@odla-ai/cli 0.8.0 → 0.10.0

package/dist/index.cjs

@@ -33,8 +33,16 @@ var index_exports = {};
 __export(index_exports, {
   AGENT_HARNESSES: () => AGENT_HARNESSES,
   CAPABILITIES: () => CAPABILITIES,
+  GOOGLE_CALENDAR_READ_SCOPE: () => GOOGLE_CALENDAR_READ_SCOPE,
   SYSTEM_AI_PURPOSES: () => SYSTEM_AI_PURPOSES,
   adminAi: () => adminAi,
+  calendarBookingPageUrl: () => calendarBookingPageUrl,
+  calendarCalendars: () => calendarCalendars,
+  calendarConnect: () => calendarConnect,
+  calendarDisconnect: () => calendarDisconnect,
+  calendarResync: () => calendarResync,
+  calendarServiceConfig: () => calendarServiceConfig,
+  calendarStatus: () => calendarStatus,
   connectGitHubSecuritySource: () => connectGitHubSecuritySource,
   disconnectGitHubSecuritySource: () => disconnectGitHubSecuritySource,
   doctor: () => doctor,
@@ -57,6 +65,8 @@ __export(index_exports, {
   runCli: () => runCli,
   runHostedSecurity: () => runHostedSecurity,
   secretsPush: () => secretsPush,
+  secretsSet: () => secretsSet,
+  secretsSetClerkKey: () => secretsSetClerkKey,
   smoke: () => smoke,
   startHostedSecurityJob: () => startHostedSecurityJob
 });
@@ -67,7 +77,7 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/admin-ai.ts
-var import_node_process4 = __toESM(require("process"), 1);
+var import_node_process5 = __toESM(require("process"), 1);
 
 // src/token.ts
 var import_db = require("@odla-ai/db");
@@ -297,9 +307,32 @@ function platformAudience(value) {
   return url.origin;
 }
 
+// src/secret-input.ts
+var import_node_process3 = __toESM(require("process"), 1);
+var MAX_BYTES = 64 * 1024;
+async function secretInputValue(options, kind = "credential") {
+  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
+  let value;
+  if (options.fromEnv) value = import_node_process3.default.env[options.fromEnv];
+  else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();
+  else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
+  value = value?.replace(/[\r\n]+$/, "");
+  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : `stdin ${kind} is empty`);
+  if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+  return value;
+}
+async function readSecretStream(kind, stream = import_node_process3.default.stdin) {
+  let value = "";
+  for await (const chunk of stream) {
+    value += String(chunk);
+    if (value.length > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+  }
+  return value;
+}
+
 // src/admin-ai-auth.ts
 var import_node_fs2 = require("fs");
-var import_node_process3 = __toESM(require("process"), 1);
+var import_node_process4 = __toESM(require("process"), 1);
 var import_db2 = require("@odla-ai/db");
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -307,7 +340,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = import_node_process3.default.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = import_node_process4.default.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -319,7 +352,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = import_node_process3.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = import_node_process4.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -329,7 +362,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const tokenFile = options.tokenFile ?? `${import_node_process3.default.cwd()}/.odla/admin-token.local.json`;
+  const tokenFile = options.tokenFile ?? `${import_node_process4.default.cwd()}/.odla/admin-token.local.json`;
   const cache = readJsonFile(tokenFile);
   const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -344,13 +377,13 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     onCode: async ({ userCode, expiresIn }) => {
       const approvalUrl = handshakeUrl(audience, userCode);
       out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      const shouldOpen = options.open === true || options.open !== false && !import_node_process3.default.env.CI && Boolean(import_node_process3.default.stdin.isTTY && import_node_process3.default.stdout.isTTY);
+      const shouldOpen = options.open === true || options.open !== false && !import_node_process4.default.env.CI && Boolean(import_node_process4.default.stdin.isTTY && import_node_process4.default.stdout.isTTY);
       if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
     }
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
   tokens[scope] = { token, expiresAt };
-  if ((0, import_node_fs2.existsSync)(`${import_node_process3.default.cwd()}/.git`)) ensureGitignore(import_node_process3.default.cwd(), [tokenFile]);
+  if ((0, import_node_fs2.existsSync)(`${import_node_process4.default.cwd()}/.git`)) ensureGitignore(import_node_process4.default.cwd(), [tokenFile]);
   writePrivateJson(tokenFile, { platform: audience, tokens });
   out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   return token;
@@ -511,7 +544,7 @@ function isRecord2(value) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? import_node_process4.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? import_node_process5.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -550,7 +583,7 @@ async function adminAi(options) {
   }
   if (options.action === "credential-set") {
     const provider = requireProvider(options.credentialProvider);
-    const value = await credentialValue(options);
+    const value = await secretInputValue(options);
     const res2 = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {
       method: "PUT",
       headers,
@@ -660,25 +693,6 @@ function requireProvider(value) {
   }
   return value;
 }
-async function credentialValue(options) {
-  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
-  let value;
-  if (options.fromEnv) value = import_node_process4.default.env[options.fromEnv];
-  else if (options.stdin) value = await (options.readStdin ?? readStdin)();
-  else throw new Error("credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments");
-  value = value?.replace(/[\r\n]+$/, "");
-  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : "stdin credential is empty");
-  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error("credential exceeds 64 KiB");
-  return value;
-}
-async function readStdin() {
-  let value = "";
-  for await (const chunk of import_node_process4.default.stdin) {
-    value += String(chunk);
-    if (value.length > 64 * 1024) throw new Error("credential exceeds 64 KiB");
-  }
-  return value;
-}
 function policyArray(body) {
   if (isRecord3(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord3);
   if (isRecord3(body) && isRecord3(body.policies)) return Object.values(body.policies).filter(isRecord3);
@@ -848,7 +862,9 @@ var CAPABILITIES = {
     "register the app and enable configured services per environment",
     "issue, persist, and explicitly rotate configured service credentials",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
     "push db schema/rules and configure platform AI, auth, and deployment links",
+    "apply read-only Google calendar mirror and public booking-page config, then drive state-bound consent, status, discovery, resync, and disconnect flows",
     "validate config offline and smoke-test a provisioned db environment",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -857,10 +873,12 @@ var CAPABILITIES = {
   agent: [
     "install and import the selected odla SDKs",
     "wrap the Worker with withObservability and choose useful telemetry",
-    "make application-specific schema, rules, auth, UI, and migration decisions"
+    "make application-specific schema, rules, auth, UI, and migration decisions",
+    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
   ],
   human: [
     "approve the odla device code and one-off third-party logins",
+    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
     "consent to production changes with --yes",
     "request destructive credential rotation explicitly",
     "review application semantics, security findings, releases, and merges",
@@ -869,6 +887,7 @@ var CAPABILITIES = {
   ],
   studio: [
     "view telemetry and environment state",
+    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
     "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
     "configure system AI purposes and view app/environment/run-attributed usage",
     "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
@@ -898,6 +917,7 @@ var import_node_url = require("url");
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
+var GOOGLE_CALENDAR_READ_SCOPE = "https://www.googleapis.com/auth/calendar.events.readonly";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
   const resolved = (0, import_node_path2.resolve)(configPath);
   if (!(0, import_node_fs3.existsSync)(resolved)) {
@@ -910,6 +930,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
   const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  validateCalendarConfig(raw, envs, services, resolved);
   const local = {
     tokenFile: (0, import_node_path2.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
     credentialsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
@@ -954,6 +975,28 @@ function buildPlan(cfg) {
     aiProvider: cfg.ai?.provider
   };
 }
+function calendarServiceConfig(cfg, env) {
+  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
+  if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
+  const google = cfg.calendar?.google;
+  if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
+  return {
+    provider: "google",
+    access: "read",
+    calendars: unique(google.calendars[env].map((id) => id.trim())),
+    match: {
+      organizerSelf: google.match?.organizerSelf ?? true,
+      requireAttendees: google.match?.requireAttendees ?? true,
+      ...google.match?.summaryPrefix !== void 0 ? { summaryPrefix: google.match.summaryPrefix.trim() } : {}
+    },
+    attendeePolicy: google.attendeePolicy ?? "full"
+  };
+}
+function calendarBookingPageUrl(cfg, env) {
+  const value = cfg.calendar?.google.bookingPageUrl?.[env];
+  if (value === void 0 || value === null) return value;
+  return new URL(value).toString();
+}
 function rulesFromSchema(schema) {
   const entities = serializedEntities(schema);
   return Object.fromEntries(
@@ -977,7 +1020,85 @@ function validateRawConfig(raw, path) {
   if (!cfg.app || typeof cfg.app !== "object") throw new Error(`${path}: missing app object`);
   if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
   if (!cfg.app.name || typeof cfg.app.name !== "string") throw new Error(`${path}: app.name is required`);
+  if (cfg.envs !== void 0 && (!Array.isArray(cfg.envs) || cfg.envs.some((env) => typeof env !== "string"))) {
+    throw new Error(`${path}: envs must be an array of names`);
+  }
   if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
+  if (cfg.services !== void 0 && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== "string" || !service.trim()))) {
+    throw new Error(`${path}: services must be an array of non-empty names`);
+  }
+}
+function validateCalendarConfig(cfg, envs, services, path) {
+  const enabled = services.includes("calendar");
+  if (!cfg.calendar) {
+    if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
+    return;
+  }
+  if (!isRecord4(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
+  if (!isRecord4(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  const google = cfg.calendar.google;
+  assertOnly(google, ["calendars", "bookingPageUrl", "match", "attendeePolicy"], `${path}: calendar.google`);
+  if (!isRecord4(google.calendars)) throw new Error(`${path}: calendar.google.calendars must map env names to calendar ids`);
+  const unknownEnv = Object.keys(google.calendars).find((env) => !envs.includes(env));
+  if (unknownEnv) throw new Error(`${path}: calendar.google.calendars.${unknownEnv} is not in config envs`);
+  for (const env of envs) {
+    const ids = google.calendars[env];
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.calendars.${env} must be a non-empty array`);
+    }
+    if (ids.length > 10) {
+      throw new Error(`${path}: calendar.google.calendars.${env} must contain at most 10 calendar ids`);
+    }
+    if (ids.some((id) => !safeText(id, 1024))) {
+      throw new Error(`${path}: calendar.google.calendars.${env} contains an invalid calendar id`);
+    }
+  }
+  if (google.bookingPageUrl !== void 0) {
+    if (!isRecord4(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value] of Object.entries(google.bookingPageUrl)) {
+      if (value !== null && !safeHttpsUrl(value)) {
+        throw new Error(`${path}: calendar.google.bookingPageUrl.${env} must be an HTTPS URL without credentials or fragment`);
+      }
+    }
+  }
+  if (google.attendeePolicy !== void 0 && google.attendeePolicy !== "full" && google.attendeePolicy !== "hashed") {
+    throw new Error(`${path}: calendar.google.attendeePolicy must be "full" or "hashed"`);
+  }
+  if (google.match !== void 0) {
+    if (!isRecord4(google.match)) throw new Error(`${path}: calendar.google.match must be an object`);
+    assertOnly(google.match, ["summaryPrefix", "organizerSelf", "requireAttendees"], `${path}: calendar.google.match`);
+    if (google.match.summaryPrefix !== void 0 && !safeText(google.match.summaryPrefix, 256)) {
+      throw new Error(`${path}: calendar.google.match.summaryPrefix must be 1-256 printable characters`);
+    }
+    for (const name of ["organizerSelf", "requireAttendees"]) {
+      if (google.match[name] !== void 0 && typeof google.match[name] !== "boolean") {
+        throw new Error(`${path}: calendar.google.match.${name} must be boolean`);
+      }
+    }
+  }
+  if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
+}
+function assertOnly(value, allowed, label) {
+  const extra = Object.keys(value).find((key) => !allowed.includes(key));
+  if (extra) throw new Error(`${label}.${extra} is not supported`);
+}
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function safeText(value, max) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+}
+function safeHttpsUrl(value) {
+  if (typeof value !== "string" || value.length > 2048) return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password && !url.hash;
+  } catch {
+    return false;
+  }
 }
 function validId(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
@@ -996,11 +1117,6 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
-// src/doctor-checks.ts
-var import_node_child_process3 = require("child_process");
-var import_node_fs5 = require("fs");
-var import_node_path4 = require("path");
-
 // src/redact.ts
 var REPLACEMENTS = [
   [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
@@ -1020,6 +1136,426 @@ function looksSecret(value) {
   return redactSecrets(value) !== value || value.includes("-----BEGIN");
 }
 
+// src/calendar-http.ts
+var CALENDAR_STATES = [
+  "not_connected",
+  "authorizing",
+  "needs_sync",
+  "initial_sync",
+  "healthy",
+  "degraded",
+  "disconnected",
+  "failed"
+];
+async function readCalendarStatus(ctx) {
+  return parseCalendarStatus(await calendarJson(ctx, "", {}), ctx.env);
+}
+async function discoverGoogleCalendars(ctx) {
+  const raw = await calendarJson(ctx, "/calendars", {});
+  const value = record(raw);
+  if (!value || !Array.isArray(value.calendars)) throw new Error("calendar discovery returned an invalid response");
+  return value.calendars.map((item, index) => {
+    const calendar = record(item);
+    const id = textField(calendar?.id, 1024);
+    if (!calendar || !id) throw new Error(`calendar discovery returned an invalid calendar at index ${index}`);
+    const role = calendar.accessRole;
+    if (role !== void 0 && role !== "freeBusyReader" && role !== "reader" && role !== "writer" && role !== "owner") {
+      throw new Error(`calendar discovery returned an invalid access role at index ${index}`);
+    }
+    return {
+      id,
+      ...optionalText("summary", calendar.summary, 500),
+      ...typeof calendar.primary === "boolean" ? { primary: calendar.primary } : {},
+      ...typeof calendar.selected === "boolean" ? { selected: calendar.selected } : {},
+      ...typeof role === "string" ? { accessRole: role } : {}
+    };
+  });
+}
+async function applyCalendarSettings(ctx, bookingPageUrl) {
+  return parseCalendarStatus(await calendarJson(ctx, "", { method: "PUT", body: JSON.stringify({ bookingPageUrl }) }), ctx.env);
+}
+async function startCalendarConnection(ctx) {
+  const raw = await calendarJson(ctx, "/google/connect", { method: "POST", body: "{}" });
+  const value = wrapped(raw, "attempt");
+  const attemptId = textField(value.attemptId, 180);
+  const consentUrl = textField(value.consentUrl, 4096);
+  const expiresAt = timestamp3(value.expiresAt);
+  if (!attemptId || !consentUrl || expiresAt === void 0) throw new Error("calendar connect returned an invalid attempt");
+  return { attemptId, consentUrl, expiresAt };
+}
+async function pollCalendarConnection(ctx, attemptId) {
+  return parseCalendarStatus(
+    await calendarJson(ctx, `/google/connect/${encodeURIComponent(identifier(attemptId, "attemptId"))}`, {}),
+    ctx.env
+  );
+}
+async function requestCalendarResync(ctx) {
+  return parseCalendarStatus(await calendarJson(ctx, "/resync", { method: "POST", body: "{}" }), ctx.env);
+}
+async function requestCalendarDisconnect(ctx) {
+  return parseCalendarStatus(
+    await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
+    ctx.env
+  );
+}
+function parseCalendarStatus(raw, env) {
+  const outer = wrapped(raw, "calendar");
+  const value = record(outer.attempt) ?? record(outer.status) ?? outer;
+  const connection = record(value.connection) ?? {};
+  const sync = record(value.sync) ?? record(connection.sync) ?? {};
+  const config = record(value.config) ?? record(outer.config) ?? {};
+  const googleConfig = record(config.google) ?? config;
+  const watches = record(value.watches) ?? {};
+  const stateValue = calendarState(value.status ?? value.state ?? connection.status ?? connection.state);
+  if (!stateValue) {
+    throw new Error("calendar status returned an invalid connection state");
+  }
+  const providerValue = value.provider ?? connection.provider ?? config.provider ?? (config.google ? "google" : void 0);
+  if (providerValue !== void 0 && providerValue !== null && providerValue !== "google") {
+    throw new Error("calendar status returned an unsupported provider");
+  }
+  const accessValue = value.access ?? connection.access ?? config.access ?? googleConfig.access;
+  if (accessValue !== void 0 && accessValue !== "read") throw new Error("calendar status returned unsupported access");
+  const policyValue = value.attendeePolicy ?? config.attendeePolicy ?? googleConfig.attendeePolicy;
+  if (policyValue !== void 0 && policyValue !== "full" && policyValue !== "hashed") {
+    throw new Error("calendar status returned an invalid attendee policy");
+  }
+  const errorValue = record(value.error) ?? record(connection.error);
+  const errorCode = textField(value.lastErrorCode, 128);
+  const bookingPageValue = Object.hasOwn(value, "bookingPageUrl") ? value.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
+  return {
+    env,
+    enabled: typeof value.enabled === "boolean" ? value.enabled : true,
+    connected: typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["needs_sync", "initial_sync", "healthy", "degraded"].includes(stateValue),
+    provider: providerValue === "google" ? "google" : null,
+    status: stateValue,
+    ...accessValue === "read" ? { access: "read" } : {},
+    calendars: calendarIds(value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars),
+    ...policyValue === "full" || policyValue === "hashed" ? { attendeePolicy: policyValue } : {},
+    ...typeof value.attendeePolicyLocked === "boolean" ? { attendeePolicyLocked: value.attendeePolicyLocked } : {},
+    ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
+    grantedScopes: stringList(value.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
+    ...optionalText("attemptId", value.attemptId ?? connection.attemptId, 180),
+    ...optionalNumber("lastSuccessfulSyncAt", value.lastSuccessfulSyncAt ?? sync.lastSuccessfulSyncAt),
+    ...optionalNumber("lastFullSyncAt", value.lastFullSyncAt ?? sync.lastFullSyncAt),
+    ...optionalNumber("watchExpiresAt", value.watchExpiresAt ?? sync.watchExpiresAt ?? watches.nextExpirationAt),
+    ...optionalInteger("bookingCount", value.bookingCount ?? sync.bookingCount),
+    ...errorValue || errorCode ? { error: {
+      ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
+      ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
+      ...!errorValue && errorCode ? { code: errorCode } : {}
+    } } : {}
+  };
+}
+function calendarState(value) {
+  if (typeof value !== "string") return null;
+  if (CALENDAR_STATES.includes(value)) return value;
+  const legacy = {
+    disabled: "not_connected",
+    disconnected: "disconnected",
+    connecting: "authorizing",
+    syncing: "initial_sync",
+    ready: "healthy",
+    error: "failed"
+  };
+  return legacy[value] ?? null;
+}
+async function calendarJson(ctx, suffix, init) {
+  const platform = platformAudience(ctx.platform);
+  const appId = identifier(ctx.appId, "appId");
+  const env = identifier(ctx.env, "env");
+  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/calendar${suffix}`, platform);
+  url.searchParams.set("env", env);
+  const token = credential(ctx.token);
+  let response;
+  try {
+    response = await (ctx.fetch ?? fetch)(url, {
+      ...init,
+      redirect: "error",
+      credentials: "omit",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init.headers }
+    });
+  } catch (error) {
+    throw new Error(`calendar request failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const code = textField(body.error?.code, 128);
+    const message = textField(body.error?.message, 500);
+    throw new Error(redactSecrets(`calendar request failed (${response.status})${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`));
+  }
+  return body;
+}
+function wrapped(raw, key) {
+  const outer = record(raw);
+  if (!outer) throw new Error("calendar returned an invalid response");
+  return record(outer[key]) ?? outer;
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function textField(value, max) {
+  return typeof value === "string" && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value) ? value : void 0;
+}
+function stringList(value) {
+  return Array.isArray(value) ? [...new Set(value.filter((item) => !!textField(item, 4096)))] : [];
+}
+function calendarIds(value) {
+  if (!Array.isArray(value)) return [];
+  return [...new Set(value.flatMap((item) => {
+    if (typeof item === "string") return textField(item, 4096) ? [item] : [];
+    const calendar = record(item);
+    const id = textField(calendar?.id, 4096);
+    return id && calendar?.selected !== false ? [id] : [];
+  }))];
+}
+function timestamp3(value) {
+  if (typeof value === "number" && Number.isFinite(value) && value >= 0) return value;
+  if (typeof value === "string") {
+    const parsed = Date.parse(value);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return void 0;
+}
+function optionalText(key, value, max) {
+  const parsed = textField(value, max);
+  return parsed ? { [key]: parsed } : {};
+}
+function optionalNumber(key, value) {
+  const parsed = timestamp3(value);
+  return parsed === void 0 ? {} : { [key]: parsed };
+}
+function optionalInteger(key, value) {
+  return Number.isSafeInteger(value) && value >= 0 ? { [key]: value } : {};
+}
+function optionalNullableUrl(key, value) {
+  if (value === null) return { [key]: null };
+  const parsed = textField(value, 4096);
+  return parsed ? { [key]: parsed } : {};
+}
+function identifier(value, name) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,179}$/.test(value)) throw new Error(`${name} is invalid`);
+  return value;
+}
+function credential(value) {
+  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error("calendar requires an odla developer token");
+  }
+  return value;
+}
+
+// src/calendar-poll.ts
+async function waitForCalendarPoll(milliseconds, signal) {
+  if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
+  await new Promise((resolve7, reject) => {
+    const timer = setTimeout(resolve7, milliseconds);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      reject(signal.reason ?? new Error("calendar connection aborted"));
+    }, { once: true });
+  });
+}
+
+// src/calendar.ts
+async function calendarStatus(options) {
+  const { ctx, out } = await lifecycleContext(options);
+  const status = await readCalendarStatus(ctx);
+  printStatus(status, options.json === true, out);
+  return status;
+}
+async function calendarCalendars(options) {
+  const { ctx, out } = await lifecycleContext(options);
+  const calendars = await discoverGoogleCalendars(ctx);
+  if (options.json) out.log(JSON.stringify({ env: ctx.env, calendars }, null, 2));
+  else if (calendars.length === 0) out.log(`${ctx.env}: no Google calendars available`);
+  else for (const calendar of calendars) {
+    out.log(`${calendar.selected ? "\u2713" : calendar.primary ? "*" : " "} ${calendar.id}${calendar.summary ? ` \u2014 ${calendar.summary}` : ""}${calendar.accessRole ? ` (${calendar.accessRole})` : ""}`);
+  }
+  return calendars;
+}
+async function calendarConnect(options) {
+  const { cfg, ctx, out } = await lifecycleContext(options);
+  productionConsent(ctx.env, options.yes, "connect calendar");
+  const page = calendarBookingPageUrl(cfg, ctx.env);
+  const applied = page === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);
+  const connectOptions = connectionOptions(options, out);
+  return await continueConnectedCalendar(ctx, applied, connectOptions, false) ?? connectWithContext(ctx, connectOptions);
+}
+async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
+  if (bookingPageUrl === void 0) return null;
+  const status = await applyCalendarSettings(ctx, bookingPageUrl);
+  out.log(`${ctx.env}: calendar booking page ${bookingPageUrl ? "set" : "cleared"}`);
+  return status;
+}
+async function calendarResync(options) {
+  const { ctx, out } = await lifecycleContext(options);
+  productionConsent(ctx.env, options.yes, "resync calendar");
+  const status = await requestCalendarResync(ctx);
+  out.log(`${ctx.env}: calendar resync requested (${status.status})`);
+  return status;
+}
+async function calendarDisconnect(options) {
+  if (!options.yes) throw new Error("calendar disconnect requires --yes");
+  const { ctx, out } = await lifecycleContext(options);
+  const status = await requestCalendarDisconnect(ctx);
+  out.log(`${ctx.env}: calendar disconnected; retained mirror rows may now be stale`);
+  return status;
+}
+async function ensureCalendarConnected(ctx, options) {
+  const out = options.stdout ?? console;
+  const current = await readCalendarStatus(ctx);
+  const connectOptions = connectionOptions(options, out);
+  return await continueConnectedCalendar(ctx, current, connectOptions, true) ?? connectWithContext(ctx, connectOptions);
+}
+async function lifecycleContext(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
+  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  calendarServiceConfig(cfg, env);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      token: options.token,
+      open: options.open,
+      interactive: options.interactive,
+      openApprovalUrl: options.openConsentUrl
+    },
+    doFetch,
+    out
+  );
+  return { cfg, ctx: { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch }, out };
+}
+function connectionOptions(options, out) {
+  const browser = approvalBrowser({ configPath: "odla.config.mjs", open: options.open, interactive: options.interactive });
+  return {
+    out,
+    open: browser.open,
+    openConsentUrl: options.openConsentUrl,
+    wait: options.wait,
+    pollTimeoutMs: options.pollTimeoutMs,
+    now: options.now,
+    signal: options.signal
+  };
+}
+async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
+  if (current.status === "healthy" || reuseDegraded && current.status === "degraded") {
+    options.out.log(`${ctx.env}: calendar ${reuseDegraded ? "connected" : "already connected"} (${current.status})`);
+    return current;
+  }
+  if (current.status === "degraded") return null;
+  if (current.status === "needs_sync") {
+    if (!current.connected) return null;
+    options.out.log(`${ctx.env}: calendar configuration needs sync`);
+    const synced = await requestCalendarResync(ctx);
+    options.out.log(`${ctx.env}: calendar ${synced.status.replaceAll("_", " ")}`);
+    return synced;
+  }
+  if (current.status === "failed" && current.connected) {
+    const reason = current.error?.message ?? current.error?.code;
+    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+  }
+  const waitingForExisting = current.status === "authorizing" || current.status === "initial_sync" && current.connected;
+  if (!waitingForExisting) return null;
+  const now = options.now ?? Date.now;
+  const deadline = now() + pollTimeout(options.pollTimeoutMs);
+  const wait = options.wait ?? waitForCalendarPoll;
+  let prior = "";
+  while (now() < deadline) {
+    if (options.signal?.aborted) throw options.signal.reason ?? new Error("calendar connection aborted");
+    const status = await readCalendarStatus(ctx);
+    if (status.status !== prior) {
+      options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
+      prior = status.status;
+    }
+    if (status.status === "healthy" || reuseDegraded && status.status === "degraded") return status;
+    if (status.status === "degraded") return null;
+    if (status.status === "needs_sync") return requestCalendarResync(ctx);
+    if (status.status === "failed" && status.connected) {
+      const reason = status.error?.message ?? status.error?.code;
+      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+    }
+    if (status.status !== "authorizing" && (status.status !== "initial_sync" || !status.connected)) return null;
+    await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
+  }
+  throw new Error('Existing Google Calendar authorization or initial sync timed out; run "odla-ai calendar status" and retry');
+}
+async function connectWithContext(ctx, options) {
+  const attempt = await startCalendarConnection(ctx);
+  const consentUrl = trustedCalendarConsentUrl(ctx.platform, attempt.consentUrl);
+  options.out.log(`${ctx.env}: Google Calendar consent: ${consentUrl}`);
+  if (options.open) {
+    await (options.openConsentUrl ?? openUrl)(consentUrl);
+    options.out.log(`${ctx.env}: opened Google Calendar consent in your browser`);
+  }
+  const now = options.now ?? Date.now;
+  const timeout = pollTimeout(options.pollTimeoutMs);
+  const deadline = Math.min(attempt.expiresAt, now() + timeout);
+  const wait = options.wait ?? waitForCalendarPoll;
+  let prior = "";
+  while (now() < deadline) {
+    if (options.signal?.aborted) throw options.signal.reason ?? new Error("calendar connection aborted");
+    const status = await pollCalendarConnection(ctx, attempt.attemptId);
+    if (status.status !== prior) {
+      options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
+      prior = status.status;
+    }
+    if (status.status === "healthy" || status.status === "degraded") return status;
+    if (status.status === "failed" || status.status === "disconnected" || status.status === "not_connected") {
+      const reason = status.error?.message ?? status.error?.code;
+      throw new Error(`calendar connection ${status.status}${reason ? `: ${reason}` : ""}`);
+    }
+    await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
+  }
+  throw new Error('Google Calendar consent or initial sync timed out; run "odla-ai calendar status" and retry connect');
+}
+function trustedCalendarConsentUrl(platform, value) {
+  const origin = platformAudience(platform);
+  let url;
+  try {
+    url = value.startsWith("/") ? new URL(value, origin) : new URL(value);
+  } catch {
+    throw new Error("odla.ai returned an invalid calendar consent URL");
+  }
+  const platformPage = url.origin === origin;
+  const googlePage = url.origin === "https://accounts.google.com" && url.pathname === "/o/oauth2/v2/auth";
+  if (!platformPage && !googlePage || url.username || url.password || url.hash) {
+    throw new Error("odla.ai returned an untrusted calendar consent URL");
+  }
+  return url.toString();
+}
+function pollTimeout(value = 10 * 6e4) {
+  if (!Number.isSafeInteger(value) || value < 1e3 || value > 60 * 6e4) throw new Error("calendar poll timeout must be 1000-3600000ms");
+  return value;
+}
+function productionConsent(env, yes, action) {
+  if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action} for "${env}" without --yes`);
+}
+function printStatus(status, json, out) {
+  if (json) {
+    out.log(JSON.stringify(status, null, 2));
+    return;
+  }
+  out.log(`calendar: ${status.provider ?? "none"}/${status.status} (${status.env})`);
+  out.log(`  access: ${status.access ?? "not granted"}`);
+  out.log(`  calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
+  if (status.attendeePolicy) {
+    out.log(`  attendee policy: ${status.attendeePolicy}${status.attendeePolicyLocked ? " (locked)" : ""}`);
+  }
+  if (status.bookingPageUrl !== void 0) out.log(`  booking page: ${status.bookingPageUrl ?? "not configured"}`);
+  out.log(`  last sync: ${status.lastSuccessfulSyncAt === void 0 ? "never" : new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+  if (status.bookingCount !== void 0) out.log(`  bookings: ${status.bookingCount}`);
+  if (status.error?.code || status.error?.message) out.log(`  error: ${status.error.code ?? "error"}${status.error.message ? ` \u2014 ${status.error.message}` : ""}`);
+}
+
+// src/doctor-checks.ts
+var import_node_child_process3 = require("child_process");
+var import_node_fs5 = require("fs");
+var import_node_path4 = require("path");
+
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
 var import_node_fs4 = require("fs");
@@ -1200,6 +1736,15 @@ function o11yProjectWarnings(rootDir) {
   }
   return warnings;
 }
+function calendarProjectWarnings(rootDir) {
+  const pkg = readPackageJson(rootDir);
+  const dependencies = pkg?.dependencies;
+  const devDependencies = pkg?.devDependencies;
+  if (dependencies?.["@odla-ai/calendar"]) return [];
+  return [
+    devDependencies?.["@odla-ai/calendar"] ? "@odla-ai/calendar is a devDependency \u2014 move it to dependencies so trusted Worker code can import it" : "calendar service is enabled but @odla-ai/calendar is not installed in dependencies"
+  ];
+}
 function readPackageJson(rootDir) {
   try {
     return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(rootDir, "package.json"), "utf8"));
@@ -1225,6 +1770,14 @@ async function doctor(options) {
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+  if (cfg.services.includes("calendar")) {
+    const calendar = cfg.envs.map((env) => `${env}:${calendarServiceConfig(cfg, env).calendars.length}`).join(", ");
+    out.log(`calendar: google/read-only (${calendar}; attendee ${cfg.calendar?.google.attendeePolicy ?? "full"})`);
+    const pages = cfg.envs.map((env) => `${env}:${calendarBookingPageUrl(cfg, env) ?? "none"}`).join(", ");
+    out.log(`booking pages: ${pages}`);
+  } else {
+    out.log("calendar: not enabled");
+  }
   const warnings = [];
   if (schema && entities.length === 0) warnings.push("schema has no entities");
   if (rules) {
@@ -1252,6 +1805,8 @@ async function doctor(options) {
     }
     warnings.push(...o11yProjectWarnings(cfg.rootDir));
   }
+  if (cfg.services.includes("calendar")) warnings.push(...calendarProjectWarnings(cfg.rootDir));
+  else if (cfg.calendar) warnings.push('calendar config is present but "calendar" is not in services');
   warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
   warnings.push(...trackedSecretFiles(cfg.rootDir, void 0, [
     cfg.local.tokenFile,
@@ -1279,8 +1834,13 @@ function printHelp() {
 
 Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
   odla-ai doctor [--config odla.config.mjs]
+  odla-ai calendar status [--env dev] [--json]
+  odla-ai calendar calendars [--env dev] [--json]
+  odla-ai calendar connect [--env dev] [--no-open] [--yes]
+  odla-ai calendar resync [--env dev] [--yes]
+  odla-ai calendar disconnect [--env dev] --yes
   odla-ai capabilities [--json]
   odla-ai admin ai show [--platform https://odla.ai] [--json]
   odla-ai admin ai models [--provider <id>] [--json]
@@ -1301,15 +1861,18 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
   odla-ai version
 
 Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
+  calendar     Inspect, connect, resync, or disconnect a read-only Google mirror.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
@@ -1317,7 +1880,9 @@ Commands:
   smoke        Verify local credentials, public-config, live schema, and db aggregate.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
-  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.
+  secrets      Push configured db/o11y secrets into the Worker via wrangler
+               stdin; set stores a tenant-vault secret and set-clerk-key the
+               reserved Clerk secret key, write-only from stdin or an env var.
   version      Print the CLI version.
 
 Safety:
@@ -1328,6 +1893,8 @@ Safety:
   preflights Wrangler before any shown-once issuance or destructive rotation.
   Provision opens the approval page automatically in interactive terminals;
   use --open to force browser launch or --no-open to suppress it.
+  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
+  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
   GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
   for a PAT or provider key. GitHub read access is separate from the explicit
   --ack-redacted-source consent and the exact --plan-digest printed by security
@@ -1372,6 +1939,7 @@ function initProject(options) {
   }
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
+  if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
   (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
   (0, import_node_fs7.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
@@ -1389,6 +1957,16 @@ function writeIfMissing(path, text) {
   (0, import_node_fs7.writeFileSync)(path, text);
 }
 function configTemplate(input) {
+  const calendar = input.services.includes("calendar") ? `  calendar: {
+    google: {
+      calendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
+      bookingPageUrl: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, null])))},
+      match: { organizerSelf: true, requireAttendees: true },
+      attendeePolicy: "full",
+      // Read-only in this release. Google consent happens in Studio during provision.
+    },
+  },
+` : "";
   return `export default {
   platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
   dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
@@ -1410,6 +1988,7 @@ function configTemplate(input) {
     // key in the platform vault for each tenant.
     keyEnv: "${defaultKeyEnv(input.aiProvider)}",
   },
+${calendar}
   auth: {
     clerk: {
       // dev: "$CLERK_PUBLISHABLE_KEY",
@@ -1475,7 +2054,7 @@ function relativeDisplay(path, rootDir) {
 // src/provision.ts
 var import_apps2 = require("@odla-ai/apps");
 var import_ai = require("@odla-ai/ai");
-var import_node_process5 = __toESM(require("process"), 1);
+var import_node_process6 = __toESM(require("process"), 1);
 
 // src/provision-credentials.ts
 var import_apps = require("@odla-ai/apps");
@@ -1536,14 +2115,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText2(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText2(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -1559,12 +2138,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText2(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText(res) {
+async function safeText2(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -1677,6 +2256,14 @@ async function provision(options) {
     out.log(`  schema: ${schema ? "yes" : "no"}`);
     out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
     out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+    if (cfg.services.includes("calendar")) {
+      for (const env of cfg.envs) {
+        const calendar = calendarServiceConfig(cfg, env);
+        out.log(`  calendar.${env}: google/read, ${calendar.calendars.join(", ")} (${calendar.attendeePolicy}; ${GOOGLE_CALENDAR_READ_SCOPE})`);
+        const bookingPage = calendarBookingPageUrl(cfg, env);
+        out.log(`  calendar.${env}.bookingPageUrl: ${bookingPage === void 0 ? "unchanged" : bookingPage ?? "clear"}`);
+      }
+    }
     out.log(`  secrets: ${options.pushSecrets ? "push configured Worker secrets" : "local only"}`);
     return;
   }
@@ -1711,8 +2298,9 @@ async function provision(options) {
     await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
     out.log(`app: created ${cfg.app.id}`);
   }
+  const serviceOrder = [...cfg.services].sort((a, b) => serviceRank(a) - serviceRank(b));
   for (const env of cfg.envs) {
-    for (const service of cfg.services) {
+    for (const service of serviceOrder) {
       if (service === "ai") {
         if (cfg.ai?.provider) {
           await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
@@ -1722,7 +2310,8 @@ async function provision(options) {
           out.log(`${env}: ai enabled`);
         }
       } else {
-        await apps.setService(cfg.app.id, service, true, { env });
+        const config = service === "calendar" ? calendarServiceConfig(cfg, env) : void 0;
+        await apps.setService(cfg.app.id, service, true, { env, ...config ? { config } : {} });
         out.log(`${env}: ${service} enabled`);
       }
     }
@@ -1736,6 +2325,21 @@ async function provision(options) {
       await apps.setLink(cfg.app.id, env, link ?? null);
       out.log(`${env}: link ${link ? "set" : "cleared"}`);
     }
+    if (cfg.services.includes("calendar")) {
+      const calendarCtx = { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch };
+      await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);
+      await ensureCalendarConnected(
+        calendarCtx,
+        {
+          open: options.open,
+          interactive: options.interactive,
+          openConsentUrl: options.openApprovalUrl,
+          wait: options.calendarPollWait,
+          pollTimeoutMs: options.calendarPollTimeoutMs,
+          stdout: out
+        }
+      );
+    }
   }
   for (const env of cfg.envs) {
     const tenantId = (0, import_apps2.tenantIdFor)(cfg.app.id, env);
@@ -1779,7 +2383,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process5.default.env[cfg.ai.keyEnv];
+      const key = import_node_process6.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -1799,6 +2403,11 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
 }
+function serviceRank(service) {
+  if (service === "db") return 0;
+  if (service === "calendar") return 2;
+  return 1;
+}
 async function readRegistryApp(cfg, token, doFetch) {
   const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -1814,7 +2423,7 @@ async function postJson(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
 }
 function normalizeClerkConfig(value) {
   if (!value) return null;
@@ -1831,7 +2440,7 @@ function defaultSecretName(provider) {
   const names = import_ai.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
-async function safeText2(res) {
+async function safeText3(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -1839,6 +2448,63 @@ async function safeText2(res) {
   }
 }
 
+// src/secrets-set.ts
+var import_ai2 = require("@odla-ai/ai");
+var import_apps3 = require("@odla-ai/apps");
+var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
+async function secretsSet(options) {
+  const name = (options.name ?? "").trim();
+  if (!name) throw new Error('secret name is required, e.g. "odla-ai secrets set clerk_webhook_secret --env dev --stdin"');
+  if (name.startsWith("$")) {
+    throw new Error('"$"-prefixed vault names are platform-reserved; for the Clerk secret key use "odla-ai secrets set-clerk-key"');
+  }
+  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  try {
+    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);
+  } catch (err) {
+    throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value));
+  }
+  out.log(`${name} stored in the ${tenantId} vault (write-only; the value was never echoed and cannot be read back here)`);
+}
+async function secretsSetClerkKey(options) {
+  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
+  if (!value.startsWith("sk_")) throw new Error("the Clerk secret key must start with sk_ (sk_test_\u2026 or sk_live_\u2026)");
+  if (value.startsWith("sk_test_") && PROD_ENV_NAMES2.has(options.env)) {
+    throw new Error(`refusing to store an sk_test_ Clerk key for "${options.env}" \u2014 use the production instance's sk_live_ key`);
+  }
+  if (value.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
+    throw new Error(`refusing to store an sk_live_ Clerk key for "${options.env}" without --yes (live users would sync into a non-prod tenant)`);
+  }
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({ value })
+  });
+  if (!res.ok) {
+    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text || "request failed"}`);
+  }
+  out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
+}
+function scrubValue(text, value) {
+  return redactSecrets(text).split(value).join("[value redacted]");
+}
+async function resolveVaultWrite(options) {
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.envs.includes(options.env)) {
+    throw new Error(`env "${options.env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  if (PROD_ENV_NAMES2.has(options.env) && !options.yes) {
+    throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
+  }
+  const value = await secretInputValue(options, "secret");
+  return { cfg, tenantId: (0, import_apps3.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
+}
+
 // src/security-command-context.ts
 var import_promises = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
@@ -3034,6 +3700,23 @@ async function smoke(options) {
     }
     out.log(`  ai: ${provider}`);
   }
+  if (cfg.services.includes("calendar")) {
+    const token = await getDeveloperToken(
+      cfg,
+      {
+        configPath: cfg.configPath,
+        token: options.token,
+        open: options.open,
+        interactive: options.interactive,
+        openApprovalUrl: options.openApprovalUrl
+      },
+      doFetch,
+      out
+    );
+    const status = await readCalendarStatus({ platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch });
+    assertCalendarHealthy(status, calendarServiceConfig(cfg, env));
+    out.log(`  calendar: ${status.status}, last sync ${new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+  }
   const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
   const expectedEntities = serializedEntities(expectedSchema);
   const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
@@ -3055,13 +3738,35 @@ async function smoke(options) {
   } else {
     out.log(`  aggregate: skipped (schema has no entities)`);
   }
+  if (cfg.services.includes("calendar")) {
+    const bookings = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      ns: "$bookings",
+      aggregate: { count: true }
+    });
+    const count = bookings.aggregate?.count;
+    out.log(`  bookings: ${String(count ?? "ok")}`);
+  }
   out.log("ok");
 }
+function assertCalendarHealthy(status, expected) {
+  if (!status.enabled || status.provider !== "google") throw new Error("calendar is not enabled with the Google provider");
+  if (status.status !== "healthy") {
+    throw new Error(`calendar connection is ${status.status}${status.error?.message ? `: ${status.error.message}` : ""}`);
+  }
+  if (status.access !== "read") throw new Error("calendar connection is not read-only");
+  const hasReadScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_READ_SCOPE || scope === "calendar.events.readonly");
+  if (!hasReadScope) throw new Error("calendar connection is missing calendar.events.readonly consent");
+  const missing = expected.calendars.filter((id) => !status.calendars.includes(id));
+  if (missing.length) throw new Error(`calendar connection is missing configured calendars: ${missing.join(", ")}`);
+  if (status.lastSuccessfulSyncAt === void 0) throw new Error("calendar has never completed a sync");
+  if (Date.now() - status.lastSuccessfulSyncAt > 30 * 6e4) throw new Error("calendar sync is more than 30 minutes stale");
+  if (status.watchExpiresAt !== void 0 && status.watchExpiresAt <= Date.now()) throw new Error("calendar watch channel is expired");
+}
 async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -3070,7 +3775,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -3078,7 +3783,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return (await res.text()).slice(0, 500);
   } catch {
@@ -3126,6 +3831,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await doctor({ configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs" });
     return;
   }
+  if (command === "calendar") {
+    await calendarCommand(parsed, dependencies);
+    return;
+  }
   if (command === "capabilities") {
     assertArgs(parsed, ["json"], 1);
     printCapabilities(parsed.options.json === true);
@@ -3140,14 +3849,19 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     return;
   }
   if (command === "provision") {
-    await provisionCommand(parsed);
+    await provisionCommand(parsed, dependencies);
     return;
   }
   if (command === "smoke") {
-    assertArgs(parsed, ["config", "env"], 1);
+    assertArgs(parsed, ["config", "env", "token", "open"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
-      env: stringOpt(parsed.options.env)
+      env: stringOpt(parsed.options.env),
+      token: stringOpt(parsed.options.token),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: dependencies.openUrl,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
     });
     return;
   }
@@ -3180,8 +3894,26 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   }
   if (command === "secrets") {
     const sub = parsed.positionals[1];
+    if (sub === "set" || sub === "set-clerk-key") {
+      assertArgs(parsed, ["config", "env", "from-env", "stdin", "token", "yes"], sub === "set" ? 3 : 2);
+      const options = {
+        configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+        name: parsed.positionals[2],
+        env: requiredString(parsed.options.env, "--env"),
+        fromEnv: stringOpt(parsed.options["from-env"]),
+        stdin: parsed.options.stdin === true,
+        token: stringOpt(parsed.options.token),
+        yes: parsed.options.yes === true,
+        fetch: dependencies.fetch,
+        stdout: dependencies.stdout
+      };
+      await (sub === "set" ? secretsSet(options) : secretsSetClerkKey(options));
+      return;
+    }
     if (sub !== "push") {
-      throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
+      throw new Error(
+        `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
+      );
     }
     assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
     await secretsPush({
@@ -3194,7 +3926,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
-async function provisionCommand(parsed) {
+async function provisionCommand(parsed, dependencies) {
   assertArgs(parsed, [
     "config",
     "dry-run",
@@ -3218,16 +3950,52 @@ async function provisionCommand(parsed) {
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-    yes: parsed.options.yes === true
+    yes: parsed.options.yes === true,
+    fetch: dependencies.fetch,
+    openApprovalUrl: dependencies.openUrl,
+    stdout: dependencies.stdout
   };
   await provision(options);
 }
+async function calendarCommand(parsed, dependencies) {
+  const sub = parsed.positionals[1];
+  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "resync" && sub !== "disconnect") {
+    throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
+  }
+  assertArgs(parsed, ["config", "env", "json", "token", "open", "yes"], 2);
+  if (sub !== "status" && sub !== "calendars" && parsed.options.json !== void 0) throw new Error(`--json is supported only by calendar status/calendars`);
+  if ((sub === "status" || sub === "calendars") && parsed.options.yes !== void 0) throw new Error(`--yes is not used by "calendar ${sub}"`);
+  const options = {
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    env: stringOpt(parsed.options.env),
+    token: stringOpt(parsed.options.token),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    yes: parsed.options.yes === true,
+    json: parsed.options.json === true,
+    fetch: dependencies.fetch,
+    stdout: dependencies.stdout,
+    openConsentUrl: dependencies.openUrl
+  };
+  if (sub === "status") await calendarStatus(options);
+  else if (sub === "calendars") await calendarCalendars(options);
+  else if (sub === "connect") await calendarConnect(options);
+  else if (sub === "resync") await calendarResync(options);
+  else await calendarDisconnect(options);
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AGENT_HARNESSES,
   CAPABILITIES,
+  GOOGLE_CALENDAR_READ_SCOPE,
   SYSTEM_AI_PURPOSES,
   adminAi,
+  calendarBookingPageUrl,
+  calendarCalendars,
+  calendarConnect,
+  calendarDisconnect,
+  calendarResync,
+  calendarServiceConfig,
+  calendarStatus,
   connectGitHubSecuritySource,
   disconnectGitHubSecuritySource,
   doctor,
@@ -3250,6 +4018,8 @@ async function provisionCommand(parsed) {
   runCli,
   runHostedSecurity,
   secretsPush,
+  secretsSet,
+  secretsSetClerkKey,
   smoke,
   startHostedSecurityJob
 });