@acms-subir/core 0.3.54 → 0.3.56

package/src/lib/mobile/requests.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+import { ApiError, readJson } from '../api';
+import { REQUESTS } from '../calendar/request-config';
+import { requestOptions, submitRequest } from '../calendar/request-service';
+import { queryParams } from './http';
+import type { PublicContext } from './route';
+
+// Event requests from apps (acms({ requests })): the options the form needs,
+// and sending one. No account; an Idempotency-Key per request (retries never
+// duplicate); 10 a minute per address and the site's daily cap
+// (lib/calendar/request-service.ts holds the rules). Never cached: "closed"
+// and the rooms must show at once.
+
+export const requestOptionsQuery = z.object({ locale: z.string().max(35).optional() }).strict();
+
+export async function getRequestOptions(c: PublicContext) {
+  if (!REQUESTS.enabled) throw new ApiError(404, 'Not found.');
+  const q = requestOptionsQuery.parse(queryParams(c.url));
+  return requestOptions(c.repo, q.locale);
+}
+
+export async function postRequest(c: PublicContext) {
+  const key = c.request.headers.get('idempotency-key') ?? '';
+  const body = await readJson(c.request, 20_000);
+  const { id } = await submitRequest(c.repo, body, { source: 'app', key, address: c.address, locals: c.locals });
+  return { id };
+}

package/src/lib/mobile/schemas.ts

@@ -9,7 +9,7 @@ const Palette = z.object({ bg: str, ink: str, muted: str, line: str, accent: str
 export const Site = z.object({
   name: str, description: str, logo: str, logoDark: str, icon: str, menu: z.array(z.object({ label: str, href: str })),
   languages: z.object({ default: locale, locales: z.array(z.object({ code: str, name: str })) }),
-  features: z.object({ blog: z.array(z.object({ key: str, name: str, url: str, redirectFrom: strings })), calendar: bool, bookings: bool, rsvp: bool, search: bool, bookingChanges: bool, guestSignIn: bool, forms: bool, links: bool, live: bool, announcements: bool }),
+  features: z.object({ blog: z.array(z.object({ key: str, name: str, url: str, redirectFrom: strings })), calendar: bool, bookings: bool, rsvp: bool, search: bool, bookingChanges: bool, guestSignIn: bool, forms: bool, links: bool, live: bool, announcements: bool, requests: bool }),
   legal: z.object({ privacy: str.nullable(), terms: str.nullable() }), apiVersion: z.literal(1),
 });
 export const Theme = z.object({
@@ -159,8 +159,19 @@ export const LiveStatus = z.object({
   snapshot: LiveSnapshot.nullable(), serverNow: ms,
   display: z.object({ style: z.enum(['poster', 'split', 'row']), bar: bool, header: bool, dock: bool }),
 });
+// GET /requests/options: types and rooms to offer, the site's words (in the asked language), the phone for when it's closed
+export const RequestOptions = z.object({
+  open: bool, types: z.array(z.object({ id: str, label: str })), rooms: z.array(z.object({ slug: str, name: str, color: str })),
+  replyTime: str, notice: str, phone: str, timezone: str,
+  // what a change can be about: public events by title, each with its dates (site-local days) in the next 120 days
+  events: z.array(z.object({ slug: str, title: str, dates: z.array(str) })),
+});
+export const RequestReceipt = z.object({ id: str });
 export const Error = z.object({ version: z.literal(1), error: z.object({
-  // duplicate (409): that email already has an RSVP for the date
-  code: z.enum(['invalid_request', 'unauthorized', 'forbidden', 'not_found', 'method_not_allowed', 'conflict', 'duplicate', 'gone', 'payload_too_large', 'unsupported_media_type', 'rate_limited', 'upstream_error', 'internal_error']),
+  // duplicate (409): that email already has an RSVP for the date. POST /requests refusals say
+  // which field (title, type, start, end, past, far, repeat, room, people, event, date, what,
+  // name, email, phone; 400), closed or changed (409), busy or full (429), trap (400)
+  code: z.enum(['invalid_request', 'unauthorized', 'forbidden', 'not_found', 'method_not_allowed', 'conflict', 'duplicate', 'gone', 'payload_too_large', 'unsupported_media_type', 'rate_limited', 'upstream_error', 'internal_error',
+    'closed', 'trap', 'busy', 'full', 'changed', 'title', 'type', 'start', 'end', 'past', 'far', 'repeat', 'room', 'people', 'event', 'date', 'what', 'name', 'email', 'phone']),
   message: str, issues: z.array(z.object({ path: z.array(z.union([str, z.number()])), message: str })).optional(),
 }) });

package/src/lib/mobile/site.ts

@@ -4,6 +4,7 @@ import { CONTENT, legacyBases } from '../content';
 import { I18N, localeName } from '../i18n';
 import { CALENDAR, bookingsEnabled } from '../calendar/config';
 import { ANNOUNCEMENTS } from '../announcements/config';
+import { REQUESTS } from '../calendar/request-config';
 import { SEARCH } from '../search-config';
 import { siteOrigin } from '../seo';
 import { resolveDesign } from '../theme';
@@ -51,6 +52,8 @@ export async function getSite(repo: ContentRepository, url: URL, _id = '', local
       live: settings.live.mode !== 'off',
       // acms({ announcements }): GET /api/v1/announcements
       announcements: ANNOUNCEMENTS.enabled,
+      // acms({ requests }): GET /api/v1/requests/options, POST /api/v1/requests (on even while requests are closed)
+      requests: REQUESTS.enabled,
     },
     // in the requested language (?locale=es → /es/privacy)
     legal: { privacy: legalUrl('privacy'), terms: legalUrl('terms') },

package/src/lib/push/types.ts

@@ -57,7 +57,7 @@ export interface PushDevice {
  * new form response, to the linked phones of staff on its alert list. Neither
  * counts in the weekly pace.
  */
-export type PushSource = 'manual' | 'post' | 'event' | 'soon' | 'live' | 'announcement' | 'change' | 'test' | 'form';
+export type PushSource = 'manual' | 'post' | 'event' | 'soon' | 'live' | 'announcement' | 'change' | 'test' | 'form' | 'request';
 export interface PushNotification {
   id: string; title: string; body: string; url: string;
   /** ['*'] = everyone */

package/src/lib/repo/migrations.ts

@@ -12,6 +12,7 @@ import { SYNC_MIGRATION } from '../sync/migration';
 import { ANNOUNCEMENT_TABLE, ANNOUNCEMENT_VISIBLE_COLUMNS } from '../announcements/migration';
 import { SCREENS_MIGRATION } from '../display/store';
 import { REQUEST_TABLE } from '../calendar/request-migration';
+import { GCAL_MIGRATION } from '../calendar/google/migration';
 // Versioned schema migrations shared by the two SQLite-dialect adapters
 // (D1 and libSQL). Applied versions are recorded in the `migrations` table;
 // each adapter's runner applies whatever is newer, in order, at startup.
@@ -734,6 +735,9 @@ export const MIGRATIONS: Migration[] = [
   // calendar requests on their own rows (RequestRecord): new events and
   // changes asked for without an account, and hosts' date moves
   { version: 68, statements: REQUEST_TABLE },
+  // two-way Google Calendar sync: the account, links, pairs, outgoing queue
+  // (triggers on events) and Recent changes. Not public, so no cache trigger.
+  GCAL_MIGRATION,
 ];
 
 // Current cache coverage; keep earlier migration inputs frozen for upgrade compatibility.

package/src/lib/repo/sql.ts

@@ -4,6 +4,7 @@ import { AuthStore } from '../auth/store';
 import { FormStore, formInsert, submissionInsert } from '../forms/store';
 import { GuestStore } from '../mobile/guest-store';
 import { LiveStore } from '../live/store';
+import { GcalStore } from '../calendar/google/store';
 import { PushStore } from '../push/store';
 import { AnnouncementStore, announcementInsert } from '../announcements/store';
 import { ScreenStore, screenInsert, screenKey } from '../display/store';
@@ -159,6 +160,10 @@ function parseMovedDates(raw: unknown): CalEvent['movedDates'] {
   for (const [key, entry] of Object.entries(value)) { const m = MovedDate.safeParse(entry); if (m.success) out[key] = m.data; }
   return out;
 }
+// quiet: the event change it records sends its webhook but no member push
+// (push_control.quiet shares the write's transaction)
+const quietly = (write: SqlStatement, quiet?: boolean): SqlStatement[] =>
+  quiet ? [{ sql: 'UPDATE push_control SET quiet=1 WHERE id=1' }, write, { sql: 'UPDATE push_control SET quiet=0 WHERE id=1' }] : [write];
 function rowToEvent(r: Row): CalEvent {
   return CalEvent.parse({
     id: r.id, slug: r.slug, title: r.title, bodyJson: r.body_json ?? '', bodyHtml: r.body_html ?? '',
@@ -293,6 +298,7 @@ export class SqlRepository implements ContentRepository {
   readonly forms: FormStore;
   readonly guests: GuestStore;
   readonly live: LiveStore;
+  readonly gcal: GcalStore;
   readonly push: PushStore;
   readonly announcements: AnnouncementStore;
   readonly requests: RequestStore;
@@ -307,6 +313,7 @@ export class SqlRepository implements ContentRepository {
     this.forms = new FormStore(async () => { await this.ready; return this.driver; });
     this.guests = new GuestStore(async () => { await this.ready; return this.driver; });
     this.live = new LiveStore(async () => { await this.ready; return this.driver; });
+    this.gcal = new GcalStore(async () => { await this.ready; return this.driver; });
     this.push = new PushStore(async () => { await this.ready; return this.driver; });
     this.announcements = new AnnouncementStore(async () => { await this.ready; return this.driver; });
     this.requests = new RequestStore(async () => { await this.ready; return this.driver; });
@@ -880,13 +887,14 @@ export class SqlRepository implements ContentRepository {
     await this.syncEventIndex(id);
     return (await this.getEvent(id))!;
   }
-  async updateEvent(id: string, data: EventUpdate) {
+  async updateEvent(id: string, data: EventUpdate, opts: { keepDraft?: boolean; quiet?: boolean } = {}) {
     await this.ready;
     const current = await this.getEvent(id);
     if (!current) return;
     // a direct live write supersedes any staged edits (applyEventDraft routes
-    // through here too, so applying clears the snapshot in the same UPDATE)
-    const sets: string[] = ['updated_at = ?', 'draft = NULL'];
+    // through here too, so applying clears the snapshot in the same UPDATE);
+    // keepDraft: a change made elsewhere (the Google sync) leaves them staged
+    const sets: string[] = opts.keepDraft ? ['updated_at = ?'] : ['updated_at = ?', 'draft = NULL'];
     const args: unknown[] = [Date.now()];
     const plain: Record<string, string> = {
       title: 'title', slug: 'slug', bodyJson: 'body_json', bodyHtml: 'body_html', excerpt: 'excerpt',
@@ -946,8 +954,8 @@ export class SqlRepository implements ContentRepository {
           start_at=CASE WHEN ? THEN (SELECT start_at FROM events WHERE id=?) ELSE start_at END,
           end_at=CASE WHEN ? THEN (SELECT end_at FROM events WHERE id=?) ELSE end_at END
           WHERE event_id=? AND kind='rsvp' AND status IN ('waitlisted','offered')`,args:[cancelled?1:0,id,siteTimezone,cancelled?1:0,single?1:0,id,single?1:0,id,id]},
-        ...notifications]);
-    } else await this.driver.batch([eventWrite]);
+        ...notifications].flatMap((st) => st === eventWrite ? quietly(eventWrite, opts.quiet) : [st]));
+    } else await this.driver.batch(quietly(eventWrite, opts.quiet));
     await this.syncEventIndex(id);
   }
   async saveEventDraft(id: string, data: Parameters<ContentRepository['saveEventDraft']>[1]) {
@@ -967,17 +975,16 @@ export class SqlRepository implements ContentRepository {
     await this.updateEvent(id, pickEventDraft(draft));
   }
   // per-date cancellations apply at once and never touch a staged draft
-  async setEventCancelledDates(id: string, dates: string[]) {
+  async setEventCancelledDates(id: string, dates: string[], opts: { quiet?: boolean } = {}) {
     await this.ready;
-    await this.driver.run('UPDATE events SET cancelled_dates = ?, updated_at = ? WHERE id = ?', [JSON.stringify(dates), Date.now(), id]);
+    await this.driver.batch(quietly({ sql: 'UPDATE events SET cancelled_dates = ?, updated_at = ? WHERE id = ?', args: [JSON.stringify(dates), Date.now(), id] }, opts.quiet));
   }
   async setEventMovedDates(id: string, moved: CalEvent['movedDates'], cancelledDates?: string[], opts: { quiet?: boolean } = {}) {
     await this.ready;
     const write = cancelledDates
       ? { sql: 'UPDATE events SET moved_dates = ?, cancelled_dates = ?, updated_at = ? WHERE id = ?', args: [JSON.stringify(moved), JSON.stringify(cancelledDates), Date.now(), id] }
       : { sql: 'UPDATE events SET moved_dates = ?, updated_at = ? WHERE id = ?', args: [JSON.stringify(moved), Date.now(), id] };
-    // quiet: the change it records sends its webhook but no member push (the flag shares this transaction)
-    await this.driver.batch(opts.quiet ? [{ sql: 'UPDATE push_control SET quiet=1 WHERE id=1' }, write, { sql: 'UPDATE push_control SET quiet=0 WHERE id=1' }] : [write]);
+    await this.driver.batch(quietly(write, opts.quiet));
   }
   async cancelOccurrenceRsvps(id: string, start: number) {
     await this.ready;
@@ -2008,6 +2015,8 @@ export class SqlRepository implements ContentRepository {
     if (authRecovery) stmts.push({ sql: `UPDATE auth_identities SET disabled=0 WHERE issuer=? AND subject=? AND user_id=? AND EXISTS(SELECT 1 FROM users WHERE id=? AND role='owner')`, args: [authRecovery.issuer, authRecovery.subject, authRecovery.userId, authRecovery.userId] });
     const settingsWrite = this.settingsStatement({ ...content.settings, live: { ...LiveConfig.parse(content.settings.live ?? {}), mode: 'off', manual: { watchUrl: '', title: 'We’re live', until: 0 } } });
     stmts.push({ sql: "UPDATE live_connections SET enabled=0,tested_at=0,revision=revision+1,lease='',lease_until=0,snapshot=NULL,upcoming=NULL,error='Restored content. Test this connection before enabling automatic checks.'" }, { sql: 'DELETE FROM live_oauth_states' });
+    // Google Calendar links pause until someone checks them (the restored events may be older than Google's)
+    stmts.push(...GcalStore.restoreStatements());
     if (settingsWrite) stmts.push(settingsWrite);
     stmts.push(
       { sql: 'UPDATE webhook_control SET suppressed=0 WHERE id=1' },

package/src/lib/repo/types.ts

@@ -5,6 +5,7 @@ import type { BackupStore } from '../backup/store';
 import type { GuestStore } from '../mobile/guest-store';
 import type { SavedForm, FormSubmission } from '../forms/schema';
 import type { LiveStore } from '../live/store';
+import type { GcalStore } from '../calendar/google/store';
 import type { BookingRequest } from '../backup/content';
 import type { EmailStore } from '../email/store';
 import type { RsvpStaffNotice } from '../email/types';
@@ -81,6 +82,8 @@ export interface ContentRepository {
   readonly backups: BackupStore;
   readonly guests: GuestStore;
   readonly live: LiveStore;
+  /** two-way Google Calendar sync (lib/calendar/google/) */
+  readonly gcal: GcalStore;
   readonly push: PushStore;
   readonly announcements: AnnouncementStore;
   // calendar requests on their own rows (lib/calendar/request-store.ts)
@@ -163,7 +166,8 @@ export interface ContentRepository {
   getEvent(id: string): Promise<CalEvent | null>;
   getEventBySlug(slug: string): Promise<CalEvent | null>;
   createEvent(data: Partial<Omit<CalEvent, 'id' | 'draft' | 'startAt' | 'endAt' | 'createdAt' | 'updatedAt'>> & { title: string; slug: string; start: string }): Promise<CalEvent>;
-  updateEvent(id: string, data: EventUpdate): Promise<void>;
+  /** keepDraft: leave staged edits staged (a change made elsewhere); quiet: no member push for it */
+  updateEvent(id: string, data: EventUpdate, opts?: { keepDraft?: boolean; quiet?: boolean }): Promise<void>;
   saveEventDraft(id: string, data: Omit<EventUpdate, 'status' | 'scheduledAt' | 'publishedAt'>): Promise<void>;
   /** the Team members who host an event (lib/calendar/requests.ts) */
   setEventHosts(id: string, hostIds: string[]): Promise<void>;
@@ -172,7 +176,7 @@ export interface ContentRepository {
   applyEventDraft(id: string): Promise<void>;
   discardEventDraft(id: string): Promise<void>;
   /** replace an event's cancelled occurrence keys at once, keeping any staged draft */
-  setEventCancelledDates(id: string, dates: string[]): Promise<void>;
+  setEventCancelledDates(id: string, dates: string[], opts?: { quiet?: boolean }): Promise<void>;
   /** replace an event's moved dates (and cancelled dates, when given) at once, keeping any staged draft; quiet: no member push for it */
   setEventMovedDates(id: string, moved: CalEvent['movedDates'], cancelledDates?: string[], opts?: { quiet?: boolean }): Promise<void>;
   /** Cancels the RSVPs for one date of an event (they get the "cancelled" email). Returns how many. */

package/src/lib/scheduler.ts

@@ -6,10 +6,12 @@ import { dispatchEmail } from './email/service';
 import { decideOverdue, sendDueReminders, sweepWaitlist } from './booking/service';
 import { runPushJobs } from './push/service';
 import { runAnnouncementJobs } from './announcements/service';
+import { pruneRequests } from './calendar/request-service';
 import { GUEST_IDLE_MS } from './mobile/guest-store';
 import { pushHeartbeat, pushUrlFor } from './monitoring';
 import { syncCachePurge } from './cache/purge';
 import { runOffsiteBackup } from './backup/offsite';
+import { syncGoogle } from './calendar/google/service';
 
 // All work is awaited on both hosts. Traffic-triggered fallbacks do not mark
 // this heartbeat: monitoring must prove the independent scheduler ran.
@@ -20,6 +22,8 @@ export async function runScheduledTasks(repo: ContentRepository, locals?: unknow
     publish: () => repo.publishDuePosts(startedAt),
     // changes to published events (scheduled publishing above included): webhooks, change pushes, redirects
     events: () => flushEventChanges(repo),
+    // two-way Google Calendar sync: site changes go out every run, each link reads Google every 2 minutes
+    gcal: () => syncGoogle(repo, locals, { now: startedAt }),
     webhooks: () => processDueDeliveries(repo),
     reminders: () => sendDueReminders(repo, { origin: settings.siteUrl, locals, now: startedAt }),
     // pending bookings past their approval deadline (Calendar settings → Bookings)
@@ -32,6 +36,8 @@ export async function runScheduledTasks(repo: ContentRepository, locals?: unknow
     announcements: () => runAnnouncementJobs(repo, { locals, now: startedAt }),
     // queued first-publish notices, starting-soon reminders, receipts, retention
     push: () => runPushJobs(repo, { locals, now: startedAt }),
+    // event requests past Calendar → Requests' retention (after the answer, or after arriving if nobody answered)
+    requests: () => pruneRequests(repo, startedAt),
     // expired guest sign-in codes and app sessions unused for 90 days
     guests: () => repo.guests.purge(GUEST_IDLE_MS, startedAt).then(() => 0),
     // clear shared caches after scheduled publishes, and retry a purge that

package/src/lib/schema.ts

@@ -406,8 +406,10 @@ export type EventRequest = z.infer<typeof EventRequest>;
 //   on (C3/C4); `data` holds the move.
 // `userId` is the member who asked; `requester` is the person without an
 // account (never both). `note` is their own words to staff, `reply` staff's
-// last answer. Decided rows (and withdrawn ones, which set reviewedAt too)
-// are deleted some days after `reviewedAt` (CalendarSettings.requests).
+// last answer. `data.sent` on new and change requests is a hash of what was
+// sent (a retry must match it). Rows are deleted some days after
+// `reviewedAt` (withdrawing sets it too), or after `createdAt` while nobody
+// answered (CalendarSettings.requests).
 export const RequestKind = z.enum(['new', 'change', 'move', 'from-date']);
 export type RequestKind = z.infer<typeof RequestKind>;
 export const RequestState = z.enum(['pending', 'approved', 'declined', 'withdrawn']);
@@ -651,6 +653,44 @@ export type ApprovalRules = z.infer<typeof ApprovalRules>;
 export const EventImageUrl = z.string().trim().max(2000).refine((value) => !value || Boolean(safeEventImageUrl(value)), 'Choose an image or use an http(s) URL or site-relative image path.');
 
 // Site-wide calendar preferences (Calendar settings → Defaults / Bookings)
+// Event requests from people without an account (acms({ requests }),
+// lib/calendar/request-service.ts), set on Calendar → Requests. A type is
+// what people pick under "Kind" (Class, Meeting…): approving a request makes
+// a draft with its tag, in its calendar.
+export const RequestType = z.object({
+  id: z.string().regex(/^[a-z0-9][a-z0-9-]{0,39}$/),
+  label: z.string().min(1).max(60),
+  // the label in each other site language
+  translations: z.record(z.string().max(60)).default({}),
+  // what an approved draft gets: this tag ('' = none), this calendar ('' = the default calendar)
+  tag: z.string().max(60).default(''),
+  calendarId: z.string().default(''),
+});
+export type RequestType = z.infer<typeof RequestType>;
+export const RequestWords = z.object({ replyTime: z.string().max(60).default(''), notice: z.string().max(400).default('') });
+export const RequestSettings = z.object({
+  // closed: the form says so (with the phone number) and new requests are refused
+  open: z.boolean().default(true),
+  types: z.array(RequestType).max(12).default([]),
+  // "We usually answer within {replyTime}" ("3 days"); '' leaves the sentence out
+  replyTime: z.string().max(60).default(''),
+  // the form's opening line ('' = the built-in "It isn't on the calendar until…")
+  notice: z.string().max(400).default(''),
+  // replyTime and notice in each other site language
+  translations: z.record(RequestWords).default({}),
+  // the office phone, shown when requests are closed and on "Request sent"
+  phone: z.string().max(40).default(''),
+  // who hears about new requests; [] = acms({ members.notify }), else the owners
+  notify: z.array(z.string().max(254)).max(20).default([]),
+  // staff on that list who linked a phone also get a push (with no details)
+  phones: z.boolean().default(false),
+  // new requests a day from the app and the website together; 0 = no cap
+  perDay: z.number().int().min(0).max(10000).default(100),
+  // requests are deleted this many days after the answer (or after they arrived, if nobody answered)
+  keepDays: z.number().int().min(7).max(1095).default(180),
+});
+export type RequestSettings = z.infer<typeof RequestSettings>;
+
 export const CalendarSettings = z.object({
   // Display-only fallback: event covers remain empty until an image is explicitly chosen.
   eventFallbackImage: EventImageUrl.default(''),
@@ -663,6 +703,7 @@ export const CalendarSettings = z.object({
   approvalRules: ApprovalRules.default({}),
   // show bookings on the Schedule grid
   showBookings: z.boolean().default(true),
+  requests: RequestSettings.default({}),
 });
 export type CalendarSettings = z.infer<typeof CalendarSettings>;
 

package/src/lib/sealed.ts

@@ -0,0 +1,46 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+import { env } from './env';
+import { ApiError } from './api';
+
+// Credentials for connected services (YouTube/Twitch live video, Google
+// Calendar) are sealed with AES-256-GCM under a key derived from
+// LIVE_ENCRYPTION_KEY, else SESSION_SECRET. Each service has its own domain:
+// a different derived key and associated data, so one service's ciphertext
+// never opens as another's. `context` narrows it further (a provider, a
+// pending OAuth state).
+export interface Sealer {
+  ready(locals?: unknown): boolean;
+  encrypt(value: unknown, context: string, locals?: unknown): string;
+  decrypt<T>(encrypted: string, context: string, locals?: unknown): T;
+}
+
+/** `what` names the credentials in the errors people see ("live credentials"). */
+export function sealer(domain: string, what: string): Sealer {
+  function key(locals?: unknown) {
+    const runtime = (locals as { runtime?: { env?: Record<string, unknown> } } | undefined)?.runtime?.env;
+    const secret = String(runtime?.LIVE_ENCRYPTION_KEY || env('LIVE_ENCRYPTION_KEY') || runtime?.SESSION_SECRET || env('SESSION_SECRET'));
+    if (secret.length < 32) throw new ApiError(503, `Set LIVE_ENCRYPTION_KEY or SESSION_SECRET to at least 32 random characters on your host before storing ${what}.`);
+    return createHash('sha256').update(`acms:${domain}:v1:${secret}`).digest();
+  }
+  return {
+    ready(locals) { try { key(locals); return true; } catch { return false; } },
+    encrypt(value, context, locals) {
+      const iv = randomBytes(12), cipher = createCipheriv('aes-256-gcm', key(locals), iv);
+      cipher.setAAD(Buffer.from(`acms:${domain}:${context}`));
+      const data = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
+      return [iv, cipher.getAuthTag(), data].map(v => v.toString('base64url')).join('.');
+    },
+    decrypt<T>(encrypted: string, context: string, locals?: unknown): T {
+      try {
+        const parts = encrypted.split('.');
+        if (parts.length !== 3) throw new Error();
+        const [iv, tag, data] = parts.map(v => Buffer.from(v, 'base64url'));
+        const cipher = createDecipheriv('aes-256-gcm', key(locals), iv);
+        cipher.setAAD(Buffer.from(`acms:${domain}:${context}`)); cipher.setAuthTag(tag);
+        return JSON.parse(Buffer.concat([cipher.update(data), cipher.final()]).toString('utf8'));
+      } catch { throw new ApiError(503, `Saved ${what} cannot be decrypted. Re-enter the credentials and reconnect.`); }
+    },
+  };
+}
+export const hash = (value: string) => createHash('sha256').update(value).digest('hex');
+export const randomToken = () => randomBytes(32).toString('base64url');

package/src/pages/admin/calendar/events/[id].astro

@@ -14,6 +14,8 @@ import { accessFor, forbiddenUnless } from '../../../../lib/permissions/access';
 import type { Permission } from '../../../../lib/permissions/catalog';
 import { ApiError } from '../../../../lib/api';
 import { roleLabel } from '../../../../lib/roles';
+import { eventClashes } from '../../../../lib/booking/holds';
+import { fieldWord } from '../../../../lib/calendar/google/map';
 import ThemeScript from '../../../../components/ThemeScript.astro';
 import ClerkSession from '../../../../components/auth/ClerkSession.astro';
 import Modal from '../../../../components/Modal.astro';
@@ -92,7 +94,20 @@ const hosts = event.hostIds.map((id) => ({ id, name: nameOf(id) })).filter((h) =
 const people = [...users].sort((a, b) => (a.name || a.email).localeCompare(b.name || b.email));
 const notice = Astro.url.searchParams.get('notice') ?? '';
 const error = Astro.url.searchParams.get('error') ?? '';
-const showBar = Boolean(req) || canEdit || hosts.length > 0 || Boolean(notice || error);
+// Synced with Google (lib/calendar/google/): which Google calendars have a copy, the latest
+// field both sides changed (the site kept its value; "Use Google's version" takes Google's),
+// whether the description still comes from Google (Q8), and room clashes a change from Google made
+const gItems = (await repo.gcal.itemsForEvent(event.id)).filter((i) => i.kind !== 'segment' && !i.gone);
+const gLinks = gItems.length ? new Map((await repo.gcal.listLinks()).map((l) => [l.id, l])) : new Map();
+const synced = gItems.map((i) => ({ ...i, googleName: gLinks.get(i.linkId)?.googleName ?? 'Google' }));
+const gConflict = synced.map((i) => i.conflict).filter((c): c is NonNullable<typeof c> => !!c).sort((a, b) => b.at - a.at)[0] ?? null;
+const gDescFromGoogle = synced.some((i) => i.descGoogle);
+const gTz = settings.timezone || 'UTC';
+const gTime = (ts: number) => new Intl.DateTimeFormat(settings.locale || 'en', { month: 'short', day: 'numeric', hour: 'numeric', minute: '2-digit', timeZone: gTz }).format(ts);
+const gClashes = synced.length && event.status === 'published' && !event.cancelled && event.roomHold.resourceIds.length
+  ? (await eventClashes(repo, settings, event, { horizonDays: 120 }).catch(() => ({ clashes: [] }))).clashes : [];
+const gRooms = gClashes.length ? new Map((await repo.listResources()).map((r) => [r.id, r.name])) : new Map<string, string>();
+const showBar = Boolean(req) || canEdit || hosts.length > 0 || Boolean(notice || error) || synced.length > 0;
 const ago = (ts: number) => {
   const s = Math.max(0, Math.floor((Date.now() - ts) / 1000));
   if (s < 60) return 'just now';
@@ -162,6 +177,27 @@ const approveLabel = pending?.kind === 'changes' ? 'Approve changes' : isLive ?
             {declined.kind === 'new' && !isLive && ` It stays a draft until ${requester} sends it again.`}
           </p>
         )}
+        {synced.length > 0 && (
+          <div class="evreq-gcal">
+            <p class="evreq-line">
+              <span class="evreq-label">Synced with Google</span>
+              {synced.map((i) => <span class="evreq-chip">{i.googleName}{i.syncedAt ? ` · ${gTime(i.syncedAt)}` : ''}{i.htmlLink && <> · <a href={i.htmlLink} target="_blank" rel="noopener">Open in Google ↗</a></>}</span>)}
+            </p>
+            {gConflict && (
+              <div class="evreq-gcal-clash">
+                <span>Changed in both places at {gTime(gConflict.at)}. The site kept its {fieldWord(gConflict.field).toLowerCase()}, “{gConflict.site}”. Google had “{gConflict.google}”.</span>
+                {(canPublish || access?.can('schedule.manage')) && (
+                  <form method="post" action="/admin/calendar/google" data-evreq>
+                    <input type="hidden" name="op" value="use" /><input type="hidden" name="log" value={gConflict.logId} /><input type="hidden" name="return" value={self} />
+                    <button class="btn sm" type="submit">Use Google’s version</button>
+                  </form>
+                )}
+              </div>
+            )}
+            {gDescFromGoogle && <p class="evreq-muted">Created in Google. Its description comes from Google until someone edits it here.</p>}
+            {gClashes.length > 0 && <p class="evreq-gcal-room">Room clash: {gRooms.get(gClashes[0].hold.resourceId) ?? 'a room'} is also held by “{gClashes[0].other.title}” on {gTime(gClashes[0].hold.eventStart)}{gClashes.length > 1 ? ` (and ${gClashes.length - 1} more)` : ''}. Changes from Google keep their rooms: check Bookings.</p>}
+          </div>
+        )}
         <div class="evreq-hosts">
           <span class="evreq-label">Hosts</span>
           {hosts.length ? hosts.map((h) => <span class="evreq-chip">{h.name}</span>) : <span class="evreq-muted">None</span>}
@@ -306,6 +342,11 @@ const approveLabel = pending?.kind === 'changes' ? 'Approve changes' : isLive ?
   .evreq-hosts { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; margin-left: auto; }
   .evreq-label { font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.07em; color: var(--muted); margin-right: 2px; }
   .evreq-chip { font-size: 12px; font-weight: 500; color: var(--text-2); background: var(--panel); border: 1px solid var(--line); border-radius: var(--r-full); padding: 1px 9px; white-space: nowrap; }
+  .evreq-gcal { flex: 1 1 480px; min-width: 0; display: flex; flex-direction: column; gap: 4px; }
+  .evreq-gcal .evreq-chip a { color: var(--accent-deep); }
+  .evreq-gcal-clash { display: flex; flex-wrap: wrap; align-items: center; gap: 6px 12px; color: var(--text); }
+  .evreq-gcal-clash form { margin: 0; }
+  .evreq-gcal-room { color: var(--red); }
   .evreq-modal-hint { margin: 0 0 12px; }
   .evreq-find { width: 100%; margin-bottom: 10px; }
   .evreq-people { max-height: min(320px, 50vh); overflow-y: auto; margin: 0 -4px; padding: 2px 4px; }

package/src/pages/admin/calendar/events/index.astro

@@ -25,6 +25,7 @@ import { approveEventRequest, declineEventRequest, pendingRequests } from '../..
 import { approveDateRequest, dateRequestClashes, dateRequestTimes, declineDateRequest, type MoveRequestData } from '../../../../lib/calendar/host-requests';
 import { mergeEventDraft } from '../../../../lib/drafts';
 import { ApiError } from '../../../../lib/api';
+import { REQUESTS } from '../../../../lib/calendar/request-config';
 
 // Schedule → List: upcoming first, grouped by the month each event next
 // happens. Subscribed calendars appear as read-only rows with a "Make an
@@ -527,6 +528,7 @@ const subBits = [
               ))}
             </section>
           )}
+          {REQUESTS.enabled && <p class="hint">Every request, including those from the app and the website, is on <a href="/admin/calendar/requests">Requests</a>.</p>}
           {(requestRows.length > 0 || dateRows.length > 0) && !canApprove && <p class="hint">Someone whose role can publish content approves these.</p>}
           {canApprove && dateRows.map((r) => (
             <Modal id={`decline-date-${r.id}`} title="Decline this date change">