@odla-ai/cli 0.9.0 → 0.10.0

package/dist/{chunk-MJYQ7YDH.js → chunk-WDKBW4BE.js}

@@ -654,6 +654,7 @@ var CAPABILITIES = {
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
     "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
     "push db schema/rules and configure platform AI, auth, and deployment links",
+    "apply read-only Google calendar mirror and public booking-page config, then drive state-bound consent, status, discovery, resync, and disconnect flows",
     "validate config offline and smoke-test a provisioned db environment",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -662,10 +663,12 @@ var CAPABILITIES = {
   agent: [
     "install and import the selected odla SDKs",
     "wrap the Worker with withObservability and choose useful telemetry",
-    "make application-specific schema, rules, auth, UI, and migration decisions"
+    "make application-specific schema, rules, auth, UI, and migration decisions",
+    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
   ],
   human: [
     "approve the odla device code and one-off third-party logins",
+    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
     "consent to production changes with --yes",
     "request destructive credential rotation explicitly",
     "review application semantics, security findings, releases, and merges",
@@ -674,6 +677,7 @@ var CAPABILITIES = {
   ],
   studio: [
     "view telemetry and environment state",
+    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
     "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
     "configure system AI purposes and view app/environment/run-attributed usage",
     "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
@@ -696,25 +700,6 @@ function printGroup(out, heading, items) {
   out.log("");
 }
 
-// src/redact.ts
-var REPLACEMENTS = [
-  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
-  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
-  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
-  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
-  [/\bo11y_[A-Za-z0-9]+/g, "o11y_[redacted]"],
-  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
-  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
-];
-function redactSecrets(value) {
-  let result = value;
-  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
-  return result;
-}
-function looksSecret(value) {
-  return redactSecrets(value) !== value || value.includes("-----BEGIN");
-}
-
 // src/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
@@ -722,6 +707,7 @@ import { pathToFileURL } from "url";
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
+var GOOGLE_CALENDAR_READ_SCOPE = "https://www.googleapis.com/auth/calendar.events.readonly";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
   const resolved = resolve2(configPath);
   if (!existsSync3(resolved)) {
@@ -734,6 +720,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
   const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  validateCalendarConfig(raw, envs, services, resolved);
   const local = {
     tokenFile: resolve2(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
     credentialsFile: resolve2(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
@@ -778,6 +765,28 @@ function buildPlan(cfg) {
     aiProvider: cfg.ai?.provider
   };
 }
+function calendarServiceConfig(cfg, env) {
+  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
+  if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
+  const google = cfg.calendar?.google;
+  if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
+  return {
+    provider: "google",
+    access: "read",
+    calendars: unique(google.calendars[env].map((id) => id.trim())),
+    match: {
+      organizerSelf: google.match?.organizerSelf ?? true,
+      requireAttendees: google.match?.requireAttendees ?? true,
+      ...google.match?.summaryPrefix !== void 0 ? { summaryPrefix: google.match.summaryPrefix.trim() } : {}
+    },
+    attendeePolicy: google.attendeePolicy ?? "full"
+  };
+}
+function calendarBookingPageUrl(cfg, env) {
+  const value = cfg.calendar?.google.bookingPageUrl?.[env];
+  if (value === void 0 || value === null) return value;
+  return new URL(value).toString();
+}
 function rulesFromSchema(schema) {
   const entities = serializedEntities(schema);
   return Object.fromEntries(
@@ -801,7 +810,85 @@ function validateRawConfig(raw, path) {
   if (!cfg.app || typeof cfg.app !== "object") throw new Error(`${path}: missing app object`);
   if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
   if (!cfg.app.name || typeof cfg.app.name !== "string") throw new Error(`${path}: app.name is required`);
+  if (cfg.envs !== void 0 && (!Array.isArray(cfg.envs) || cfg.envs.some((env) => typeof env !== "string"))) {
+    throw new Error(`${path}: envs must be an array of names`);
+  }
   if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
+  if (cfg.services !== void 0 && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== "string" || !service.trim()))) {
+    throw new Error(`${path}: services must be an array of non-empty names`);
+  }
+}
+function validateCalendarConfig(cfg, envs, services, path) {
+  const enabled = services.includes("calendar");
+  if (!cfg.calendar) {
+    if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
+    return;
+  }
+  if (!isRecord4(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
+  if (!isRecord4(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  const google = cfg.calendar.google;
+  assertOnly(google, ["calendars", "bookingPageUrl", "match", "attendeePolicy"], `${path}: calendar.google`);
+  if (!isRecord4(google.calendars)) throw new Error(`${path}: calendar.google.calendars must map env names to calendar ids`);
+  const unknownEnv = Object.keys(google.calendars).find((env) => !envs.includes(env));
+  if (unknownEnv) throw new Error(`${path}: calendar.google.calendars.${unknownEnv} is not in config envs`);
+  for (const env of envs) {
+    const ids = google.calendars[env];
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.calendars.${env} must be a non-empty array`);
+    }
+    if (ids.length > 10) {
+      throw new Error(`${path}: calendar.google.calendars.${env} must contain at most 10 calendar ids`);
+    }
+    if (ids.some((id) => !safeText(id, 1024))) {
+      throw new Error(`${path}: calendar.google.calendars.${env} contains an invalid calendar id`);
+    }
+  }
+  if (google.bookingPageUrl !== void 0) {
+    if (!isRecord4(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value] of Object.entries(google.bookingPageUrl)) {
+      if (value !== null && !safeHttpsUrl(value)) {
+        throw new Error(`${path}: calendar.google.bookingPageUrl.${env} must be an HTTPS URL without credentials or fragment`);
+      }
+    }
+  }
+  if (google.attendeePolicy !== void 0 && google.attendeePolicy !== "full" && google.attendeePolicy !== "hashed") {
+    throw new Error(`${path}: calendar.google.attendeePolicy must be "full" or "hashed"`);
+  }
+  if (google.match !== void 0) {
+    if (!isRecord4(google.match)) throw new Error(`${path}: calendar.google.match must be an object`);
+    assertOnly(google.match, ["summaryPrefix", "organizerSelf", "requireAttendees"], `${path}: calendar.google.match`);
+    if (google.match.summaryPrefix !== void 0 && !safeText(google.match.summaryPrefix, 256)) {
+      throw new Error(`${path}: calendar.google.match.summaryPrefix must be 1-256 printable characters`);
+    }
+    for (const name of ["organizerSelf", "requireAttendees"]) {
+      if (google.match[name] !== void 0 && typeof google.match[name] !== "boolean") {
+        throw new Error(`${path}: calendar.google.match.${name} must be boolean`);
+      }
+    }
+  }
+  if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
+}
+function assertOnly(value, allowed, label) {
+  const extra = Object.keys(value).find((key) => !allowed.includes(key));
+  if (extra) throw new Error(`${label}.${extra} is not supported`);
+}
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function safeText(value, max) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+}
+function safeHttpsUrl(value) {
+  if (typeof value !== "string" || value.length > 2048) return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password && !url.hash;
+  } catch {
+    return false;
+  }
 }
 function validId(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
@@ -820,6 +907,440 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/redact.ts
+var REPLACEMENTS = [
+  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
+  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
+  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
+  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
+  [/\bo11y_[A-Za-z0-9]+/g, "o11y_[redacted]"],
+  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
+  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
+];
+function redactSecrets(value) {
+  let result = value;
+  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
+  return result;
+}
+function looksSecret(value) {
+  return redactSecrets(value) !== value || value.includes("-----BEGIN");
+}
+
+// src/calendar-http.ts
+var CALENDAR_STATES = [
+  "not_connected",
+  "authorizing",
+  "needs_sync",
+  "initial_sync",
+  "healthy",
+  "degraded",
+  "disconnected",
+  "failed"
+];
+async function readCalendarStatus(ctx) {
+  return parseCalendarStatus(await calendarJson(ctx, "", {}), ctx.env);
+}
+async function discoverGoogleCalendars(ctx) {
+  const raw = await calendarJson(ctx, "/calendars", {});
+  const value = record(raw);
+  if (!value || !Array.isArray(value.calendars)) throw new Error("calendar discovery returned an invalid response");
+  return value.calendars.map((item, index) => {
+    const calendar = record(item);
+    const id = textField(calendar?.id, 1024);
+    if (!calendar || !id) throw new Error(`calendar discovery returned an invalid calendar at index ${index}`);
+    const role = calendar.accessRole;
+    if (role !== void 0 && role !== "freeBusyReader" && role !== "reader" && role !== "writer" && role !== "owner") {
+      throw new Error(`calendar discovery returned an invalid access role at index ${index}`);
+    }
+    return {
+      id,
+      ...optionalText("summary", calendar.summary, 500),
+      ...typeof calendar.primary === "boolean" ? { primary: calendar.primary } : {},
+      ...typeof calendar.selected === "boolean" ? { selected: calendar.selected } : {},
+      ...typeof role === "string" ? { accessRole: role } : {}
+    };
+  });
+}
+async function applyCalendarSettings(ctx, bookingPageUrl) {
+  return parseCalendarStatus(await calendarJson(ctx, "", { method: "PUT", body: JSON.stringify({ bookingPageUrl }) }), ctx.env);
+}
+async function startCalendarConnection(ctx) {
+  const raw = await calendarJson(ctx, "/google/connect", { method: "POST", body: "{}" });
+  const value = wrapped(raw, "attempt");
+  const attemptId = textField(value.attemptId, 180);
+  const consentUrl = textField(value.consentUrl, 4096);
+  const expiresAt = timestamp3(value.expiresAt);
+  if (!attemptId || !consentUrl || expiresAt === void 0) throw new Error("calendar connect returned an invalid attempt");
+  return { attemptId, consentUrl, expiresAt };
+}
+async function pollCalendarConnection(ctx, attemptId) {
+  return parseCalendarStatus(
+    await calendarJson(ctx, `/google/connect/${encodeURIComponent(identifier(attemptId, "attemptId"))}`, {}),
+    ctx.env
+  );
+}
+async function requestCalendarResync(ctx) {
+  return parseCalendarStatus(await calendarJson(ctx, "/resync", { method: "POST", body: "{}" }), ctx.env);
+}
+async function requestCalendarDisconnect(ctx) {
+  return parseCalendarStatus(
+    await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
+    ctx.env
+  );
+}
+function parseCalendarStatus(raw, env) {
+  const outer = wrapped(raw, "calendar");
+  const value = record(outer.attempt) ?? record(outer.status) ?? outer;
+  const connection = record(value.connection) ?? {};
+  const sync = record(value.sync) ?? record(connection.sync) ?? {};
+  const config = record(value.config) ?? record(outer.config) ?? {};
+  const googleConfig = record(config.google) ?? config;
+  const watches = record(value.watches) ?? {};
+  const stateValue = calendarState(value.status ?? value.state ?? connection.status ?? connection.state);
+  if (!stateValue) {
+    throw new Error("calendar status returned an invalid connection state");
+  }
+  const providerValue = value.provider ?? connection.provider ?? config.provider ?? (config.google ? "google" : void 0);
+  if (providerValue !== void 0 && providerValue !== null && providerValue !== "google") {
+    throw new Error("calendar status returned an unsupported provider");
+  }
+  const accessValue = value.access ?? connection.access ?? config.access ?? googleConfig.access;
+  if (accessValue !== void 0 && accessValue !== "read") throw new Error("calendar status returned unsupported access");
+  const policyValue = value.attendeePolicy ?? config.attendeePolicy ?? googleConfig.attendeePolicy;
+  if (policyValue !== void 0 && policyValue !== "full" && policyValue !== "hashed") {
+    throw new Error("calendar status returned an invalid attendee policy");
+  }
+  const errorValue = record(value.error) ?? record(connection.error);
+  const errorCode = textField(value.lastErrorCode, 128);
+  const bookingPageValue = Object.hasOwn(value, "bookingPageUrl") ? value.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
+  return {
+    env,
+    enabled: typeof value.enabled === "boolean" ? value.enabled : true,
+    connected: typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["needs_sync", "initial_sync", "healthy", "degraded"].includes(stateValue),
+    provider: providerValue === "google" ? "google" : null,
+    status: stateValue,
+    ...accessValue === "read" ? { access: "read" } : {},
+    calendars: calendarIds(value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars),
+    ...policyValue === "full" || policyValue === "hashed" ? { attendeePolicy: policyValue } : {},
+    ...typeof value.attendeePolicyLocked === "boolean" ? { attendeePolicyLocked: value.attendeePolicyLocked } : {},
+    ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
+    grantedScopes: stringList(value.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
+    ...optionalText("attemptId", value.attemptId ?? connection.attemptId, 180),
+    ...optionalNumber("lastSuccessfulSyncAt", value.lastSuccessfulSyncAt ?? sync.lastSuccessfulSyncAt),
+    ...optionalNumber("lastFullSyncAt", value.lastFullSyncAt ?? sync.lastFullSyncAt),
+    ...optionalNumber("watchExpiresAt", value.watchExpiresAt ?? sync.watchExpiresAt ?? watches.nextExpirationAt),
+    ...optionalInteger("bookingCount", value.bookingCount ?? sync.bookingCount),
+    ...errorValue || errorCode ? { error: {
+      ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
+      ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
+      ...!errorValue && errorCode ? { code: errorCode } : {}
+    } } : {}
+  };
+}
+function calendarState(value) {
+  if (typeof value !== "string") return null;
+  if (CALENDAR_STATES.includes(value)) return value;
+  const legacy = {
+    disabled: "not_connected",
+    disconnected: "disconnected",
+    connecting: "authorizing",
+    syncing: "initial_sync",
+    ready: "healthy",
+    error: "failed"
+  };
+  return legacy[value] ?? null;
+}
+async function calendarJson(ctx, suffix, init) {
+  const platform = platformAudience(ctx.platform);
+  const appId = identifier(ctx.appId, "appId");
+  const env = identifier(ctx.env, "env");
+  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/calendar${suffix}`, platform);
+  url.searchParams.set("env", env);
+  const token = credential(ctx.token);
+  let response;
+  try {
+    response = await (ctx.fetch ?? fetch)(url, {
+      ...init,
+      redirect: "error",
+      credentials: "omit",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init.headers }
+    });
+  } catch (error) {
+    throw new Error(`calendar request failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const code = textField(body.error?.code, 128);
+    const message = textField(body.error?.message, 500);
+    throw new Error(redactSecrets(`calendar request failed (${response.status})${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`));
+  }
+  return body;
+}
+function wrapped(raw, key) {
+  const outer = record(raw);
+  if (!outer) throw new Error("calendar returned an invalid response");
+  return record(outer[key]) ?? outer;
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function textField(value, max) {
+  return typeof value === "string" && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value) ? value : void 0;
+}
+function stringList(value) {
+  return Array.isArray(value) ? [...new Set(value.filter((item) => !!textField(item, 4096)))] : [];
+}
+function calendarIds(value) {
+  if (!Array.isArray(value)) return [];
+  return [...new Set(value.flatMap((item) => {
+    if (typeof item === "string") return textField(item, 4096) ? [item] : [];
+    const calendar = record(item);
+    const id = textField(calendar?.id, 4096);
+    return id && calendar?.selected !== false ? [id] : [];
+  }))];
+}
+function timestamp3(value) {
+  if (typeof value === "number" && Number.isFinite(value) && value >= 0) return value;
+  if (typeof value === "string") {
+    const parsed = Date.parse(value);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return void 0;
+}
+function optionalText(key, value, max) {
+  const parsed = textField(value, max);
+  return parsed ? { [key]: parsed } : {};
+}
+function optionalNumber(key, value) {
+  const parsed = timestamp3(value);
+  return parsed === void 0 ? {} : { [key]: parsed };
+}
+function optionalInteger(key, value) {
+  return Number.isSafeInteger(value) && value >= 0 ? { [key]: value } : {};
+}
+function optionalNullableUrl(key, value) {
+  if (value === null) return { [key]: null };
+  const parsed = textField(value, 4096);
+  return parsed ? { [key]: parsed } : {};
+}
+function identifier(value, name) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,179}$/.test(value)) throw new Error(`${name} is invalid`);
+  return value;
+}
+function credential(value) {
+  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error("calendar requires an odla developer token");
+  }
+  return value;
+}
+
+// src/calendar-poll.ts
+async function waitForCalendarPoll(milliseconds, signal) {
+  if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
+  await new Promise((resolve7, reject) => {
+    const timer = setTimeout(resolve7, milliseconds);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      reject(signal.reason ?? new Error("calendar connection aborted"));
+    }, { once: true });
+  });
+}
+
+// src/calendar.ts
+async function calendarStatus(options) {
+  const { ctx, out } = await lifecycleContext(options);
+  const status = await readCalendarStatus(ctx);
+  printStatus(status, options.json === true, out);
+  return status;
+}
+async function calendarCalendars(options) {
+  const { ctx, out } = await lifecycleContext(options);
+  const calendars = await discoverGoogleCalendars(ctx);
+  if (options.json) out.log(JSON.stringify({ env: ctx.env, calendars }, null, 2));
+  else if (calendars.length === 0) out.log(`${ctx.env}: no Google calendars available`);
+  else for (const calendar of calendars) {
+    out.log(`${calendar.selected ? "\u2713" : calendar.primary ? "*" : " "} ${calendar.id}${calendar.summary ? ` \u2014 ${calendar.summary}` : ""}${calendar.accessRole ? ` (${calendar.accessRole})` : ""}`);
+  }
+  return calendars;
+}
+async function calendarConnect(options) {
+  const { cfg, ctx, out } = await lifecycleContext(options);
+  productionConsent(ctx.env, options.yes, "connect calendar");
+  const page = calendarBookingPageUrl(cfg, ctx.env);
+  const applied = page === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);
+  const connectOptions = connectionOptions(options, out);
+  return await continueConnectedCalendar(ctx, applied, connectOptions, false) ?? connectWithContext(ctx, connectOptions);
+}
+async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
+  if (bookingPageUrl === void 0) return null;
+  const status = await applyCalendarSettings(ctx, bookingPageUrl);
+  out.log(`${ctx.env}: calendar booking page ${bookingPageUrl ? "set" : "cleared"}`);
+  return status;
+}
+async function calendarResync(options) {
+  const { ctx, out } = await lifecycleContext(options);
+  productionConsent(ctx.env, options.yes, "resync calendar");
+  const status = await requestCalendarResync(ctx);
+  out.log(`${ctx.env}: calendar resync requested (${status.status})`);
+  return status;
+}
+async function calendarDisconnect(options) {
+  if (!options.yes) throw new Error("calendar disconnect requires --yes");
+  const { ctx, out } = await lifecycleContext(options);
+  const status = await requestCalendarDisconnect(ctx);
+  out.log(`${ctx.env}: calendar disconnected; retained mirror rows may now be stale`);
+  return status;
+}
+async function ensureCalendarConnected(ctx, options) {
+  const out = options.stdout ?? console;
+  const current = await readCalendarStatus(ctx);
+  const connectOptions = connectionOptions(options, out);
+  return await continueConnectedCalendar(ctx, current, connectOptions, true) ?? connectWithContext(ctx, connectOptions);
+}
+async function lifecycleContext(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
+  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  calendarServiceConfig(cfg, env);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      token: options.token,
+      open: options.open,
+      interactive: options.interactive,
+      openApprovalUrl: options.openConsentUrl
+    },
+    doFetch,
+    out
+  );
+  return { cfg, ctx: { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch }, out };
+}
+function connectionOptions(options, out) {
+  const browser = approvalBrowser({ configPath: "odla.config.mjs", open: options.open, interactive: options.interactive });
+  return {
+    out,
+    open: browser.open,
+    openConsentUrl: options.openConsentUrl,
+    wait: options.wait,
+    pollTimeoutMs: options.pollTimeoutMs,
+    now: options.now,
+    signal: options.signal
+  };
+}
+async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
+  if (current.status === "healthy" || reuseDegraded && current.status === "degraded") {
+    options.out.log(`${ctx.env}: calendar ${reuseDegraded ? "connected" : "already connected"} (${current.status})`);
+    return current;
+  }
+  if (current.status === "degraded") return null;
+  if (current.status === "needs_sync") {
+    if (!current.connected) return null;
+    options.out.log(`${ctx.env}: calendar configuration needs sync`);
+    const synced = await requestCalendarResync(ctx);
+    options.out.log(`${ctx.env}: calendar ${synced.status.replaceAll("_", " ")}`);
+    return synced;
+  }
+  if (current.status === "failed" && current.connected) {
+    const reason = current.error?.message ?? current.error?.code;
+    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+  }
+  const waitingForExisting = current.status === "authorizing" || current.status === "initial_sync" && current.connected;
+  if (!waitingForExisting) return null;
+  const now = options.now ?? Date.now;
+  const deadline = now() + pollTimeout(options.pollTimeoutMs);
+  const wait = options.wait ?? waitForCalendarPoll;
+  let prior = "";
+  while (now() < deadline) {
+    if (options.signal?.aborted) throw options.signal.reason ?? new Error("calendar connection aborted");
+    const status = await readCalendarStatus(ctx);
+    if (status.status !== prior) {
+      options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
+      prior = status.status;
+    }
+    if (status.status === "healthy" || reuseDegraded && status.status === "degraded") return status;
+    if (status.status === "degraded") return null;
+    if (status.status === "needs_sync") return requestCalendarResync(ctx);
+    if (status.status === "failed" && status.connected) {
+      const reason = status.error?.message ?? status.error?.code;
+      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+    }
+    if (status.status !== "authorizing" && (status.status !== "initial_sync" || !status.connected)) return null;
+    await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
+  }
+  throw new Error('Existing Google Calendar authorization or initial sync timed out; run "odla-ai calendar status" and retry');
+}
+async function connectWithContext(ctx, options) {
+  const attempt = await startCalendarConnection(ctx);
+  const consentUrl = trustedCalendarConsentUrl(ctx.platform, attempt.consentUrl);
+  options.out.log(`${ctx.env}: Google Calendar consent: ${consentUrl}`);
+  if (options.open) {
+    await (options.openConsentUrl ?? openUrl)(consentUrl);
+    options.out.log(`${ctx.env}: opened Google Calendar consent in your browser`);
+  }
+  const now = options.now ?? Date.now;
+  const timeout = pollTimeout(options.pollTimeoutMs);
+  const deadline = Math.min(attempt.expiresAt, now() + timeout);
+  const wait = options.wait ?? waitForCalendarPoll;
+  let prior = "";
+  while (now() < deadline) {
+    if (options.signal?.aborted) throw options.signal.reason ?? new Error("calendar connection aborted");
+    const status = await pollCalendarConnection(ctx, attempt.attemptId);
+    if (status.status !== prior) {
+      options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
+      prior = status.status;
+    }
+    if (status.status === "healthy" || status.status === "degraded") return status;
+    if (status.status === "failed" || status.status === "disconnected" || status.status === "not_connected") {
+      const reason = status.error?.message ?? status.error?.code;
+      throw new Error(`calendar connection ${status.status}${reason ? `: ${reason}` : ""}`);
+    }
+    await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
+  }
+  throw new Error('Google Calendar consent or initial sync timed out; run "odla-ai calendar status" and retry connect');
+}
+function trustedCalendarConsentUrl(platform, value) {
+  const origin = platformAudience(platform);
+  let url;
+  try {
+    url = value.startsWith("/") ? new URL(value, origin) : new URL(value);
+  } catch {
+    throw new Error("odla.ai returned an invalid calendar consent URL");
+  }
+  const platformPage = url.origin === origin;
+  const googlePage = url.origin === "https://accounts.google.com" && url.pathname === "/o/oauth2/v2/auth";
+  if (!platformPage && !googlePage || url.username || url.password || url.hash) {
+    throw new Error("odla.ai returned an untrusted calendar consent URL");
+  }
+  return url.toString();
+}
+function pollTimeout(value = 10 * 6e4) {
+  if (!Number.isSafeInteger(value) || value < 1e3 || value > 60 * 6e4) throw new Error("calendar poll timeout must be 1000-3600000ms");
+  return value;
+}
+function productionConsent(env, yes, action) {
+  if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action} for "${env}" without --yes`);
+}
+function printStatus(status, json, out) {
+  if (json) {
+    out.log(JSON.stringify(status, null, 2));
+    return;
+  }
+  out.log(`calendar: ${status.provider ?? "none"}/${status.status} (${status.env})`);
+  out.log(`  access: ${status.access ?? "not granted"}`);
+  out.log(`  calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
+  if (status.attendeePolicy) {
+    out.log(`  attendee policy: ${status.attendeePolicy}${status.attendeePolicyLocked ? " (locked)" : ""}`);
+  }
+  if (status.bookingPageUrl !== void 0) out.log(`  booking page: ${status.bookingPageUrl ?? "not configured"}`);
+  out.log(`  last sync: ${status.lastSuccessfulSyncAt === void 0 ? "never" : new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+  if (status.bookingCount !== void 0) out.log(`  bookings: ${status.bookingCount}`);
+  if (status.error?.code || status.error?.message) out.log(`  error: ${status.error.code ?? "error"}${status.error.message ? ` \u2014 ${status.error.message}` : ""}`);
+}
+
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
@@ -1005,6 +1526,15 @@ function o11yProjectWarnings(rootDir) {
   }
   return warnings;
 }
+function calendarProjectWarnings(rootDir) {
+  const pkg = readPackageJson(rootDir);
+  const dependencies = pkg?.dependencies;
+  const devDependencies = pkg?.devDependencies;
+  if (dependencies?.["@odla-ai/calendar"]) return [];
+  return [
+    devDependencies?.["@odla-ai/calendar"] ? "@odla-ai/calendar is a devDependency \u2014 move it to dependencies so trusted Worker code can import it" : "calendar service is enabled but @odla-ai/calendar is not installed in dependencies"
+  ];
+}
 function readPackageJson(rootDir) {
   try {
     return JSON.parse(readFileSync4(join2(rootDir, "package.json"), "utf8"));
@@ -1030,6 +1560,14 @@ async function doctor(options) {
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+  if (cfg.services.includes("calendar")) {
+    const calendar = cfg.envs.map((env) => `${env}:${calendarServiceConfig(cfg, env).calendars.length}`).join(", ");
+    out.log(`calendar: google/read-only (${calendar}; attendee ${cfg.calendar?.google.attendeePolicy ?? "full"})`);
+    const pages = cfg.envs.map((env) => `${env}:${calendarBookingPageUrl(cfg, env) ?? "none"}`).join(", ");
+    out.log(`booking pages: ${pages}`);
+  } else {
+    out.log("calendar: not enabled");
+  }
   const warnings = [];
   if (schema && entities.length === 0) warnings.push("schema has no entities");
   if (rules) {
@@ -1057,6 +1595,8 @@ async function doctor(options) {
     }
     warnings.push(...o11yProjectWarnings(cfg.rootDir));
   }
+  if (cfg.services.includes("calendar")) warnings.push(...calendarProjectWarnings(cfg.rootDir));
+  else if (cfg.calendar) warnings.push('calendar config is present but "calendar" is not in services');
   warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
   warnings.push(...trackedSecretFiles(cfg.rootDir, void 0, [
     cfg.local.tokenFile,
@@ -1088,6 +1628,7 @@ function initProject(options) {
   }
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
+  if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
   mkdirSync2(dirname3(configPath), { recursive: true });
   mkdirSync2(resolve4(rootDir, "src/odla"), { recursive: true });
@@ -1105,6 +1646,16 @@ function writeIfMissing(path, text) {
   writeFileSync2(path, text);
 }
 function configTemplate(input) {
+  const calendar = input.services.includes("calendar") ? `  calendar: {
+    google: {
+      calendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
+      bookingPageUrl: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, null])))},
+      match: { organizerSelf: true, requireAttendees: true },
+      attendeePolicy: "full",
+      // Read-only in this release. Google consent happens in Studio during provision.
+    },
+  },
+` : "";
   return `export default {
   platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
   dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
@@ -1126,6 +1677,7 @@ function configTemplate(input) {
     // key in the platform vault for each tenant.
     keyEnv: "${defaultKeyEnv(input.aiProvider)}",
   },
+${calendar}
   auth: {
     clerk: {
       // dev: "$CLERK_PUBLISHABLE_KEY",
@@ -1325,14 +1877,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText2(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText2(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -1348,12 +1900,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText2(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText(res) {
+async function safeText2(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -1393,6 +1945,14 @@ async function provision(options) {
     out.log(`  schema: ${schema ? "yes" : "no"}`);
     out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
     out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+    if (cfg.services.includes("calendar")) {
+      for (const env of cfg.envs) {
+        const calendar = calendarServiceConfig(cfg, env);
+        out.log(`  calendar.${env}: google/read, ${calendar.calendars.join(", ")} (${calendar.attendeePolicy}; ${GOOGLE_CALENDAR_READ_SCOPE})`);
+        const bookingPage = calendarBookingPageUrl(cfg, env);
+        out.log(`  calendar.${env}.bookingPageUrl: ${bookingPage === void 0 ? "unchanged" : bookingPage ?? "clear"}`);
+      }
+    }
     out.log(`  secrets: ${options.pushSecrets ? "push configured Worker secrets" : "local only"}`);
     return;
   }
@@ -1427,8 +1987,9 @@ async function provision(options) {
     await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
     out.log(`app: created ${cfg.app.id}`);
   }
+  const serviceOrder = [...cfg.services].sort((a, b) => serviceRank(a) - serviceRank(b));
   for (const env of cfg.envs) {
-    for (const service of cfg.services) {
+    for (const service of serviceOrder) {
       if (service === "ai") {
         if (cfg.ai?.provider) {
           await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
@@ -1438,7 +1999,8 @@ async function provision(options) {
           out.log(`${env}: ai enabled`);
         }
       } else {
-        await apps.setService(cfg.app.id, service, true, { env });
+        const config = service === "calendar" ? calendarServiceConfig(cfg, env) : void 0;
+        await apps.setService(cfg.app.id, service, true, { env, ...config ? { config } : {} });
         out.log(`${env}: ${service} enabled`);
       }
     }
@@ -1452,6 +2014,21 @@ async function provision(options) {
       await apps.setLink(cfg.app.id, env, link ?? null);
       out.log(`${env}: link ${link ? "set" : "cleared"}`);
     }
+    if (cfg.services.includes("calendar")) {
+      const calendarCtx = { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch };
+      await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);
+      await ensureCalendarConnected(
+        calendarCtx,
+        {
+          open: options.open,
+          interactive: options.interactive,
+          openConsentUrl: options.openApprovalUrl,
+          wait: options.calendarPollWait,
+          pollTimeoutMs: options.calendarPollTimeoutMs,
+          stdout: out
+        }
+      );
+    }
   }
   for (const env of cfg.envs) {
     const tenantId = tenantIdFor2(cfg.app.id, env);
@@ -1515,6 +2092,11 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
 }
+function serviceRank(service) {
+  if (service === "db") return 0;
+  if (service === "calendar") return 2;
+  return 1;
+}
 async function readRegistryApp(cfg, token, doFetch) {
   const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -1530,7 +2112,7 @@ async function postJson(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
 }
 function normalizeClerkConfig(value) {
   if (!value) return null;
@@ -1547,7 +2129,7 @@ function defaultSecretName(provider) {
   const names = DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
-async function safeText2(res) {
+async function safeText3(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -2382,6 +2964,23 @@ async function smoke(options) {
     }
     out.log(`  ai: ${provider}`);
   }
+  if (cfg.services.includes("calendar")) {
+    const token = await getDeveloperToken(
+      cfg,
+      {
+        configPath: cfg.configPath,
+        token: options.token,
+        open: options.open,
+        interactive: options.interactive,
+        openApprovalUrl: options.openApprovalUrl
+      },
+      doFetch,
+      out
+    );
+    const status = await readCalendarStatus({ platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch });
+    assertCalendarHealthy(status, calendarServiceConfig(cfg, env));
+    out.log(`  calendar: ${status.status}, last sync ${new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+  }
   const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
   const expectedEntities = serializedEntities(expectedSchema);
   const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
@@ -2403,13 +3002,35 @@ async function smoke(options) {
   } else {
     out.log(`  aggregate: skipped (schema has no entities)`);
   }
+  if (cfg.services.includes("calendar")) {
+    const bookings = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      ns: "$bookings",
+      aggregate: { count: true }
+    });
+    const count = bookings.aggregate?.count;
+    out.log(`  bookings: ${String(count ?? "ok")}`);
+  }
   out.log("ok");
 }
+function assertCalendarHealthy(status, expected) {
+  if (!status.enabled || status.provider !== "google") throw new Error("calendar is not enabled with the Google provider");
+  if (status.status !== "healthy") {
+    throw new Error(`calendar connection is ${status.status}${status.error?.message ? `: ${status.error.message}` : ""}`);
+  }
+  if (status.access !== "read") throw new Error("calendar connection is not read-only");
+  const hasReadScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_READ_SCOPE || scope === "calendar.events.readonly");
+  if (!hasReadScope) throw new Error("calendar connection is missing calendar.events.readonly consent");
+  const missing = expected.calendars.filter((id) => !status.calendars.includes(id));
+  if (missing.length) throw new Error(`calendar connection is missing configured calendars: ${missing.join(", ")}`);
+  if (status.lastSuccessfulSyncAt === void 0) throw new Error("calendar has never completed a sync");
+  if (Date.now() - status.lastSuccessfulSyncAt > 30 * 6e4) throw new Error("calendar sync is more than 30 minutes stale");
+  if (status.watchExpiresAt !== void 0 && status.watchExpiresAt <= Date.now()) throw new Error("calendar watch channel is expired");
+}
 async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -2418,7 +3039,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -2426,7 +3047,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return (await res.text()).slice(0, 500);
   } catch {
@@ -2579,8 +3200,13 @@ function printHelp() {
 
 Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
   odla-ai doctor [--config odla.config.mjs]
+  odla-ai calendar status [--env dev] [--json]
+  odla-ai calendar calendars [--env dev] [--json]
+  odla-ai calendar connect [--env dev] [--no-open] [--yes]
+  odla-ai calendar resync [--env dev] [--yes]
+  odla-ai calendar disconnect [--env dev] --yes
   odla-ai capabilities [--json]
   odla-ai admin ai show [--platform https://odla.ai] [--json]
   odla-ai admin ai models [--provider <id>] [--json]
@@ -2601,7 +3227,7 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
@@ -2612,6 +3238,7 @@ Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
+  calendar     Inspect, connect, resync, or disconnect a read-only Google mirror.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
@@ -2632,6 +3259,8 @@ Safety:
   preflights Wrangler before any shown-once issuance or destructive rotation.
   Provision opens the approval page automatically in interactive terminals;
   use --open to force browser launch or --no-open to suppress it.
+  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
+  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
   GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
   for a PAT or provider key. GitHub read access is separate from the explicit
   --ack-redacted-source consent and the exact --plan-digest printed by security
@@ -3131,6 +3760,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await doctor({ configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs" });
     return;
   }
+  if (command === "calendar") {
+    await calendarCommand(parsed, dependencies);
+    return;
+  }
   if (command === "capabilities") {
     assertArgs(parsed, ["json"], 1);
     printCapabilities(parsed.options.json === true);
@@ -3145,14 +3778,19 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     return;
   }
   if (command === "provision") {
-    await provisionCommand(parsed);
+    await provisionCommand(parsed, dependencies);
     return;
   }
   if (command === "smoke") {
-    assertArgs(parsed, ["config", "env"], 1);
+    assertArgs(parsed, ["config", "env", "token", "open"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
-      env: stringOpt(parsed.options.env)
+      env: stringOpt(parsed.options.env),
+      token: stringOpt(parsed.options.token),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: dependencies.openUrl,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
     });
     return;
   }
@@ -3217,7 +3855,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
-async function provisionCommand(parsed) {
+async function provisionCommand(parsed, dependencies) {
   assertArgs(parsed, [
     "config",
     "dry-run",
@@ -3241,10 +3879,38 @@ async function provisionCommand(parsed) {
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-    yes: parsed.options.yes === true
+    yes: parsed.options.yes === true,
+    fetch: dependencies.fetch,
+    openApprovalUrl: dependencies.openUrl,
+    stdout: dependencies.stdout
   };
   await provision(options);
 }
+async function calendarCommand(parsed, dependencies) {
+  const sub = parsed.positionals[1];
+  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "resync" && sub !== "disconnect") {
+    throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
+  }
+  assertArgs(parsed, ["config", "env", "json", "token", "open", "yes"], 2);
+  if (sub !== "status" && sub !== "calendars" && parsed.options.json !== void 0) throw new Error(`--json is supported only by calendar status/calendars`);
+  if ((sub === "status" || sub === "calendars") && parsed.options.yes !== void 0) throw new Error(`--yes is not used by "calendar ${sub}"`);
+  const options = {
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    env: stringOpt(parsed.options.env),
+    token: stringOpt(parsed.options.token),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    yes: parsed.options.yes === true,
+    json: parsed.options.json === true,
+    fetch: dependencies.fetch,
+    stdout: dependencies.stdout,
+    openConsentUrl: dependencies.openUrl
+  };
+  if (sub === "status") await calendarStatus(options);
+  else if (sub === "calendars") await calendarCalendars(options);
+  else if (sub === "connect") await calendarConnect(options);
+  else if (sub === "resync") await calendarResync(options);
+  else await calendarDisconnect(options);
+}
 
 export {
   getScopedPlatformToken,
@@ -3252,7 +3918,15 @@ export {
   adminAi,
   CAPABILITIES,
   printCapabilities,
+  GOOGLE_CALENDAR_READ_SCOPE,
+  calendarServiceConfig,
+  calendarBookingPageUrl,
   redactSecrets,
+  calendarStatus,
+  calendarCalendars,
+  calendarConnect,
+  calendarResync,
+  calendarDisconnect,
   doctor,
   initProject,
   secretsPush,
@@ -3278,4 +3952,4 @@ export {
   smoke,
   runCli
 };
-//# sourceMappingURL=chunk-MJYQ7YDH.js.map
+//# sourceMappingURL=chunk-WDKBW4BE.js.map