@odla-ai/cli 0.9.0 → 0.10.1

package/dist/bin.cjs

@@ -203,14 +203,16 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
     return cached.token;
   }
   const browser = approvalBrowser(options);
+  const email = handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0);
   const { token, expiresAt } = await (0, import_db.requestToken)({
     endpoint: cfg.platformUrl,
+    email,
     label: `${cfg.app.id} provisioner`,
     fetch: doFetch,
-    onCode: async ({ userCode, expiresIn }) => {
-      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
+    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
+      const approvalUrl = verificationUriComplete ?? handshakeUrl(cfg.platformUrl, userCode);
       out.log("");
-      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      out.log(`Review, then approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
       if (browser.open) {
         try {
           await (options.openApprovalUrl ?? openUrl)(approvalUrl);
@@ -224,10 +226,17 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
       out.log("");
     }
   });
-  writePrivateJson(cfg.local.tokenFile, { platform: audience, token, expiresAt });
+  writePrivateJson(cfg.local.tokenFile, { platform: audience, email, token, expiresAt });
   out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
+function handshakeEmail(value, cached) {
+  const email = (value ?? import_node_process2.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
+  }
+  return email;
+}
 function approvalBrowser(options) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
@@ -320,14 +329,16 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     out.log(`auth: using cached ${scope} grant (${tokenFile})`);
     return cached.token;
   }
+  const email = handshakeEmail(options.email, cache?.platform === audience ? cache.email : void 0);
   const { token, expiresAt } = await (0, import_db2.requestToken)({
     endpoint: audience,
+    email,
     label: `odla CLI admin AI (${scope})`,
     scopes: [scope],
     fetch: doFetch,
-    onCode: async ({ userCode, expiresIn }) => {
-      const approvalUrl = handshakeUrl(audience, userCode);
-      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
+      const approvalUrl = verificationUriComplete ?? handshakeUrl(audience, userCode);
+      out.log(`Review, then approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
       const shouldOpen = options.open === true || options.open !== false && !import_node_process4.default.env.CI && Boolean(import_node_process4.default.stdin.isTTY && import_node_process4.default.stdout.isTTY);
       if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
     }
@@ -335,7 +346,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
   tokens[scope] = { token, expiresAt };
   if ((0, import_node_fs2.existsSync)(`${import_node_process4.default.cwd()}/.git`)) ensureGitignore(import_node_process4.default.cwd(), [tokenFile]);
-  writePrivateJson(tokenFile, { platform: audience, tokens });
+  writePrivateJson(tokenFile, { platform: audience, email, tokens });
   out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   return token;
 }
@@ -505,6 +516,7 @@ async function adminAi(options) {
     platform,
     scope,
     token: options.token,
+    email: options.email,
     open: options.open,
     fetch: doFetch,
     stdout: out,
@@ -764,6 +776,7 @@ async function adminCommand(parsed) {
     "platform",
     "json",
     "open",
+    "email",
     "provider",
     "model",
     "enabled",
@@ -791,6 +804,7 @@ async function adminCommand(parsed) {
     maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
     maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
     platform: stringOpt(parsed.options.platform),
+    email: stringOpt(parsed.options.email),
     json: parsed.options.json === true,
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
@@ -810,11 +824,13 @@ async function adminCommand(parsed) {
 // src/capabilities.ts
 var CAPABILITIES = {
   cli: [
+    "start an email-bound device request without accepting a password or user session token",
     "register the app and enable configured services per environment",
     "issue, persist, and explicitly rotate configured service credentials",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
     "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
     "push db schema/rules and configure platform AI, auth, and deployment links",
+    "apply read-only Google calendar mirror and public booking-page config, then drive state-bound consent, status, discovery, resync, and disconnect flows",
     "validate config offline and smoke-test a provisioned db environment",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -823,10 +839,12 @@ var CAPABILITIES = {
   agent: [
     "install and import the selected odla SDKs",
     "wrap the Worker with withObservability and choose useful telemetry",
-    "make application-specific schema, rules, auth, UI, and migration decisions"
+    "make application-specific schema, rules, auth, UI, and migration decisions",
+    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
   ],
   human: [
-    "approve the odla device code and one-off third-party logins",
+    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
+    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
     "consent to production changes with --yes",
     "request destructive credential rotation explicitly",
     "review application semantics, security findings, releases, and merges",
@@ -835,6 +853,8 @@ var CAPABILITIES = {
   ],
   studio: [
     "view telemetry and environment state",
+    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
+    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
     "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
     "configure system AI purposes and view app/environment/run-attributed usage",
     "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
@@ -864,6 +884,7 @@ var import_node_url = require("url");
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
+var GOOGLE_CALENDAR_READ_SCOPE = "https://www.googleapis.com/auth/calendar.events.readonly";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
   const resolved = (0, import_node_path2.resolve)(configPath);
   if (!(0, import_node_fs3.existsSync)(resolved)) {
@@ -876,6 +897,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
   const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  validateCalendarConfig(raw, envs, services, resolved);
   const local = {
     tokenFile: (0, import_node_path2.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
     credentialsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
@@ -920,6 +942,28 @@ function buildPlan(cfg) {
     aiProvider: cfg.ai?.provider
   };
 }
+function calendarServiceConfig(cfg, env) {
+  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
+  if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
+  const google = cfg.calendar?.google;
+  if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
+  return {
+    provider: "google",
+    access: "read",
+    calendars: unique(google.calendars[env].map((id) => id.trim())),
+    match: {
+      organizerSelf: google.match?.organizerSelf ?? true,
+      requireAttendees: google.match?.requireAttendees ?? true,
+      ...google.match?.summaryPrefix !== void 0 ? { summaryPrefix: google.match.summaryPrefix.trim() } : {}
+    },
+    attendeePolicy: google.attendeePolicy ?? "full"
+  };
+}
+function calendarBookingPageUrl(cfg, env) {
+  const value = cfg.calendar?.google.bookingPageUrl?.[env];
+  if (value === void 0 || value === null) return value;
+  return new URL(value).toString();
+}
 function rulesFromSchema(schema) {
   const entities = serializedEntities(schema);
   return Object.fromEntries(
@@ -943,7 +987,85 @@ function validateRawConfig(raw, path) {
   if (!cfg.app || typeof cfg.app !== "object") throw new Error(`${path}: missing app object`);
   if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
   if (!cfg.app.name || typeof cfg.app.name !== "string") throw new Error(`${path}: app.name is required`);
+  if (cfg.envs !== void 0 && (!Array.isArray(cfg.envs) || cfg.envs.some((env) => typeof env !== "string"))) {
+    throw new Error(`${path}: envs must be an array of names`);
+  }
   if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
+  if (cfg.services !== void 0 && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== "string" || !service.trim()))) {
+    throw new Error(`${path}: services must be an array of non-empty names`);
+  }
+}
+function validateCalendarConfig(cfg, envs, services, path) {
+  const enabled = services.includes("calendar");
+  if (!cfg.calendar) {
+    if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
+    return;
+  }
+  if (!isRecord4(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
+  if (!isRecord4(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  const google = cfg.calendar.google;
+  assertOnly(google, ["calendars", "bookingPageUrl", "match", "attendeePolicy"], `${path}: calendar.google`);
+  if (!isRecord4(google.calendars)) throw new Error(`${path}: calendar.google.calendars must map env names to calendar ids`);
+  const unknownEnv = Object.keys(google.calendars).find((env) => !envs.includes(env));
+  if (unknownEnv) throw new Error(`${path}: calendar.google.calendars.${unknownEnv} is not in config envs`);
+  for (const env of envs) {
+    const ids = google.calendars[env];
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.calendars.${env} must be a non-empty array`);
+    }
+    if (ids.length > 10) {
+      throw new Error(`${path}: calendar.google.calendars.${env} must contain at most 10 calendar ids`);
+    }
+    if (ids.some((id) => !safeText(id, 1024))) {
+      throw new Error(`${path}: calendar.google.calendars.${env} contains an invalid calendar id`);
+    }
+  }
+  if (google.bookingPageUrl !== void 0) {
+    if (!isRecord4(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value] of Object.entries(google.bookingPageUrl)) {
+      if (value !== null && !safeHttpsUrl(value)) {
+        throw new Error(`${path}: calendar.google.bookingPageUrl.${env} must be an HTTPS URL without credentials or fragment`);
+      }
+    }
+  }
+  if (google.attendeePolicy !== void 0 && google.attendeePolicy !== "full" && google.attendeePolicy !== "hashed") {
+    throw new Error(`${path}: calendar.google.attendeePolicy must be "full" or "hashed"`);
+  }
+  if (google.match !== void 0) {
+    if (!isRecord4(google.match)) throw new Error(`${path}: calendar.google.match must be an object`);
+    assertOnly(google.match, ["summaryPrefix", "organizerSelf", "requireAttendees"], `${path}: calendar.google.match`);
+    if (google.match.summaryPrefix !== void 0 && !safeText(google.match.summaryPrefix, 256)) {
+      throw new Error(`${path}: calendar.google.match.summaryPrefix must be 1-256 printable characters`);
+    }
+    for (const name of ["organizerSelf", "requireAttendees"]) {
+      if (google.match[name] !== void 0 && typeof google.match[name] !== "boolean") {
+        throw new Error(`${path}: calendar.google.match.${name} must be boolean`);
+      }
+    }
+  }
+  if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
+}
+function assertOnly(value, allowed, label) {
+  const extra = Object.keys(value).find((key) => !allowed.includes(key));
+  if (extra) throw new Error(`${label}.${extra} is not supported`);
+}
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function safeText(value, max) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+}
+function safeHttpsUrl(value) {
+  if (typeof value !== "string" || value.length > 2048) return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password && !url.hash;
+  } catch {
+    return false;
+  }
 }
 function validId(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
@@ -962,11 +1084,6 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
-// src/doctor-checks.ts
-var import_node_child_process3 = require("child_process");
-var import_node_fs5 = require("fs");
-var import_node_path4 = require("path");
-
 // src/redact.ts
 var REPLACEMENTS = [
   [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
@@ -986,6 +1103,427 @@ function looksSecret(value) {
   return redactSecrets(value) !== value || value.includes("-----BEGIN");
 }
 
+// src/calendar-http.ts
+var CALENDAR_STATES = [
+  "not_connected",
+  "authorizing",
+  "needs_sync",
+  "initial_sync",
+  "healthy",
+  "degraded",
+  "disconnected",
+  "failed"
+];
+async function readCalendarStatus(ctx) {
+  return parseCalendarStatus(await calendarJson(ctx, "", {}), ctx.env);
+}
+async function discoverGoogleCalendars(ctx) {
+  const raw = await calendarJson(ctx, "/calendars", {});
+  const value = record(raw);
+  if (!value || !Array.isArray(value.calendars)) throw new Error("calendar discovery returned an invalid response");
+  return value.calendars.map((item, index) => {
+    const calendar = record(item);
+    const id = textField(calendar?.id, 1024);
+    if (!calendar || !id) throw new Error(`calendar discovery returned an invalid calendar at index ${index}`);
+    const role = calendar.accessRole;
+    if (role !== void 0 && role !== "freeBusyReader" && role !== "reader" && role !== "writer" && role !== "owner") {
+      throw new Error(`calendar discovery returned an invalid access role at index ${index}`);
+    }
+    return {
+      id,
+      ...optionalText("summary", calendar.summary, 500),
+      ...typeof calendar.primary === "boolean" ? { primary: calendar.primary } : {},
+      ...typeof calendar.selected === "boolean" ? { selected: calendar.selected } : {},
+      ...typeof role === "string" ? { accessRole: role } : {}
+    };
+  });
+}
+async function applyCalendarSettings(ctx, bookingPageUrl) {
+  return parseCalendarStatus(await calendarJson(ctx, "", { method: "PUT", body: JSON.stringify({ bookingPageUrl }) }), ctx.env);
+}
+async function startCalendarConnection(ctx) {
+  const raw = await calendarJson(ctx, "/google/connect", { method: "POST", body: "{}" });
+  const value = wrapped(raw, "attempt");
+  const attemptId = textField(value.attemptId, 180);
+  const consentUrl = textField(value.consentUrl, 4096);
+  const expiresAt = timestamp3(value.expiresAt);
+  if (!attemptId || !consentUrl || expiresAt === void 0) throw new Error("calendar connect returned an invalid attempt");
+  return { attemptId, consentUrl, expiresAt };
+}
+async function pollCalendarConnection(ctx, attemptId) {
+  return parseCalendarStatus(
+    await calendarJson(ctx, `/google/connect/${encodeURIComponent(identifier(attemptId, "attemptId"))}`, {}),
+    ctx.env
+  );
+}
+async function requestCalendarResync(ctx) {
+  return parseCalendarStatus(await calendarJson(ctx, "/resync", { method: "POST", body: "{}" }), ctx.env);
+}
+async function requestCalendarDisconnect(ctx) {
+  return parseCalendarStatus(
+    await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
+    ctx.env
+  );
+}
+function parseCalendarStatus(raw, env) {
+  const outer = wrapped(raw, "calendar");
+  const value = record(outer.attempt) ?? record(outer.status) ?? outer;
+  const connection = record(value.connection) ?? {};
+  const sync = record(value.sync) ?? record(connection.sync) ?? {};
+  const config = record(value.config) ?? record(outer.config) ?? {};
+  const googleConfig = record(config.google) ?? config;
+  const watches = record(value.watches) ?? {};
+  const stateValue = calendarState(value.status ?? value.state ?? connection.status ?? connection.state);
+  if (!stateValue) {
+    throw new Error("calendar status returned an invalid connection state");
+  }
+  const providerValue = value.provider ?? connection.provider ?? config.provider ?? (config.google ? "google" : void 0);
+  if (providerValue !== void 0 && providerValue !== null && providerValue !== "google") {
+    throw new Error("calendar status returned an unsupported provider");
+  }
+  const accessValue = value.access ?? connection.access ?? config.access ?? googleConfig.access;
+  if (accessValue !== void 0 && accessValue !== "read") throw new Error("calendar status returned unsupported access");
+  const policyValue = value.attendeePolicy ?? config.attendeePolicy ?? googleConfig.attendeePolicy;
+  if (policyValue !== void 0 && policyValue !== "full" && policyValue !== "hashed") {
+    throw new Error("calendar status returned an invalid attendee policy");
+  }
+  const errorValue = record(value.error) ?? record(connection.error);
+  const errorCode = textField(value.lastErrorCode, 128);
+  const bookingPageValue = Object.hasOwn(value, "bookingPageUrl") ? value.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
+  return {
+    env,
+    enabled: typeof value.enabled === "boolean" ? value.enabled : true,
+    connected: typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["needs_sync", "initial_sync", "healthy", "degraded"].includes(stateValue),
+    provider: providerValue === "google" ? "google" : null,
+    status: stateValue,
+    ...accessValue === "read" ? { access: "read" } : {},
+    calendars: calendarIds(value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars),
+    ...policyValue === "full" || policyValue === "hashed" ? { attendeePolicy: policyValue } : {},
+    ...typeof value.attendeePolicyLocked === "boolean" ? { attendeePolicyLocked: value.attendeePolicyLocked } : {},
+    ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
+    grantedScopes: stringList(value.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
+    ...optionalText("attemptId", value.attemptId ?? connection.attemptId, 180),
+    ...optionalNumber("lastSuccessfulSyncAt", value.lastSuccessfulSyncAt ?? sync.lastSuccessfulSyncAt),
+    ...optionalNumber("lastFullSyncAt", value.lastFullSyncAt ?? sync.lastFullSyncAt),
+    ...optionalNumber("watchExpiresAt", value.watchExpiresAt ?? sync.watchExpiresAt ?? watches.nextExpirationAt),
+    ...optionalInteger("bookingCount", value.bookingCount ?? sync.bookingCount),
+    ...errorValue || errorCode ? { error: {
+      ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
+      ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
+      ...!errorValue && errorCode ? { code: errorCode } : {}
+    } } : {}
+  };
+}
+function calendarState(value) {
+  if (typeof value !== "string") return null;
+  if (CALENDAR_STATES.includes(value)) return value;
+  const legacy = {
+    disabled: "not_connected",
+    disconnected: "disconnected",
+    connecting: "authorizing",
+    syncing: "initial_sync",
+    ready: "healthy",
+    error: "failed"
+  };
+  return legacy[value] ?? null;
+}
+async function calendarJson(ctx, suffix, init) {
+  const platform = platformAudience(ctx.platform);
+  const appId = identifier(ctx.appId, "appId");
+  const env = identifier(ctx.env, "env");
+  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/calendar${suffix}`, platform);
+  url.searchParams.set("env", env);
+  const token = credential(ctx.token);
+  let response;
+  try {
+    response = await (ctx.fetch ?? fetch)(url, {
+      ...init,
+      redirect: "error",
+      credentials: "omit",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init.headers }
+    });
+  } catch (error) {
+    throw new Error(`calendar request failed: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const code = textField(body.error?.code, 128);
+    const message = textField(body.error?.message, 500);
+    throw new Error(redactSecrets(`calendar request failed (${response.status})${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`));
+  }
+  return body;
+}
+function wrapped(raw, key) {
+  const outer = record(raw);
+  if (!outer) throw new Error("calendar returned an invalid response");
+  return record(outer[key]) ?? outer;
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function textField(value, max) {
+  return typeof value === "string" && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value) ? value : void 0;
+}
+function stringList(value) {
+  return Array.isArray(value) ? [...new Set(value.filter((item) => !!textField(item, 4096)))] : [];
+}
+function calendarIds(value) {
+  if (!Array.isArray(value)) return [];
+  return [...new Set(value.flatMap((item) => {
+    if (typeof item === "string") return textField(item, 4096) ? [item] : [];
+    const calendar = record(item);
+    const id = textField(calendar?.id, 4096);
+    return id && calendar?.selected !== false ? [id] : [];
+  }))];
+}
+function timestamp3(value) {
+  if (typeof value === "number" && Number.isFinite(value) && value >= 0) return value;
+  if (typeof value === "string") {
+    const parsed = Date.parse(value);
+    if (Number.isFinite(parsed)) return parsed;
+  }
+  return void 0;
+}
+function optionalText(key, value, max) {
+  const parsed = textField(value, max);
+  return parsed ? { [key]: parsed } : {};
+}
+function optionalNumber(key, value) {
+  const parsed = timestamp3(value);
+  return parsed === void 0 ? {} : { [key]: parsed };
+}
+function optionalInteger(key, value) {
+  return Number.isSafeInteger(value) && value >= 0 ? { [key]: value } : {};
+}
+function optionalNullableUrl(key, value) {
+  if (value === null) return { [key]: null };
+  const parsed = textField(value, 4096);
+  return parsed ? { [key]: parsed } : {};
+}
+function identifier(value, name) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,179}$/.test(value)) throw new Error(`${name} is invalid`);
+  return value;
+}
+function credential(value) {
+  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error("calendar requires an odla developer token");
+  }
+  return value;
+}
+
+// src/calendar-poll.ts
+async function waitForCalendarPoll(milliseconds, signal) {
+  if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
+  await new Promise((resolve7, reject) => {
+    const timer = setTimeout(resolve7, milliseconds);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      reject(signal.reason ?? new Error("calendar connection aborted"));
+    }, { once: true });
+  });
+}
+
+// src/calendar.ts
+async function calendarStatus(options) {
+  const { ctx, out } = await lifecycleContext(options);
+  const status = await readCalendarStatus(ctx);
+  printStatus(status, options.json === true, out);
+  return status;
+}
+async function calendarCalendars(options) {
+  const { ctx, out } = await lifecycleContext(options);
+  const calendars = await discoverGoogleCalendars(ctx);
+  if (options.json) out.log(JSON.stringify({ env: ctx.env, calendars }, null, 2));
+  else if (calendars.length === 0) out.log(`${ctx.env}: no Google calendars available`);
+  else for (const calendar of calendars) {
+    out.log(`${calendar.selected ? "\u2713" : calendar.primary ? "*" : " "} ${calendar.id}${calendar.summary ? ` \u2014 ${calendar.summary}` : ""}${calendar.accessRole ? ` (${calendar.accessRole})` : ""}`);
+  }
+  return calendars;
+}
+async function calendarConnect(options) {
+  const { cfg, ctx, out } = await lifecycleContext(options);
+  productionConsent(ctx.env, options.yes, "connect calendar");
+  const page = calendarBookingPageUrl(cfg, ctx.env);
+  const applied = page === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);
+  const connectOptions = connectionOptions(options, out);
+  return await continueConnectedCalendar(ctx, applied, connectOptions, false) ?? connectWithContext(ctx, connectOptions);
+}
+async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
+  if (bookingPageUrl === void 0) return null;
+  const status = await applyCalendarSettings(ctx, bookingPageUrl);
+  out.log(`${ctx.env}: calendar booking page ${bookingPageUrl ? "set" : "cleared"}`);
+  return status;
+}
+async function calendarResync(options) {
+  const { ctx, out } = await lifecycleContext(options);
+  productionConsent(ctx.env, options.yes, "resync calendar");
+  const status = await requestCalendarResync(ctx);
+  out.log(`${ctx.env}: calendar resync requested (${status.status})`);
+  return status;
+}
+async function calendarDisconnect(options) {
+  if (!options.yes) throw new Error("calendar disconnect requires --yes");
+  const { ctx, out } = await lifecycleContext(options);
+  const status = await requestCalendarDisconnect(ctx);
+  out.log(`${ctx.env}: calendar disconnected; retained mirror rows may now be stale`);
+  return status;
+}
+async function ensureCalendarConnected(ctx, options) {
+  const out = options.stdout ?? console;
+  const current = await readCalendarStatus(ctx);
+  const connectOptions = connectionOptions(options, out);
+  return await continueConnectedCalendar(ctx, current, connectOptions, true) ?? connectWithContext(ctx, connectOptions);
+}
+async function lifecycleContext(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
+  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  calendarServiceConfig(cfg, env);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      token: options.token,
+      email: options.email,
+      open: options.open,
+      interactive: options.interactive,
+      openApprovalUrl: options.openConsentUrl
+    },
+    doFetch,
+    out
+  );
+  return { cfg, ctx: { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch }, out };
+}
+function connectionOptions(options, out) {
+  const browser = approvalBrowser({ configPath: "odla.config.mjs", open: options.open, interactive: options.interactive });
+  return {
+    out,
+    open: browser.open,
+    openConsentUrl: options.openConsentUrl,
+    wait: options.wait,
+    pollTimeoutMs: options.pollTimeoutMs,
+    now: options.now,
+    signal: options.signal
+  };
+}
+async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
+  if (current.status === "healthy" || reuseDegraded && current.status === "degraded") {
+    options.out.log(`${ctx.env}: calendar ${reuseDegraded ? "connected" : "already connected"} (${current.status})`);
+    return current;
+  }
+  if (current.status === "degraded") return null;
+  if (current.status === "needs_sync") {
+    if (!current.connected) return null;
+    options.out.log(`${ctx.env}: calendar configuration needs sync`);
+    const synced = await requestCalendarResync(ctx);
+    options.out.log(`${ctx.env}: calendar ${synced.status.replaceAll("_", " ")}`);
+    return synced;
+  }
+  if (current.status === "failed" && current.connected) {
+    const reason = current.error?.message ?? current.error?.code;
+    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+  }
+  const waitingForExisting = current.status === "authorizing" || current.status === "initial_sync" && current.connected;
+  if (!waitingForExisting) return null;
+  const now = options.now ?? Date.now;
+  const deadline = now() + pollTimeout(options.pollTimeoutMs);
+  const wait = options.wait ?? waitForCalendarPoll;
+  let prior = "";
+  while (now() < deadline) {
+    if (options.signal?.aborted) throw options.signal.reason ?? new Error("calendar connection aborted");
+    const status = await readCalendarStatus(ctx);
+    if (status.status !== prior) {
+      options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
+      prior = status.status;
+    }
+    if (status.status === "healthy" || reuseDegraded && status.status === "degraded") return status;
+    if (status.status === "degraded") return null;
+    if (status.status === "needs_sync") return requestCalendarResync(ctx);
+    if (status.status === "failed" && status.connected) {
+      const reason = status.error?.message ?? status.error?.code;
+      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+    }
+    if (status.status !== "authorizing" && (status.status !== "initial_sync" || !status.connected)) return null;
+    await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
+  }
+  throw new Error('Existing Google Calendar authorization or initial sync timed out; run "odla-ai calendar status" and retry');
+}
+async function connectWithContext(ctx, options) {
+  const attempt = await startCalendarConnection(ctx);
+  const consentUrl = trustedCalendarConsentUrl(ctx.platform, attempt.consentUrl);
+  options.out.log(`${ctx.env}: Google Calendar consent: ${consentUrl}`);
+  if (options.open) {
+    await (options.openConsentUrl ?? openUrl)(consentUrl);
+    options.out.log(`${ctx.env}: opened Google Calendar consent in your browser`);
+  }
+  const now = options.now ?? Date.now;
+  const timeout = pollTimeout(options.pollTimeoutMs);
+  const deadline = Math.min(attempt.expiresAt, now() + timeout);
+  const wait = options.wait ?? waitForCalendarPoll;
+  let prior = "";
+  while (now() < deadline) {
+    if (options.signal?.aborted) throw options.signal.reason ?? new Error("calendar connection aborted");
+    const status = await pollCalendarConnection(ctx, attempt.attemptId);
+    if (status.status !== prior) {
+      options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
+      prior = status.status;
+    }
+    if (status.status === "healthy" || status.status === "degraded") return status;
+    if (status.status === "failed" || status.status === "disconnected" || status.status === "not_connected") {
+      const reason = status.error?.message ?? status.error?.code;
+      throw new Error(`calendar connection ${status.status}${reason ? `: ${reason}` : ""}`);
+    }
+    await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
+  }
+  throw new Error('Google Calendar consent or initial sync timed out; run "odla-ai calendar status" and retry connect');
+}
+function trustedCalendarConsentUrl(platform, value) {
+  const origin = platformAudience(platform);
+  let url;
+  try {
+    url = value.startsWith("/") ? new URL(value, origin) : new URL(value);
+  } catch {
+    throw new Error("odla.ai returned an invalid calendar consent URL");
+  }
+  const platformPage = url.origin === origin;
+  const googlePage = url.origin === "https://accounts.google.com" && url.pathname === "/o/oauth2/v2/auth";
+  if (!platformPage && !googlePage || url.username || url.password || url.hash) {
+    throw new Error("odla.ai returned an untrusted calendar consent URL");
+  }
+  return url.toString();
+}
+function pollTimeout(value = 10 * 6e4) {
+  if (!Number.isSafeInteger(value) || value < 1e3 || value > 60 * 6e4) throw new Error("calendar poll timeout must be 1000-3600000ms");
+  return value;
+}
+function productionConsent(env, yes, action) {
+  if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action} for "${env}" without --yes`);
+}
+function printStatus(status, json, out) {
+  if (json) {
+    out.log(JSON.stringify(status, null, 2));
+    return;
+  }
+  out.log(`calendar: ${status.provider ?? "none"}/${status.status} (${status.env})`);
+  out.log(`  access: ${status.access ?? "not granted"}`);
+  out.log(`  calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
+  if (status.attendeePolicy) {
+    out.log(`  attendee policy: ${status.attendeePolicy}${status.attendeePolicyLocked ? " (locked)" : ""}`);
+  }
+  if (status.bookingPageUrl !== void 0) out.log(`  booking page: ${status.bookingPageUrl ?? "not configured"}`);
+  out.log(`  last sync: ${status.lastSuccessfulSyncAt === void 0 ? "never" : new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+  if (status.bookingCount !== void 0) out.log(`  bookings: ${status.bookingCount}`);
+  if (status.error?.code || status.error?.message) out.log(`  error: ${status.error.code ?? "error"}${status.error.message ? ` \u2014 ${status.error.message}` : ""}`);
+}
+
+// src/doctor-checks.ts
+var import_node_child_process3 = require("child_process");
+var import_node_fs5 = require("fs");
+var import_node_path4 = require("path");
+
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
 var import_node_fs4 = require("fs");
@@ -1166,6 +1704,15 @@ function o11yProjectWarnings(rootDir) {
   }
   return warnings;
 }
+function calendarProjectWarnings(rootDir) {
+  const pkg = readPackageJson(rootDir);
+  const dependencies = pkg?.dependencies;
+  const devDependencies = pkg?.devDependencies;
+  if (dependencies?.["@odla-ai/calendar"]) return [];
+  return [
+    devDependencies?.["@odla-ai/calendar"] ? "@odla-ai/calendar is a devDependency \u2014 move it to dependencies so trusted Worker code can import it" : "calendar service is enabled but @odla-ai/calendar is not installed in dependencies"
+  ];
+}
 function readPackageJson(rootDir) {
   try {
     return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(rootDir, "package.json"), "utf8"));
@@ -1191,6 +1738,14 @@ async function doctor(options) {
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+  if (cfg.services.includes("calendar")) {
+    const calendar = cfg.envs.map((env) => `${env}:${calendarServiceConfig(cfg, env).calendars.length}`).join(", ");
+    out.log(`calendar: google/read-only (${calendar}; attendee ${cfg.calendar?.google.attendeePolicy ?? "full"})`);
+    const pages = cfg.envs.map((env) => `${env}:${calendarBookingPageUrl(cfg, env) ?? "none"}`).join(", ");
+    out.log(`booking pages: ${pages}`);
+  } else {
+    out.log("calendar: not enabled");
+  }
   const warnings = [];
   if (schema && entities.length === 0) warnings.push("schema has no entities");
   if (rules) {
@@ -1218,6 +1773,8 @@ async function doctor(options) {
     }
     warnings.push(...o11yProjectWarnings(cfg.rootDir));
   }
+  if (cfg.services.includes("calendar")) warnings.push(...calendarProjectWarnings(cfg.rootDir));
+  else if (cfg.calendar) warnings.push('calendar config is present but "calendar" is not in services');
   warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
   warnings.push(...trackedSecretFiles(cfg.rootDir, void 0, [
     cfg.local.tokenFile,
@@ -1245,10 +1802,15 @@ function printHelp() {
 
 Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
   odla-ai doctor [--config odla.config.mjs]
+  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
+  odla-ai calendar resync [--env dev] [--email <odla-account>] [--yes]
+  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
   odla-ai capabilities [--json]
-  odla-ai admin ai show [--platform https://odla.ai] [--json]
+  odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
   odla-ai admin ai models [--provider <id>] [--json]
   odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
   odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
@@ -1257,7 +1819,7 @@ Usage:
   odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
   odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
   odla-ai admin ai audit [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--no-open]
+  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai security github disconnect --source <id> [--env dev] [--yes]
   odla-ai security plan [--env dev] [--json]
   odla-ai security sources [--env dev] [--json]
@@ -1266,18 +1828,19 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
-  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
   odla-ai version
 
 Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
+  calendar     Inspect, connect, resync, or disconnect a read-only Google mirror.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
@@ -1298,6 +1861,12 @@ Safety:
   preflights Wrangler before any shown-once issuance or destructive rotation.
   Provision opens the approval page automatically in interactive terminals;
   use --open to force browser launch or --no-open to suppress it.
+  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
+  The email is a non-secret identity hint: never provide a password or session
+  token. The matching account must already exist, be signed in, explicitly
+  review the exact code, and finish any current request before claiming another.
+  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
+  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
   GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
   for a PAT or provider key. GitHub read access is separate from the explicit
   --ack-redacted-source consent and the exact --plan-digest printed by security
@@ -1342,6 +1911,7 @@ function initProject(options) {
   }
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
+  if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
   (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
   (0, import_node_fs7.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
@@ -1359,6 +1929,16 @@ function writeIfMissing(path, text) {
   (0, import_node_fs7.writeFileSync)(path, text);
 }
 function configTemplate(input) {
+  const calendar = input.services.includes("calendar") ? `  calendar: {
+    google: {
+      calendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
+      bookingPageUrl: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, null])))},
+      match: { organizerSelf: true, requireAttendees: true },
+      attendeePolicy: "full",
+      // Read-only in this release. Google consent happens in Studio during provision.
+    },
+  },
+` : "";
   return `export default {
   platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
   dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
@@ -1380,6 +1960,7 @@ function configTemplate(input) {
     // key in the platform vault for each tenant.
     keyEnv: "${defaultKeyEnv(input.aiProvider)}",
   },
+${calendar}
   auth: {
     clerk: {
       // dev: "$CLERK_PUBLISHABLE_KEY",
@@ -1506,14 +2087,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText2(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText2(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -1529,12 +2110,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText2(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText(res) {
+async function safeText2(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -1647,6 +2228,14 @@ async function provision(options) {
     out.log(`  schema: ${schema ? "yes" : "no"}`);
     out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
     out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+    if (cfg.services.includes("calendar")) {
+      for (const env of cfg.envs) {
+        const calendar = calendarServiceConfig(cfg, env);
+        out.log(`  calendar.${env}: google/read, ${calendar.calendars.join(", ")} (${calendar.attendeePolicy}; ${GOOGLE_CALENDAR_READ_SCOPE})`);
+        const bookingPage = calendarBookingPageUrl(cfg, env);
+        out.log(`  calendar.${env}.bookingPageUrl: ${bookingPage === void 0 ? "unchanged" : bookingPage ?? "clear"}`);
+      }
+    }
     out.log(`  secrets: ${options.pushSecrets ? "push configured Worker secrets" : "local only"}`);
     return;
   }
@@ -1681,8 +2270,9 @@ async function provision(options) {
     await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
     out.log(`app: created ${cfg.app.id}`);
   }
+  const serviceOrder = [...cfg.services].sort((a, b) => serviceRank(a) - serviceRank(b));
   for (const env of cfg.envs) {
-    for (const service of cfg.services) {
+    for (const service of serviceOrder) {
       if (service === "ai") {
         if (cfg.ai?.provider) {
           await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
@@ -1692,7 +2282,8 @@ async function provision(options) {
           out.log(`${env}: ai enabled`);
         }
       } else {
-        await apps.setService(cfg.app.id, service, true, { env });
+        const config = service === "calendar" ? calendarServiceConfig(cfg, env) : void 0;
+        await apps.setService(cfg.app.id, service, true, { env, ...config ? { config } : {} });
         out.log(`${env}: ${service} enabled`);
       }
     }
@@ -1706,6 +2297,21 @@ async function provision(options) {
       await apps.setLink(cfg.app.id, env, link ?? null);
       out.log(`${env}: link ${link ? "set" : "cleared"}`);
     }
+    if (cfg.services.includes("calendar")) {
+      const calendarCtx = { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch };
+      await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);
+      await ensureCalendarConnected(
+        calendarCtx,
+        {
+          open: options.open,
+          interactive: options.interactive,
+          openConsentUrl: options.openApprovalUrl,
+          wait: options.calendarPollWait,
+          pollTimeoutMs: options.calendarPollTimeoutMs,
+          stdout: out
+        }
+      );
+    }
   }
   for (const env of cfg.envs) {
     const tenantId = (0, import_apps2.tenantIdFor)(cfg.app.id, env);
@@ -1769,6 +2375,11 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
 }
+function serviceRank(service) {
+  if (service === "db") return 0;
+  if (service === "calendar") return 2;
+  return 1;
+}
 async function readRegistryApp(cfg, token, doFetch) {
   const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -1784,7 +2395,7 @@ async function postJson(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
 }
 function normalizeClerkConfig(value) {
   if (!value) return null;
@@ -1801,7 +2412,7 @@ function defaultSecretName(provider) {
   const names = import_ai.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
-async function safeText2(res) {
+async function safeText3(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -1884,7 +2495,7 @@ async function hostedSecurityContext(parsed, dependencies) {
   const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
   const token = await getDeveloperToken(
     cfg,
-    { configPath, open, openApprovalUrl: dependencies.openUrl },
+    { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
     doFetch,
     stdout
   );
@@ -2502,6 +3113,7 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     "source",
     "ref",
     "follow",
+    "email",
     "open",
     "json",
     "ack-redacted-source",
@@ -2590,6 +3202,7 @@ async function runLocalSecurityCommand(parsed, dependencies) {
     "platform",
     "self",
     "ack-redacted-source",
+    "email",
     "open",
     "fail-on",
     "fail-on-candidates",
@@ -2619,6 +3232,7 @@ async function runLocalSecurityCommand(parsed, dependencies) {
         return getScopedPlatformToken({
           platform: request.platform,
           scope: request.scope,
+          email: stringOpt(parsed.options.email),
           open,
           fetch: doFetch,
           stdout: out,
@@ -2631,7 +3245,7 @@ async function runLocalSecurityCommand(parsed, dependencies) {
       }
       return getDeveloperToken(
         cfg,
-        { configPath, open, openApprovalUrl: dependencies.openUrl },
+        { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
         doFetch,
         out
       );
@@ -2665,7 +3279,7 @@ async function securityCommand(parsed, dependencies) {
     return;
   }
   if (sub === "plan") {
-    assertArgs(parsed, ["config", "env", "platform", "open", "json"], 2);
+    assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 2);
     const context = await hostedSecurityContext(parsed, dependencies);
     const plan = await getHostedSecurityPlan(context);
     if (parsed.options.json === true) context.stdout.log(JSON.stringify(plan, null, 2));
@@ -2681,7 +3295,7 @@ async function securityCommand(parsed, dependencies) {
     return;
   }
   if (sub === "report") {
-    assertArgs(parsed, ["config", "env", "platform", "open", "json"], 3);
+    assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
     const report = await getHostedSecurityReport({ ...context, jobId });
@@ -2699,7 +3313,7 @@ async function securityCommand(parsed, dependencies) {
 async function githubSecurityCommand(parsed, dependencies) {
   const action = parsed.positionals[2];
   if (action === "disconnect") {
-    assertArgs(parsed, ["config", "env", "platform", "source", "open", "yes"], 3);
+    assertArgs(parsed, ["config", "env", "platform", "source", "email", "open", "yes"], 3);
     const context2 = await hostedSecurityContext(parsed, dependencies);
     const sourceId = requiredString(parsed.options.source, "--source");
     const confirmed = parsed.options.yes === true || await interactiveConfirmation(
@@ -2716,7 +3330,7 @@ async function githubSecurityCommand(parsed, dependencies) {
   if (action !== "connect") {
     throw new Error('unknown security github command. Try "odla-ai security github connect".');
   }
-  assertArgs(parsed, ["config", "env", "platform", "repo", "open"], 3);
+  assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
   const context = await hostedSecurityContext(parsed, dependencies);
   const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin);
   const connection = await connectGitHubSecuritySource({
@@ -2731,7 +3345,7 @@ async function githubSecurityCommand(parsed, dependencies) {
   context.stdout.log("github: odla.ai stores the installation; no PAT or GitHub token is written locally");
 }
 async function listSecuritySources(parsed, dependencies) {
-  assertArgs(parsed, ["config", "env", "platform", "open", "json"], 2);
+  assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 2);
   const context = await hostedSecurityContext(parsed, dependencies);
   const [plan, sources] = await Promise.all([
     getHostedSecurityPlan(context),
@@ -2753,7 +3367,7 @@ source	repository	default ref	status`);
   }
 }
 async function securityStatus(parsed, dependencies) {
-  assertArgs(parsed, ["config", "env", "platform", "open", "json", "follow"], 3);
+  assertArgs(parsed, ["config", "env", "platform", "email", "open", "json", "follow"], 3);
   const jobId = requiredSecurityPositional(parsed, 2, "job id");
   const context = await hostedSecurityContext(parsed, dependencies);
   const job = parsed.options.follow === true ? await followHostedSecurityJob({
@@ -3050,6 +3664,24 @@ async function smoke(options) {
     }
     out.log(`  ai: ${provider}`);
   }
+  if (cfg.services.includes("calendar")) {
+    const token = await getDeveloperToken(
+      cfg,
+      {
+        configPath: cfg.configPath,
+        token: options.token,
+        email: options.email,
+        open: options.open,
+        interactive: options.interactive,
+        openApprovalUrl: options.openApprovalUrl
+      },
+      doFetch,
+      out
+    );
+    const status = await readCalendarStatus({ platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch });
+    assertCalendarHealthy(status, calendarServiceConfig(cfg, env));
+    out.log(`  calendar: ${status.status}, last sync ${new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+  }
   const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
   const expectedEntities = serializedEntities(expectedSchema);
   const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
@@ -3071,13 +3703,35 @@ async function smoke(options) {
   } else {
     out.log(`  aggregate: skipped (schema has no entities)`);
   }
+  if (cfg.services.includes("calendar")) {
+    const bookings = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      ns: "$bookings",
+      aggregate: { count: true }
+    });
+    const count = bookings.aggregate?.count;
+    out.log(`  bookings: ${String(count ?? "ok")}`);
+  }
   out.log("ok");
 }
+function assertCalendarHealthy(status, expected) {
+  if (!status.enabled || status.provider !== "google") throw new Error("calendar is not enabled with the Google provider");
+  if (status.status !== "healthy") {
+    throw new Error(`calendar connection is ${status.status}${status.error?.message ? `: ${status.error.message}` : ""}`);
+  }
+  if (status.access !== "read") throw new Error("calendar connection is not read-only");
+  const hasReadScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_READ_SCOPE || scope === "calendar.events.readonly");
+  if (!hasReadScope) throw new Error("calendar connection is missing calendar.events.readonly consent");
+  const missing = expected.calendars.filter((id) => !status.calendars.includes(id));
+  if (missing.length) throw new Error(`calendar connection is missing configured calendars: ${missing.join(", ")}`);
+  if (status.lastSuccessfulSyncAt === void 0) throw new Error("calendar has never completed a sync");
+  if (Date.now() - status.lastSuccessfulSyncAt > 30 * 6e4) throw new Error("calendar sync is more than 30 minutes stale");
+  if (status.watchExpiresAt !== void 0 && status.watchExpiresAt <= Date.now()) throw new Error("calendar watch channel is expired");
+}
 async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -3086,7 +3740,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -3094,7 +3748,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return (await res.text()).slice(0, 500);
   } catch {
@@ -3142,6 +3796,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await doctor({ configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs" });
     return;
   }
+  if (command === "calendar") {
+    await calendarCommand(parsed, dependencies);
+    return;
+  }
   if (command === "capabilities") {
     assertArgs(parsed, ["json"], 1);
     printCapabilities(parsed.options.json === true);
@@ -3156,14 +3814,20 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     return;
   }
   if (command === "provision") {
-    await provisionCommand(parsed);
+    await provisionCommand(parsed, dependencies);
     return;
   }
   if (command === "smoke") {
-    assertArgs(parsed, ["config", "env"], 1);
+    assertArgs(parsed, ["config", "env", "token", "email", "open"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
-      env: stringOpt(parsed.options.env)
+      env: stringOpt(parsed.options.env),
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      openApprovalUrl: dependencies.openUrl,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
     });
     return;
   }
@@ -3197,7 +3861,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   if (command === "secrets") {
     const sub = parsed.positionals[1];
     if (sub === "set" || sub === "set-clerk-key") {
-      assertArgs(parsed, ["config", "env", "from-env", "stdin", "token", "yes"], sub === "set" ? 3 : 2);
+      assertArgs(parsed, ["config", "env", "from-env", "stdin", "token", "email", "yes"], sub === "set" ? 3 : 2);
       const options = {
         configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
         name: parsed.positionals[2],
@@ -3205,6 +3869,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
         fromEnv: stringOpt(parsed.options["from-env"]),
         stdin: parsed.options.stdin === true,
         token: stringOpt(parsed.options.token),
+        email: stringOpt(parsed.options.email),
         yes: parsed.options.yes === true,
         fetch: dependencies.fetch,
         stdout: dependencies.stdout
@@ -3228,7 +3893,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
-async function provisionCommand(parsed) {
+async function provisionCommand(parsed, dependencies) {
   assertArgs(parsed, [
     "config",
     "dry-run",
@@ -3238,6 +3903,7 @@ async function provisionCommand(parsed) {
     "write-credentials",
     "write-dev-vars",
     "token",
+    "email",
     "open",
     "yes"
   ], 1);
@@ -3251,11 +3917,41 @@ async function provisionCommand(parsed) {
     writeCredentials: parsed.options["write-credentials"] !== false,
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-    yes: parsed.options.yes === true
+    yes: parsed.options.yes === true,
+    fetch: dependencies.fetch,
+    openApprovalUrl: dependencies.openUrl,
+    stdout: dependencies.stdout
   };
   await provision(options);
 }
+async function calendarCommand(parsed, dependencies) {
+  const sub = parsed.positionals[1];
+  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "resync" && sub !== "disconnect") {
+    throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
+  }
+  assertArgs(parsed, ["config", "env", "json", "token", "email", "open", "yes"], 2);
+  if (sub !== "status" && sub !== "calendars" && parsed.options.json !== void 0) throw new Error(`--json is supported only by calendar status/calendars`);
+  if ((sub === "status" || sub === "calendars") && parsed.options.yes !== void 0) throw new Error(`--yes is not used by "calendar ${sub}"`);
+  const options = {
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    env: stringOpt(parsed.options.env),
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    yes: parsed.options.yes === true,
+    json: parsed.options.json === true,
+    fetch: dependencies.fetch,
+    stdout: dependencies.stdout,
+    openConsentUrl: dependencies.openUrl
+  };
+  if (sub === "status") await calendarStatus(options);
+  else if (sub === "calendars") await calendarCalendars(options);
+  else if (sub === "connect") await calendarConnect(options);
+  else if (sub === "resync") await calendarResync(options);
+  else await calendarDisconnect(options);
+}
 
 // src/bin.ts
 runCli().catch((err) => {