
+  // changes asked for without an account, and hosts' date moves
+  { version: 68, statements: REQUEST_TABLE },
+  // two-way Google Calendar sync: the account, links, pairs, outgoing queue
+  // (triggers on events) and Recent changes. Not public, so no cache trigger.
+  GCAL_MIGRATION,
 ];
 
 // Current cache coverage; keep earlier migration inputs frozen for upgrade compatibility.

package/src/lib/repo/sql.ts

@@ -4,9 +4,11 @@ import { AuthStore } from '../auth/store';
 import { FormStore, formInsert, submissionInsert } from '../forms/store';
 import { GuestStore } from '../mobile/guest-store';
 import { LiveStore } from '../live/store';
+import { GcalStore } from '../calendar/google/store';
 import { PushStore } from '../push/store';
 import { AnnouncementStore, announcementInsert } from '../announcements/store';
 import { ScreenStore, screenInsert, screenKey } from '../display/store';
+import { RequestStore, requestInsert } from '../calendar/request-store';
 import { EditorStore } from '../editor/store';
 import { PermissionStore } from '../permissions/store';
 import { BackupStore } from '../backup/store';
@@ -158,6 +160,10 @@ function parseMovedDates(raw: unknown): CalEvent['movedDates'] {
   for (const [key, entry] of Object.entries(value)) { const m = MovedDate.safeParse(entry); if (m.success) out[key] = m.data; }
   return out;
 }
+// quiet: the event change it records sends its webhook but no member push
+// (push_control.quiet shares the write's transaction)
+const quietly = (write: SqlStatement, quiet?: boolean): SqlStatement[] =>
+  quiet ? [{ sql: 'UPDATE push_control SET quiet=1 WHERE id=1' }, write, { sql: 'UPDATE push_control SET quiet=0 WHERE id=1' }] : [write];
 function rowToEvent(r: Row): CalEvent {
   return CalEvent.parse({
     id: r.id, slug: r.slug, title: r.title, bodyJson: r.body_json ?? '', bodyHtml: r.body_html ?? '',
@@ -292,8 +298,10 @@ export class SqlRepository implements ContentRepository {
   readonly forms: FormStore;
   readonly guests: GuestStore;
   readonly live: LiveStore;
+  readonly gcal: GcalStore;
   readonly push: PushStore;
   readonly announcements: AnnouncementStore;
+  readonly requests: RequestStore;
   readonly editor: EditorStore;
   readonly backups: BackupStore;
   readonly permissions: PermissionStore;
@@ -305,8 +313,10 @@ export class SqlRepository implements ContentRepository {
     this.forms = new FormStore(async () => { await this.ready; return this.driver; });
     this.guests = new GuestStore(async () => { await this.ready; return this.driver; });
     this.live = new LiveStore(async () => { await this.ready; return this.driver; });
+    this.gcal = new GcalStore(async () => { await this.ready; return this.driver; });
     this.push = new PushStore(async () => { await this.ready; return this.driver; });
     this.announcements = new AnnouncementStore(async () => { await this.ready; return this.driver; });
+    this.requests = new RequestStore(async () => { await this.ready; return this.driver; });
     this.editor = new EditorStore(async () => { await this.ready; return this.driver; });
     this.backups = new BackupStore(async () => { await this.ready; return this.driver; });
     this.auth = new AuthStore(async () => { await this.ready; return this.driver; });
@@ -877,13 +887,14 @@ export class SqlRepository implements ContentRepository {
     await this.syncEventIndex(id);
     return (await this.getEvent(id))!;
   }
-  async updateEvent(id: string, data: EventUpdate) {
+  async updateEvent(id: string, data: EventUpdate, opts: { keepDraft?: boolean; quiet?: boolean } = {}) {
     await this.ready;
     const current = await this.getEvent(id);
     if (!current) return;
     // a direct live write supersedes any staged edits (applyEventDraft routes
-    // through here too, so applying clears the snapshot in the same UPDATE)
-    const sets: string[] = ['updated_at = ?', 'draft = NULL'];
+    // through here too, so applying clears the snapshot in the same UPDATE);
+    // keepDraft: a change made elsewhere (the Google sync) leaves them staged
+    const sets: string[] = opts.keepDraft ? ['updated_at = ?'] : ['updated_at = ?', 'draft = NULL'];
     const args: unknown[] = [Date.now()];
     const plain: Record<string, string> = {
       title: 'title', slug: 'slug', bodyJson: 'body_json', bodyHtml: 'body_html', excerpt: 'excerpt',
@@ -943,8 +954,8 @@ export class SqlRepository implements ContentRepository {
           start_at=CASE WHEN ? THEN (SELECT start_at FROM events WHERE id=?) ELSE start_at END,
           end_at=CASE WHEN ? THEN (SELECT end_at FROM events WHERE id=?) ELSE end_at END
           WHERE event_id=? AND kind='rsvp' AND status IN ('waitlisted','offered')`,args:[cancelled?1:0,id,siteTimezone,cancelled?1:0,single?1:0,id,single?1:0,id,id]},
-        ...notifications]);
-    } else await this.driver.batch([eventWrite]);
+        ...notifications].flatMap((st) => st === eventWrite ? quietly(eventWrite, opts.quiet) : [st]));
+    } else await this.driver.batch(quietly(eventWrite, opts.quiet));
     await this.syncEventIndex(id);
   }
   async saveEventDraft(id: string, data: Parameters<ContentRepository['saveEventDraft']>[1]) {
@@ -964,17 +975,16 @@ export class SqlRepository implements ContentRepository {
     await this.updateEvent(id, pickEventDraft(draft));
   }
   // per-date cancellations apply at once and never touch a staged draft
-  async setEventCancelledDates(id: string, dates: string[]) {
+  async setEventCancelledDates(id: string, dates: string[], opts: { quiet?: boolean } = {}) {
     await this.ready;
-    await this.driver.run('UPDATE events SET cancelled_dates = ?, updated_at = ? WHERE id = ?', [JSON.stringify(dates), Date.now(), id]);
+    await this.driver.batch(quietly({ sql: 'UPDATE events SET cancelled_dates = ?, updated_at = ? WHERE id = ?', args: [JSON.stringify(dates), Date.now(), id] }, opts.quiet));
   }
   async setEventMovedDates(id: string, moved: CalEvent['movedDates'], cancelledDates?: string[], opts: { quiet?: boolean } = {}) {
     await this.ready;
     const write = cancelledDates
       ? { sql: 'UPDATE events SET moved_dates = ?, cancelled_dates = ?, updated_at = ? WHERE id = ?', args: [JSON.stringify(moved), JSON.stringify(cancelledDates), Date.now(), id] }
       : { sql: 'UPDATE events SET moved_dates = ?, updated_at = ? WHERE id = ?', args: [JSON.stringify(moved), Date.now(), id] };
-    // quiet: the change it records sends its webhook but no member push (the flag shares this transaction)
-    await this.driver.batch(opts.quiet ? [{ sql: 'UPDATE push_control SET quiet=1 WHERE id=1' }, write, { sql: 'UPDATE push_control SET quiet=0 WHERE id=1' }] : [write]);
+    await this.driver.batch(quietly(write, opts.quiet));
   }
   async cancelOccurrenceRsvps(id: string, start: number) {
     await this.ready;
@@ -1023,6 +1033,8 @@ export class SqlRepository implements ContentRepository {
       ...notifications,
       { sql: 'DELETE FROM events WHERE id = ?', args: [id] },
       { sql: "DELETE FROM search_index WHERE kind = 'event' AND ref_id = ?", args: [id] },
+      // requests about it can't be answered any more: withdrawn (so they're pruned like answered ones)
+      { sql: "UPDATE event_requests SET state = 'withdrawn', reviewed_at = ?, updated_at = MAX(?, updated_at + 1) WHERE event_id = ? AND state = 'pending'", args: [Date.now(), Date.now(), id] },
     ]);
   }
 
@@ -1943,6 +1955,8 @@ export class SqlRepository implements ContentRepository {
       ...(content.announcements ? [{ sql: 'DELETE FROM announcements' }, ...content.announcements.map(announcementInsert)] : []),
       // screens come back with new keys (backups never hold them): each TV needs its new link
       ...(content.screens ? [{ sql: 'DELETE FROM display_screens' }, ...content.screens.map((s) => screenInsert({ ...s, key: screenKey(), lastSeenAt: null }))] : []),
+      // calendar requests (a backup made before them leaves the current ones)
+      ...(content.eventRequests ? [{ sql: 'DELETE FROM event_requests' }, ...content.eventRequests.map(requestInsert)] : []),
       ...(content.forms ?? []).map(formInsert),
       ...(content.formSubmissions ?? []).map(submissionInsert),
       ...(content.resources ?? []).map((r) => this.resourceInsert(r)),
@@ -2001,6 +2015,8 @@ export class SqlRepository implements ContentRepository {
     if (authRecovery) stmts.push({ sql: `UPDATE auth_identities SET disabled=0 WHERE issuer=? AND subject=? AND user_id=? AND EXISTS(SELECT 1 FROM users WHERE id=? AND role='owner')`, args: [authRecovery.issuer, authRecovery.subject, authRecovery.userId, authRecovery.userId] });
     const settingsWrite = this.settingsStatement({ ...content.settings, live: { ...LiveConfig.parse(content.settings.live ?? {}), mode: 'off', manual: { watchUrl: '', title: 'We’re live', until: 0 } } });
     stmts.push({ sql: "UPDATE live_connections SET enabled=0,tested_at=0,revision=revision+1,lease='',lease_until=0,snapshot=NULL,upcoming=NULL,error='Restored content. Test this connection before enabling automatic checks.'" }, { sql: 'DELETE FROM live_oauth_states' });
+    // Google Calendar links pause until someone checks them (the restored events may be older than Google's)
+    stmts.push(...GcalStore.restoreStatements());
     if (settingsWrite) stmts.push(settingsWrite);
     stmts.push(
       { sql: 'UPDATE webhook_control SET suppressed=0 WHERE id=1' },

package/src/lib/repo/types.ts

@@ -5,11 +5,13 @@ import type { BackupStore } from '../backup/store';
 import type { GuestStore } from '../mobile/guest-store';
 import type { SavedForm, FormSubmission } from '../forms/schema';
 import type { LiveStore } from '../live/store';
+import type { GcalStore } from '../calendar/google/store';
 import type { BookingRequest } from '../backup/content';
 import type { EmailStore } from '../email/store';
 import type { RsvpStaffNotice } from '../email/types';
 import type { PushStore } from '../push/store';
 import type { AnnouncementStore } from '../announcements/store';
+import type { RequestStore } from '../calendar/request-store';
 import type { Announcement } from '../announcements/types';
 import type { EditorStore } from '../editor/store';
 import type { PermissionStore } from '../permissions/store';
@@ -19,7 +21,7 @@ export type ImportRecordKind = 'post' | 'page' | 'user' | 'tag' | 'media' | 'red
 export interface ImportRecord { runId: string; kind: ImportRecordKind; sourceId: string; acmsId: string; action: 'created' | 'updated'; stamp: number }
 export interface DesignVersion { id: string; createdAt: number; author: string; summary: string; snapshot: Record<string, unknown> }
 
-import type { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Role, WidgetInstance, Calendar, CalEvent, ApiKey, ApiScope, Webhook, WebhookDelivery, Resource, BookingLink, Booking, BookingStatus, Place, EventLocation, EventRequest } from '../schema';
+import type { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Role, WidgetInstance, Calendar, CalEvent, ApiKey, ApiScope, Webhook, WebhookDelivery, Resource, BookingLink, Booking, BookingStatus, Place, EventLocation, EventRequest, RequestRecord } from '../schema';
 
 export interface Stats {
   publishedPages: number;
@@ -80,8 +82,12 @@ export interface ContentRepository {
   readonly backups: BackupStore;
   readonly guests: GuestStore;
   readonly live: LiveStore;
+  /** two-way Google Calendar sync (lib/calendar/google/) */
+  readonly gcal: GcalStore;
   readonly push: PushStore;
   readonly announcements: AnnouncementStore;
+  // calendar requests on their own rows (lib/calendar/request-store.ts)
+  readonly requests: RequestStore;
   readonly editor: EditorStore;
   readonly permissions: PermissionStore;
   readonly screens: ScreenStore;
@@ -160,7 +166,8 @@ export interface ContentRepository {
   getEvent(id: string): Promise<CalEvent | null>;
   getEventBySlug(slug: string): Promise<CalEvent | null>;
   createEvent(data: Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt'>> & { title: string; slug: string; start: string }): Promise<CalEvent>;
-  updateEvent(id: string, data: EventUpdate): Promise<void>;
+  /** keepDraft: leave staged edits staged (a change made elsewhere); quiet: no member push for it */
+  updateEvent(id: string, data: EventUpdate, opts?: { keepDraft?: boolean; quiet?: boolean }): Promise<void>;
   saveEventDraft(id: string, data: Omit<EventUpdate, 'status' | 'scheduledAt' | 'publishedAt'>): Promise<void>;
   /** the Team members who host an event (lib/calendar/requests.ts) */
   setEventHosts(id: string, hostIds: string[]): Promise<void>;
@@ -169,7 +176,7 @@ export interface ContentRepository {
   applyEventDraft(id: string): Promise<void>;
   discardEventDraft(id: string): Promise<void>;
   /** replace an event's cancelled occurrence keys at once, keeping any staged draft */
-  setEventCancelledDates(id: string, dates: string[]): Promise<void>;
+  setEventCancelledDates(id: string, dates: string[], opts?: { quiet?: boolean }): Promise<void>;
   /** replace an event's moved dates (and cancelled dates, when given) at once, keeping any staged draft; quiet: no member push for it */
   setEventMovedDates(id: string, moved: CalEvent['movedDates'], cancelledDates?: string[], opts?: { quiet?: boolean }): Promise<void>;
   /** Cancels the RSVPs for one date of an event (they get the "cancelled" email). Returns how many. */
@@ -372,6 +379,8 @@ export interface ContentRepository {
     // saved TV screens, without their keys (each gets a new one); a backup
     // without them leaves the current ones
     screens?: Screen[];
+    // added with calendar requests; a backup without them leaves the current ones
+    eventRequests?: RequestRecord[];
   }, authRecovery?: { issuer: string; subject: string; userId: string }): Promise<void>;
 
   // imports (lib/import/apply.ts drives these). writeImported is the

package/src/lib/scheduler.ts

@@ -10,6 +10,7 @@ import { GUEST_IDLE_MS } from './mobile/guest-store';
 import { pushHeartbeat, pushUrlFor } from './monitoring';
 import { syncCachePurge } from './cache/purge';
 import { runOffsiteBackup } from './backup/offsite';
+import { syncGoogle } from './calendar/google/service';
 
 // All work is awaited on both hosts. Traffic-triggered fallbacks do not mark
 // this heartbeat: monitoring must prove the independent scheduler ran.
@@ -20,6 +21,8 @@ export async function runScheduledTasks(repo: ContentRepository, locals?: unknow
     publish: () => repo.publishDuePosts(startedAt),
     // changes to published events (scheduled publishing above included): webhooks, change pushes, redirects
     events: () => flushEventChanges(repo),
+    // two-way Google Calendar sync: site changes go out every run, each link reads Google every 2 minutes
+    gcal: () => syncGoogle(repo, locals, { now: startedAt }),
     webhooks: () => processDueDeliveries(repo),
     reminders: () => sendDueReminders(repo, { origin: settings.siteUrl, locals, now: startedAt }),
     // pending bookings past their approval deadline (Calendar settings → Bookings)

package/src/lib/schema.ts

@@ -395,6 +395,53 @@ export const EventRequest = z.object({
 });
 export type EventRequest = z.infer<typeof EventRequest>;
 
+// A request about the calendar kept on its own row (table event_requests,
+// lib/calendar/request-store.ts), unlike the member requests above that
+// stage an event draft:
+// - 'new': a new event from anyone, without an account (source 'app' or 'web').
+//   Approving makes a draft event and stores its id in `eventId`.
+// - 'change': anyone asks for a change to an event (`eventId`, one date in
+//   `key` or '' for the whole event); `note` says what should change.
+// - 'move' / 'from-date': a host's move of one date, or a change from a date
+//   on (C3/C4); `data` holds the move.
+// `userId` is the member who asked; `requester` is the person without an
+// account (never both). `note` is their own words to staff, `reply` staff's
+// last answer. Decided rows (and withdrawn ones, which set reviewedAt too)
+// are deleted some days after `reviewedAt` (CalendarSettings.requests).
+export const RequestKind = z.enum(['new', 'change', 'move', 'from-date']);
+export type RequestKind = z.infer<typeof RequestKind>;
+export const RequestState = z.enum(['pending', 'approved', 'declined', 'withdrawn']);
+export type RequestState = z.infer<typeof RequestState>;
+export const RequestSource = z.enum(['member', 'web', 'app']);
+export type RequestSource = z.infer<typeof RequestSource>;
+export const Requester = z.object({
+  name: z.string(),
+  email: z.string(),
+  phone: z.string().default(''),
+  // the language they asked in, for replies ('' = the main language)
+  locale: z.string().default(''),
+});
+export type Requester = z.infer<typeof Requester>;
+export const RequestRecord = z.object({
+  id: z.string(),
+  kind: RequestKind,
+  state: RequestState.default('pending'),
+  source: RequestSource,
+  userId: z.string().default(''),
+  requester: Requester.nullable().default(null),
+  eventId: z.string().default(''),
+  // an occurrence key (same format as exdates) when it's about one date
+  key: z.string().default(''),
+  data: z.record(z.any()).default({}),
+  note: z.string().default(''),
+  reply: z.string().default(''),
+  reviewedBy: z.string().default(''),
+  reviewedAt: z.number().default(0),
+  createdAt: z.number(),
+  updatedAt: z.number(),
+});
+export type RequestRecord = z.infer<typeof RequestRecord>;
+
 export const CalEvent = z.object({
   id: z.string(),
   slug: z.string(),

package/src/lib/sealed.ts

@@ -0,0 +1,46 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import { env } from './env';
+import { ApiError } from './api';
+
+// Credentials for connected services (YouTube/Twitch live video, Google
+// Calendar) are sealed with AES-256-GCM under a key derived from
+// LIVE_ENCRYPTION_KEY, else SESSION_SECRET. Each service has its own domain:
+// a different derived key and associated data, so one service's ciphertext
+// never opens as another's. `context` narrows it further (a provider, a
+// pending OAuth state).
+export interface Sealer {
+  ready(locals?: unknown): boolean;
+  encrypt(value: unknown, context: string, locals?: unknown): string;
+  decrypt<T>(encrypted: string, context: string, locals?: unknown): T;
+}
+
+/** `what` names the credentials in the errors people see ("live credentials"). */
+export function sealer(domain: string, what: string): Sealer {
+  function key(locals?: unknown) {
+    const runtime = (locals as { runtime?: { env?: Record<string, unknown> } } | undefined)?.runtime?.env;
+    const secret = String(runtime?.LIVE_ENCRYPTION_KEY || env('LIVE_ENCRYPTION_KEY') || runtime?.SESSION_SECRET || env('SESSION_SECRET'));
+    if (secret.length < 32) throw new ApiError(503, `Set LIVE_ENCRYPTION_KEY or SESSION_SECRET to at least 32 random characters on your host before storing ${what}.`);
+    return createHash('sha256').update(`acms:${domain}:v1:${secret}`).digest();
+  }
+  return {
+    ready(locals) { try { key(locals); return true; } catch { return false; } },
+    encrypt(value, context, locals) {
+      const iv = randomBytes(12), cipher = createCipheriv('aes-256-gcm', key(locals), iv);
+      cipher.setAAD(Buffer.from(`acms:${domain}:${context}`));
+      const data = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
+      return [iv, cipher.getAuthTag(), data].map(v => v.toString('base64url')).join('.');
+    },
+    decrypt<T>(encrypted: string, context: string, locals?: unknown): T {
+      try {
+        const parts = encrypted.split('.');
+        if (parts.length !== 3) throw new Error();
+        const [iv, tag, data] = parts.map(v => Buffer.from(v, 'base64url'));
+        const cipher = createDecipheriv('aes-256-gcm', key(locals), iv);
+        cipher.setAAD(Buffer.from(`acms:${domain}:${context}`)); cipher.setAuthTag(tag);
+        return JSON.parse(Buffer.concat([cipher.update(data), cipher.final()]).toString('utf8'));
+      } catch { throw new ApiError(503, `Saved ${what} cannot be decrypted. Re-enter the credentials and reconnect.`); }
+    },
+  };
+}
+export const hash = (value: string) => createHash('sha256').update(value).digest('hex');
+export const randomToken = () => randomBytes(32).toString('base64url');

package/src/pages/admin/calendar/events/[id].astro

@@ -14,6 +14,8 @@ import { accessFor, forbiddenUnless } from '../../../../lib/permissions/access';
 import type { Permission } from '../../../../lib/permissions/catalog';
 import { ApiError } from '../../../../lib/api';
 import { roleLabel } from '../../../../lib/roles';
+import { eventClashes } from '../../../../lib/booking/holds';
+import { fieldWord } from '../../../../lib/calendar/google/map';
 import ThemeScript from '../../../../components/ThemeScript.astro';
 import ClerkSession from '../../../../components/auth/ClerkSession.astro';
 import Modal from '../../../../components/Modal.astro';
@@ -92,7 +94,20 @@ const hosts = event.hostIds.map((id) => ({ id, name: nameOf(id) })).filter((h) =
 const people = [...users].sort((a, b) => (a.name || a.email).localeCompare(b.name || b.email));
 const notice = Astro.url.searchParams.get('notice') ?? '';
 const error = Astro.url.searchParams.get('error') ?? '';
-const showBar = Boolean(req) || canEdit || hosts.length > 0 || Boolean(notice || error);
+// Synced with Google (lib/calendar/google/): which Google calendars have a copy, the latest
+// field both sides changed (the site kept its value; "Use Google's version" takes Google's),
+// whether the description still comes from Google (Q8), and room clashes a change from Google made
+const gItems = (await repo.gcal.itemsForEvent(event.id)).filter((i) => i.kind !== 'segment' && !i.gone);
+const gLinks = gItems.length ? new Map((await repo.gcal.listLinks()).map((l) => [l.id, l])) : new Map();
+const synced = gItems.map((i) => ({ ...i, googleName: gLinks.get(i.linkId)?.googleName ?? 'Google' }));
+const gConflict = synced.map((i) => i.conflict).filter((c): c is NonNullable<typeof c> => !!c).sort((a, b) => b.at - a.at)[0] ?? null;
+const gDescFromGoogle = synced.some((i) => i.descGoogle);
+const gTz = settings.timezone || 'UTC';
+const gTime = (ts: number) => new Intl.DateTimeFormat(settings.locale || 'en', { month: 'short', day: 'numeric', hour: 'numeric', minute: '2-digit', timeZone: gTz }).format(ts);
+const gClashes = synced.length && event.status === 'published' && !event.cancelled && event.roomHold.resourceIds.length
+  ? (await eventClashes(repo, settings, event, { horizonDays: 120 }).catch(() => ({ clashes: [] }))).clashes : [];
+const gRooms = gClashes.length ? new Map((await repo.listResources()).map((r) => [r.id, r.name])) : new Map<string, string>();
+const showBar = Boolean(req) || canEdit || hosts.length > 0 || Boolean(notice || error) || synced.length > 0;
 const ago = (ts: number) => {
   const s = Math.max(0, Math.floor((Date.now() - ts) / 1000));
   if (s < 60) return 'just now';
@@ -162,6 +177,27 @@ const approveLabel = pending?.kind === 'changes' ? 'Approve changes' : isLive ?
             {declined.kind === 'new' && !isLive && ` It stays a draft until ${requester} sends it again.`}
           </p>
         )}
+        {synced.length > 0 && (
+          <div class="evreq-gcal">
+            <p class="evreq-line">
+              <span class="evreq-label">Synced with Google</span>
+              {synced.map((i) => <span class="evreq-chip">{i.googleName}{i.syncedAt ? ` · ${gTime(i.syncedAt)}` : ''}{i.htmlLink && <> · <a href={i.htmlLink} target="_blank" rel="noopener">Open in Google ↗</a></>}</span>)}
+            </p>
+            {gConflict && (
+              <div class="evreq-gcal-clash">
+                <span>Changed in both places at {gTime(gConflict.at)}. The site kept its {fieldWord(gConflict.field).toLowerCase()}, “{gConflict.site}”. Google had “{gConflict.google}”.</span>
+                {(canPublish || access?.can('schedule.manage')) && (
+                  <form method="post" action="/admin/calendar/google" data-evreq>
+                    <input type="hidden" name="op" value="use" /><input type="hidden" name="log" value={gConflict.logId} /><input type="hidden" name="return" value={self} />
+                    <button class="btn sm" type="submit">Use Google’s version</button>
+                  </form>
+                )}
+              </div>
+            )}
+            {gDescFromGoogle && <p class="evreq-muted">Created in Google. Its description comes from Google until someone edits it here.</p>}
+            {gClashes.length > 0 && <p class="evreq-gcal-room">Room clash: {gRooms.get(gClashes[0].hold.resourceId) ?? 'a room'} is also held by “{gClashes[0].other.title}” on {gTime(gClashes[0].hold.eventStart)}{gClashes.length > 1 ? ` (and ${gClashes.length - 1} more)` : ''}. Changes from Google keep their rooms: check Bookings.</p>}
+          </div>
+        )}
         <div class="evreq-hosts">
           <span class="evreq-label">Hosts</span>
           {hosts.length ? hosts.map((h) => <span class="evreq-chip">{h.name}</span>) : <span class="evreq-muted">None</span>}
@@ -306,6 +342,11 @@ const approveLabel = pending?.kind === 'changes' ? 'Approve changes' : isLive ?
   .evreq-hosts { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; margin-left: auto; }
   .evreq-label { font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.07em; color: var(--muted); margin-right: 2px; }
   .evreq-chip { font-size: 12px; font-weight: 500; color: var(--text-2); background: var(--panel); border: 1px solid var(--line); border-radius: var(--r-full); padding: 1px 9px; white-space: nowrap; }
+  .evreq-gcal { flex: 1 1 480px; min-width: 0; display: flex; flex-direction: column; gap: 4px; }
+  .evreq-gcal .evreq-chip a { color: var(--accent-deep); }
+  .evreq-gcal-clash { display: flex; flex-wrap: wrap; align-items: center; gap: 6px 12px; color: var(--text); }
+  .evreq-gcal-clash form { margin: 0; }
+  .evreq-gcal-room { color: var(--red); }
   .evreq-modal-hint { margin: 0 0 12px; }
   .evreq-find { width: 100%; margin-bottom: 10px; }
   .evreq-people { max-height: min(320px, 50vh); overflow-y: auto; margin: 0 -4px; padding: 2px 4px; }