P375:[{"_390":95,"_391":99,"_392":393},"app1","app2","diffPatch","diff --git a/.env b/.env\nindex b0cc267..9e29e6a 100644\n--- a/.env\n+++ b/.env\n@@ -1,14 +1,2 @@\n-# Example environment variables for local dev, test, and preview deploys.\n-# Copy this to `.env` for local development and local tests.\n-\n-# Required\n-COOKIE_SECRET=79c7d07db29567bc273192c55b1a613bfdc73097c134ef00573a372c51c2ae78\n-\n # Optional (preview uses request origin by default)\n APP_BASE_URL=\n-\n-# Resend (optional; preview deploys overwrite these to point at the mock services)\n-RESEND_API_BASE_URL=\n-RESEND_API_KEY=\n-RESEND_FROM_EMAIL=reset@epic-scheduler.dev\n-\ndiff --git a/.env.example b/.env.example\nindex 2090ada..a1432f9 100644\n--- a/.env.example\n+++ b/.env.example\n@@ -1,14 +1,6 @@\n # Example environment variables for local dev, test, and preview deploys.\n # Copy this to `.env` for local development and local tests.\n \n-# Required\n-COOKIE_SECRET=LOCAL_AND_PREVIEW_COOKIE_SECRET_32_CHARS_MINIMUM\n-\n # Optional (preview uses request origin by default)\n APP_BASE_URL=\n \n-# Resend (optional; preview deploys overwrite these to point at the mock services)\n-RESEND_API_BASE_URL=\n-RESEND_API_KEY=\n-RESEND_FROM_EMAIL=reset@epic-scheduler.dev\n-\ndiff --git a/AGENTS.md b/AGENTS.md\nindex a1beeaa..a8901a1 100644\n--- a/AGENTS.md\n+++ b/AGENTS.md\n@@ -24,5 +24,4 @@ This file is intentionally brief. Detailed instructions live in focused docs:\n - Architecture references:\n - [docs/architecture/index.md](./docs/architecture/index.md)\n - [docs/architecture/request-lifecycle.md](./docs/architecture/request-lifecycle.md)\n- - [docs/architecture/authentication.md](./docs/architecture/authentication.md)\n - [docs/architecture/data-storage.md](./docs/architecture/data-storage.md)\ndiff --git a/cli.ts b/cli.ts\nindex c903ba3..79b0586 100644\n--- a/cli.ts\n+++ b/cli.ts\n@@ -1,14 +1,10 @@\n import { spawn, type ChildProcess } from 'node:child_process'\n-import { randomUUID } from 'node:crypto'\n import { platform } from 'node:os'\n import readline from 'node:readline'\n import { setTimeout as delay } from 'node:timers/promises'\n import getPort, { clearLockedPorts } from 'get-port'\n \n const defaultWorkerPort = 3742\n-const defaultMockPort = 8788\n-const mockReadyTimeoutMs = 10_000\n-const mockReadyPollMs = 200\n \n const ansiReset = '\\x1b[0m'\n const ansiBright = '\\x1b[1m'\n@@ -48,8 +44,6 @@ const extraArgs = process.argv.slice(2)\n let shutdown: (() => void) | null = null\n let devChildren: Array = []\n let workerOrigin = ''\n-let mockResendProcess: ChildProcess | null = null\n-let mockEnvOverrides: Record = {}\n \n void startDev()\n \n@@ -61,7 +55,7 @@ async function startDev() {\n \t})\n \tshutdown = setupShutdown(\n \t\t() => devChildren,\n-\t\t() => mockResendProcess,\n+\t\t() => null,\n \t)\n }\n \n@@ -230,7 +224,6 @@ async function restartDev(\n \t{ announce }: { announce: boolean } = { announce: true },\n ) {\n \tawait stopChildren(devChildren)\n-\tconst mockEnv = await ensureMockServers()\n \tconst desiredPort = Number.parseInt(\n \t\tprocess.env.PORT ?? String(defaultWorkerPort),\n \t\t10,\n@@ -253,7 +246,7 @@ async function restartDev(\n \tconst worker = runNpmScript(\n \t\t'dev:worker',\n \t\textraArgs,\n-\t\t{ PORT: String(workerPort), ...mockEnv },\n+\t\t{ PORT: String(workerPort) },\n \t\t{ outputFilter: 'worker' },\n \t)\n \tdevChildren = [client, worker]\n@@ -264,87 +257,6 @@ async function restartDev(\n \t}\n }\n \n-function hasEnvValue(value: string | undefined) {\n-\treturn typeof value === 'string' && value.trim().length > 0\n-}\n-\n-async function isMockReady(baseUrl: string) {\n-\ttry {\n-\t\tconst response = await fetch(`${baseUrl}/__mocks/meta`)\n-\t\tawait response.body?.cancel()\n-\t\treturn response.ok\n-\t} catch {\n-\t\treturn false\n-\t}\n-}\n-\n-async function waitForMockReady(baseUrl: string, child: ChildProcess) {\n-\tconst start = Date.now()\n-\twhile (Date.now() - start < mockReadyTimeoutMs) {\n-\t\tif (child.killed || child.exitCode !== null) {\n-\t\t\treturn false\n-\t\t}\n-\t\tif (await isMockReady(baseUrl)) {\n-\t\t\treturn true\n-\t\t}\n-\t\tawait delay(mockReadyPollMs)\n-\t}\n-\treturn false\n-}\n-\n-async function ensureMockServers() {\n-\tif (\n-\t\tmockResendProcess &&\n-\t\t!mockResendProcess.killed &&\n-\t\tmockResendProcess.exitCode === null\n-\t) {\n-\t\treturn mockEnvOverrides\n-\t}\n-\tconst desiredPort = Number.parseInt(\n-\t\tprocess.env.MOCK_API_PORT ?? String(defaultMockPort),\n-\t\t10,\n-\t)\n-\tconst portRange = Array.from(\n-\t\t{ length: 10 },\n-\t\t(_, index) => desiredPort + index,\n-\t)\n-\tconst mockPort = await getPort({ port: portRange })\n-\tconst baseUrl = `http://127.0.0.1:${mockPort}`\n-\tconst apiToken = `mock-resend-${randomUUID()}`\n-\tconst child = runNpmScript(\n-\t\t'dev:mock-resend',\n-\t\t[\n-\t\t\t'--port',\n-\t\t\tString(mockPort),\n-\t\t\t'--ip',\n-\t\t\t'127.0.0.1',\n-\t\t\t'--var',\n-\t\t\t`MOCK_API_TOKEN:${apiToken}`,\n-\t\t],\n-\t\t{},\n-\t)\n-\tmockResendProcess = child\n-\tchild.once('exit', () => {\n-\t\tmockResendProcess = null\n-\t})\n-\tmockEnvOverrides = {\n-\t\tRESEND_API_BASE_URL: baseUrl,\n-\t\tRESEND_API_KEY: apiToken,\n-\t}\n-\tif (!hasEnvValue(process.env.RESEND_FROM_EMAIL)) {\n-\t\tmockEnvOverrides.RESEND_FROM_EMAIL = 'reset@epic-scheduler.dev'\n-\t}\n-\tconst didStart = await waitForMockReady(baseUrl, child)\n-\tif (!didStart) {\n-\t\tconsole.warn(\n-\t\t\t`Mock API worker did not become ready within ${mockReadyTimeoutMs}ms.`,\n-\t\t)\n-\t}\n-\tconsole.log(dim(`Mock API worker running at ${baseUrl}`))\n-\tconsole.log(dim(`Resend mock base URL ${baseUrl}`))\n-\treturn mockEnvOverrides\n-}\n-\n async function stopChildren(children: Array) {\n \tawait Promise.all(children.map((child) => stopChild(child)))\n }\ndiff --git a/client/app-session-refresh.test.ts b/client/app-session-refresh.test.ts\ndeleted file mode 100644\nindex 5c6acb3..0000000\n--- a/client/app-session-refresh.test.ts\n+++ /dev/null\n@@ -1,80 +0,0 @@\n-import { expect, test, vi } from 'vitest'\n-import { type Handle } from 'remix/component'\n-\n-type QueueTask = Parameters[0]\n-\n-const navigationListeners: Array<() => void> = []\n-const queuedSessionResponses: Array<{ email: string } | null> = []\n-const fetchSessionInfoMock = vi.fn(async () => {\n-\treturn queuedSessionResponses.shift() ?? null\n-})\n-\n-vi.mock('./client-router.tsx', () => ({\n-\trouterEvents: new EventTarget(),\n-\tlistenToRouterNavigation: (_handle: Handle, listener: () => void) => {\n-\t\tnavigationListeners.push(listener)\n-\t},\n-\tgetPathname: () => '/',\n-\tnavigate: () => {\n-\t\treturn\n-\t},\n-\tRouter: () => () => null,\n-}))\n-\n-vi.mock('./session.ts', () => ({\n-\tfetchSessionInfo: fetchSessionInfoMock,\n-}))\n-\n-const { App } = await import('./app.tsx')\n-\n-function inspect(value: unknown) {\n-\treturn JSON.stringify(value)\n-}\n-\n-async function runNextTask(tasks: Array, aborted: boolean) {\n-\tconst task = tasks.shift()\n-\texpect(task).toBeDefined()\n-\tconst controller = new AbortController()\n-\tif (aborted) controller.abort()\n-\tawait task!(controller.signal)\n-}\n-\n-test('aborted refresh does not erase a ready authenticated session', async () => {\n-\tnavigationListeners.length = 0\n-\tqueuedSessionResponses.length = 0\n-\tqueuedSessionResponses.push({ email: 'signed-in@example.com' }, null)\n-\n-\tconst queuedTasks: Array = []\n-\tconst handle = {\n-\t\tqueueTask(task: QueueTask) {\n-\t\t\tqueuedTasks.push(task)\n-\t\t},\n-\t\tasync update() {\n-\t\t\treturn new AbortController().signal\n-\t\t},\n-\t\ton() {\n-\t\t\treturn\n-\t\t},\n-\t} as unknown as Handle\n-\n-\tconst render = App(handle)\n-\texpect(navigationListeners).toHaveLength(1)\n-\n-\t// Initial bootstrap task enqueues the session fetch.\n-\tawait runNextTask(queuedTasks, false)\n-\tawait runNextTask(queuedTasks, false)\n-\n-\tconst authenticatedUi = inspect(render())\n-\texpect(authenticatedUi).toContain('signed-in@example.com')\n-\texpect(authenticatedUi).toContain('Log out')\n-\n-\t// Re-run refresh via navigation, then abort in-flight fetch.\n-\tnavigationListeners[0]!()\n-\tawait runNextTask(queuedTasks, true)\n-\n-\tconst uiAfterAbort = inspect(render())\n-\texpect(uiAfterAbort).toContain('signed-in@example.com')\n-\texpect(uiAfterAbort).toContain('Log out')\n-\texpect(uiAfterAbort).not.toContain('>Login<')\n-\texpect(uiAfterAbort).not.toContain('>Signup<')\n-})\ndiff --git a/client/app.tsx b/client/app.tsx\nindex d5cb400..6e838e9 100644\n--- a/client/app.tsx\n+++ b/client/app.tsx\n@@ -1,53 +1,9 @@\n import { type Handle } from 'remix/component'\n import { clientRoutes } from './routes/index.tsx'\n-import { listenToRouterNavigation, Router } from './client-router.tsx'\n-import {\n-\tfetchSessionInfo,\n-\ttype SessionInfo,\n-\ttype SessionStatus,\n-} from './session.ts'\n-import { buildAuthLink } from './auth-links.ts'\n+import { Router } from './client-router.tsx'\n import { colors, spacing, typography } from './styles/tokens.ts'\n \n-export function App(handle: Handle) {\n-\tlet session: SessionInfo | null = null\n-\tlet sessionStatus: SessionStatus = 'idle'\n-\tlet sessionRefreshInFlight = false\n-\tlet sessionRefreshQueued = false\n-\n-\tfunction queueSessionRefresh() {\n-\t\tsessionRefreshQueued = true\n-\t\tif (sessionRefreshInFlight) return\n-\n-\t\t// Preserve current nav state during refreshes after first load.\n-\t\tif (sessionStatus === 'idle') {\n-\t\t\tsessionStatus = 'loading'\n-\t\t\thandle.update()\n-\t\t}\n-\n-\t\tsessionRefreshQueued = false\n-\t\tsessionRefreshInFlight = true\n-\t\thandle.queueTask(async (signal) => {\n-\t\t\tconst nextSession = await fetchSessionInfo(signal)\n-\t\t\tsessionRefreshInFlight = false\n-\t\t\tif (signal.aborted) return\n-\t\t\tsession = nextSession\n-\t\t\tsessionStatus = 'ready'\n-\t\t\thandle.update()\n-\t\t\tif (sessionRefreshQueued) {\n-\t\t\t\tqueueSessionRefresh()\n-\t\t\t}\n-\t\t})\n-\t\tif (sessionStatus !== 'loading') {\n-\t\t\thandle.update()\n-\t\t}\n-\t}\n-\n-\thandle.queueTask(() => {\n-\t\tqueueSessionRefresh()\n-\t})\n-\tlistenToRouterNavigation(handle, queueSessionRefresh)\n-\n+export function App(_handle: Handle) {\n \tconst navLinkCss = {\n \t\tcolor: colors.primaryText,\n \t\tfontWeight: typography.fontWeight.medium,\n@@ -57,33 +13,11 @@ export function App(handle: Handle) {\n \t\t},\n \t}\n \n-\tconst logOutButtonCss = {\n-\t\tpadding: `${spacing.xs} ${spacing.md}`,\n-\t\tborderRadius: '999px',\n-\t\tborder: `1px solid ${colors.border}`,\n-\t\tbackgroundColor: 'transparent',\n-\t\tcolor: colors.text,\n-\t\tfontWeight: typography.fontWeight.medium,\n-\t\tcursor: 'pointer',\n-\t}\n-\n \treturn () => {\n-\t\tconst sessionEmail = session?.email ?? ''\n-\t\tconst isSessionReady = sessionStatus === 'ready'\n-\t\tconst isLoggedIn = isSessionReady && Boolean(sessionEmail)\n-\t\tconst showAuthLinks = isSessionReady && !isLoggedIn\n-\t\tconst oauthRedirectTo =\n-\t\t\ttypeof window !== 'undefined' &&\n-\t\t\twindow.location.pathname === '/oauth/authorize'\n-\t\t\t\t? `${window.location.pathname}${window.location.search}`\n-\t\t\t\t: null\n-\t\tconst loginHref = buildAuthLink('/login', oauthRedirectTo)\n-\t\tconst signupHref = buildAuthLink('/signup', oauthRedirectTo)\n-\n \t\treturn (\n \t\t\t\n \t\t\t\t\t\n-\t\t\t\t\t\tHome\n-\t\t\t\t\t\n-\t\t\t\t\t{showAuthLinks ? (\n-\t\t\t\t\t\t<>\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\tLogin\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\tSignup\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t) : null}\n-\t\t\t\t\t{isLoggedIn ? (\n-\t\t\t\t\t\t<>\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\tChat\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\t{sessionEmail}\n+\t\t\t\t\t\tEpic Scheduler\n \t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t) : null}\n \t\t\t\t\n \t\t\t\t | undefined) {\n-\tconst theme = source?.theme\n-\treturn theme === 'dark' || theme === 'light' ? theme : undefined\n-}\n-\n-function initializeCalculatorWidget() {\n-\tconst documentRef = globalThis.document\n-\tconst windowRef = globalThis.window\n-\tif (!documentRef || !windowRef) return\n-\n-\tconst rootElement = documentRef.documentElement\n-\tconst expressionElement =\n-\t\tdocumentRef.querySelector('[data-expression]')\n-\tconst resultElement = documentRef.querySelector('[data-result]')\n-\tconst keyElements = Array.from(\n-\t\tdocumentRef.querySelectorAll('[data-action]'),\n-\t)\n-\n-\tif (!expressionElement || !resultElement) {\n-\t\treturn\n-\t}\n-\tconst expressionDisplayElement = expressionElement\n-\tconst resultDisplayElement = resultElement\n-\n-\tconst state: CalculatorState = {\n-\t\tleftOperand: null,\n-\t\toperator: null,\n-\t\tdisplayValue: '0',\n-\t\twaitingForNextOperand: false,\n-\t\texpressionText: '',\n-\t}\n-\n-\tfunction applyTheme(theme: string | undefined) {\n-\t\tif (theme === 'dark' || theme === 'light') {\n-\t\t\trootElement.setAttribute('data-theme', theme)\n-\t\t\treturn\n-\t\t}\n-\t\trootElement.removeAttribute('data-theme')\n-\t}\n-\n-\tconst hostBridge = createWidgetHostBridge({\n-\t\tappInfo: {\n-\t\t\tname: 'calculator-widget',\n-\t\t\tversion: '1.0.0',\n-\t\t},\n-\t\tonRenderData: (renderData) => {\n-\t\t\tapplyTheme(readTheme(renderData))\n-\t\t},\n-\t\tonHostContextChanged: (hostContext) => {\n-\t\t\tapplyTheme(readTheme(hostContext))\n-\t\t},\n-\t})\n-\n-\tfunction formatNumber(value: number) {\n-\t\tif (!Number.isFinite(value)) return 'Error'\n-\t\treturn Number(value.toPrecision(12)).toString()\n-\t}\n-\n-\tfunction compute(\n-\t\tleft: number,\n-\t\toperator: CalculatorOperator | null,\n-\t\tright: number,\n-\t): number | null {\n-\t\tif (operator === '+') return left + right\n-\t\tif (operator === '-') return left - right\n-\t\tif (operator === '*') return left * right\n-\t\tif (operator === '/') {\n-\t\t\tif (right === 0) return null\n-\t\t\treturn left / right\n-\t\t}\n-\t\treturn right\n-\t}\n-\n-\tfunction updateView() {\n-\t\texpressionDisplayElement.textContent = state.expressionText || ' '\n-\t\tresultDisplayElement.textContent = state.displayValue\n-\t}\n-\n-\tfunction sendResultToHostAgent(expression: string, resultValue: string) {\n-\t\tconst prompt = 'Calculator result: ' + expression + ' = ' + resultValue\n-\t\tvoid hostBridge.sendUserMessageWithFallback(prompt)\n-\t}\n-\n-\tfunction resetAll() {\n-\t\tstate.leftOperand = null\n-\t\tstate.operator = null\n-\t\tstate.displayValue = '0'\n-\t\tstate.waitingForNextOperand = false\n-\t\tstate.expressionText = ''\n-\t\tupdateView()\n-\t}\n-\n-\tfunction setError() {\n-\t\tstate.leftOperand = null\n-\t\tstate.operator = null\n-\t\tstate.displayValue = 'Error'\n-\t\tstate.waitingForNextOperand = true\n-\t\tstate.expressionText = 'Invalid operation'\n-\t\tupdateView()\n-\t}\n-\n-\tfunction addDigit(digit: string) {\n-\t\tif (state.displayValue === 'Error' || state.waitingForNextOperand) {\n-\t\t\tstate.displayValue = digit\n-\t\t\tstate.waitingForNextOperand = false\n-\t\t\tupdateView()\n-\t\t\treturn\n-\t\t}\n-\n-\t\tstate.displayValue =\n-\t\t\tstate.displayValue === '0' ? digit : state.displayValue + digit\n-\t\tupdateView()\n-\t}\n-\n-\tfunction addDecimal() {\n-\t\tif (state.displayValue === 'Error' || state.waitingForNextOperand) {\n-\t\t\tstate.displayValue = '0.'\n-\t\t\tstate.waitingForNextOperand = false\n-\t\t\tupdateView()\n-\t\t\treturn\n-\t\t}\n-\n-\t\tif (!state.displayValue.includes('.')) {\n-\t\t\tstate.displayValue += '.'\n-\t\t\tupdateView()\n-\t\t}\n-\t}\n-\n-\tfunction removeLastCharacter() {\n-\t\tif (state.displayValue === 'Error' || state.waitingForNextOperand) {\n-\t\t\tstate.displayValue = '0'\n-\t\t\tstate.waitingForNextOperand = false\n-\t\t\tupdateView()\n-\t\t\treturn\n-\t\t}\n-\n-\t\tstate.displayValue = state.displayValue.slice(0, -1) || '0'\n-\t\tupdateView()\n-\t}\n-\n-\tfunction useOperator(nextOperator: CalculatorOperator) {\n-\t\tconst inputValue = Number(state.displayValue)\n-\t\tif (!Number.isFinite(inputValue)) {\n-\t\t\tsetError()\n-\t\t\treturn\n-\t\t}\n-\n-\t\tif (state.operator && state.waitingForNextOperand) {\n-\t\t\tstate.operator = nextOperator\n-\t\t\tstate.expressionText =\n-\t\t\t\tformatNumber(state.leftOperand ?? 0) + ' ' + nextOperator\n-\t\t\tupdateView()\n-\t\t\treturn\n-\t\t}\n-\n-\t\tif (state.leftOperand === null || state.operator === null) {\n-\t\t\tstate.leftOperand = inputValue\n-\t\t} else {\n-\t\t\tconst result = compute(state.leftOperand, state.operator, inputValue)\n-\t\t\tif (result === null || !Number.isFinite(result)) {\n-\t\t\t\tsetError()\n-\t\t\t\treturn\n-\t\t\t}\n-\t\t\tstate.leftOperand = result\n-\t\t\tstate.displayValue = formatNumber(result)\n-\t\t}\n-\n-\t\tstate.operator = nextOperator\n-\t\tstate.waitingForNextOperand = true\n-\t\tstate.expressionText = formatNumber(state.leftOperand) + ' ' + nextOperator\n-\t\tupdateView()\n-\t}\n-\n-\tfunction evaluateExpression() {\n-\t\tif (\n-\t\t\tstate.operator === null ||\n-\t\t\tstate.leftOperand === null ||\n-\t\t\tstate.waitingForNextOperand\n-\t\t) {\n-\t\t\treturn\n-\t\t}\n-\n-\t\tconst rightOperand = Number(state.displayValue)\n-\t\tconst result = compute(state.leftOperand, state.operator, rightOperand)\n-\t\tif (result === null || !Number.isFinite(result)) {\n-\t\t\tsetError()\n-\t\t\treturn\n-\t\t}\n-\n-\t\tconst expression =\n-\t\t\tformatNumber(state.leftOperand) +\n-\t\t\t' ' +\n-\t\t\tstate.operator +\n-\t\t\t' ' +\n-\t\t\tformatNumber(rightOperand)\n-\n-\t\tstate.displayValue = formatNumber(result)\n-\t\tstate.leftOperand = result\n-\t\tstate.operator = null\n-\t\tstate.waitingForNextOperand = true\n-\t\tstate.expressionText = expression + ' ='\n-\t\tupdateView()\n-\t\tsendResultToHostAgent(expression, state.displayValue)\n-\t}\n-\n-\tfunction handleAction(action: string | null, value: string | null) {\n-\t\tif (action === 'digit' && value) return addDigit(value)\n-\t\tif (action === 'decimal') return addDecimal()\n-\t\tif (action === 'operator' && value) {\n-\t\t\tif (value === '+' || value === '-' || value === '*' || value === '/') {\n-\t\t\t\treturn useOperator(value)\n-\t\t\t}\n-\t\t\treturn\n-\t\t}\n-\t\tif (action === 'evaluate') return evaluateExpression()\n-\t\tif (action === 'clear') {\n-\t\t\tstate.displayValue = '0'\n-\t\t\tstate.waitingForNextOperand = false\n-\t\t\tupdateView()\n-\t\t\treturn\n-\t\t}\n-\t\tif (action === 'backspace') return removeLastCharacter()\n-\t\tif (action === 'reset') return resetAll()\n-\t}\n-\n-\tfor (const keyElement of keyElements) {\n-\t\tkeyElement.addEventListener('click', () => {\n-\t\t\thandleAction(\n-\t\t\t\tkeyElement.getAttribute('data-action'),\n-\t\t\t\tkeyElement.getAttribute('data-value'),\n-\t\t\t)\n-\t\t})\n-\t}\n-\n-\tdocumentRef.addEventListener('keydown', (event) => {\n-\t\tif (event.key >= '0' && event.key <= '9') {\n-\t\t\tevent.preventDefault()\n-\t\t\taddDigit(event.key)\n-\t\t\treturn\n-\t\t}\n-\t\tif (event.key === '.') {\n-\t\t\tevent.preventDefault()\n-\t\t\taddDecimal()\n-\t\t\treturn\n-\t\t}\n-\t\tif (event.key === 'Enter' || event.key === '=') {\n-\t\t\tevent.preventDefault()\n-\t\t\tevaluateExpression()\n-\t\t\treturn\n-\t\t}\n-\t\tif (\n-\t\t\tevent.key === '+' ||\n-\t\t\tevent.key === '-' ||\n-\t\t\tevent.key === '*' ||\n-\t\t\tevent.key === '/'\n-\t\t) {\n-\t\t\tevent.preventDefault()\n-\t\t\tuseOperator(event.key)\n-\t\t\treturn\n-\t\t}\n-\t\tif (event.key === 'Backspace') {\n-\t\t\tevent.preventDefault()\n-\t\t\tremoveLastCharacter()\n-\t\t\treturn\n-\t\t}\n-\t\tif (event.key.toLowerCase() === 'c' && !event.ctrlKey && !event.metaKey) {\n-\t\t\tevent.preventDefault()\n-\t\t\thandleAction('clear', null)\n-\t\t}\n-\t})\n-\n-\twindowRef.addEventListener('message', (event) => {\n-\t\thostBridge.handleHostMessage(event.data)\n-\t})\n-\n-\tvoid hostBridge.initialize()\n-\thostBridge.requestRenderData()\n-\tupdateView()\n-}\n-\n-if (document.readyState === 'loading') {\n-\tdocument.addEventListener('DOMContentLoaded', initializeCalculatorWidget, {\n-\t\tonce: true,\n-\t})\n-} else {\n-\tinitializeCalculatorWidget()\n-}\ndiff --git a/client/mcp-apps/widget-host-bridge.test.ts b/client/mcp-apps/widget-host-bridge.test.ts\ndeleted file mode 100644\nindex 1339563..0000000\n--- a/client/mcp-apps/widget-host-bridge.test.ts\n+++ /dev/null\n@@ -1,125 +0,0 @@\n-import { afterEach, expect, test } from 'vitest'\n-import { createWidgetHostBridge } from './widget-host-bridge.ts'\n-\n-type HostRequestMessage = {\n-\tjsonrpc?: string\n-\tid?: string | number | null\n-\tmethod?: string\n-\tparams?: Record\n-\ttype?: string\n-\tpayload?: Record\n-}\n-\n-const latestProtocolVersion = '2026-01-26'\n-\n-const originalWindow = globalThis.window\n-\n-afterEach(() => {\n-\tif (originalWindow) {\n-\t\tglobalThis.window = originalWindow\n-\t\treturn\n-\t}\n-\tReflect.deleteProperty(globalThis, 'window')\n-})\n-\n-test('sendUserMessageWithFallback delivers ui/message to latest-protocol host', async () => {\n-\tconst deliveredChatMessages: Array = []\n-\tconst hostPostedMessages: Array = []\n-\tlet bridge: ReturnType\n-\tlet initialized = false\n-\n-\tconst parentWindow = {\n-\t\tpostMessage(message: unknown) {\n-\t\t\tif (!message || typeof message !== 'object' || Array.isArray(message)) {\n-\t\t\t\treturn\n-\t\t\t}\n-\n-\t\t\tconst request = message as HostRequestMessage\n-\t\t\thostPostedMessages.push(request)\n-\t\t\tif (request.method === 'ui/initialize') {\n-\t\t\t\tif (request.params?.protocolVersion !== latestProtocolVersion) {\n-\t\t\t\t\tbridge.handleHostMessage({\n-\t\t\t\t\t\tjsonrpc: '2.0',\n-\t\t\t\t\t\tid: request.id,\n-\t\t\t\t\t\terror: {\n-\t\t\t\t\t\t\tcode: -32602,\n-\t\t\t\t\t\t\tmessage: `Unsupported protocol version ${String(\n-\t\t\t\t\t\t\t\trequest.params?.protocolVersion,\n-\t\t\t\t\t\t\t)}`,\n-\t\t\t\t\t\t},\n-\t\t\t\t\t})\n-\t\t\t\t\treturn\n-\t\t\t\t}\n-\n-\t\t\t\tinitialized = true\n-\t\t\t\tbridge.handleHostMessage({\n-\t\t\t\t\tjsonrpc: '2.0',\n-\t\t\t\t\tid: request.id,\n-\t\t\t\t\tresult: {\n-\t\t\t\t\t\tprotocolVersion: latestProtocolVersion,\n-\t\t\t\t\t\thostInfo: {\n-\t\t\t\t\t\t\tname: 'mcp-jam-sim',\n-\t\t\t\t\t\t\tversion: '1.0.0',\n-\t\t\t\t\t\t},\n-\t\t\t\t\t\thostCapabilities: {\n-\t\t\t\t\t\t\tmessage: { text: {} },\n-\t\t\t\t\t\t},\n-\t\t\t\t\t\thostContext: {},\n-\t\t\t\t\t},\n-\t\t\t\t})\n-\t\t\t\treturn\n-\t\t\t}\n-\n-\t\t\tif (request.method !== 'ui/message') {\n-\t\t\t\treturn\n-\t\t\t}\n-\n-\t\t\tconst firstContent = Array.isArray(request.params?.content)\n-\t\t\t\t? request.params.content[0]\n-\t\t\t\t: null\n-\t\t\tconst text =\n-\t\t\t\tfirstContent &&\n-\t\t\t\ttypeof firstContent === 'object' &&\n-\t\t\t\t(firstContent as { type?: unknown }).type === 'text' &&\n-\t\t\t\ttypeof (firstContent as { text?: unknown }).text === 'string'\n-\t\t\t\t\t? (firstContent as { text: string }).text\n-\t\t\t\t\t: null\n-\n-\t\t\tif (!initialized || request.params?.role !== 'user' || !text) {\n-\t\t\t\tbridge.handleHostMessage({\n-\t\t\t\t\tjsonrpc: '2.0',\n-\t\t\t\t\tid: request.id,\n-\t\t\t\t\tresult: { isError: true },\n-\t\t\t\t})\n-\t\t\t\treturn\n-\t\t\t}\n-\n-\t\t\tdeliveredChatMessages.push(text)\n-\t\t\tbridge.handleHostMessage({\n-\t\t\t\tjsonrpc: '2.0',\n-\t\t\t\tid: request.id,\n-\t\t\t\tresult: {},\n-\t\t\t})\n-\t\t},\n-\t}\n-\n-\tglobalThis.window = {\n-\t\tparent: parentWindow,\n-\t} as unknown as Window & typeof globalThis\n-\n-\tbridge = createWidgetHostBridge({\n-\t\tappInfo: {\n-\t\t\tname: 'calculator-widget',\n-\t\t\tversion: '1.0.0',\n-\t\t},\n-\t\trequestTimeoutMs: 500,\n-\t})\n-\n-\tconst messageText = 'Calculator result: 7 + 3 = 10'\n-\tconst sent = await bridge.sendUserMessageWithFallback(messageText)\n-\texpect(sent).toBe(true)\n-\texpect(deliveredChatMessages).toEqual([messageText])\n-\texpect(hostPostedMessages.some((entry) => entry.type === 'prompt')).toBe(\n-\t\tfalse,\n-\t)\n-})\ndiff --git a/client/mcp-apps/widget-host-bridge.ts b/client/mcp-apps/widget-host-bridge.ts\ndeleted file mode 100644\nindex 2c4521a..0000000\n--- a/client/mcp-apps/widget-host-bridge.ts\n+++ /dev/null\n@@ -1,248 +0,0 @@\n-type WidgetHostBridgeOptions = {\n-\tprotocolVersion?: string\n-\trequestTimeoutMs?: number\n-\tappInfo?: {\n-\t\tname: string\n-\t\tversion: string\n-\t}\n-\tonRenderData?: (renderData: Record | undefined) => void\n-\tonHostContextChanged?: (\n-\t\thostContext: Record | undefined,\n-\t) => void\n-}\n-\n-type WidgetHostBridge = {\n-\thandleHostMessage(message: unknown): void\n-\tinitialize(): Promise\n-\tsendUserMessage(text: string): Promise\n-\tsendUserMessageWithFallback(text: string): Promise\n-\trequestRenderData(): boolean\n-}\n-\n-type BridgeResponseMessage = {\n-\tjsonrpc: '2.0'\n-\tid?: string | number | null\n-\tresult?: Record\n-\terror?: Record\n-}\n-\n-type PendingBridgeRequest = {\n-\tresolve: (value: BridgeResponseMessage) => void\n-\treject: (reason?: unknown) => void\n-\ttimeoutId: ReturnType\n-}\n-\n-function isRecord(value: unknown): value is Record {\n-\treturn typeof value === 'object' && value !== null\n-}\n-\n-function toRequestId(value: string | number) {\n-\treturn String(value)\n-}\n-\n-function getBridgeErrorMessage(error: unknown) {\n-\tif (isRecord(error) && typeof error.message === 'string') {\n-\t\treturn error.message\n-\t}\n-\treturn 'Bridge request failed'\n-}\n-\n-export function createWidgetHostBridge(\n-\toptions: WidgetHostBridgeOptions = {},\n-): WidgetHostBridge {\n-\tconst protocolVersion = options.protocolVersion ?? '2026-01-26'\n-\tconst requestTimeoutMs = options.requestTimeoutMs ?? 1500\n-\tconst appInfo = options.appInfo ?? {\n-\t\tname: 'mcp-widget',\n-\t\tversion: '1.0.0',\n-\t}\n-\tconst renderDataMessageType = 'ui-lifecycle-iframe-render-data'\n-\tconst hostContextChangedMethod = 'ui/notifications/host-context-changed'\n-\n-\tlet requestCounter = 0\n-\tlet initialized = false\n-\tlet initializationPromise: Promise | null = null\n-\tconst pendingRequests = new Map()\n-\n-\tfunction postMessageToHost(message: Record) {\n-\t\tconst hostWindow = globalThis.window?.parent\n-\t\tif (!hostWindow) {\n-\t\t\tthrow new Error('Host window is unavailable')\n-\t\t}\n-\t\thostWindow.postMessage(message, '*')\n-\t}\n-\n-\tfunction dispatchRenderData(renderData: unknown) {\n-\t\tif (!options.onRenderData) return\n-\t\toptions.onRenderData(isRecord(renderData) ? renderData : undefined)\n-\t}\n-\n-\tfunction dispatchHostContext(hostContext: unknown) {\n-\t\tif (!options.onHostContextChanged) return\n-\t\toptions.onHostContextChanged(\n-\t\t\tisRecord(hostContext) ? hostContext : undefined,\n-\t\t)\n-\t}\n-\n-\tfunction handleBridgeResponseMessage(message: unknown) {\n-\t\tif (!isRecord(message)) return\n-\t\tif (message.jsonrpc !== '2.0') return\n-\t\tif (typeof message.id !== 'string' && typeof message.id !== 'number') return\n-\n-\t\tconst requestId = toRequestId(message.id)\n-\t\tconst pendingRequest = pendingRequests.get(requestId)\n-\t\tif (!pendingRequest) return\n-\n-\t\tglobalThis.clearTimeout(pendingRequest.timeoutId)\n-\t\tpendingRequests.delete(requestId)\n-\n-\t\tconst response: BridgeResponseMessage = {\n-\t\t\tjsonrpc: '2.0',\n-\t\t\tid: message.id,\n-\t\t\tresult: isRecord(message.result) ? message.result : undefined,\n-\t\t\terror: isRecord(message.error) ? message.error : undefined,\n-\t\t}\n-\n-\t\tif (response.error) {\n-\t\t\tpendingRequest.reject(new Error(getBridgeErrorMessage(response.error)))\n-\t\t\treturn\n-\t\t}\n-\n-\t\tpendingRequest.resolve(response)\n-\t}\n-\n-\tfunction handleLifecycleMessage(message: unknown) {\n-\t\tif (!isRecord(message)) return\n-\n-\t\tif (message.type === renderDataMessageType) {\n-\t\t\tconst payload = isRecord(message.payload) ? message.payload : undefined\n-\t\t\tdispatchRenderData(payload?.renderData)\n-\t\t\treturn\n-\t\t}\n-\n-\t\tif (message.method === hostContextChangedMethod) {\n-\t\t\tdispatchHostContext(message.params)\n-\t\t}\n-\t}\n-\n-\tfunction handleHostMessage(message: unknown) {\n-\t\thandleBridgeResponseMessage(message)\n-\t\thandleLifecycleMessage(message)\n-\t}\n-\n-\tfunction sendBridgeRequest(\n-\t\tmethod: string,\n-\t\tparams: Record,\n-\t): Promise {\n-\t\treturn new Promise((resolve, reject) => {\n-\t\t\trequestCounter += 1\n-\t\t\tconst requestId = toRequestId(`${appInfo.name}-bridge-${requestCounter}`)\n-\t\t\tconst timeoutId = globalThis.setTimeout(() => {\n-\t\t\t\tpendingRequests.delete(requestId)\n-\t\t\t\treject(new Error('Bridge request timed out'))\n-\t\t\t}, requestTimeoutMs)\n-\n-\t\t\tpendingRequests.set(requestId, {\n-\t\t\t\tresolve,\n-\t\t\t\treject,\n-\t\t\t\ttimeoutId,\n-\t\t\t})\n-\n-\t\t\ttry {\n-\t\t\t\tpostMessageToHost({\n-\t\t\t\t\tjsonrpc: '2.0',\n-\t\t\t\t\tid: requestId,\n-\t\t\t\t\tmethod,\n-\t\t\t\t\tparams,\n-\t\t\t\t})\n-\t\t\t} catch (error) {\n-\t\t\t\tpendingRequests.delete(requestId)\n-\t\t\t\tglobalThis.clearTimeout(timeoutId)\n-\t\t\t\treject(error)\n-\t\t\t}\n-\t\t})\n-\t}\n-\n-\tasync function initialize() {\n-\t\tif (initialized) return true\n-\t\tif (initializationPromise) return initializationPromise\n-\n-\t\tinitializationPromise = sendBridgeRequest('ui/initialize', {\n-\t\t\tappInfo,\n-\t\t\tappCapabilities: {},\n-\t\t\tprotocolVersion,\n-\t\t})\n-\t\t\t.then((response) => {\n-\t\t\t\tdispatchHostContext(response.result?.hostContext)\n-\t\t\t\tinitialized = true\n-\t\t\t\ttry {\n-\t\t\t\t\tpostMessageToHost({\n-\t\t\t\t\t\tjsonrpc: '2.0',\n-\t\t\t\t\t\tmethod: 'ui/notifications/initialized',\n-\t\t\t\t\t\tparams: {},\n-\t\t\t\t\t})\n-\t\t\t\t} catch {\n-\t\t\t\t\t// Ignore initialized notification failures and continue.\n-\t\t\t\t}\n-\t\t\t\treturn true\n-\t\t\t})\n-\t\t\t.catch(() => {\n-\t\t\t\treturn false\n-\t\t\t})\n-\t\t\t.finally(() => {\n-\t\t\t\tinitializationPromise = null\n-\t\t\t})\n-\n-\t\treturn initializationPromise\n-\t}\n-\n-\tasync function sendUserMessage(text: string) {\n-\t\tconst bridgeReady = await initialize()\n-\t\tif (!bridgeReady) return false\n-\n-\t\ttry {\n-\t\t\tconst response = await sendBridgeRequest('ui/message', {\n-\t\t\t\trole: 'user',\n-\t\t\t\tcontent: [{ type: 'text', text }],\n-\t\t\t})\n-\t\t\treturn response.result?.isError !== true\n-\t\t} catch {\n-\t\t\treturn false\n-\t\t}\n-\t}\n-\n-\tasync function sendUserMessageWithFallback(text: string) {\n-\t\tconst bridgeSent = await sendUserMessage(text)\n-\t\tif (bridgeSent) return true\n-\n-\t\ttry {\n-\t\t\tpostMessageToHost({\n-\t\t\t\ttype: 'prompt',\n-\t\t\t\tpayload: { prompt: text },\n-\t\t\t})\n-\t\t\treturn true\n-\t\t} catch {\n-\t\t\treturn false\n-\t\t}\n-\t}\n-\n-\tfunction requestRenderData() {\n-\t\ttry {\n-\t\t\tpostMessageToHost({\n-\t\t\t\ttype: 'ui-request-render-data',\n-\t\t\t\tpayload: {},\n-\t\t\t})\n-\t\t\treturn true\n-\t\t} catch {\n-\t\t\treturn false\n-\t\t}\n-\t}\n-\n-\treturn {\n-\t\thandleHostMessage,\n-\t\tinitialize,\n-\t\tsendUserMessage,\n-\t\tsendUserMessageWithFallback,\n-\t\trequestRenderData,\n-\t}\n-}\ndiff --git a/client/routes/account.tsx b/client/routes/account.tsx\ndeleted file mode 100644\nindex 3f3b02e..0000000\n--- a/client/routes/account.tsx\n+++ /dev/null\n@@ -1,82 +0,0 @@\n-import { type Handle } from 'remix/component'\n-import { colors, spacing, typography } from '#client/styles/tokens.ts'\n-\n-type AccountStatus = 'idle' | 'loading' | 'ready' | 'error'\n-\n-export function AccountRoute(handle: Handle) {\n-\tlet status: AccountStatus = 'loading'\n-\tlet email = ''\n-\tlet message: string | null = null\n-\n-\tasync function loadAccount(signal: AbortSignal) {\n-\t\ttry {\n-\t\t\tconst response = await fetch('/session', {\n-\t\t\t\theaders: { Accept: 'application/json' },\n-\t\t\t\tcredentials: 'include',\n-\t\t\t\tsignal,\n-\t\t\t})\n-\t\t\tif (signal.aborted) return\n-\t\t\tconst payload = await response.json().catch(() => null)\n-\t\t\tconst sessionEmail =\n-\t\t\t\tresponse.ok &&\n-\t\t\t\tpayload?.ok &&\n-\t\t\t\ttypeof payload?.session?.email === 'string'\n-\t\t\t\t\t? payload.session.email.trim()\n-\t\t\t\t\t: ''\n-\t\t\tif (!sessionEmail) {\n-\t\t\t\twindow.location.assign('/login')\n-\t\t\t\treturn\n-\t\t\t}\n-\t\t\temail = sessionEmail\n-\t\t\tstatus = 'ready'\n-\t\t\tmessage = null\n-\t\t\thandle.update()\n-\t\t} catch {\n-\t\t\tif (signal.aborted) return\n-\t\t\tstatus = 'error'\n-\t\t\tmessage = 'Unable to load your account.'\n-\t\t\thandle.update()\n-\t\t}\n-\t}\n-\n-\treturn () => {\n-\t\tif (status === 'loading') {\n-\t\t\thandle.queueTask(loadAccount)\n-\t\t}\n-\n-\t\treturn (\n-\t\t\t\n-\t\t\t\t

\n-\t\t\t\t\t\n-\t\t\t\t\t\t{email ? `Welcome, ${email}` : 'Welcome'}\n-\t\t\t\t\t\n-\t\t\t\t\t

\n-\t\t\t\t\t\tYou are signed in to epic-scheduler.\n-\t\t\t\t\t

\n-\t\t\t\t

\n-\t\t\t\t{status === 'loading' ? (\n-\t\t\t\t\t

Loading your account…

\n-\t\t\t\t) : null}\n-\t\t\t\t{message ? (\n-\t\t\t\t\t

\n-\t\t\t\t\t\t{message}\n-\t\t\t\t\t

\n-\t\t\t\t) : null}\n-\t\t\t\n-\t\t)\n-\t}\n-}\ndiff --git a/client/routes/chat.tsx b/client/routes/chat.tsx\ndeleted file mode 100644\nindex aabff4d..0000000\n--- a/client/routes/chat.tsx\n+++ /dev/null\n@@ -1,20 +0,0 @@\n-import { type Handle } from 'remix/component'\n-import { colors, spacing, typography } from '#client/styles/tokens.ts'\n-\n-export function ChatRoute(_handle: Handle) {\n-\treturn () => (\n-\t\t

\n-\t\t\t\n-\t\t\t\tChat\n-\t\t\t\n-\t\t\t

AI chat coming soon.

\n-\t\t

\n-\t)\n-}\ndiff --git a/client/routes/create-schedule.tsx b/client/routes/create-schedule.tsx\nnew file mode 100644\nindex 0000000..fe3be26\n--- /dev/null\n+++ b/client/routes/create-schedule.tsx\n@@ -0,0 +1,469 @@\n+import { type Handle } from 'remix/component'\n+import { navigate } from '#client/client-router.tsx'\n+import {\n+\tcollectRangeSlotIds,\n+\tcreateGridModel,\n+\trenderScheduleGrid,\n+} from '#client/schedule-grid.tsx'\n+import {\n+\tcolors,\n+\tmq,\n+\tradius,\n+\tshadows,\n+\tspacing,\n+\ttypography,\n+} from '#client/styles/tokens.ts'\n+import {\n+\tgenerateLocalSlotKeys,\n+\tlocalSlotKeyToUtcIso,\n+\tnormalizeIanaTimeZone,\n+\tslotIncrementOptions,\n+\ttype SlotIncrement,\n+} from '#shared/scheduling-time.ts'\n+\n+function toDateInputValue(date: Date) {\n+\tconst year = date.getFullYear()\n+\tconst month = String(date.getMonth() + 1).padStart(2, '0')\n+\tconst day = String(date.getDate()).padStart(2, '0')\n+\treturn `${year}-${month}-${day}`\n+}\n+\n+function getDefaultDates() {\n+\tconst now = new Date()\n+\tconst startDate = toDateInputValue(now)\n+\tconst end = new Date(now)\n+\tend.setDate(now.getDate() + 2)\n+\tconst endDate = toDateInputValue(end)\n+\treturn { startDate, endDate }\n+}\n+\n+export function CreateScheduleRoute(handle: Handle) {\n+\tconst defaults = getDefaultDates()\n+\tlet title = 'Friday Hangout'\n+\tlet startDate = defaults.startDate\n+\tlet endDate = defaults.endDate\n+\tlet slotMinutes: SlotIncrement = 30\n+\tlet timezone = normalizeIanaTimeZone(\n+\t\tnormalizeIanaTimeZone(Intl.DateTimeFormat().resolvedOptions().timeZone ?? 'UTC'),\n+\t)\n+\tlet selectedLocalSlots = new Set(\n+\t\tnew Set(generateLocalSlotKeys(defaults.startDate, defaults.endDate, 30)),\n+\t)\n+\tlet isSubmitting = false\n+\tlet errorMessage: string | null = null\n+\tlet anchorSlotId: string | null = null\n+\tlet isMouseDragging = false\n+\tlet dragMode: 'add' | 'remove' | null = null\n+\tlet isHandleDragging = false\n+\tlet listenersAttached = false\n+\n+\tfunction syncSelectedSlotsToRange() {\n+\t\tconst localSlots = generateLocalSlotKeys(startDate, endDate, slotMinutes)\n+\t\tconst available = new Set(localSlots)\n+\t\tconst next = new Set()\n+\t\tfor (const slot of selectedLocalSlots) {\n+\t\t\tif (available.has(slot)) {\n+\t\t\t\tnext.add(slot)\n+\t\t\t}\n+\t\t}\n+\t\tif (next.size === 0) {\n+\t\t\tfor (const slot of localSlots) {\n+\t\t\t\tnext.add(slot)\n+\t\t\t}\n+\t\t}\n+\t\tselectedLocalSlots = next\n+\t\tif (anchorSlotId && !selectedLocalSlots.has(anchorSlotId)) {\n+\t\t\tanchorSlotId = null\n+\t\t}\n+\t}\n+\n+\tfunction ensureListeners() {\n+\t\tif (listenersAttached || typeof window === 'undefined') return\n+\t\tlistenersAttached = true\n+\t\twindow.addEventListener('mouseup', () => {\n+\t\t\tif (!isMouseDragging && !dragMode) return\n+\t\t\tisMouseDragging = false\n+\t\t\tdragMode = null\n+\t\t\thandle.update()\n+\t\t})\n+\t}\n+\n+\tfunction updateSelected(mutator: (next: Set) => void) {\n+\t\tconst next = new Set(selectedLocalSlots)\n+\t\tmutator(next)\n+\t\tselectedLocalSlots = next\n+\t\thandle.update()\n+\t}\n+\n+\tfunction handleCellClick(slotId: string) {\n+\t\tanchorSlotId = slotId\n+\t\tupdateSelected((next) => {\n+\t\t\tif (next.has(slotId)) {\n+\t\t\t\tnext.delete(slotId)\n+\t\t\t} else {\n+\t\t\t\tnext.add(slotId)\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction handleCellMouseDown(event: MouseEvent, slotId: string) {\n+\t\tif (event.button !== 0) return\n+\t\tevent.preventDefault()\n+\t\tanchorSlotId = slotId\n+\t\tdragMode = selectedLocalSlots.has(slotId) ? 'remove' : 'add'\n+\t\tisMouseDragging = true\n+\t\tupdateSelected((next) => {\n+\t\t\tif (dragMode === 'add') {\n+\t\t\t\tnext.add(slotId)\n+\t\t\t} else {\n+\t\t\t\tnext.delete(slotId)\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction handleCellMouseEnter(slotId: string) {\n+\t\tif (!isMouseDragging || !dragMode) return\n+\t\tupdateSelected((next) => {\n+\t\t\tif (dragMode === 'add') {\n+\t\t\t\tnext.add(slotId)\n+\t\t\t} else {\n+\t\t\t\tnext.delete(slotId)\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction handleSelectionHandlePointerDown(event: PointerEvent) {\n+\t\tif (!anchorSlotId) return\n+\t\tevent.preventDefault()\n+\t\tevent.stopPropagation()\n+\t\tisHandleDragging = true\n+\t\tconst target = event.currentTarget as HTMLElement\n+\t\ttarget.setPointerCapture(event.pointerId)\n+\t}\n+\n+\tfunction handleSelectionHandlePointerMove(event: PointerEvent) {\n+\t\tif (!isHandleDragging || !anchorSlotId) return\n+\t\tconst gridSlots = generateLocalSlotKeys(startDate, endDate, slotMinutes).map(\n+\t\t\t(localSlotKey) => ({\n+\t\t\t\tid: localSlotKey,\n+\t\t\t\tstartsAtUtc: localSlotKeyToUtcIso(localSlotKey, timezone),\n+\t\t\t}),\n+\t\t)\n+\t\tconst model = createGridModel(gridSlots, timezone)\n+\t\tconst targetElement = document.elementFromPoint(event.clientX, event.clientY)\n+\t\tconst cellElement = targetElement?.closest('[data-slot-id]') as\n+\t\t\t| HTMLElement\n+\t\t\t| null\n+\t\tconst targetSlotId = cellElement?.dataset.slotId\n+\t\tif (!targetSlotId) return\n+\t\tselectedLocalSlots = new Set(\n+\t\t\tcollectRangeSlotIds(model, anchorSlotId, targetSlotId),\n+\t\t)\n+\t\thandle.update()\n+\t}\n+\n+\tfunction handleSelectionHandlePointerUp(event: PointerEvent) {\n+\t\tif (!isHandleDragging) return\n+\t\tisHandleDragging = false\n+\t\tconst target = event.currentTarget as HTMLElement\n+\t\tif (target.hasPointerCapture(event.pointerId)) {\n+\t\t\ttarget.releasePointerCapture(event.pointerId)\n+\t\t}\n+\t}\n+\n+\tasync function handleCreateSchedule(event: SubmitEvent) {\n+\t\tevent.preventDefault()\n+\t\tisSubmitting = true\n+\t\terrorMessage = null\n+\t\thandle.update()\n+\n+\t\tconst selectedSlotsUtc = [...selectedLocalSlots].map((slotKey) =>\n+\t\t\tlocalSlotKeyToUtcIso(slotKey, timezone),\n+\t\t)\n+\n+\t\tif (selectedSlotsUtc.length === 0) {\n+\t\t\terrorMessage = 'Select at least one available time slot before creating.'\n+\t\t\tisSubmitting = false\n+\t\t\thandle.update()\n+\t\t\treturn\n+\t\t}\n+\n+\t\ttry {\n+\t\t\tconst response = await fetch('/api/schedules', {\n+\t\t\t\tmethod: 'POST',\n+\t\t\t\theaders: {\n+\t\t\t\t\t'Content-Type': 'application/json',\n+\t\t\t\t\tAccept: 'application/json',\n+\t\t\t\t},\n+\t\t\t\tbody: JSON.stringify({\n+\t\t\t\t\ttitle,\n+\t\t\t\t\tstartDate,\n+\t\t\t\t\tendDate,\n+\t\t\t\t\tslotMinutes,\n+\t\t\t\t\ttimezone,\n+\t\t\t\t\tselectedSlotsUtc,\n+\t\t\t\t}),\n+\t\t\t})\n+\t\t\tconst payload = (await response.json().catch(() => null)) as\n+\t\t\t\t| { hostUrl?: string; error?: string }\n+\t\t\t\t| null\n+\t\t\tif (!response.ok || !payload?.hostUrl) {\n+\t\t\t\terrorMessage = payload?.error ?? 'Unable to create schedule.'\n+\t\t\t\tisSubmitting = false\n+\t\t\t\thandle.update()\n+\t\t\t\treturn\n+\t\t\t}\n+\t\t\tnavigate(payload.hostUrl)\n+\t\t} catch {\n+\t\t\terrorMessage = 'Network error while creating schedule.'\n+\t\t\tisSubmitting = false\n+\t\t\thandle.update()\n+\t\t}\n+\t}\n+\n+\treturn () => {\n+\t\tensureListeners()\n+\t\tconst localSlots = generateLocalSlotKeys(startDate, endDate, slotMinutes)\n+\t\tconst gridSlots = localSlots.map((localSlotKey) => ({\n+\t\t\tid: localSlotKey,\n+\t\t\tstartsAtUtc: localSlotKeyToUtcIso(localSlotKey, timezone),\n+\t\t}))\n+\t\tconst model = createGridModel(gridSlots, timezone)\n+\n+\t\treturn (\n+\t\t\t

\n+\t\t\t\n+\t\t\t\t\n+\t\t\t\t\tCreate a schedule\n+\t\t\t\t\n+\t\t\t\t

\n+\t\t\t\t\tPick a date range, choose host availability, then share your attendee\n+\t\t\t\t\tlink.\n+\t\t\t\t

\n+\t\t\t\n+\n+\t\t\t\n+\t\t\t\t\n+\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\tPlan title\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLInputElement)) return\n+\t\t\t\t\t\t\t\t\ttitle = event.currentTarget.value\n+\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t\tfontSize: typography.fontSize.base,\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t/>\n+\t\t\t\t\t\n+\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\tStart date\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLInputElement)) return\n+\t\t\t\t\t\t\t\t\tstartDate = event.currentTarget.value\n+\t\t\t\t\t\t\t\t\tsyncSelectedSlotsToRange()\n+\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t\tfontSize: typography.fontSize.base,\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t/>\n+\t\t\t\t\t\n+\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\tEnd date\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLInputElement)) return\n+\t\t\t\t\t\t\t\t\tendDate = event.currentTarget.value\n+\t\t\t\t\t\t\t\t\tsyncSelectedSlotsToRange()\n+\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t\tfontSize: typography.fontSize.base,\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t/>\n+\t\t\t\t\t\n+\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\tSlot size\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLSelectElement)) return\n+\t\t\t\t\t\t\t\t\tslotMinutes = Number(\n+\t\t\t\t\t\t\t\t\t\tevent.currentTarget.value,\n+\t\t\t\t\t\t\t\t\t) as SlotIncrement\n+\t\t\t\t\t\t\t\t\tsyncSelectedSlotsToRange()\n+\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t\tfontSize: typography.fontSize.base,\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t>\n+\t\t\t\t\t\t\t{slotIncrementOptions.map((value) => (\n+\t\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t))}\n+\t\t\t\t\t\t\n+\t\t\t\t\t\n+\t\t\t\t\n+\n+\t\t\t\t

\n+\t\t\t\t\t

\n+\t\t\t\t\t\tHost timezone: {timezone}\n+\t\t\t\t\t

\n+\t\t\t\t\t{renderScheduleGrid({\n+\t\t\t\t\t\tmodel,\n+\t\t\t\t\t\tselectedSlotIds: selectedLocalSlots,\n+\t\t\t\t\t\tanchorSlotId,\n+\t\t\t\t\t\tariaLabel: 'Host availability selection grid',\n+\t\t\t\t\t\tonCellClick: handleCellClick,\n+\t\t\t\t\t\tonCellMouseDown: handleCellMouseDown,\n+\t\t\t\t\t\tonCellMouseEnter: handleCellMouseEnter,\n+\t\t\t\t\t\tonHandlePointerDown: handleSelectionHandlePointerDown,\n+\t\t\t\t\t\tonHandlePointerMove: handleSelectionHandlePointerMove,\n+\t\t\t\t\t\tonHandlePointerUp: handleSelectionHandlePointerUp,\n+\t\t\t\t\t})}\n+\t\t\t\t

\n+\n+\t\t\t\t

\n+\t\t\t\t\t\n+\t\t\t\t\t\t{isSubmitting ? 'Creating schedule...' : 'Create schedule'}\n+\t\t\t\t\t\n+\t\t\t\t\t

\n+\t\t\t\t\t\t{selectedLocalSlots.size} slots selected\n+\t\t\t\t\t

\n+\t\t\t\t

\n+\t\t\t\t{errorMessage ? (\n+\t\t\t\t\t

\n+\t\t\t\t\t\t{errorMessage}\n+\t\t\t\t\t

\n+\t\t\t\t) : null}\n+\t\t\t\n+\t\t\t

\n+\t\t)\n+\t}\n+}\n+\ndiff --git a/client/routes/host-schedule.tsx b/client/routes/host-schedule.tsx\nnew file mode 100644\nindex 0000000..32e1a10\n--- /dev/null\n+++ b/client/routes/host-schedule.tsx\n@@ -0,0 +1,679 @@\n+import { type Handle } from 'remix/component'\n+import {\n+\tcollectRangeSlotIds,\n+\tcreateGridModel,\n+\trenderScheduleGrid,\n+} from '#client/schedule-grid.tsx'\n+import {\n+\tcolors,\n+\tmq,\n+\tradius,\n+\tspacing,\n+\ttypography,\n+} from '#client/styles/tokens.ts'\n+import {\n+\tformatUtcInTimeZone,\n+\tgenerateLocalSlotKeys,\n+\tlocalSlotKeyToUtcIso,\n+\tnormalizeIanaTimeZone,\n+\tslotIncrementOptions,\n+\ttype SlotIncrement,\n+\tutcIsoToLocalSlotKey,\n+} from '#shared/scheduling-time.ts'\n+\n+type SchedulePayload = {\n+\tscheduleKey: string\n+\ttitle: string\n+\tstartDate: string\n+\tendDate: string\n+\tslotMinutes: SlotIncrement\n+\ttimezone: string\n+\tslotsUtc: Array\n+\tresponseCounts: Record\n+\ttotalResponders: number\n+\tbestSlotUtc: string | null\n+}\n+\n+type HostResponse = {\n+\tok: boolean\n+\tschedule: SchedulePayload\n+\thostKey: string\n+\tattendeeSummary: Array<{ attendeeName: string; slots: Array }>\n+}\n+\n+function getHostParamsFromPath() {\n+\tif (typeof window === 'undefined') return null\n+\tconst segments = window.location.pathname.split('/').filter(Boolean)\n+\tif (segments.length !== 3) return null\n+\tif (segments[0] !== 's') return null\n+\treturn {\n+\t\tscheduleKey: segments[1] ?? '',\n+\t\thostKey: segments[2] ?? '',\n+\t}\n+}\n+\n+export function HostScheduleRoute(handle: Handle) {\n+\tconst hostParams = getHostParamsFromPath()\n+\tlet status: 'loading' | 'ready' | 'error' = 'loading'\n+\tlet errorMessage: string | null = null\n+\tlet isSaving = false\n+\tlet saveMessage: string | null = null\n+\tlet requestQueued = false\n+\tlet listenersAttached = false\n+\tlet attendeeSummary: Array<{ attendeeName: string; slots: Array }> = []\n+\tlet title = ''\n+\tlet startDate = ''\n+\tlet endDate = ''\n+\tlet slotMinutes: SlotIncrement = 30\n+\tlet timezone = 'UTC'\n+\tlet selectedLocalSlots = new Set()\n+\tlet scheduleSnapshot: SchedulePayload | null = null\n+\tlet anchorSlotId: string | null = null\n+\tlet isMouseDragging = false\n+\tlet dragMode: 'add' | 'remove' | null = null\n+\tlet isHandleDragging = false\n+\n+\tfunction ensureListeners() {\n+\t\tif (listenersAttached || typeof window === 'undefined') return\n+\t\tlistenersAttached = true\n+\t\twindow.addEventListener('mouseup', () => {\n+\t\t\tif (!isMouseDragging && !dragMode) return\n+\t\t\tisMouseDragging = false\n+\t\t\tdragMode = null\n+\t\t\thandle.update()\n+\t\t})\n+\t}\n+\n+\tfunction syncSelectedSlotsToRange() {\n+\t\tconst localSlots = generateLocalSlotKeys(startDate, endDate, slotMinutes)\n+\t\tconst available = new Set(localSlots)\n+\t\tconst next = new Set()\n+\t\tfor (const slot of selectedLocalSlots) {\n+\t\t\tif (available.has(slot)) {\n+\t\t\t\tnext.add(slot)\n+\t\t\t}\n+\t\t}\n+\t\tif (next.size === 0) {\n+\t\t\tfor (const slot of localSlots) next.add(slot)\n+\t\t}\n+\t\tselectedLocalSlots = next\n+\t\tif (anchorSlotId && !selectedLocalSlots.has(anchorSlotId)) {\n+\t\t\tanchorSlotId = null\n+\t\t}\n+\t}\n+\n+\tfunction queueLoad() {\n+\t\tif (requestQueued) return\n+\t\trequestQueued = true\n+\t\tif (!hostParams) {\n+\t\t\tstatus = 'error'\n+\t\t\terrorMessage = 'Invalid host link.'\n+\t\t\thandle.update()\n+\t\t\treturn\n+\t\t}\n+\n+\t\thandle.queueTask(async (signal) => {\n+\t\t\ttry {\n+\t\t\t\tconst response = await fetch(\n+\t\t\t\t\t`/api/schedules/${encodeURIComponent(hostParams.scheduleKey)}/${encodeURIComponent(hostParams.hostKey)}`,\n+\t\t\t\t\t{\n+\t\t\t\t\t\theaders: { Accept: 'application/json' },\n+\t\t\t\t\t\tsignal,\n+\t\t\t\t\t},\n+\t\t\t\t)\n+\t\t\t\tconst payload = (await response.json().catch(() => null)) as\n+\t\t\t\t\t| HostResponse\n+\t\t\t\t\t| { error?: string }\n+\t\t\t\t\t| null\n+\t\t\t\tif (signal.aborted) return\n+\t\t\t\tif (!response.ok || !payload || !('ok' in payload) || !payload.ok) {\n+\t\t\t\t\tstatus = 'error'\n+\t\t\t\t\terrorMessage =\n+\t\t\t\t\t\t(payload && 'error' in payload && payload.error) ||\n+\t\t\t\t\t\t'Unable to load host dashboard.'\n+\t\t\t\t\thandle.update()\n+\t\t\t\t\treturn\n+\t\t\t\t}\n+\n+\t\t\t\tconst nextSchedule = payload.schedule\n+\t\t\t\tscheduleSnapshot = nextSchedule\n+\t\t\t\tattendeeSummary = payload.attendeeSummary\n+\t\t\t\ttitle = nextSchedule.title\n+\t\t\t\tstartDate = nextSchedule.startDate\n+\t\t\t\tendDate = nextSchedule.endDate\n+\t\t\t\tslotMinutes = nextSchedule.slotMinutes\n+\t\t\t\ttimezone = normalizeIanaTimeZone(nextSchedule.timezone)\n+\t\t\t\tselectedLocalSlots = new Set(\n+\t\t\t\t\tnextSchedule.slotsUtc.map((slotUtc) =>\n+\t\t\t\t\t\tutcIsoToLocalSlotKey(slotUtc, nextSchedule.timezone),\n+\t\t\t\t\t),\n+\t\t\t\t)\n+\t\t\t\tstatus = 'ready'\n+\t\t\t\terrorMessage = null\n+\t\t\t\thandle.update()\n+\t\t\t} catch {\n+\t\t\t\tif (signal.aborted) return\n+\t\t\t\tstatus = 'error'\n+\t\t\t\terrorMessage = 'Network error while loading host dashboard.'\n+\t\t\t\thandle.update()\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction attendeeUrl() {\n+\t\tif (!hostParams || typeof window === 'undefined') return ''\n+\t\treturn `${window.location.origin}/s/${hostParams.scheduleKey}`\n+\t}\n+\n+\tfunction hostUrl() {\n+\t\tif (!hostParams || typeof window === 'undefined') return ''\n+\t\treturn `${window.location.origin}/s/${hostParams.scheduleKey}/${hostParams.hostKey}`\n+\t}\n+\n+\tasync function copyLink(value: string) {\n+\t\ttry {\n+\t\t\tawait navigator.clipboard.writeText(value)\n+\t\t\tsaveMessage = 'Link copied.'\n+\t\t\thandle.update()\n+\t\t} catch {\n+\t\t\terrorMessage = 'Unable to copy link in this browser.'\n+\t\t\thandle.update()\n+\t\t}\n+\t}\n+\n+\tfunction updateSelected(mutator: (next: Set) => void) {\n+\t\tconst next = new Set(selectedLocalSlots)\n+\t\tmutator(next)\n+\t\tselectedLocalSlots = next\n+\t\thandle.update()\n+\t}\n+\n+\tfunction handleCellClick(slotId: string) {\n+\t\tanchorSlotId = slotId\n+\t\tupdateSelected((next) => {\n+\t\t\tif (next.has(slotId)) {\n+\t\t\t\tnext.delete(slotId)\n+\t\t\t} else {\n+\t\t\t\tnext.add(slotId)\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction handleCellMouseDown(event: MouseEvent, slotId: string) {\n+\t\tif (event.button !== 0) return\n+\t\tevent.preventDefault()\n+\t\tanchorSlotId = slotId\n+\t\tdragMode = selectedLocalSlots.has(slotId) ? 'remove' : 'add'\n+\t\tisMouseDragging = true\n+\t\tupdateSelected((next) => {\n+\t\t\tif (dragMode === 'add') {\n+\t\t\t\tnext.add(slotId)\n+\t\t\t} else {\n+\t\t\t\tnext.delete(slotId)\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction handleCellMouseEnter(slotId: string) {\n+\t\tif (!isMouseDragging || !dragMode) return\n+\t\tupdateSelected((next) => {\n+\t\t\tif (dragMode === 'add') {\n+\t\t\t\tnext.add(slotId)\n+\t\t\t} else {\n+\t\t\t\tnext.delete(slotId)\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction handleSelectionHandlePointerDown(event: PointerEvent) {\n+\t\tif (!anchorSlotId) return\n+\t\tevent.preventDefault()\n+\t\tevent.stopPropagation()\n+\t\tisHandleDragging = true\n+\t\tconst target = event.currentTarget as HTMLElement\n+\t\ttarget.setPointerCapture(event.pointerId)\n+\t}\n+\n+\tfunction handleSelectionHandlePointerMove(event: PointerEvent) {\n+\t\tif (!isHandleDragging || !anchorSlotId) return\n+\t\tconst gridSlots = generateLocalSlotKeys(startDate, endDate, slotMinutes).map(\n+\t\t\t(localSlotKey) => ({\n+\t\t\t\tid: localSlotKey,\n+\t\t\t\tstartsAtUtc: localSlotKeyToUtcIso(localSlotKey, timezone),\n+\t\t\t}),\n+\t\t)\n+\t\tconst model = createGridModel(gridSlots, timezone)\n+\t\tconst targetElement = document.elementFromPoint(event.clientX, event.clientY)\n+\t\tconst cellElement = targetElement?.closest('[data-slot-id]') as\n+\t\t\t| HTMLElement\n+\t\t\t| null\n+\t\tconst targetSlotId = cellElement?.dataset.slotId\n+\t\tif (!targetSlotId) return\n+\t\tselectedLocalSlots = new Set(\n+\t\t\tcollectRangeSlotIds(model, anchorSlotId, targetSlotId),\n+\t\t)\n+\t\thandle.update()\n+\t}\n+\n+\tfunction handleSelectionHandlePointerUp(event: PointerEvent) {\n+\t\tif (!isHandleDragging) return\n+\t\tisHandleDragging = false\n+\t\tconst target = event.currentTarget as HTMLElement\n+\t\tif (target.hasPointerCapture(event.pointerId)) {\n+\t\t\ttarget.releasePointerCapture(event.pointerId)\n+\t\t}\n+\t}\n+\n+\tasync function handleSaveSchedule(event: SubmitEvent) {\n+\t\tevent.preventDefault()\n+\t\tif (!hostParams) return\n+\t\terrorMessage = null\n+\t\tsaveMessage = null\n+\t\tisSaving = true\n+\t\thandle.update()\n+\n+\t\ttry {\n+\t\t\tconst selectedSlotsUtc = [...selectedLocalSlots].map((slotKey) =>\n+\t\t\t\tlocalSlotKeyToUtcIso(slotKey, timezone),\n+\t\t\t)\n+\t\t\tconst response = await fetch(\n+\t\t\t\t`/api/schedules/${encodeURIComponent(hostParams.scheduleKey)}/${encodeURIComponent(hostParams.hostKey)}`,\n+\t\t\t\t{\n+\t\t\t\t\tmethod: 'POST',\n+\t\t\t\t\theaders: {\n+\t\t\t\t\t\t'Content-Type': 'application/json',\n+\t\t\t\t\t\tAccept: 'application/json',\n+\t\t\t\t\t},\n+\t\t\t\t\tbody: JSON.stringify({\n+\t\t\t\t\t\ttitle,\n+\t\t\t\t\t\tstartDate,\n+\t\t\t\t\t\tendDate,\n+\t\t\t\t\t\tslotMinutes,\n+\t\t\t\t\t\ttimezone,\n+\t\t\t\t\t\tselectedSlotsUtc,\n+\t\t\t\t\t}),\n+\t\t\t\t},\n+\t\t\t)\n+\t\t\tconst payload = (await response.json().catch(() => null)) as\n+\t\t\t\t| HostResponse\n+\t\t\t\t| { error?: string }\n+\t\t\t\t| null\n+\t\t\tif (!response.ok || !payload || !('ok' in payload) || !payload.ok) {\n+\t\t\t\terrorMessage =\n+\t\t\t\t\t(payload && 'error' in payload && payload.error) ||\n+\t\t\t\t\t'Unable to save schedule.'\n+\t\t\t\tisSaving = false\n+\t\t\t\thandle.update()\n+\t\t\t\treturn\n+\t\t\t}\n+\n+\t\t\tscheduleSnapshot = payload.schedule\n+\t\t\tattendeeSummary = payload.attendeeSummary\n+\t\t\tsaveMessage = 'Schedule updated.'\n+\t\t\tisSaving = false\n+\t\t\thandle.update()\n+\t\t} catch {\n+\t\t\terrorMessage = 'Network error while updating schedule.'\n+\t\t\tisSaving = false\n+\t\t\thandle.update()\n+\t\t}\n+\t}\n+\n+\treturn () => {\n+\t\tensureListeners()\n+\t\tqueueLoad()\n+\n+\t\tif (status === 'loading') {\n+\t\t\treturn

Loading host dashboard...

\n+\t\t}\n+\n+\t\tif (status === 'error' || !hostParams) {\n+\t\t\treturn (\n+\t\t\t\t

\n+\t\t\t\t\t{errorMessage ?? 'Unable to load host dashboard.'}\n+\t\t\t\t

\n+\t\t\t)\n+\t\t}\n+\n+\t\tconst localSlots = generateLocalSlotKeys(startDate, endDate, slotMinutes)\n+\t\tconst gridSlots = localSlots.map((localSlotKey) => ({\n+\t\t\tid: localSlotKey,\n+\t\t\tstartsAtUtc: localSlotKeyToUtcIso(localSlotKey, timezone),\n+\t\t}))\n+\t\tconst model = createGridModel(gridSlots, timezone)\n+\t\tconst bestSlotSubmissionCount = scheduleSnapshot?.bestSlotUtc\n+\t\t\t? (scheduleSnapshot.responseCounts[scheduleSnapshot.bestSlotUtc] ?? 0)\n+\t\t\t: 0\n+\n+\t\treturn (\n+\t\t\t

\n+\t\t\t\t

\n+\t\t\t\t\t\n+\t\t\t\t\t\tHost dashboard\n+\t\t\t\t\t\n+\t\t\t\t\t

\n+\t\t\t\t\t\tShare your attendee link, tune schedule details, and review responses.\n+\t\t\t\t\t

\n+\t\t\t\t

\n+\n+\t\t\t\t\n+\t\t\t\t\t

\n+\t\t\t\t\t\t

Attendee link

\n+\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t{attendeeUrl()}\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t copyLink(attendeeUrl()) }}\n+\t\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\t\tborder: `1px solid ${colors.primary}`,\n+\t\t\t\t\t\t\t\t\tbackgroundColor: colors.primary,\n+\t\t\t\t\t\t\t\t\tcolor: colors.onPrimary,\n+\t\t\t\t\t\t\t\t\tpadding: `${spacing.xs} ${spacing.md}`,\n+\t\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\t\tcursor: 'pointer',\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t>\n+\t\t\t\t\t\t\t\tCopy attendee link\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t

\n+\t\t\t\t\t

\n+\t\t\t\t\t\t

Private host link

\n+\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t{hostUrl()}\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t copyLink(hostUrl()) }}\n+\t\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\t\tborder: `1px solid ${colors.primary}`,\n+\t\t\t\t\t\t\t\t\tbackgroundColor: colors.primary,\n+\t\t\t\t\t\t\t\t\tcolor: colors.onPrimary,\n+\t\t\t\t\t\t\t\t\tpadding: `${spacing.xs} ${spacing.md}`,\n+\t\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\t\tcursor: 'pointer',\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t>\n+\t\t\t\t\t\t\t\tCopy host link\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t

\n+\t\t\t\t\t

\n+\t\t\t\t\n+\n+\t\t\t\t

\n+\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\tPlan title\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLInputElement)) return\n+\t\t\t\t\t\t\t\t\t\ttitle = event.currentTarget.value\n+\t\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t/>\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\tStart date\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLInputElement)) return\n+\t\t\t\t\t\t\t\t\t\tstartDate = event.currentTarget.value\n+\t\t\t\t\t\t\t\t\t\tsyncSelectedSlotsToRange()\n+\t\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t/>\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\tEnd date\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLInputElement)) return\n+\t\t\t\t\t\t\t\t\t\tendDate = event.currentTarget.value\n+\t\t\t\t\t\t\t\t\t\tsyncSelectedSlotsToRange()\n+\t\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t/>\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\tSlot size\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLSelectElement)) return\n+\t\t\t\t\t\t\t\t\t\tslotMinutes = Number(\n+\t\t\t\t\t\t\t\t\t\t\tevent.currentTarget.value,\n+\t\t\t\t\t\t\t\t\t\t) as SlotIncrement\n+\t\t\t\t\t\t\t\t\t\tsyncSelectedSlotsToRange()\n+\t\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t>\n+\t\t\t\t\t\t\t\t{slotIncrementOptions.map((value) => (\n+\t\t\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t))}\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\tTimezone\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLInputElement)) return\n+\t\t\t\t\t\t\t\t\t\ttimezone = normalizeIanaTimeZone(event.currentTarget.value)\n+\t\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t/>\n+\t\t\t\t\t\t\n+\t\t\t\t\t\n+\n+\t\t\t\t\t{renderScheduleGrid({\n+\t\t\t\t\t\tmodel,\n+\t\t\t\t\t\tselectedSlotIds: selectedLocalSlots,\n+\t\t\t\t\t\tanchorSlotId,\n+\t\t\t\t\t\tariaLabel: 'Host availability editing grid',\n+\t\t\t\t\t\tonCellClick: handleCellClick,\n+\t\t\t\t\t\tonCellMouseDown: handleCellMouseDown,\n+\t\t\t\t\t\tonCellMouseEnter: handleCellMouseEnter,\n+\t\t\t\t\t\tonHandlePointerDown: handleSelectionHandlePointerDown,\n+\t\t\t\t\t\tonHandlePointerMove: handleSelectionHandlePointerMove,\n+\t\t\t\t\t\tonHandlePointerUp: handleSelectionHandlePointerUp,\n+\t\t\t\t\t})}\n+\n+\t\t\t\t\t

\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\t{isSaving ? 'Saving...' : 'Save schedule changes'}\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t{selectedLocalSlots.size} slots selected\n+\t\t\t\t\t\t

\n+\t\t\t\t\t

\n+\t\t\t\t\t{errorMessage ? (\n+\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t{errorMessage}\n+\t\t\t\t\t\t

\n+\t\t\t\t\t) : null}\n+\t\t\t\t\t{saveMessage ? (\n+\t\t\t\t\t\t

{saveMessage}

\n+\t\t\t\t\t) : null}\n+\t\t\t\t\n+\n+\t\t\t\t\n+\t\t\t\t\t\n+\t\t\t\t\t\tResponse summary\n+\t\t\t\t\t\n+\t\t\t\t\t

\n+\t\t\t\t\t\t{scheduleSnapshot?.totalResponders ?? 0} attendees responded.\n+\t\t\t\t\t

\n+\t\t\t\t\t{scheduleSnapshot?.bestSlotUtc ? (\n+\t\t\t\t\t\t

\n+\t\t\t\t\t\t\tBest slot:{' '}\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t{formatUtcInTimeZone(scheduleSnapshot.bestSlotUtc, timezone, {\n+\t\t\t\t\t\t\t\t\tweekday: 'short',\n+\t\t\t\t\t\t\t\t\tmonth: 'short',\n+\t\t\t\t\t\t\t\t\tday: 'numeric',\n+\t\t\t\t\t\t\t\t\thour: 'numeric',\n+\t\t\t\t\t\t\t\t\tminute: '2-digit',\n+\t\t\t\t\t\t\t\t})}{' '}\n+\t\t\t\t\t\t\t\t({bestSlotSubmissionCount} submission\n+\t\t\t\t\t\t\t\t{bestSlotSubmissionCount === 1 ? '' : 's'}, {timezone})\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t

\n+\t\t\t\t\t) : (\n+\t\t\t\t\t\t

\n+\t\t\t\t\t\t\tNo attendee responses yet.\n+\t\t\t\t\t\t

\n+\t\t\t\t\t)}\n+\t\t\t\t\t{attendeeSummary.length > 0 ? (\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\t{attendeeSummary.map((attendee) => (\n+\t\t\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t\t\t{attendee.attendeeName} ({attendee.slots.length} slots)\n+\t\t\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t))}\n+\t\t\t\t\t\t\n+\t\t\t\t\t) : null}\n+\t\t\t\t

\n+\t\t\t\n+\t\t)\n+\t}\n+}\n+\ndiff --git a/client/routes/index.tsx b/client/routes/index.tsx\nindex a99e05f..46c0232 100644\n--- a/client/routes/index.tsx\n+++ b/client/routes/index.tsx\n@@ -1,18 +1,9 @@\n-import { AccountRoute } from './account.tsx'\n-import { ChatRoute } from './chat.tsx'\n-import { HomeRoute } from './home.tsx'\n-import { LoginRoute } from './login.tsx'\n-import { OAuthAuthorizeRoute } from './oauth-authorize.tsx'\n-import { OAuthCallbackRoute } from './oauth-callback.tsx'\n-import { ResetPasswordRoute } from './reset-password.tsx'\n+import { CreateScheduleRoute } from './create-schedule.tsx'\n+import { HostScheduleRoute } from './host-schedule.tsx'\n+import { RespondScheduleRoute } from './respond-schedule.tsx'\n \n export const clientRoutes = {\n-\t'/': ,\n-\t'/chat': ,\n-\t'/account': ,\n-\t'/login': ,\n-\t'/signup': ,\n-\t'/reset-password': ,\n-\t'/oauth/authorize': ,\n-\t'/oauth/callback': ,\n+\t'/': ,\n+\t'/s/:scheduleKey/:hostKey': ,\n+\t'/s/:scheduleKey': ,\n }\ndiff --git a/client/routes/login.tsx b/client/routes/login.tsx\ndeleted file mode 100644\nindex b482221..0000000\n--- a/client/routes/login.tsx\n+++ /dev/null\n@@ -1,322 +0,0 @@\n-import { type Handle } from 'remix/component'\n-import { buildAuthLink } from '#client/auth-links.ts'\n-import { navigate } from '#client/client-router.tsx'\n-import { fetchSessionInfo, type SessionStatus } from '#client/session.ts'\n-import {\n-\tcolors,\n-\tradius,\n-\tshadows,\n-\tspacing,\n-\ttransitions,\n-\ttypography,\n-} from '#client/styles/tokens.ts'\n-\n-type AuthMode = 'login' | 'signup'\n-type AuthStatus = 'idle' | 'submitting' | 'success' | 'error'\n-\n-type LoginFormSetup = {\n-\tinitialMode?: AuthMode\n-}\n-\n-function getSearchParams() {\n-\treturn typeof window === 'undefined'\n-\t\t? new URLSearchParams()\n-\t\t: new URLSearchParams(window.location.search)\n-}\n-\n-function normalizeRedirectTo(value: string | null) {\n-\tif (!value) return null\n-\tif (!value.startsWith('/')) return null\n-\tif (value.startsWith('//')) return null\n-\treturn value\n-}\n-\n-function buildAuthPath(mode: AuthMode, redirectTo: string | null) {\n-\tconst path = mode === 'signup' ? '/signup' : '/login'\n-\treturn buildAuthLink(path, redirectTo)\n-}\n-\n-export function LoginRoute(handle: Handle, setup: LoginFormSetup = {}) {\n-\tlet mode: AuthMode = setup.initialMode ?? 'login'\n-\tlet status: AuthStatus = 'idle'\n-\tlet message: string | null = null\n-\tlet sessionStatus: SessionStatus = 'idle'\n-\tlet sessionEmail = ''\n-\tconst redirectTo = normalizeRedirectTo(getSearchParams().get('redirectTo'))\n-\tconst redirectTarget = redirectTo ?? '/account'\n-\n-\tfunction setState(nextStatus: AuthStatus, nextMessage: string | null = null) {\n-\t\tstatus = nextStatus\n-\t\tmessage = nextMessage\n-\t\thandle.update()\n-\t}\n-\n-\tfunction switchMode(nextMode: AuthMode) {\n-\t\tif (mode === nextMode) return\n-\t\tmode = nextMode\n-\t\tstatus = 'idle'\n-\t\tmessage = null\n-\t\tnavigate(buildAuthPath(nextMode, redirectTo))\n-\t\thandle.update()\n-\t}\n-\n-\thandle.queueTask(async (signal) => {\n-\t\tif (sessionStatus !== 'idle') return\n-\t\tsessionStatus = 'loading'\n-\n-\t\tconst session = await fetchSessionInfo(signal)\n-\t\tif (signal.aborted) return\n-\t\tsessionEmail = session?.email ?? ''\n-\n-\t\tsessionStatus = 'ready'\n-\t\tif (sessionEmail && typeof window !== 'undefined') {\n-\t\t\twindow.location.assign(redirectTarget)\n-\t\t\treturn\n-\t\t}\n-\t\thandle.update()\n-\t})\n-\n-\tasync function handleSubmit(event: SubmitEvent) {\n-\t\tevent.preventDefault()\n-\t\tif (!(event.currentTarget instanceof HTMLFormElement)) return\n-\n-\t\tconst formData = new FormData(event.currentTarget)\n-\t\tconst email = String(formData.get('email') ?? '').trim()\n-\t\tconst password = String(formData.get('password') ?? '')\n-\n-\t\tif (!email || !password) {\n-\t\t\tsetState('error', 'Email and password are required.')\n-\t\t\treturn\n-\t\t}\n-\n-\t\tsetState('submitting')\n-\n-\t\ttry {\n-\t\t\tconst response = await fetch('/auth', {\n-\t\t\t\tmethod: 'POST',\n-\t\t\t\theaders: { 'Content-Type': 'application/json' },\n-\t\t\t\tcredentials: 'include',\n-\t\t\t\tbody: JSON.stringify({ email, password, mode }),\n-\t\t\t})\n-\t\t\tconst payload = await response.json().catch(() => null)\n-\n-\t\t\tif (!response.ok) {\n-\t\t\t\tconst errorMessage =\n-\t\t\t\t\ttypeof payload?.error === 'string'\n-\t\t\t\t\t\t? payload.error\n-\t\t\t\t\t\t: 'Unable to authenticate.'\n-\t\t\t\tsetState('error', errorMessage)\n-\t\t\t\treturn\n-\t\t\t}\n-\n-\t\t\tif (typeof window !== 'undefined') {\n-\t\t\t\twindow.location.assign(redirectTarget)\n-\t\t\t}\n-\t\t} catch {\n-\t\t\tsetState('error', 'Network error. Please try again.')\n-\t\t}\n-\t}\n-\n-\treturn () => {\n-\t\tconst isSignup = mode === 'signup'\n-\t\tconst isSubmitting = status === 'submitting'\n-\t\tconst title = isSignup ? 'Create your account' : 'Welcome back'\n-\t\tconst description = isSignup\n-\t\t\t? 'Sign up to start using epic-scheduler.'\n-\t\t\t: 'Log in to continue to epic-scheduler.'\n-\t\tconst submitLabel = isSignup ? 'Create account' : 'Sign in'\n-\t\tconst toggleLabel = isSignup\n-\t\t\t? 'Already have an account?'\n-\t\t\t: 'Need an account?'\n-\t\tconst toggleAction = isSignup ? 'Sign in instead' : 'Sign up instead'\n-\n-\t\treturn (\n-\t\t\t\n-\t\t\t\t

\n-\t\t\t\t\t\n-\t\t\t\t\t\t{title}\n-\t\t\t\t\t\n-\t\t\t\t\t

{description}

\n-\t\t\t\t

\n-\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\tEmail\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\tPassword\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\t{isSubmitting ? 'Submitting...' : submitLabel}\n-\t\t\t\t\t\n-\t\t\t\t\t{message ? (\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\t{message}\n-\t\t\t\t\t\t

\n-\t\t\t\t\t) : null}\n-\t\t\t\t\n-\t\t\t\t

\n-\t\t\t\t\t {\n-\t\t\t\t\t\t\t\tif (event.defaultPrevented) return\n-\t\t\t\t\t\t\t\tswitchMode(isSignup ? 'login' : 'signup')\n-\t\t\t\t\t\t\t},\n-\t\t\t\t\t\t}}\n-\t\t\t\t\t\tcss={{\n-\t\t\t\t\t\t\tbackground: 'none',\n-\t\t\t\t\t\t\tborder: 'none',\n-\t\t\t\t\t\t\tpadding: 0,\n-\t\t\t\t\t\t\tcolor: colors.primaryText,\n-\t\t\t\t\t\t\tfontSize: typography.fontSize.sm,\n-\t\t\t\t\t\t\tcursor: 'pointer',\n-\t\t\t\t\t\t\ttextAlign: 'left',\n-\t\t\t\t\t\t\ttextDecoration: 'none',\n-\t\t\t\t\t\t\t'&:hover': {\n-\t\t\t\t\t\t\t\ttextDecoration: 'underline',\n-\t\t\t\t\t\t\t},\n-\t\t\t\t\t\t}}\n-\t\t\t\t\t>\n-\t\t\t\t\t\t{toggleLabel} {toggleAction}\n-\t\t\t\t\t\n-\t\t\t\t\t{!isSignup ? (\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\tForgot password?\n-\t\t\t\t\t\t\n-\t\t\t\t\t) : null}\n-\t\t\t\t\t\n-\t\t\t\t\t\tBack home\n-\t\t\t\t\t\n-\t\t\t\t

\n-\t\t\t\n-\t\t)\n-\t}\n-}\ndiff --git a/client/routes/oauth-authorize.tsx b/client/routes/oauth-authorize.tsx\ndeleted file mode 100644\nindex 1f3a6b3..0000000\n--- a/client/routes/oauth-authorize.tsx\n+++ /dev/null\n@@ -1,420 +0,0 @@\n-import { type Handle } from 'remix/component'\n-import {\n-\tfetchSessionInfo,\n-\ttype SessionInfo,\n-\ttype SessionStatus,\n-} from '#client/session.ts'\n-import {\n-\tcolors,\n-\tradius,\n-\tshadows,\n-\tspacing,\n-\ttypography,\n-} from '#client/styles/tokens.ts'\n-\n-type OAuthAuthorizeInfo = {\n-\tclient: { id: string; name: string }\n-\tscopes: Array\n-}\n-\n-type OAuthAuthorizeStatus = 'idle' | 'loading' | 'ready' | 'error'\n-type OAuthAuthorizeMessage = { type: 'error' | 'info'; text: string }\n-\n-function getSearchParams() {\n-\treturn typeof window === 'undefined'\n-\t\t? new URLSearchParams()\n-\t\t: new URLSearchParams(window.location.search)\n-}\n-\n-export function OAuthAuthorizeRoute(handle: Handle) {\n-\tlet info: OAuthAuthorizeInfo | null = null\n-\tlet status: OAuthAuthorizeStatus = 'idle'\n-\tlet message: OAuthAuthorizeMessage | null = null\n-\tlet submitting = false\n-\tlet lastSearch = ''\n-\tlet session: SessionInfo | null = null\n-\tlet sessionStatus: SessionStatus = 'idle'\n-\n-\tfunction setMessage(next: OAuthAuthorizeMessage | null) {\n-\t\tmessage = next\n-\t\thandle.update()\n-\t}\n-\n-\tfunction readQueryError() {\n-\t\tconst params = getSearchParams()\n-\t\tconst description = params.get('error_description')\n-\t\tif (description) return description\n-\t\tconst error = params.get('error')\n-\t\treturn error ? `Authorization error: ${error}` : null\n-\t}\n-\n-\tasync function loadInfo() {\n-\t\tstatus = 'loading'\n-\n-\t\tconst queryError = readQueryError()\n-\t\tif (queryError) {\n-\t\t\tmessage = { type: 'error', text: queryError }\n-\t\t}\n-\n-\t\ttry {\n-\t\t\tconst query = typeof window === 'undefined' ? '' : window.location.search\n-\t\t\tconst response = await fetch(`/oauth/authorize-info${query}`, {\n-\t\t\t\theaders: { Accept: 'application/json' },\n-\t\t\t\tcredentials: 'include',\n-\t\t\t})\n-\t\t\tconst payload = await response.json().catch(() => null)\n-\t\t\tif (!response.ok || !payload?.ok) {\n-\t\t\t\tconst errorText =\n-\t\t\t\t\ttypeof payload?.error === 'string'\n-\t\t\t\t\t\t? payload.error\n-\t\t\t\t\t\t: 'Unable to load authorization details.'\n-\t\t\t\tinfo = null\n-\t\t\t\tstatus = 'error'\n-\t\t\t\tmessage = { type: 'error', text: errorText }\n-\t\t\t\thandle.update()\n-\t\t\t\treturn\n-\t\t\t}\n-\t\t\tinfo = {\n-\t\t\t\tclient: payload.client,\n-\t\t\t\tscopes: payload.scopes,\n-\t\t\t}\n-\t\t\tstatus = 'ready'\n-\t\t\tif (!queryError) {\n-\t\t\t\tmessage = null\n-\t\t\t}\n-\t\t\thandle.update()\n-\t\t} catch {\n-\t\t\tinfo = null\n-\t\t\tstatus = 'error'\n-\t\t\tmessage = {\n-\t\t\t\ttype: 'error',\n-\t\t\t\ttext: 'Unable to load authorization details.',\n-\t\t\t}\n-\t\t\thandle.update()\n-\t\t}\n-\t}\n-\n-\tasync function loadSession() {\n-\t\tif (sessionStatus !== 'idle') return\n-\t\tsessionStatus = 'loading'\n-\n-\t\tsession = await fetchSessionInfo()\n-\n-\t\tsessionStatus = 'ready'\n-\t\thandle.update()\n-\t}\n-\n-\tasync function submitDecision(\n-\t\tdecision: 'approve' | 'deny',\n-\t\tform?: HTMLFormElement,\n-\t) {\n-\t\tif (submitting) return\n-\t\tsubmitting = true\n-\t\thandle.update()\n-\n-\t\ttry {\n-\t\t\tconst body = new URLSearchParams()\n-\t\t\tbody.set('decision', decision)\n-\t\t\tif (decision === 'approve' && form) {\n-\t\t\t\tconst formData = new FormData(form)\n-\t\t\t\tconst email = String(formData.get('email') ?? '').trim()\n-\t\t\t\tconst password = String(formData.get('password') ?? '')\n-\t\t\t\tif (!email || !password) {\n-\t\t\t\t\tsetMessage({\n-\t\t\t\t\t\ttype: 'error',\n-\t\t\t\t\t\ttext: 'Email and password are required.',\n-\t\t\t\t\t})\n-\t\t\t\t\tsubmitting = false\n-\t\t\t\t\thandle.update()\n-\t\t\t\t\treturn\n-\t\t\t\t}\n-\t\t\t\tbody.set('email', email)\n-\t\t\t\tbody.set('password', password)\n-\t\t\t}\n-\t\t\tconst response = await fetch(window.location.href, {\n-\t\t\t\tmethod: 'POST',\n-\t\t\t\theaders: {\n-\t\t\t\t\tAccept: 'application/json',\n-\t\t\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n-\t\t\t\t},\n-\t\t\t\tcredentials: 'include',\n-\t\t\t\tbody,\n-\t\t\t})\n-\t\t\tconst payload = await response.json().catch(() => null)\n-\t\t\tif (!response.ok) {\n-\t\t\t\tconst errorText =\n-\t\t\t\t\ttypeof payload?.error === 'string'\n-\t\t\t\t\t\t? payload.error\n-\t\t\t\t\t\t: 'Unable to complete authorization.'\n-\t\t\t\tsetMessage({ type: 'error', text: errorText })\n-\t\t\t\tsubmitting = false\n-\t\t\t\thandle.update()\n-\t\t\t\treturn\n-\t\t\t}\n-\t\t\tif (payload?.redirectTo) {\n-\t\t\t\twindow.location.assign(payload.redirectTo)\n-\t\t\t\treturn\n-\t\t\t}\n-\t\t\tsetMessage({ type: 'error', text: 'Missing redirect response.' })\n-\t\t} catch {\n-\t\t\tsetMessage({\n-\t\t\t\ttype: 'error',\n-\t\t\t\ttext: 'Network error. Please try again.',\n-\t\t\t})\n-\t\t} finally {\n-\t\t\tsubmitting = false\n-\t\t\thandle.update()\n-\t\t}\n-\t}\n-\n-\tasync function handleSubmit(event: SubmitEvent) {\n-\t\tevent.preventDefault()\n-\t\tif (!(event.currentTarget instanceof HTMLFormElement)) return\n-\t\tconst hasSession = Boolean(session?.email)\n-\t\tawait submitDecision(\n-\t\t\t'approve',\n-\t\t\thasSession ? undefined : event.currentTarget,\n-\t\t)\n-\t}\n-\n-\treturn () => {\n-\t\tconst currentSearch =\n-\t\t\ttypeof window === 'undefined' ? '' : window.location.search\n-\t\tif (currentSearch !== lastSearch) {\n-\t\t\tlastSearch = currentSearch\n-\t\t\tvoid loadInfo()\n-\t\t}\n-\t\tif (sessionStatus === 'idle') {\n-\t\t\tvoid loadSession()\n-\t\t}\n-\n-\t\tconst clientLabel = info?.client?.name ?? 'Unknown client'\n-\t\tconst scopes = info?.scopes ?? []\n-\t\tconst scopeLabel =\n-\t\t\tscopes.length > 0 ? scopes.join(', ') : 'No scopes requested.'\n-\t\tconst sessionEmail = session?.email ?? ''\n-\t\tconst isSessionReady = sessionStatus === 'ready'\n-\t\tconst isSessionLoading =\n-\t\t\tsessionStatus === 'loading' || sessionStatus === 'idle'\n-\t\tconst isLoggedIn = isSessionReady && Boolean(sessionEmail)\n-\t\tconst actionsDisabled = status !== 'ready' || submitting || isSessionLoading\n-\t\tconst formReady = status === 'ready' && !isSessionLoading\n-\t\tconst authorizeLabel = submitting\n-\t\t\t? 'Submitting...'\n-\t\t\t: isLoggedIn\n-\t\t\t\t? 'Approve connection'\n-\t\t\t\t: 'Authorize'\n-\n-\t\treturn (\n-\t\t\t\n-\t\t\t\t

\n-\t\t\t\t\t\n-\t\t\t\t\t\tAuthorize access\n-\t\t\t\t\t\n-\t\t\t\t\t

\n-\t\t\t\t\t\t{clientLabel} wants to access your epic-scheduler account.\n-\t\t\t\t\t

\n-\t\t\t\t

\n-\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\tRequested scopes\n-\t\t\t\t\t

\n-\t\t\t\t\t

{scopeLabel}

\n-\t\t\t\t\n-\t\t\t\t{isSessionLoading ? (\n-\t\t\t\t\t

Checking your session…

\n-\t\t\t\t) : null}\n-\t\t\t\t{isLoggedIn ? (\n-\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\tSigned in as {sessionEmail}\n-\t\t\t\t\t\t

\n-\t\t\t\t\t\t

\n-\t\t\t\t\t\t\tApprove to continue with this account.\n-\t\t\t\t\t\t

\n-\t\t\t\t\t\n-\t\t\t\t) : null}\n-\t\t\t\t{status === 'loading' ? (\n-\t\t\t\t\t

\n-\t\t\t\t\t\tLoading authorization details…\n-\t\t\t\t\t

\n-\t\t\t\t) : null}\n-\t\t\t\t{message ? (\n-\t\t\t\t\t\n-\t\t\t\t\t\t{message.text}\n-\t\t\t\t\t

\n-\t\t\t\t) : null}\n-\t\t\t\t\n-\t\t\t\t\t{!isLoggedIn && isSessionReady ? (\n-\t\t\t\t\t\t<>\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\t\tEmail\n-\t\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\t\tPassword\n-\t\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t) : null}\n-\t\t\t\t\t

\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\t{authorizeLabel}\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t submitDecision('deny') }}\n-\t\t\t\t\t\t\tcss={{\n-\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.lg}`,\n-\t\t\t\t\t\t\t\tborderRadius: radius.full,\n-\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n-\t\t\t\t\t\t\t\tbackgroundColor: 'transparent',\n-\t\t\t\t\t\t\t\tcolor: colors.text,\n-\t\t\t\t\t\t\t\tfontSize: typography.fontSize.base,\n-\t\t\t\t\t\t\t\tfontWeight: typography.fontWeight.medium,\n-\t\t\t\t\t\t\t\tcursor: actionsDisabled ? 'not-allowed' : 'pointer',\n-\t\t\t\t\t\t\t\topacity: actionsDisabled ? 0.7 : 1,\n-\t\t\t\t\t\t\t}}\n-\t\t\t\t\t\t>\n-\t\t\t\t\t\t\tDeny\n-\t\t\t\t\t\t\n-\t\t\t\t\t

\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\tBack home\n-\t\t\t\t\n-\t\t\t\n-\t\t)\n-\t}\n-}\ndiff --git a/client/routes/oauth-callback.tsx b/client/routes/oauth-callback.tsx\ndeleted file mode 100644\nindex 11ba295..0000000\n--- a/client/routes/oauth-callback.tsx\n+++ /dev/null\n@@ -1,73 +0,0 @@\n-import { colors, radius, spacing, typography } from '#client/styles/tokens.ts'\n-import { type Handle } from 'remix/component'\n-\n-export function OAuthCallbackRoute(_handle: Handle) {\n-\treturn () => {\n-\t\tconst params =\n-\t\t\ttypeof window === 'undefined'\n-\t\t\t\t? new URLSearchParams()\n-\t\t\t\t: new URLSearchParams(window.location.search)\n-\t\tconst error = params.get('error')\n-\t\tconst description = params.get('error_description')\n-\t\tconst code = params.get('code')\n-\t\tconst state = params.get('state')\n-\t\tconst isError = Boolean(error || description)\n-\t\tconst title = isError ? 'Authorization failed' : 'Authorization completed'\n-\t\tconst message = description || error\n-\t\tconst detail = isError ? message : code\n-\n-\t\treturn (\n-\t\t\t\n-\t\t\t\t

\n-\t\t\t\t\t\n-\t\t\t\t\t\tOAuth callback\n-\t\t\t\t\t\n-\t\t\t\t\t

{title}.

\n-\t\t\t\t

\n-\t\t\t\t{detail ? (\n-\t\t\t\t\t\n-\t\t\t\t\t\t{detail}\n-\t\t\t\t\t\n-\t\t\t\t) : null}\n-\t\t\t\t{state ? (\n-\t\t\t\t\t

State: {state}

\n-\t\t\t\t) : null}\n-\t\t\t\t\n-\t\t\t\t\tBack home\n-\t\t\t\t\n-\t\t\t\n-\t\t)\n-\t}\n-}\ndiff --git a/client/routes/reset-password.tsx b/client/routes/reset-password.tsx\ndeleted file mode 100644\nindex e39d776..0000000\n--- a/client/routes/reset-password.tsx\n+++ /dev/null\n@@ -1,269 +0,0 @@\n-import { type Handle } from 'remix/component'\n-import {\n-\tcolors,\n-\tradius,\n-\tshadows,\n-\tspacing,\n-\ttypography,\n-} from '#client/styles/tokens.ts'\n-\n-type ResetStatus = 'idle' | 'submitting' | 'success' | 'error'\n-\n-function getSearchParams() {\n-\treturn typeof window === 'undefined'\n-\t\t? new URLSearchParams()\n-\t\t: new URLSearchParams(window.location.search)\n-}\n-\n-export function ResetPasswordRoute(handle: Handle) {\n-\tlet status: ResetStatus = 'idle'\n-\tlet message: string | null = null\n-\n-\tfunction setState(\n-\t\tnextStatus: ResetStatus,\n-\t\tnextMessage: string | null = null,\n-\t) {\n-\t\tstatus = nextStatus\n-\t\tmessage = nextMessage\n-\t\thandle.update()\n-\t}\n-\n-\tasync function submitResetRequest(event: SubmitEvent) {\n-\t\tevent.preventDefault()\n-\t\tif (!(event.currentTarget instanceof HTMLFormElement)) return\n-\n-\t\tconst formData = new FormData(event.currentTarget)\n-\t\tconst email = String(formData.get('email') ?? '').trim()\n-\t\tif (!email) {\n-\t\t\tsetState('error', 'Email is required.')\n-\t\t\treturn\n-\t\t}\n-\n-\t\tsetState('submitting')\n-\t\ttry {\n-\t\t\tconst response = await fetch('/password-reset', {\n-\t\t\t\tmethod: 'POST',\n-\t\t\t\theaders: { 'Content-Type': 'application/json' },\n-\t\t\t\tbody: JSON.stringify({ email }),\n-\t\t\t})\n-\t\t\tconst payload = await response.json().catch(() => null)\n-\t\t\tif (!response.ok) {\n-\t\t\t\tconst errorMessage =\n-\t\t\t\t\ttypeof payload?.error === 'string'\n-\t\t\t\t\t\t? payload.error\n-\t\t\t\t\t\t: 'Unable to request a reset.'\n-\t\t\t\tsetState('error', errorMessage)\n-\t\t\t\treturn\n-\t\t\t}\n-\t\t\tsetState(\n-\t\t\t\t'success',\n-\t\t\t\tpayload?.message ?? 'Check your inbox for a reset link.',\n-\t\t\t)\n-\t\t} catch {\n-\t\t\tsetState('error', 'Network error. Please try again.')\n-\t\t}\n-\t}\n-\n-\tasync function submitResetConfirm(event: SubmitEvent, token: string) {\n-\t\tevent.preventDefault()\n-\t\tif (!(event.currentTarget instanceof HTMLFormElement)) return\n-\n-\t\tconst formData = new FormData(event.currentTarget)\n-\t\tconst password = String(formData.get('password') ?? '')\n-\t\tif (!password) {\n-\t\t\tsetState('error', 'Password is required.')\n-\t\t\treturn\n-\t\t}\n-\n-\t\tsetState('submitting')\n-\t\ttry {\n-\t\t\tconst response = await fetch('/password-reset/confirm', {\n-\t\t\t\tmethod: 'POST',\n-\t\t\t\theaders: { 'Content-Type': 'application/json' },\n-\t\t\t\tbody: JSON.stringify({ token, password }),\n-\t\t\t})\n-\t\t\tconst payload = await response.json().catch(() => null)\n-\t\t\tif (!response.ok) {\n-\t\t\t\tconst errorMessage =\n-\t\t\t\t\ttypeof payload?.error === 'string'\n-\t\t\t\t\t\t? payload.error\n-\t\t\t\t\t\t: 'Unable to reset password.'\n-\t\t\t\tsetState('error', errorMessage)\n-\t\t\t\treturn\n-\t\t\t}\n-\t\t\tsetState('success', 'Password updated. You can sign in now.')\n-\t\t} catch {\n-\t\t\tsetState('error', 'Network error. Please try again.')\n-\t\t}\n-\t}\n-\n-\treturn () => {\n-\t\tconst searchParams = getSearchParams()\n-\t\tconst token = String(searchParams.get('token') ?? '').trim()\n-\t\tconst mode = token ? 'confirm' : 'request'\n-\t\tconst isSubmitting = status === 'submitting'\n-\t\tconst title =\n-\t\t\tmode === 'confirm' ? 'Choose a new password' : 'Reset your password'\n-\t\tconst description =\n-\t\t\tmode === 'confirm'\n-\t\t\t\t? 'Enter a new password for your account.'\n-\t\t\t\t: 'We will send a reset link to your email.'\n-\n-\t\treturn (\n-\t\t\t\n-\t\t\t\t

\n-\t\t\t\t\t\n-\t\t\t\t\t\t{title}\n-\t\t\t\t\t\n-\t\t\t\t\t

{description}

\n-\t\t\t\t

\n-\t\t\t\t\n-\t\t\t\t\t\t\tmode === 'confirm'\n-\t\t\t\t\t\t\t\t? submitResetConfirm(event, token)\n-\t\t\t\t\t\t\t\t: submitResetRequest(event),\n-\t\t\t\t\t}}\n-\t\t\t\t>\n-\t\t\t\t\t{mode === 'confirm' ? (\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\tNew password\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t) : (\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\tEmail\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t)}\n-\t\t\t\t\t\n-\t\t\t\t\t\t{isSubmitting\n-\t\t\t\t\t\t\t? 'Submitting...'\n-\t\t\t\t\t\t\t: mode === 'confirm'\n-\t\t\t\t\t\t\t\t? 'Update password'\n-\t\t\t\t\t\t\t\t: 'Send reset link'}\n-\t\t\t\t\t\n-\t\t\t\t\t{message ? (\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\t{message}\n-\t\t\t\t\t\t

\n-\t\t\t\t\t) : null}\n-\t\t\t\t\n-\t\t\t\t

\n-\t\t\t\t\t\n-\t\t\t\t\t\tBack to sign in\n-\t\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\tBack home\n-\t\t\t\t\t\n-\t\t\t\t

\n-\t\t\t\n-\t\t)\n-\t}\n-}\ndiff --git a/client/routes/respond-schedule.tsx b/client/routes/respond-schedule.tsx\nnew file mode 100644\nindex 0000000..59cab27\n--- /dev/null\n+++ b/client/routes/respond-schedule.tsx\n@@ -0,0 +1,386 @@\n+import { type Handle } from 'remix/component'\n+import {\n+\tcollectRangeSlotIds,\n+\tcreateGridModel,\n+\trenderScheduleGrid,\n+} from '#client/schedule-grid.tsx'\n+import { colors, radius, spacing, typography } from '#client/styles/tokens.ts'\n+import { formatUtcInTimeZone, normalizeIanaTimeZone } from '#shared/scheduling-time.ts'\n+\n+type SchedulePayload = {\n+\tscheduleKey: string\n+\ttitle: string\n+\tstartDate: string\n+\tendDate: string\n+\tslotMinutes: number\n+\ttimezone: string\n+\tslotsUtc: Array\n+\tresponseCounts: Record\n+\ttotalResponders: number\n+\tbestSlotUtc: string | null\n+}\n+\n+type ReadScheduleResponse = {\n+\tok: boolean\n+\tschedule: SchedulePayload\n+}\n+\n+function getScheduleKeyFromPath() {\n+\tif (typeof window === 'undefined') return null\n+\tconst segments = window.location.pathname.split('/').filter(Boolean)\n+\tif (segments.length !== 2) return null\n+\tif (segments[0] !== 's') return null\n+\treturn segments[1] ?? null\n+}\n+\n+export function RespondScheduleRoute(handle: Handle) {\n+\tlet schedule: SchedulePayload | null = null\n+\tlet selectedSlots = new Set()\n+\tlet attendeeName = ''\n+\tlet status: 'loading' | 'ready' | 'error' = 'loading'\n+\tlet errorMessage: string | null = null\n+\tlet saveMessage: string | null = null\n+\tlet isSaving = false\n+\tlet requestQueued = false\n+\tlet anchorSlotId: string | null = null\n+\tlet isMouseDragging = false\n+\tlet dragMode: 'add' | 'remove' | null = null\n+\tlet isHandleDragging = false\n+\tlet listenersAttached = false\n+\n+\tconst scheduleKey = getScheduleKeyFromPath()\n+\tconst attendeeTimeZone = normalizeIanaTimeZone(\n+\t\tIntl.DateTimeFormat().resolvedOptions().timeZone ?? 'UTC',\n+\t)\n+\n+\tfunction ensureListeners() {\n+\t\tif (listenersAttached || typeof window === 'undefined') return\n+\t\tlistenersAttached = true\n+\t\twindow.addEventListener('mouseup', () => {\n+\t\t\tif (!isMouseDragging && !dragMode) return\n+\t\t\tisMouseDragging = false\n+\t\t\tdragMode = null\n+\t\t\thandle.update()\n+\t\t})\n+\t}\n+\n+\tfunction queueLoad() {\n+\t\tif (requestQueued) return\n+\t\trequestQueued = true\n+\t\tif (!scheduleKey) {\n+\t\t\tstatus = 'error'\n+\t\t\terrorMessage = 'Invalid attendee link.'\n+\t\t\thandle.update()\n+\t\t\treturn\n+\t\t}\n+\n+\t\thandle.queueTask(async (signal) => {\n+\t\t\ttry {\n+\t\t\t\tconst response = await fetch(\n+\t\t\t\t\t`/api/schedules/${encodeURIComponent(scheduleKey)}`,\n+\t\t\t\t\t{\n+\t\t\t\t\t\theaders: {\n+\t\t\t\t\t\t\tAccept: 'application/json',\n+\t\t\t\t\t\t},\n+\t\t\t\t\t\tsignal,\n+\t\t\t\t\t},\n+\t\t\t\t)\n+\t\t\t\tconst payload = (await response.json().catch(() => null)) as\n+\t\t\t\t\t| ReadScheduleResponse\n+\t\t\t\t\t| { error?: string }\n+\t\t\t\t\t| null\n+\t\t\t\tif (signal.aborted) return\n+\t\t\t\tif (!response.ok || !payload || !('ok' in payload) || !payload.ok) {\n+\t\t\t\t\tstatus = 'error'\n+\t\t\t\t\terrorMessage =\n+\t\t\t\t\t\t(payload && 'error' in payload && payload.error) ||\n+\t\t\t\t\t\t'Unable to load this schedule.'\n+\t\t\t\t\thandle.update()\n+\t\t\t\t\treturn\n+\t\t\t\t}\n+\t\t\t\tschedule = payload.schedule\n+\t\t\t\tstatus = 'ready'\n+\t\t\t\terrorMessage = null\n+\t\t\t\thandle.update()\n+\t\t\t} catch {\n+\t\t\t\tif (signal.aborted) return\n+\t\t\t\tstatus = 'error'\n+\t\t\t\terrorMessage = 'Network error while loading schedule.'\n+\t\t\t\thandle.update()\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction updateSelected(mutator: (next: Set) => void) {\n+\t\tconst next = new Set(selectedSlots)\n+\t\tmutator(next)\n+\t\tselectedSlots = next\n+\t\thandle.update()\n+\t}\n+\n+\tfunction handleCellClick(slotId: string) {\n+\t\tanchorSlotId = slotId\n+\t\tupdateSelected((next) => {\n+\t\t\tif (next.has(slotId)) {\n+\t\t\t\tnext.delete(slotId)\n+\t\t\t} else {\n+\t\t\t\tnext.add(slotId)\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction handleCellMouseDown(event: MouseEvent, slotId: string) {\n+\t\tif (event.button !== 0) return\n+\t\tevent.preventDefault()\n+\t\tanchorSlotId = slotId\n+\t\tdragMode = selectedSlots.has(slotId) ? 'remove' : 'add'\n+\t\tisMouseDragging = true\n+\t\tupdateSelected((next) => {\n+\t\t\tif (dragMode === 'add') {\n+\t\t\t\tnext.add(slotId)\n+\t\t\t} else {\n+\t\t\t\tnext.delete(slotId)\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction handleCellMouseEnter(slotId: string) {\n+\t\tif (!isMouseDragging || !dragMode) return\n+\t\tupdateSelected((next) => {\n+\t\t\tif (dragMode === 'add') {\n+\t\t\t\tnext.add(slotId)\n+\t\t\t} else {\n+\t\t\t\tnext.delete(slotId)\n+\t\t\t}\n+\t\t})\n+\t}\n+\n+\tfunction handleSelectionHandlePointerDown(event: PointerEvent) {\n+\t\tif (!anchorSlotId) return\n+\t\tevent.preventDefault()\n+\t\tevent.stopPropagation()\n+\t\tisHandleDragging = true\n+\t\tconst target = event.currentTarget as HTMLElement\n+\t\ttarget.setPointerCapture(event.pointerId)\n+\t}\n+\n+\tfunction handleSelectionHandlePointerMove(event: PointerEvent) {\n+\t\tif (!isHandleDragging || !anchorSlotId || !schedule) return\n+\t\tconst slots = schedule.slotsUtc.map((slot) => ({ id: slot, startsAtUtc: slot }))\n+\t\tconst model = createGridModel(slots, attendeeTimeZone)\n+\t\tconst targetElement = document.elementFromPoint(event.clientX, event.clientY)\n+\t\tconst cellElement = targetElement?.closest('[data-slot-id]') as\n+\t\t\t| HTMLElement\n+\t\t\t| null\n+\t\tconst targetSlotId = cellElement?.dataset.slotId\n+\t\tif (!targetSlotId) return\n+\t\tselectedSlots = new Set(collectRangeSlotIds(model, anchorSlotId, targetSlotId))\n+\t\thandle.update()\n+\t}\n+\n+\tfunction handleSelectionHandlePointerUp(event: PointerEvent) {\n+\t\tif (!isHandleDragging) return\n+\t\tisHandleDragging = false\n+\t\tconst target = event.currentTarget as HTMLElement\n+\t\tif (target.hasPointerCapture(event.pointerId)) {\n+\t\t\ttarget.releasePointerCapture(event.pointerId)\n+\t\t}\n+\t}\n+\n+\tasync function handleSaveResponse(event: SubmitEvent) {\n+\t\tevent.preventDefault()\n+\t\tif (!scheduleKey) return\n+\t\tif (!attendeeName.trim()) {\n+\t\t\terrorMessage = 'Enter your name before submitting.'\n+\t\t\thandle.update()\n+\t\t\treturn\n+\t\t}\n+\t\terrorMessage = null\n+\t\tsaveMessage = null\n+\t\tisSaving = true\n+\t\thandle.update()\n+\t\ttry {\n+\t\t\tconst response = await fetch(\n+\t\t\t\t`/api/schedules/${encodeURIComponent(scheduleKey)}/responses`,\n+\t\t\t\t{\n+\t\t\t\t\tmethod: 'POST',\n+\t\t\t\t\theaders: {\n+\t\t\t\t\t\t'Content-Type': 'application/json',\n+\t\t\t\t\t\tAccept: 'application/json',\n+\t\t\t\t\t},\n+\t\t\t\t\tbody: JSON.stringify({\n+\t\t\t\t\t\tattendeeName: attendeeName.trim(),\n+\t\t\t\t\t\tselectedSlotsUtc: [...selectedSlots],\n+\t\t\t\t\t}),\n+\t\t\t\t},\n+\t\t\t)\n+\t\t\tconst payload = (await response.json().catch(() => null)) as\n+\t\t\t\t| { ok?: boolean; error?: string }\n+\t\t\t\t| null\n+\t\t\tif (!response.ok || !payload?.ok) {\n+\t\t\t\terrorMessage = payload?.error ?? 'Unable to submit availability.'\n+\t\t\t\tisSaving = false\n+\t\t\t\thandle.update()\n+\t\t\t\treturn\n+\t\t\t}\n+\t\t\tsaveMessage = 'Availability saved.'\n+\t\t\tisSaving = false\n+\t\t\thandle.update()\n+\t\t} catch {\n+\t\t\terrorMessage = 'Network error while saving availability.'\n+\t\t\tisSaving = false\n+\t\t\thandle.update()\n+\t\t}\n+\t}\n+\n+\treturn () => {\n+\t\tensureListeners()\n+\t\tqueueLoad()\n+\n+\t\tif (status === 'loading') {\n+\t\t\treturn

Loading schedule...

\n+\t\t}\n+\n+\t\tif (status === 'error' || !schedule) {\n+\t\t\treturn (\n+\t\t\t\t

\n+\t\t\t\t\t{errorMessage ?? 'Unable to load schedule.'}\n+\t\t\t\t

\n+\t\t\t)\n+\t\t}\n+\n+\t\tconst gridSlots = schedule.slotsUtc.map((slot) => ({\n+\t\t\tid: slot,\n+\t\t\tstartsAtUtc: slot,\n+\t\t}))\n+\t\tconst model = createGridModel(gridSlots, attendeeTimeZone)\n+\t\tconst bestSlotSubmissionCount = schedule.bestSlotUtc\n+\t\t\t? (schedule.responseCounts[schedule.bestSlotUtc] ?? 0)\n+\t\t\t: 0\n+\n+\t\treturn (\n+\t\t\t

\n+\t\t\t\t\n+\t\t\t\t\t\n+\t\t\t\t\t\t{schedule.title}\n+\t\t\t\t\t\n+\t\t\t\t\t

\n+\t\t\t\t\t\tSelect every time that works for you. Times are shown in{' '}\n+\t\t\t\t\t\t{attendeeTimeZone}.\n+\t\t\t\t\t

\n+\t\t\t\t\t{schedule.bestSlotUtc ? (\n+\t\t\t\t\t\t

\n+\t\t\t\t\t\t\tCurrent top slot:{' '}\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t{formatUtcInTimeZone(schedule.bestSlotUtc, attendeeTimeZone, {\n+\t\t\t\t\t\t\t\t\tweekday: 'short',\n+\t\t\t\t\t\t\t\t\tmonth: 'short',\n+\t\t\t\t\t\t\t\t\tday: 'numeric',\n+\t\t\t\t\t\t\t\t\thour: 'numeric',\n+\t\t\t\t\t\t\t\t\tminute: '2-digit',\n+\t\t\t\t\t\t\t\t})}{' '}\n+\t\t\t\t\t\t\t\t({bestSlotSubmissionCount} submission\n+\t\t\t\t\t\t\t\t{bestSlotSubmissionCount === 1 ? '' : 's'})\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t

\n+\t\t\t\t\t) : null}\n+\t\t\t\t\n+\n+\t\t\t\t

\n+\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\tYour name\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t {\n+\t\t\t\t\t\t\t\t\tif (!(event.currentTarget instanceof HTMLInputElement)) return\n+\t\t\t\t\t\t\t\t\tattendeeName = event.currentTarget.value\n+\t\t\t\t\t\t\t\t\thandle.update()\n+\t\t\t\t\t\t\t\t},\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\tborder: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\tborderRadius: radius.md,\n+\t\t\t\t\t\t\t\tpadding: `${spacing.sm} ${spacing.md}`,\n+\t\t\t\t\t\t\t\tbackgroundColor: colors.surface,\n+\t\t\t\t\t\t\t\tcolor: colors.text,\n+\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t/>\n+\t\t\t\t\t\n+\t\t\t\t\t{renderScheduleGrid({\n+\t\t\t\t\t\tmodel,\n+\t\t\t\t\t\tselectedSlotIds: selectedSlots,\n+\t\t\t\t\t\tanchorSlotId,\n+\t\t\t\t\t\tariaLabel: 'Attendee availability selection grid',\n+\t\t\t\t\t\tonCellClick: handleCellClick,\n+\t\t\t\t\t\tonCellMouseDown: handleCellMouseDown,\n+\t\t\t\t\t\tonCellMouseEnter: handleCellMouseEnter,\n+\t\t\t\t\t\tonHandlePointerDown: handleSelectionHandlePointerDown,\n+\t\t\t\t\t\tonHandlePointerMove: handleSelectionHandlePointerMove,\n+\t\t\t\t\t\tonHandlePointerUp: handleSelectionHandlePointerUp,\n+\t\t\t\t\t})}\n+\t\t\t\t\t

\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\t{isSaving ? 'Saving...' : 'Save availability'}\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t{selectedSlots.size} slots selected\n+\t\t\t\t\t\t

\n+\t\t\t\t\t

\n+\t\t\t\t\t{errorMessage ? (\n+\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t{errorMessage}\n+\t\t\t\t\t\t

\n+\t\t\t\t\t) : null}\n+\t\t\t\t\t{saveMessage ? (\n+\t\t\t\t\t\t

{saveMessage}

\n+\t\t\t\t\t) : null}\n+\t\t\t\t\n+\t\t\t

\n+\t\t)\n+\t}\n+}\n+\ndiff --git a/client/schedule-grid.tsx b/client/schedule-grid.tsx\nnew file mode 100644\nindex 0000000..c7915d9\n--- /dev/null\n+++ b/client/schedule-grid.tsx\n@@ -0,0 +1,322 @@\n+import { colors, radius, spacing, typography } from '#client/styles/tokens.ts'\n+\n+export type GridSlot = {\n+\tid: string\n+\tstartsAtUtc: string\n+}\n+\n+type GridModel = {\n+\tdays: Array<{ key: string; label: string }>\n+\ttimes: Array<{ minutes: number; label: string }>\n+\tslotByCoordinate: Map\n+\tcoordinatesBySlot: Map\n+}\n+\n+function coordinateKey(dayKey: string, minutes: number) {\n+\treturn `${dayKey}::${minutes}`\n+}\n+\n+function getTimeParts(date: Date, timeZone: string) {\n+\tconst partsFormatter = new Intl.DateTimeFormat('en-US', {\n+\t\ttimeZone,\n+\t\thour: '2-digit',\n+\t\tminute: '2-digit',\n+\t\thourCycle: 'h23',\n+\t})\n+\tconst parts = partsFormatter.formatToParts(date)\n+\tconst hour = Number(parts.find((part) => part.type === 'hour')?.value ?? 0)\n+\tconst minute = Number(parts.find((part) => part.type === 'minute')?.value ?? 0)\n+\tconst label = new Intl.DateTimeFormat('en-US', {\n+\t\ttimeZone,\n+\t\thour: 'numeric',\n+\t\tminute: '2-digit',\n+\t\thourCycle: 'h23',\n+\t}).format(date)\n+\treturn {\n+\t\tminutes: hour * 60 + minute,\n+\t\tlabel,\n+\t}\n+}\n+\n+export function createGridModel(\n+\tslots: ReadonlyArray,\n+\tdisplayTimeZone: string,\n+) {\n+\tconst dayKeyFormatter = new Intl.DateTimeFormat('en-CA', {\n+\t\ttimeZone: displayTimeZone,\n+\t\tyear: 'numeric',\n+\t\tmonth: '2-digit',\n+\t\tday: '2-digit',\n+\t})\n+\tconst dayLabelFormatter = new Intl.DateTimeFormat('en-US', {\n+\t\ttimeZone: displayTimeZone,\n+\t\tweekday: 'short',\n+\t\tmonth: 'short',\n+\t\tday: 'numeric',\n+\t})\n+\n+\tconst dayLabels = new Map()\n+\tconst timeLabels = new Map()\n+\tconst slotByCoordinate = new Map()\n+\n+\tfor (const slot of slots) {\n+\t\tconst date = new Date(slot.startsAtUtc)\n+\t\tconst dayKey = dayKeyFormatter.format(date)\n+\t\tconst dayLabel = dayLabelFormatter.format(date)\n+\t\tconst time = getTimeParts(date, displayTimeZone)\n+\t\tdayLabels.set(dayKey, dayLabel)\n+\t\ttimeLabels.set(time.minutes, time.label)\n+\t\tslotByCoordinate.set(coordinateKey(dayKey, time.minutes), slot)\n+\t}\n+\n+\tconst days = [...dayLabels.entries()]\n+\t\t.sort((a, b) => a[0].localeCompare(b[0]))\n+\t\t.map(([key, label]) => ({ key, label }))\n+\tconst times = [...timeLabels.entries()]\n+\t\t.sort((a, b) => a[0] - b[0])\n+\t\t.map(([minutes, label]) => ({ minutes, label }))\n+\n+\tconst dayIndexByKey = new Map(days.map((day, index) => [day.key, index]))\n+\tconst timeIndexByMinute = new Map(\n+\t\ttimes.map((time, index) => [time.minutes, index]),\n+\t)\n+\tconst coordinatesBySlot = new Map()\n+\n+\tfor (const slot of slots) {\n+\t\tconst date = new Date(slot.startsAtUtc)\n+\t\tconst dayKey = dayKeyFormatter.format(date)\n+\t\tconst time = getTimeParts(date, displayTimeZone)\n+\t\tconst dayIndex = dayIndexByKey.get(dayKey)\n+\t\tconst timeIndex = timeIndexByMinute.get(time.minutes)\n+\t\tif (dayIndex === undefined || timeIndex === undefined) continue\n+\t\tcoordinatesBySlot.set(slot.id, { dayIndex, timeIndex })\n+\t}\n+\n+\treturn {\n+\t\tdays,\n+\t\ttimes,\n+\t\tslotByCoordinate,\n+\t\tcoordinatesBySlot,\n+\t} satisfies GridModel\n+}\n+\n+export function collectRangeSlotIds(\n+\tmodel: ReturnType,\n+\tanchorSlotId: string,\n+\ttargetSlotId: string,\n+) {\n+\tconst anchor = model.coordinatesBySlot.get(anchorSlotId)\n+\tconst target = model.coordinatesBySlot.get(targetSlotId)\n+\tif (!anchor || !target) return []\n+\n+\tconst minDay = Math.min(anchor.dayIndex, target.dayIndex)\n+\tconst maxDay = Math.max(anchor.dayIndex, target.dayIndex)\n+\tconst minTime = Math.min(anchor.timeIndex, target.timeIndex)\n+\tconst maxTime = Math.max(anchor.timeIndex, target.timeIndex)\n+\tconst slotIds: Array = []\n+\n+\tfor (let dayIndex = minDay; dayIndex <= maxDay; dayIndex += 1) {\n+\t\tconst day = model.days[dayIndex]\n+\t\tif (!day) continue\n+\t\tfor (let timeIndex = minTime; timeIndex <= maxTime; timeIndex += 1) {\n+\t\t\tconst time = model.times[timeIndex]\n+\t\t\tif (!time) continue\n+\t\t\tconst slot = model.slotByCoordinate.get(coordinateKey(day.key, time.minutes))\n+\t\t\tif (slot) slotIds.push(slot.id)\n+\t\t}\n+\t}\n+\n+\treturn slotIds\n+}\n+\n+export function renderScheduleGrid({\n+\tmodel,\n+\tselectedSlotIds,\n+\tanchorSlotId,\n+\treadOnly = false,\n+\tariaLabel = 'Schedule availability grid',\n+\tonCellClick,\n+\tonCellMouseDown,\n+\tonCellMouseEnter,\n+\tonHandlePointerDown,\n+\tonHandlePointerMove,\n+\tonHandlePointerUp,\n+}: {\n+\tmodel: ReturnType\n+\tselectedSlotIds: ReadonlySet\n+\tanchorSlotId: string | null\n+\treadOnly?: boolean\n+\tariaLabel?: string\n+\tonCellClick: (slotId: string) => void\n+\tonCellMouseDown: (event: MouseEvent, slotId: string) => void\n+\tonCellMouseEnter: (slotId: string) => void\n+\tonHandlePointerDown: (event: PointerEvent) => void\n+\tonHandlePointerMove: (event: PointerEvent) => void\n+\tonHandlePointerUp: (event: PointerEvent) => void\n+}) {\n+\tif (model.days.length === 0 || model.times.length === 0) {\n+\t\treturn (\n+\t\t\t

\n+\t\t\t\tNo slots available for this date range.\n+\t\t\t

\n+\t\t)\n+\t}\n+\n+\treturn (\n+\t\t\n+\t\t\t\n+\t\t\t\t\n+\t\t\t\t\t\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\tTime\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t{model.days.map((day) => (\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t{day.label}\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t))}\n+\t\t\t\t\t\n+\t\t\t\t\n+\t\t\t\t\n+\t\t\t\t\t{model.times.map((time) => (\n+\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t{time.label}\n+\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t{model.days.map((day) => {\n+\t\t\t\t\t\t\t\tconst slot = model.slotByCoordinate.get(\n+\t\t\t\t\t\t\t\t\tcoordinateKey(day.key, time.minutes),\n+\t\t\t\t\t\t\t\t)\n+\t\t\t\t\t\t\t\treturn (\n+\t\t\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t\t\t{slot ? (\n+\t\t\t\t\t\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t\t\t\t\t\t onCellClick(slot.id),\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\tmousedown: (event) =>\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tonCellMouseDown(event, slot.id),\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\tmouseenter: () => onCellMouseEnter(slot.id),\n+\t\t\t\t\t\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t\t\t\t\t\t\tcss={{\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\twidth: '100%',\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\theight: '2rem',\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\tborder: selectedSlotIds.has(slot.id)\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t? `2px solid ${colors.primaryText}`\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t: `1px solid ${colors.border}`,\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\tbackgroundColor: selectedSlotIds.has(slot.id)\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t? colors.primarySoftHover\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t: colors.surface,\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\tborderRadius: radius.sm,\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\tcursor: readOnly ? 'not-allowed' : 'pointer',\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\tpadding: 0,\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\tmargin: 0,\n+\t\t\t\t\t\t\t\t\t\t\t\t\t}}\n+\t\t\t\t\t\t\t\t\t\t\t\t/>\n+\t\t\t\t\t\t\t\t\t\t\t\t{anchorSlotId === slot.id &&\n+\t\t\t\t\t\t\t\t\t\t\t\tselectedSlotIds.has(slot.id) &&\n+\t\t\t\t\t\t\t\t\t\t\t\t!readOnly ? (\n+\t\t\t\t\t\t\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t\t\t\t\t) : null}\n+\t\t\t\t\t\t\t\t\t\t\t

\n+\t\t\t\t\t\t\t\t\t\t) : null}\n+\t\t\t\t\t\t\t\t\t\n+\t\t\t\t\t\t\t\t)\n+\t\t\t\t\t\t\t})}\n+\t\t\t\t\t\t\n+\t\t\t\t\t))}\n+\t\t\t\t\n+\t\t\t\n+\t\t\n+\t)\n+}\n+\ndiff --git a/client/session.ts b/client/session.ts\ndeleted file mode 100644\nindex db7666c..0000000\n--- a/client/session.ts\n+++ /dev/null\n@@ -1,26 +0,0 @@\n-export type SessionInfo = {\n-\temail: string\n-}\n-\n-export type SessionStatus = 'idle' | 'loading' | 'ready'\n-\n-export async function fetchSessionInfo(\n-\tsignal?: AbortSignal,\n-): Promise {\n-\ttry {\n-\t\tconst response = await fetch('/session', {\n-\t\t\theaders: { Accept: 'application/json' },\n-\t\t\tcredentials: 'include',\n-\t\t\tsignal,\n-\t\t})\n-\t\tif (signal?.aborted) return null\n-\t\tconst payload = await response.json().catch(() => null)\n-\t\tconst email =\n-\t\t\tresponse.ok && payload?.ok && typeof payload?.session?.email === 'string'\n-\t\t\t\t? payload.session.email.trim()\n-\t\t\t\t: ''\n-\t\treturn email ? { email } : null\n-\t} catch {\n-\t\treturn null\n-\t}\n-}\ndiff --git a/docs/agents/end-to-end-testing.md b/docs/agents/end-to-end-testing.md\nindex 80a8508..e9dc5e7 100644\n--- a/docs/agents/end-to-end-testing.md\n+++ b/docs/agents/end-to-end-testing.md\n@@ -11,7 +11,7 @@ on the Epic Web E2E workshop and our existing setup.\n \n ## What to test\n \n-- Primary routes and flows (navigation, auth, critical forms).\n+- Primary routes and flows (navigation and critical scheduling forms).\n - Integration across the worker, client router, and API endpoints.\n - Regressions that are expensive to catch in unit tests.\n \n@@ -42,9 +42,8 @@ Avoid `page.locator('css')` unless no accessible alternative exists.\n `PLAYWRIGHT_PORT`.\n - Playwright sets `CLOUDFLARE_ENV=test`; Wrangler still loads `.env` values for\n local secrets.\n-- Ensure the `env.test` section in `wrangler.jsonc` includes assets, KV, and\n- durable objects since these are not inherited from top-level Wrangler config.\n-- Ensure `.env` includes a `COOKIE_SECRET` var for local sessions.\n+- Ensure the `env.test` section in `wrangler.jsonc` includes assets and D1\n+ configuration since these are not inherited from top-level Wrangler config.\n - Client routes live in `client/app.tsx` and `client/routes/index.tsx`.\n - API endpoints are defined in `server/routes.ts` and mapped in\n `server/router.ts`.\n@@ -55,7 +54,7 @@ handled by the static asset fetcher in `worker/index.ts`.\n ## Test data\n \n - Use real input values and a happy-path payload.\n-- Keep credentials and emails obviously fake and local-only.\n+- Keep schedule titles, attendee names, and dates obviously fake and local-only.\n - Avoid hidden fixtures or global state in the Playwright tests.\n \n ## Assertions\n@@ -65,18 +64,17 @@ handled by the static asset fetcher in `worker/index.ts`.\n - For client-router regressions, you may set a `window` marker before clicking a\n link and assert it survives navigation to prove there was no full document\n reload.\n-- Use the same marker pattern for form submissions (for example logout) when\n- verifying router-handled form navigation.\n+- Use the same marker pattern for form submissions when verifying router-handled\n+ navigation.\n \n ## Running tests\n \n Common commands:\n \n - `npm run test:e2e`\n-- `npm run test:e2e e2e/login.spec.ts`\n+- `npm run test:e2e e2e/home.spec.ts`\n \n If `.env` is missing, `test:e2e` copies `.env.example` to `.env` before running\n Playwright.\n \n-These tests are executed by the `validate` gate, which also runs `lint:fix` and\n-the MCP E2E suite.\n+These tests are executed by the `validate` gate, which also runs `lint:fix`.\ndiff --git a/docs/agents/setup.md b/docs/agents/setup.md\nindex bce569a..97d3453 100644\n--- a/docs/agents/setup.md\n+++ b/docs/agents/setup.md\n@@ -15,9 +15,7 @@ Quick notes for getting a local epic-scheduler environment running.\n \n - Copy `.env.example` to `.env` before starting any work, then update secrets as\n needed.\n-- `npm run dev` (starts mock API servers automatically and sets\n- `RESEND_API_BASE_URL` to the local mock Worker).\n-- Add new mock API servers by following `docs/agents/mock-api-servers.md`.\n+- `npm run dev`\n - If you only need the client bundle or worker, use:\n - `npm run dev:client`\n - `npm run dev:worker`\n@@ -27,11 +25,10 @@ Quick notes for getting a local epic-scheduler environment running.\n ## Checks\n \n - `npm run validate` runs format check, lint fix, build, typecheck, Playwright\n- tests, and MCP E2E tests.\n+ tests.\n - `npm run format` applies formatting updates.\n - `npm run test:e2e:install` to install Playwright browsers.\n - `npm run test:e2e` to run Playwright specs.\n-- `npm run test:mcp` to run MCP server E2E tests.\n \n ## Documentation maintenance\n \n@@ -42,36 +39,13 @@ Quick notes for getting a local epic-scheduler environment running.\n - When failures repeat, promote lessons from docs into tests, lint rules, or\n scripts.\n \n-## Seed test account\n+## Reset local state\n \n-Use this script to ensure a known test login exists in any deployed environment:\n+For a full local reset:\n \n-- Local D1 (default):\n- - `npm run migrate:local`\n- - `node ./tools/seed-test-data.ts --local`\n-- Local D1 with custom persisted state:\n- - `node ./tools/seed-test-data.ts --local --persist-to .wrangler/state/e2e`\n-- Remote D1:\n- - `node ./tools/seed-test-data.ts --remote --config `\n-- Default credentials:\n- - email: `kody@kcd.dev`\n- - password: `kodylovesyou`\n-- Override credentials when needed:\n- - `node ./tools/seed-test-data.ts --email --password `\n-- When changing DB schema/model definitions or migrations, review\n- `tools/seed-test-data.ts` and update it so seeded data still matches the new\n- model and remains useful for local and preview verification.\n-\n-### Reset, re-migrate, then seed\n-\n-For a full local reset before seeding:\n-\n-1. Drop app tables:\n- - `node ./wrangler-env.ts d1 execute APP_DB --local --command \"PRAGMA foreign_keys=OFF; DROP TABLE IF EXISTS password_resets; DROP TABLE IF EXISTS mock_resend_messages; DROP TABLE IF EXISTS users; PRAGMA foreign_keys=ON;\"`\n+1. Delete local Wrangler state if you want a completely fresh database.\n 2. Re-apply migrations:\n - `npm run migrate:local`\n-3. Seed test account:\n- - `node ./tools/seed-test-data.ts`\n \n For preview environments, we do a full resource reset:\n \n@@ -81,8 +55,6 @@ For preview environments, we do a full resource reset:\n - `node ./tools/ci/preview-resources.ts ensure --worker-name --out-config wrangler-preview.generated.json`\n 3. Re-apply remote migrations:\n - `CLOUDFLARE_ENV=preview node ./wrangler-env.ts d1 migrations apply APP_DB --remote --config wrangler-preview.generated.json`\n-4. Seed test account:\n- - `node ./tools/seed-test-data.ts --remote --config wrangler-preview.generated.json`\n \n ## PR preview deployments\n \n@@ -90,32 +62,23 @@ The GitHub Actions preview workflow creates per-preview Cloudflare resources so\n each PR preview is isolated:\n \n - D1 database: `-db`\n-- KV namespace (OAuth state): `-oauth-kv`\n \n When a PR is closed, the cleanup job deletes the preview Worker(s) and these\n resources as well.\n \n-Cloudflare Workers supports version `preview_urls`, but those preview URLs are\n-not currently available for Workers that use Durable Objects. The main app\n-Worker binds `MCP_OBJECT`, so app previews continue to use per-PR Worker names.\n-Mock Workers do not use Durable Objects, so their Wrangler configs opt into\n-`preview_urls = true` and the workflow includes mock version preview links when\n-Cloudflare returns them.\n+Cloudflare Workers supports version `preview_urls`, but this project continues\n+to use per-PR Worker names for predictable preview environments.\n \n Production deploys also ensure required Cloudflare resources exist before\n migrations/deploy:\n \n - D1 database: from `env.production.d1_databases` binding `APP_DB`\n-- KV namespace: `OAUTH_KV` (defaults to `-oauth` when creating)\n \n Both the preview and production deploy workflows run a post-deploy healthcheck\n against `/health` and fail the job if it does not return\n `{ ok: true, commitSha }` with `commitSha` matching the commit SHA deployed by\n that workflow.\n \n-Preview deploys also run `node ./tools/seed-test-data.ts` after deploy to create or\n-verify the shared test account credentials listed above.\n-\n If you ever need to do the same operations manually, use:\n \n - `node ./tools/ci/preview-resources.ts ensure --worker-name --out-config `\ndiff --git a/docs/architecture/authentication.md b/docs/architecture/authentication.md\ndeleted file mode 100644\nindex de634b1..0000000\n--- a/docs/architecture/authentication.md\n+++ /dev/null\n@@ -1,87 +0,0 @@\n-# Authentication\n-\n-`epic-scheduler` uses two related authentication models:\n-\n-1. Cookie-based app sessions for browser users\n-2. OAuth bearer tokens for MCP access\n-\n-## Browser app sessions\n-\n-Session cookie behavior is implemented in `server/auth-session.ts`.\n-\n-- Cookie name: `epic-scheduler_session`\n-- `httpOnly: true`\n-- `sameSite: 'Lax'`\n-- signed with `COOKIE_SECRET`\n-- max age: 7 days\n-\n-The cookie payload stores:\n-\n-- `id` (user id as string)\n-- `email`\n-\n-`server/handler.ts` calls `setAuthSessionSecret` on each request so cookie\n-signing and verification are available to handlers.\n-\n-## Login and signup\n-\n-`POST /auth` is implemented by `server/handlers/auth.ts`.\n-\n-- Accepts JSON body with `email`, `password`, and `mode` (`login` or `signup`)\n-- Uses D1 (`users` table) for user lookups and inserts\n-- Hashes passwords with `server/password-hash.ts`\n-- Returns signed session cookie via `Set-Cookie` on success\n-- Emits structured audit events through `server/audit-log.ts`\n-\n-Related handlers:\n-\n-- `GET /login` and `GET /signup`: `server/handlers/auth-page.ts`\n-- `POST /logout`: `server/handlers/logout.ts`\n-- `POST /session`: `server/handlers/session.ts` for session status checks\n-- `GET /account`: `server/handlers/account.ts` (redirects to login if missing\n- session)\n-\n-### Client session refresh behavior\n-\n-The app shell (`client/app.tsx`) refreshes session state after initial load and\n-on client-side navigation events. If an in-flight refresh is aborted, the client\n-keeps the last known ready session instead of overwriting it with `null`. This\n-prevents transient logged-out UI during concurrent re-renders.\n-\n-## Password reset\n-\n-Password reset handlers are in `server/handlers/password-reset.ts`.\n-\n-- `POST /password-reset` creates a one-time token and stores only its hash\n-- `POST /password-reset/confirm` verifies token hash and expiry, then updates\n- password\n-- reset tokens expire after 1 hour\n-- when configured, email delivery is done via Resend\n-\n-## OAuth for MCP\n-\n-OAuth endpoints are implemented in `worker/oauth-handlers.ts` and routed from\n-`worker/index.ts`.\n-\n-- Authorization endpoint: `/oauth/authorize`\n-- Token endpoint: `/oauth/token` (via provider)\n-- Client registration: `/oauth/register` (via provider)\n-- Supported scopes: `profile`, `email`\n-- On `/oauth/authorize`, unauthenticated users can log in inline or via top-nav\n- auth links; those links preserve the full authorize URL in `redirectTo` so\n- successful login/signup returns to the original OAuth request\n-\n-`/mcp` is protected by `worker/mcp-auth.ts`:\n-\n-- Requires `Authorization: Bearer `\n-- Token is validated via OAuth provider helpers (`unwrapToken`)\n-- Audience must match the app origin or `/mcp`\n-- Unauthenticated requests return `401` with `WWW-Authenticate` metadata\n-\n-## What to read when changing auth\n-\n-- `worker/index.ts` for route order and integration points\n-- `worker/oauth-handlers.ts` for OAuth authorization logic\n-- `worker/mcp-auth.ts` for MCP token enforcement\n-- `server/auth-session.ts` for cookie format/signing\n-- `server/handlers/auth.ts` for app login/signup flow\ndiff --git a/docs/architecture/data-storage.md b/docs/architecture/data-storage.md\nindex 520ed9f..a8d4cfb 100644\n--- a/docs/architecture/data-storage.md\n+++ b/docs/architecture/data-storage.md\n@@ -1,6 +1,7 @@\n # Data storage\n \n-This project uses three Cloudflare storage systems for different purposes.\n+This project uses D1 for scheduling data and the Worker asset binding for the\n+client bundle.\n \n ## D1 (`APP_DB`)\n \n@@ -8,40 +9,20 @@ Relational app data lives in D1.\n \n Current schema is defined by migrations in `migrations/`:\n \n-- `users`: login identity and password hash\n-- `password_resets`: hashed reset tokens with expiry and foreign key to users\n+- `schedules`: schedule metadata plus host access keys\n+- `schedule_slots`: canonical UTC slots for each schedule\n+- `attendee_availability`: attendee selections for each slot\n \n App access pattern:\n \n-- `worker/db.ts` defines shared `remix/data-table` table metadata and creates a\n- D1-backed database runtime via `worker/d1-data-table-adapter.ts`\n+- `server/scheduling-repository.ts` is the main persistence layer for schedule\n+ creation, reads, and updates\n - Database row validation and API payload parsing use `remix/data-schema`\n-- app handlers and the mock Resend worker perform CRUD/query operations through\n- `remix/data-table` (including `findOne`, `create`, `update`, `deleteMany`, and\n- `count`)\n-\n-## KV (`OAUTH_KV`)\n-\n-OAuth provider state is stored in KV through the\n-`@cloudflare/workers-oauth-provider` integration.\n-\n-- Binding is configured in `wrangler.jsonc`\n-- This supports OAuth client and token flows without custom storage code in the\n- app handlers\n-\n-## Durable Objects (`MCP_OBJECT`)\n-\n-MCP server runtime state is hosted via a Durable Object class (`MCP`) in\n-`mcp/index.ts`, exposed through the `/mcp` route.\n-\n-- The Worker forwards authorized MCP requests to `MCP.serve(...).fetch`\n-- Durable Objects provide a stateful execution model for MCP operations\n+- Schedule handlers call D1 directly for the core MVP workflows\n \n ## Configuration reference\n \n Bindings are configured per environment in `wrangler.jsonc`:\n \n - `APP_DB` (D1)\n-- `OAUTH_KV` (KV)\n-- `MCP_OBJECT` (Durable Objects)\n - `ASSETS` (static assets bucket)\ndiff --git a/docs/architecture/index.md b/docs/architecture/index.md\nindex b533ed4..a394dc0 100644\n--- a/docs/architecture/index.md\n+++ b/docs/architecture/index.md\n@@ -6,15 +6,11 @@ This folder documents the important runtime architecture for `epic-scheduler`.\n \n - [Request Lifecycle](./request-lifecycle.md): how requests are routed in the\n Worker.\n-- [Authentication](./authentication.md): app session auth and OAuth-protected\n- MCP auth.\n-- [Data Storage](./data-storage.md): what is stored in D1, KV, and Durable\n- Objects.\n+- [Data Storage](./data-storage.md): what is stored in D1 for schedules and\n+ attendee availability.\n \n ## Source of truth in code\n \n - Worker entrypoint: `worker/index.ts`\n - Server request handler: `server/handler.ts`\n - Router and HTTP route mapping: `server/router.ts` and `server/routes.ts`\n-- OAuth handlers: `worker/oauth-handlers.ts`\n-- MCP auth checks: `worker/mcp-auth.ts`\ndiff --git a/docs/architecture/request-lifecycle.md b/docs/architecture/request-lifecycle.md\nindex 10a57d8..c68ccae 100644\n--- a/docs/architecture/request-lifecycle.md\n+++ b/docs/architecture/request-lifecycle.md\n@@ -6,36 +6,28 @@ This document explains how an incoming request moves through the system.\n \n All traffic enters the Worker at `worker/index.ts`.\n \n-The `fetch` handler is wrapped by `OAuthProvider` from\n-`@cloudflare/workers-oauth-provider`, which means OAuth endpoints and token\n-infrastructure are available alongside normal app routes.\n-\n ## Routing order\n \n Requests are handled in this order:\n \n-1. OAuth authorization endpoints:\n- - `/oauth/authorize`\n- - `/oauth/authorize-info`\n- - `/oauth/callback`\n-2. Browser noise endpoint:\n- - `/.well-known/appspecific/com.chrome.devtools.json` (returns 204)\n-3. OAuth protected resource metadata endpoint:\n- - `/.well-known/oauth-protected-resource` (and the `/mcp` variant)\n-4. MCP endpoint:\n- - `/mcp` (requires OAuth bearer token)\n-5. Static assets:\n+1. Static assets:\n - Served from `ASSETS` for `GET` and `HEAD` when available\n-6. App server routes:\n+2. App server routes:\n - Everything else is handled by `server/handler.ts`\n \n ## App server flow\n \n-`server/handler.ts` validates environment variables and configures session\n-cookie signing (`COOKIE_SECRET`) before creating the app router.\n+`server/handler.ts` validates environment variables before creating the app\n+router.\n \n `server/router.ts` maps route patterns from `server/routes.ts` to handler\n-modules (home, auth, account, session, logout, password reset, health).\n+modules for the scheduling MVP:\n+\n+- `/` for schedule creation\n+- `/s/:scheduleKey` for attendee responses\n+- `/s/:scheduleKey/:hostKey` for host management\n+- `/health` for health checks\n+- `/api/schedules*` for the JSON APIs that power those routes\n \n ## Client-side navigation flow\n \n@@ -52,11 +44,6 @@ Full page navigations still occur for:\n \n ## CORS behavior\n \n-`worker/index.ts` wraps the handler with `withCors`:\n-\n-- CORS headers are only added when `Origin` exactly matches the request origin.\n-- Allowed methods are `GET, POST, OPTIONS`.\n-- Allowed headers include `content-type` and `authorization`.\n-\n-This keeps cross-origin behavior narrow while still allowing same-origin browser\n-and API requests.\n+The app is designed for same-origin browser and API traffic. There is no custom\n+CORS layer in `worker/index.ts`; requests are handled directly by the Worker and\n+app router.\ndiff --git a/docs/cloudflare-offerings.md b/docs/cloudflare-offerings.md\nindex 65c25c2..84cf910 100644\n--- a/docs/cloudflare-offerings.md\n+++ b/docs/cloudflare-offerings.md\n@@ -3,16 +3,13 @@\n epic-scheduler ships with:\n \n - D1 (`APP_DB`) for relational storage\n-- KV (`OAUTH_KV`) for OAuth/session state (owned by\n- `@cloudflare/workers-oauth-provider`)\n-- Durable Objects (`MCP_OBJECT`) for MCP server state\n \n This guide covers how to add common Cloudflare offerings on top of the starter:\n \n - R2 (object storage)\n - Workers AI\n - AI Gateway\n-- An additional KV namespace for app data (separate from `OAUTH_KV`)\n+- KV for app-managed key/value data\n \n All examples assume you are using the template's `wrangler.jsonc` and that you\n run commands from the repo root.\n@@ -37,10 +34,9 @@ Cloudflare's API token UI changes over time, but the shape is stable:\n - You grant **Read**/**Edit** per product area\n - Wrangler deploys, creates resources, and sets secrets via the API token\n \n-Recommended baseline permissions for this template (deploy + existing D1/KV):\n+Recommended baseline permissions for this template (deploy + existing D1):\n \n - `Workers Scripts:Edit` (deploy, update, delete preview Workers)\n-- `Workers KV Storage:Edit` (OAuth/session KV)\n - `D1:Edit` (migrations, database operations)\n \n Add these permissions when you add the corresponding offering:\n@@ -185,20 +181,17 @@ Most provider SDKs support overriding the base URL:\n - Keep the provider API key as a Worker secret (for example `OPENAI_API_KEY`)\n - Point the SDK's base URL at the gateway URL\n \n-## KV (app KV, separate from `OAUTH_KV`)\n+## KV (app KV)\n \n-This template already binds `OAUTH_KV` for OAuth/session state. Treat `OAUTH_KV`\n-as \"owned\" by `@cloudflare/workers-oauth-provider`:\n-\n-- Avoid mixing app data into `OAUTH_KV`\n-- Avoid key prefix collisions with the OAuth library\n-- Keep quotas/evictions isolated from auth state\n+This template does not bind KV by default. Add it only when you have a real\n+key/value use case such as caching, lightweight feature flags, or per-region\n+derived data.\n \n ### Token permissions\n \n - `Workers KV Storage:Edit`\n \n-### Commands to create a second namespace\n+### Commands to create a namespace\n \n Create a dedicated namespace for app data, for example `APP_KV`:\n \n@@ -210,15 +203,10 @@ If you are not using `--update-config`, record the namespace IDs and add them to\n \n ### Bind the namespace in `wrangler.jsonc`\n \n-Add a second entry in `kv_namespaces` alongside `OAUTH_KV`:\n+Add a `kv_namespaces` entry for the new binding:\n \n ```jsonc\n \"kv_namespaces\": [\n- {\n- \"binding\": \"OAUTH_KV\",\n- \"id\": \"\",\n- \"preview_id\": \"\"\n- },\n {\n \"binding\": \"APP_KV\",\n \"id\": \"\",\ndiff --git a/docs/environment-variables.md b/docs/environment-variables.md\nindex 8149094..ab9442f 100644\n--- a/docs/environment-variables.md\n+++ b/docs/environment-variables.md\n@@ -17,12 +17,7 @@ types, runtime validation, and documentation in sync.\n \n ```ts\n const EnvSchema = z.object({\n- \tCOOKIE_SECRET: z\n- \t\t.string()\n- \t\t.min(\n- \t\t\t32,\n- \t\t\t'COOKIE_SECRET must be at least 32 characters for session signing.',\n- \t\t),\n+ \tAPP_BASE_URL: z.string().url().optional(),\n \tTHIRD_PARTY_API_KEY: z\n \t\t.string()\n \t\t.min(\ndiff --git a/docs/getting-started.md b/docs/getting-started.md\nindex 262012c..3521d1a 100644\n--- a/docs/getting-started.md\n+++ b/docs/getting-started.md\n@@ -71,7 +71,7 @@ node ./docs/post-download.ts --guided\n ```\n \n This setup step does not create Cloudflare resources or rewrite `wrangler.jsonc`\n-resource IDs. The production deploy workflow creates missing D1/KV resources\n+resource IDs. The production deploy workflow creates missing D1 resources\n automatically on first CI deploy. Cloudflare deploys do not auto-create those\n resources from bindings alone, so the workflow runs an explicit ensure step\n before migrations/deploy.\n@@ -80,7 +80,6 @@ before migrations/deploy.\n \n - `CLOUDFLARE_API_TOKEN` (Workers deploy + D1 edit access on the correct\n account)\n-- `COOKIE_SECRET` (generate with `openssl rand -hex 32` or similar)\n - See `docs/setup-manifest.md` (`GitHub Actions secrets`) for full optional\n secrets and where to get each value.\n \n@@ -93,8 +92,7 @@ npm run deploy\n ## Agent/CI setup\n \n Use non-interactive flags or `--defaults`. The `--defaults` flag skips prompts\n-and uses defaults based on the current directory name (app/package naming), plus\n-a generated cookie secret.\n+and uses defaults based on the current directory name (app/package naming).\n \n ```\n node ./docs/post-download.ts --defaults\n@@ -121,7 +119,6 @@ are missing (for example `--app-name` without `--defaults`, and init choice when\n - `--github-username`: derives repository URL as\n `git+ssh://git@github.com//.git`.\n - `--repository-url`: explicit repository URL override.\n-- `--cookie-secret`: explicit `COOKIE_SECRET` value (otherwise generated).\n \n Cloudflare resources are managed during deploy. The setup script does not create\n Cloudflare resources or rewrite `wrangler.jsonc` resource IDs.\n@@ -130,18 +127,6 @@ Cloudflare resources or rewrite `wrangler.jsonc` resource IDs.\n \n See `docs/agents/setup.md` for local dev commands and verification steps.\n \n-To create a deterministic test login in a running environment:\n-\n-```bash\n-npm run migrate:local\n-node ./tools/seed-test-data.ts --local\n-```\n-\n-Default test credentials:\n-\n-- Email: `kody@kcd.dev`\n-- Password: `kodylovesyou`\n-\n ## Build and deploy\n \n Build the project:\ndiff --git a/docs/setup-manifest.md b/docs/setup-manifest.md\nindex 1eb9f9a..22dbad2 100644\n--- a/docs/setup-manifest.md\n+++ b/docs/setup-manifest.md\n@@ -8,9 +8,6 @@ This project uses the following resources:\n \n - D1 database\n - `database_name`: ``\n-- KV namespace for OAuth/session storage\n- - `binding`: `OAUTH_KV`\n- - `title`: `-oauth`\n \n Production CI deploys now ensure these resources exist and create them when\n missing. The post-download script does not create Cloudflare resources and does\n@@ -33,9 +30,9 @@ Use Cloudflare's built-in rate limiting rules instead of custom Worker logic.\n 1. Open the Cloudflare dashboard for the zone that routes to your Worker.\n 2. Go to `Security` → `WAF` → `Rate limiting rules` (or `Rules` →\n `Rate limiting rules`).\n-3. Create a rule that targets auth endpoints, for example:\n+3. Create a rule that targets the write endpoints, for example:\n - Expression:\n- `(http.request.method eq \"POST\" and http.request.uri.path in {\"/auth\" \"/oauth/authorize\" \"/oauth/token\" \"/oauth/register\"})`\n+ `(http.request.method eq \"POST\" and starts_with(http.request.uri.path, \"/api/schedules\"))`\n - Threshold: `10` requests per `1 minute` per IP (tune as needed).\n - Action: `Block` or `Managed Challenge`.\n \n@@ -43,14 +40,10 @@ Use Cloudflare's built-in rate limiting rules instead of custom Worker logic.\n \n Local development uses `.env`, which Wrangler loads automatically:\n \n-- `COOKIE_SECRET` (generate with `openssl rand -hex 32`)\n - `APP_BASE_URL` (optional; defaults to request origin, example\n `https://app.example.com`)\n - `APP_COMMIT_SHA` (optional; set automatically by deploy workflows for\n version-aware `/health` checks)\n-- `RESEND_API_BASE_URL` (optional, defaults to `https://api.resend.com`)\n-- `RESEND_API_KEY` (optional, required to send via Resend)\n-- `RESEND_FROM_EMAIL` (optional, required to send via Resend)\n \n Tests run with `CLOUDFLARE_ENV=test` (set by Playwright) and still read local\n secrets from `.env`.\n@@ -61,11 +54,7 @@ Configure these secrets for GitHub Actions workflows:\n \n - `CLOUDFLARE_API_TOKEN` (Workers deploy + D1 edit access on the correct\n account)\n-- `COOKIE_SECRET` (same format as local)\n - `APP_BASE_URL` (optional, used by the production deploy)\n-- `RESEND_API_KEY` (optional, required to send via Resend in non-mock\n- environments)\n-- `RESEND_FROM_EMAIL` (optional, required to send via Resend)\n \n How to get/set each secret:\n \n@@ -74,19 +63,10 @@ How to get/set each secret:\n Workers and edit D1 on the target account.\n - In GitHub: `Settings` → `Secrets and variables` → `Actions` →\n `New repository secret`.\n-- `COOKIE_SECRET`\n- - Generate locally: `openssl rand -hex 32`\n- - Store the exact value as a repository secret in GitHub Actions.\n - `APP_BASE_URL` (optional)\n - Use your production app URL (for example `https://app.example.com`).\n - Add only if you want deploy-time health/version checks to use a fixed URL.\n-- `RESEND_API_KEY` (optional)\n- - Create in Resend Dashboard (API keys), then store in GitHub Actions secrets.\n-- `RESEND_FROM_EMAIL` (optional)\n- - Use your verified sender/from address in Resend (for example\n- `noreply@example.com`), then store it as a secret.\n \n Preview deploys for pull requests create a separate Worker per PR named\n-`-pr-` (for epic-scheduler: `epic-scheduler-pr-123`) plus one Worker per\n-mock service named `-pr--mock-`. The same\n+`-pr-` (for epic-scheduler: `epic-scheduler-pr-123`). The same\n `CLOUDFLARE_API_TOKEN` must be able to create/update and delete those Workers.\ndiff --git a/e2e/account.spec.ts b/e2e/account.spec.ts\ndeleted file mode 100644\nindex a650c85..0000000\n--- a/e2e/account.spec.ts\n+++ /dev/null\n@@ -1,67 +0,0 @@\n-import { expect, test, type APIRequestContext } from '@playwright/test'\n-\n-const testUser = { email: 'user@example.com', password: 'password123' }\n-\n-async function ensureUserExists(request: APIRequestContext) {\n-\tconst response = await request.post('/auth', {\n-\t\tdata: { ...testUser, mode: 'signup' },\n-\t\theaders: { 'Content-Type': 'application/json' },\n-\t})\n-\tif (response.ok() || response.status() === 409) {\n-\t\treturn\n-\t}\n-\tthrow new Error(`Failed to seed user (${response.status()}).`)\n-}\n-\n-test.beforeEach(async ({ page }) => {\n-\tawait ensureUserExists(page.request)\n-\tawait page.context().clearCookies()\n-})\n-\n-test('redirects unauthenticated account to login with redirectTo', async ({\n-\tpage,\n-}) => {\n-\tawait page.goto('/account')\n-\tawait expect(page).toHaveURL(/\\/login\\?redirectTo=%2Faccount$/)\n-\tawait expect(\n-\t\tpage.getByRole('heading', { name: 'Welcome back' }),\n-\t).toBeVisible()\n-})\n-\n-test('redirects authenticated user from login to account', async ({ page }) => {\n-\tawait page.goto('/login')\n-\tawait page.getByLabel('Email').fill(testUser.email)\n-\tawait page.getByLabel('Password').fill(testUser.password)\n-\tawait page.getByRole('button', { name: 'Sign in' }).click()\n-\n-\tawait expect(page).toHaveURL(/\\/account$/)\n-\n-\tawait page.goto('/login')\n-\tawait expect(page).toHaveURL(/\\/account$/)\n-})\n-\n-test('logs out from the account page', async ({ page }) => {\n-\tawait page.goto('/login')\n-\tawait page.getByLabel('Email').fill(testUser.email)\n-\tawait page.getByLabel('Password').fill(testUser.password)\n-\tawait page.getByRole('button', { name: 'Sign in' }).click()\n-\n-\tawait expect(page).toHaveURL(/\\/account$/)\n-\tconst marker = await page.evaluate(() => {\n-\t\tconst value = `form-spa-${Math.random().toString(16).slice(2)}`\n-\t\t;(window as { __formSpaMarker?: string }).__formSpaMarker = value\n-\t\treturn value\n-\t})\n-\tawait page.getByRole('button', { name: 'Log out' }).click()\n-\n-\tawait expect(page).toHaveURL(/\\/login$/)\n-\tawait expect(\n-\t\tpage.getByRole('heading', { name: 'Welcome back' }),\n-\t).toBeVisible()\n-\tawait expect(page.getByRole('link', { name: 'Login' })).toBeVisible()\n-\tawait expect(page.getByRole('button', { name: 'Log out' })).toHaveCount(0)\n-\tconst markerAfterLogout = await page.evaluate(\n-\t\t() => (window as { __formSpaMarker?: string }).__formSpaMarker ?? null,\n-\t)\n-\texpect(markerAfterLogout).toBe(marker)\n-})\ndiff --git a/e2e/chat.spec.ts b/e2e/chat.spec.ts\ndeleted file mode 100644\nindex 3083473..0000000\n--- a/e2e/chat.spec.ts\n+++ /dev/null\n@@ -1,15 +0,0 @@\n-import { expect, test } from './playwright-utils.ts'\n-\n-test('redirects to login when unauthenticated', async ({ page }) => {\n-\tawait page.goto('/chat')\n-\tawait expect(page).toHaveURL(/\\/login/)\n-})\n-\n-test('loads chat page when authenticated', async ({ page, login }) => {\n-\tawait login()\n-\tawait page.goto('/chat')\n-\tawait expect(page).toHaveURL(/\\/chat$/)\n-\n-\t// Check that we don't get redirected to login and the shell is visible\n-\tawait expect(page.getByRole('heading', { name: 'Chat' })).toBeVisible()\n-})\ndiff --git a/e2e/home.spec.ts b/e2e/home.spec.ts\nindex 1045286..690175e 100644\n--- a/e2e/home.spec.ts\n+++ b/e2e/home.spec.ts\n@@ -1,32 +1,13 @@\n import { expect, test } from '@playwright/test'\n \n-test('home page renders the shell', async ({ page }) => {\n+test('home page renders the schedule builder', async ({ page }) => {\n \tawait page.goto('/')\n \tawait expect(page).toHaveTitle('epic-scheduler')\n \tawait expect(\n-\t\tpage.getByRole('heading', { name: 'epic-scheduler Remix 3' }),\n+\t\tpage.getByRole('heading', { name: 'Create a schedule' }),\n \t).toBeVisible()\n-})\n-\n-test('login link navigates without full page reload', async ({ page }) => {\n-\tawait page.goto('/')\n-\tconst loginLink = page.getByRole('link', { name: 'Login' })\n-\tawait expect(loginLink).toBeVisible()\n-\n-\tconst marker = await page.evaluate(() => {\n-\t\tconst value = `spa-${Math.random().toString(16).slice(2)}`\n-\t\t;(window as { __spaMarker?: string }).__spaMarker = value\n-\t\treturn value\n-\t})\n-\n-\tawait loginLink.click()\n-\tawait expect(page).toHaveURL(/\\/login$/)\n+\tawait expect(page.getByLabel('Plan title')).toHaveValue('Friday Hangout')\n \tawait expect(\n-\t\tpage.getByRole('heading', { name: 'Welcome back' }),\n+\t\tpage.getByRole('button', { name: 'Create schedule' }),\n \t).toBeVisible()\n-\n-\tconst markerAfterNavigation = await page.evaluate(\n-\t\t() => (window as { __spaMarker?: string }).__spaMarker ?? null,\n-\t)\n-\texpect(markerAfterNavigation).toBe(marker)\n })\ndiff --git a/e2e/login.spec.ts b/e2e/login.spec.ts\ndeleted file mode 100644\nindex 92e225d..0000000\n--- a/e2e/login.spec.ts\n+++ /dev/null\n@@ -1,46 +0,0 @@\n-import { expect, test, type APIRequestContext } from '@playwright/test'\n-\n-const testUser = { email: 'user@example.com', password: 'password123' }\n-\n-async function ensureUserExists(request: APIRequestContext) {\n-\tconst response = await request.post('/auth', {\n-\t\tdata: { ...testUser, mode: 'signup' },\n-\t\theaders: { 'Content-Type': 'application/json' },\n-\t})\n-\tif (response.ok() || response.status() === 409) {\n-\t\treturn\n-\t}\n-\tthrow new Error(`Failed to seed user (${response.status()}).`)\n-}\n-\n-test('logs in with email and password', async ({ page }) => {\n-\tawait ensureUserExists(page.request)\n-\tawait page.context().clearCookies()\n-\tawait page.goto('/login')\n-\n-\tawait page.getByLabel('Email').fill(testUser.email)\n-\tawait page.getByLabel('Password').fill(testUser.password)\n-\tawait page.getByRole('button', { name: 'Sign in' }).click()\n-\n-\tawait expect(page).toHaveURL(/\\/account$/)\n-\tawait expect(\n-\t\tpage.getByRole('heading', { name: `Welcome, ${testUser.email}` }),\n-\t).toBeVisible()\n-})\n-\n-test('signs up with email and password', async ({ page }) => {\n-\tconst signupUser = {\n-\t\temail: `new-user-${crypto.randomUUID()}@example.com`,\n-\t\tpassword: 'password123',\n-\t}\n-\tawait page.goto('/signup')\n-\n-\tawait page.getByLabel('Email').fill(signupUser.email)\n-\tawait page.getByLabel('Password').fill(signupUser.password)\n-\tawait page.getByRole('button', { name: 'Create account' }).click()\n-\n-\tawait expect(page).toHaveURL(/\\/account$/)\n-\tawait expect(\n-\t\tpage.getByRole('heading', { name: `Welcome, ${signupUser.email}` }),\n-\t).toBeVisible()\n-})\ndiff --git a/e2e/oauth-authorize.spec.ts b/e2e/oauth-authorize.spec.ts\ndeleted file mode 100644\nindex 6a5b071..0000000\n--- a/e2e/oauth-authorize.spec.ts\n+++ /dev/null\n@@ -1,229 +0,0 @@\n-import { expect, test, type APIRequestContext } from '@playwright/test'\n-import { createServer } from 'node:http'\n-import getPort from 'get-port'\n-\n-function toBase64Url(bytes: Uint8Array) {\n-\treturn Buffer.from(bytes)\n-\t\t.toString('base64')\n-\t\t.replace(/\\+/g, '-')\n-\t\t.replace(/\\//g, '_')\n-\t\t.replace(/=+$/g, '')\n-}\n-\n-function createCodeVerifier() {\n-\treturn toBase64Url(crypto.getRandomValues(new Uint8Array(32)))\n-}\n-\n-async function createCodeChallenge(codeVerifier: string) {\n-\tconst digest = await crypto.subtle.digest(\n-\t\t'SHA-256',\n-\t\tnew TextEncoder().encode(codeVerifier),\n-\t)\n-\treturn toBase64Url(new Uint8Array(digest))\n-}\n-\n-async function createUser(request: APIRequestContext) {\n-\tconst user = {\n-\t\temail: `oauth-ui-${crypto.randomUUID()}@example.com`,\n-\t\tpassword: `pw-${crypto.randomUUID()}`,\n-\t}\n-\tconst response = await request.post('/auth', {\n-\t\tdata: { ...user, mode: 'signup' },\n-\t\theaders: { 'Content-Type': 'application/json' },\n-\t})\n-\tif (!response.ok()) {\n-\t\tthrow new Error(`Failed to create user (${response.status()}).`)\n-\t}\n-\treturn user\n-}\n-\n-async function registerOAuthClient(\n-\trequest: APIRequestContext,\n-\tredirectUri: string,\n-) {\n-\tconst response = await request.post('/oauth/register', {\n-\t\tdata: {\n-\t\t\tclient_name: 'oauth-ui-playwright-client',\n-\t\t\tredirect_uris: [redirectUri],\n-\t\t\tgrant_types: ['authorization_code', 'refresh_token'],\n-\t\t\tresponse_types: ['code'],\n-\t\t\ttoken_endpoint_auth_method: 'client_secret_post',\n-\t\t},\n-\t\theaders: { 'Content-Type': 'application/json' },\n-\t})\n-\tif (!response.ok()) {\n-\t\tthrow new Error(`Failed to register OAuth client (${response.status()}).`)\n-\t}\n-\tconst payload = (await response.json()) as {\n-\t\tclient_id?: unknown\n-\t}\n-\tif (typeof payload.client_id !== 'string') {\n-\t\tthrow new Error('OAuth client registration response missing client_id.')\n-\t}\n-\treturn payload.client_id\n-}\n-\n-async function createLoopbackCallbackServer() {\n-\tconst port = await getPort({ host: '127.0.0.1' })\n-\tlet resolveCallback: ((url: URL) => void) | null = null\n-\tconst callbackPromise = new Promise((resolve) => {\n-\t\tresolveCallback = resolve\n-\t})\n-\n-\tconst server = createServer((req, res) => {\n-\t\tconst requestUrl = new URL(req.url ?? '/', `http://127.0.0.1:${port}`)\n-\t\tresolveCallback?.(requestUrl)\n-\t\tresolveCallback = null\n-\t\tres.statusCode = 200\n-\t\tres.setHeader('Content-Type', 'text/plain; charset=utf-8')\n-\t\tres.end('oauth callback received')\n-\t})\n-\n-\tawait new Promise((resolve, reject) => {\n-\t\tserver.once('error', reject)\n-\t\tserver.listen(port, '127.0.0.1', () => {\n-\t\t\tserver.off('error', reject)\n-\t\t\tresolve()\n-\t\t})\n-\t})\n-\n-\treturn {\n-\t\tredirectUri: `http://127.0.0.1:${port}/oauth/callback`,\n-\t\twaitForCallback: () => callbackPromise,\n-\t\tclose: async () => {\n-\t\t\tawait new Promise((resolve, reject) => {\n-\t\t\t\tserver.close((error) => {\n-\t\t\t\t\tif (error) {\n-\t\t\t\t\t\treject(error)\n-\t\t\t\t\t\treturn\n-\t\t\t\t\t}\n-\t\t\t\t\tresolve()\n-\t\t\t\t})\n-\t\t\t})\n-\t\t},\n-\t}\n-}\n-\n-test('oauth authorize page accepts valid credentials for logged-out user', async ({\n-\tbaseURL,\n-\tpage,\n-}) => {\n-\tif (!baseURL) {\n-\t\tthrow new Error('Playwright baseURL is required for OAuth test.')\n-\t}\n-\n-\tconst user = await createUser(page.request)\n-\tconst redirectUri = `${baseURL}/oauth/callback`\n-\tconst clientId = await registerOAuthClient(page.request, redirectUri)\n-\tconst codeVerifier = createCodeVerifier()\n-\tconst codeChallenge = await createCodeChallenge(codeVerifier)\n-\tawait page.context().clearCookies()\n-\n-\tconst authorizeParams = new URLSearchParams({\n-\t\tresponse_type: 'code',\n-\t\tclient_id: clientId,\n-\t\tredirect_uri: redirectUri,\n-\t\tscope: 'profile email',\n-\t\tstate: 'playwright-oauth-state',\n-\t\tcode_challenge: codeChallenge,\n-\t\tcode_challenge_method: 'S256',\n-\t})\n-\n-\tawait page.goto(`/oauth/authorize?${authorizeParams.toString()}`)\n-\tawait expect(\n-\t\tpage.getByRole('heading', { name: 'Authorize access' }),\n-\t).toBeVisible()\n-\tawait expect(page.getByLabel('Email')).toBeVisible()\n-\n-\tawait page.getByLabel('Email').fill(user.email)\n-\tawait page.getByLabel('Password').fill(user.password)\n-\tawait page.getByRole('button', { name: 'Authorize' }).click()\n-\n-\tawait expect(page).toHaveURL(/\\/oauth\\/callback\\?/)\n-\tconst callbackUrl = new URL(page.url())\n-\texpect(callbackUrl.searchParams.get('code')).toBeTruthy()\n-\tawait expect(\n-\t\tpage.getByRole('heading', { name: 'OAuth callback' }),\n-\t).toBeVisible()\n-})\n-\n-test('oauth authorize redirects to loopback callback with code after login', async ({\n-\tpage,\n-}) => {\n-\tconst callbackServer = await createLoopbackCallbackServer()\n-\ttry {\n-\t\tconst user = await createUser(page.request)\n-\t\tconst clientId = await registerOAuthClient(\n-\t\t\tpage.request,\n-\t\t\tcallbackServer.redirectUri,\n-\t\t)\n-\t\tconst codeVerifier = createCodeVerifier()\n-\t\tconst codeChallenge = await createCodeChallenge(codeVerifier)\n-\t\tawait page.context().clearCookies()\n-\n-\t\tconst authorizeParams = new URLSearchParams({\n-\t\t\tresponse_type: 'code',\n-\t\t\tclient_id: clientId,\n-\t\t\tredirect_uri: callbackServer.redirectUri,\n-\t\t\tscope: 'profile email',\n-\t\t\tstate: 'playwright-oauth-loopback',\n-\t\t\tcode_challenge: codeChallenge,\n-\t\t\tcode_challenge_method: 'S256',\n-\t\t})\n-\n-\t\tawait page.goto(`/oauth/authorize?${authorizeParams.toString()}`)\n-\t\tawait expect(page.getByLabel('Email')).toBeVisible()\n-\t\tawait page.getByLabel('Email').fill(user.email)\n-\t\tawait page.getByLabel('Password').fill(user.password)\n-\t\tawait page.getByRole('button', { name: 'Authorize' }).click()\n-\n-\t\tconst callbackRequest = await callbackServer.waitForCallback()\n-\t\texpect(callbackRequest.searchParams.get('code')).toBeTruthy()\n-\t\texpect(callbackRequest.searchParams.get('state')).toBe(\n-\t\t\t'playwright-oauth-loopback',\n-\t\t)\n-\t} finally {\n-\t\tawait callbackServer.close()\n-\t}\n-})\n-\n-test('oauth login link preserves authorize params through login', async ({\n-\tpage,\n-}) => {\n-\tconst callbackServer = await createLoopbackCallbackServer()\n-\ttry {\n-\t\tconst user = await createUser(page.request)\n-\t\tconst clientId = await registerOAuthClient(\n-\t\t\tpage.request,\n-\t\t\tcallbackServer.redirectUri,\n-\t\t)\n-\t\tconst codeVerifier = createCodeVerifier()\n-\t\tconst codeChallenge = await createCodeChallenge(codeVerifier)\n-\t\tawait page.context().clearCookies()\n-\n-\t\tconst authorizeParams = new URLSearchParams({\n-\t\t\tresponse_type: 'code',\n-\t\t\tclient_id: clientId,\n-\t\t\tredirect_uri: callbackServer.redirectUri,\n-\t\t\tscope: 'profile email',\n-\t\t\tstate: 'playwright-oauth-link-login',\n-\t\t\tcode_challenge: codeChallenge,\n-\t\t\tcode_challenge_method: 'S256',\n-\t\t})\n-\t\tconst authorizePath = `/oauth/authorize?${authorizeParams.toString()}`\n-\t\tawait page.goto(authorizePath)\n-\t\tawait page.getByRole('link', { name: 'Login' }).click()\n-\t\tawait expect(page).toHaveURL(/\\/login/)\n-\n-\t\tawait page.getByLabel('Email').fill(user.email)\n-\t\tawait page.getByLabel('Password').fill(user.password)\n-\t\tawait page.getByRole('button', { name: 'Sign in' }).click()\n-\n-\t\tawait expect(page).toHaveURL(new RegExp(`/oauth/authorize\\\\?`))\n-\t\tawait expect(\n-\t\t\tpage.getByRole('button', { name: 'Approve connection' }),\n-\t\t).toBeVisible()\n-\t} finally {\n-\t\tawait callbackServer.close()\n-\t}\n-})\ndiff --git a/e2e/playwright-utils.ts b/e2e/playwright-utils.ts\ndeleted file mode 100644\nindex ba2a8c5..0000000\n--- a/e2e/playwright-utils.ts\n+++ /dev/null\n@@ -1,76 +0,0 @@\n-import { test as base } from '@playwright/test'\n-import * as setCookieParser from 'set-cookie-parser'\n-\n-export * from '@playwright/test'\n-\n-export const test = base.extend<{\n-\tinsertNewUser(options?: {\n-\t\temail?: string\n-\t\tpassword?: string\n-\t}): Promise<{ email: string; password: string }>\n-\tlogin(options?: {\n-\t\temail?: string\n-\t\tpassword?: string\n-\t}): Promise<{ email: string; password: string }>\n-}>({\n-\tinsertNewUser: async ({ page }, use) => {\n-\t\tawait use(async (options) => {\n-\t\t\tconst email = options?.email ?? `user-${crypto.randomUUID()}@example.com`\n-\t\t\tconst password = options?.password ?? 'password123'\n-\n-\t\t\tconst response = await page.request.post('/auth', {\n-\t\t\t\tdata: { email, password, mode: 'signup' },\n-\t\t\t\theaders: { 'Content-Type': 'application/json' },\n-\t\t\t})\n-\n-\t\t\tif (!response.ok() && response.status() !== 409) {\n-\t\t\t\tthrow new Error(`Failed to seed user (${response.status()}).`)\n-\t\t\t}\n-\n-\t\t\treturn { email, password }\n-\t\t})\n-\t},\n-\tlogin: async ({ page }, use) => {\n-\t\tawait use(async (options) => {\n-\t\t\tconst email = options?.email ?? `user-${crypto.randomUUID()}@example.com`\n-\t\t\tconst password = options?.password ?? 'password123'\n-\n-\t\t\tlet response = await page.request.post('/auth', {\n-\t\t\t\tdata: { email, password, mode: 'signup' },\n-\t\t\t\theaders: { 'Content-Type': 'application/json' },\n-\t\t\t})\n-\n-\t\t\tif (!response.ok() && response.status() !== 409) {\n-\t\t\t\tthrow new Error(`Failed to seed user (${response.status()}).`)\n-\t\t\t}\n-\n-\t\t\tif (response.status() === 409) {\n-\t\t\t\tresponse = await page.request.post('/auth', {\n-\t\t\t\t\tdata: { email, password, mode: 'login' },\n-\t\t\t\t\theaders: { 'Content-Type': 'application/json' },\n-\t\t\t\t})\n-\n-\t\t\t\tif (!response.ok()) {\n-\t\t\t\t\tthrow new Error(`Failed to login user (${response.status()}).`)\n-\t\t\t\t}\n-\t\t\t}\n-\n-\t\t\tconst setCookieHeader = response.headers()['set-cookie']\n-\t\t\tif (setCookieHeader) {\n-\t\t\t\tconst parsed = setCookieParser.parseString(setCookieHeader)\n-\t\t\t\tconst cookieConfig = {\n-\t\t\t\t\tname: parsed.name,\n-\t\t\t\t\tvalue: parsed.value,\n-\t\t\t\t\tdomain: 'localhost',\n-\t\t\t\t\tpath: parsed.path || '/',\n-\t\t\t\t\thttpOnly: parsed.httpOnly,\n-\t\t\t\t\tsecure: parsed.secure,\n-\t\t\t\t\tsameSite: parsed.sameSite as 'Strict' | 'Lax' | 'None',\n-\t\t\t\t}\n-\t\t\t\tawait page.context().addCookies([cookieConfig])\n-\t\t\t}\n-\n-\t\t\treturn { email, password }\n-\t\t})\n-\t},\n-})\ndiff --git a/mcp/apps/calculator-ui-entry-point.ts b/mcp/apps/calculator-ui-entry-point.ts\ndeleted file mode 100644\nindex 7b6ca04..0000000\n--- a/mcp/apps/calculator-ui-entry-point.ts\n+++ /dev/null\n@@ -1,211 +0,0 @@\n-export const calculatorUiResourceUri =\n-\t'ui://calculator-app/entry-point.html' as const\n-\n-export function renderCalculatorUiEntryPoint(baseUrl: string | URL) {\n-\tconst stylesheetHref = new URL('/styles.css', baseUrl).toString()\n-\tconst widgetScriptHref = new URL(\n-\t\t'/mcp-apps/calculator-widget.js',\n-\t\tbaseUrl,\n-\t).toString()\n-\n-\treturn `\n-\n-\n-\t\n-\t\t\n-\t\t\n-\t\tCalculator\n-\t\t\n-\t\t\n-\t\n-\t\n-\t\t

\n-\t\t\t

\n-\t\t\t\t

Calculator

\n-\t\t\t\t

Use keys, Enter, and Backspace.

\n-\t\t\t

\n-\n-\t\t\t

\n-\t\t\t\t

\n-\t\t\t

\n-\n-\t\t\t

\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\n-\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\n-\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\n-\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\n-\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t\t\n-\t\t\t

\n-\t\t

\n-\n-\t\t\n-\t\n-\n-`.trim()\n-}\ndiff --git a/mcp/index.ts b/mcp/index.ts\nindex a79dee9..4161890 100644\n--- a/mcp/index.ts\n+++ b/mcp/index.ts\n@@ -1,43 +1,7 @@\n-import { invariant } from '@epic-web/invariant'\n-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\n-import { McpAgent } from 'agents/mcp'\n-import { registerResources } from './register-resources.ts'\n-import { registerTools } from './register-tools.ts'\n+import { createMcpHandler } from 'agents/mcp'\n+import { createSchedulingMcpServer } from './server.ts'\n \n-export type State = {}\n-export type Props = {\n-\tbaseUrl: string\n-}\n-\n-const serverMetadata = {\n-\timplementation: {\n-\t\tname: 'epic-scheduler-mcp',\n-\t\tversion: '1.0.0',\n-\t},\n-\tinstructions: `\n-Quick start\n-- Use 'do_math' any time you need arithmetic. Prefer calling the tool over doing mental math.\n-- Use 'open_calculator_ui' when you want an interactive calculator widget in MCP App compatible hosts.\n-\n-How to chain tools safely\n-- If you need to verify, re-run 'do_math' with the same arguments (idempotent) or validate with an inverse operation.\n-\t`.trim(),\n-} as const\n-\n-export class MCP extends McpAgent {\n-\tserver = new McpServer(serverMetadata.implementation, {\n-\t\tinstructions: serverMetadata.instructions,\n-\t})\n-\tasync init() {\n-\t\tawait registerResources(this)\n-\t\tawait registerTools(this)\n-\t}\n-\trequireDomain() {\n-\t\tconst baseUrl = this.props?.baseUrl\n-\t\tinvariant(\n-\t\t\tbaseUrl,\n-\t\t\t'This should never happen, but somehow we did not get the baseUrl from the request handler',\n-\t\t)\n-\t\treturn baseUrl\n-\t}\n+export function createSchedulingMcpHandler(env: Env) {\n+\tconst server = createSchedulingMcpServer(env)\n+\treturn createMcpHandler(server)\n }\ndiff --git a/mcp/mcp-server-e2e.test.ts b/mcp/mcp-server-e2e.test.ts\nindex 941c691..44a2c9d 100644\n--- a/mcp/mcp-server-e2e.test.ts\n+++ b/mcp/mcp-server-e2e.test.ts\n@@ -1,89 +1,75 @@\n-import {\n-\tspawn,\n-\tspawnSync,\n-\ttype ChildProcess,\n-} from 'node:child_process'\n-import { expect, test } from 'vitest'\n+import { spawn } from 'node:child_process'\n+import { existsSync } from 'node:fs'\n+import { mkdtemp, rm } from 'node:fs/promises'\n+import { tmpdir } from 'node:os'\n+import { join, resolve } from 'node:path'\n+import { fileURLToPath } from 'node:url'\n import { Client } from '@modelcontextprotocol/sdk/client/index.js'\n import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'\n-import {\n-\tauth,\n-\ttype OAuthClientProvider,\n-} from '@modelcontextprotocol/sdk/client/auth.js'\n-import {\n-\ttype OAuthClientInformationMixed,\n-\ttype OAuthTokens,\n-} from '@modelcontextprotocol/sdk/shared/auth.js'\n import {\n \ttype CallToolResult,\n \ttype ContentBlock,\n } from '@modelcontextprotocol/sdk/types.js'\n import getPort from 'get-port'\n-import { mkdtemp, readdir, rm } from 'node:fs/promises'\n-import { tmpdir } from 'node:os'\n-import { join } from 'node:path'\n-import { fileURLToPath } from 'node:url'\n+import { expect, test } from 'vitest'\n \n const projectRoot = fileURLToPath(new URL('..', import.meta.url))\n-const migrationsDir = join(projectRoot, 'migrations')\n const defaultTimeoutMs = 60_000\n-const calculatorUiResourceUri = 'ui://calculator-app/entry-point.html'\n-\n-const passwordHashPrefix = 'pbkdf2_sha256'\n-const passwordSaltBytes = 16\n-const passwordHashBytes = 32\n-const passwordHashIterations = 100_000\n+type SpawnedProcess = ReturnType\n \n function delay(ms: number) {\n \treturn new Promise((resolve) => setTimeout(resolve, ms))\n }\n \n-function toHex(bytes: Uint8Array) {\n-\treturn Array.from(bytes)\n-\t\t.map((value) => value.toString(16).padStart(2, '0'))\n-\t\t.join('')\n+function captureOutput(stream: NodeJS.ReadableStream | null) {\n+\tlet output = ''\n+\tif (!stream) return () => output\n+\tstream.setEncoding('utf8')\n+\tstream.on('data', (chunk: string) => {\n+\t\toutput += chunk\n+\t})\n+\treturn () => output\n }\n \n-async function createPasswordHash(password: string) {\n-\tconst salt = crypto.getRandomValues(new Uint8Array(passwordSaltBytes))\n-\tconst key = await crypto.subtle.importKey(\n-\t\t'raw',\n-\t\tnew TextEncoder().encode(password),\n-\t\t'PBKDF2',\n-\t\tfalse,\n-\t\t['deriveBits'],\n-\t)\n-\tconst derivedBits = await crypto.subtle.deriveBits(\n-\t\t{\n-\t\t\tname: 'PBKDF2',\n-\t\t\tsalt,\n-\t\t\titerations: passwordHashIterations,\n-\t\t\thash: 'SHA-256',\n-\t\t},\n-\t\tkey,\n-\t\tpasswordHashBytes * 8,\n-\t)\n-\treturn `${passwordHashPrefix}$${passwordHashIterations}$${toHex(salt)}$${toHex(\n-\t\tnew Uint8Array(derivedBits),\n-\t)}`\n+function formatOutput(stdout: string, stderr: string) {\n+\tconst snippets: Array = []\n+\tif (stdout.trim()) snippets.push(`stdout: ${stdout.trim().slice(-2000)}`)\n+\tif (stderr.trim()) snippets.push(`stderr: ${stderr.trim().slice(-2000)}`)\n+\treturn snippets.length > 0 ? ` Output:\\n${snippets.join('\\n')}` : ''\n }\n \n-function escapeSql(value: string) {\n-\treturn value.replace(/'/g, \"''\")\n+function waitForExit(child: SpawnedProcess) {\n+\treturn new Promise((resolve, reject) => {\n+\t\tif (child.exitCode !== null) {\n+\t\t\tresolve(child.exitCode)\n+\t\t\treturn\n+\t\t}\n+\t\tchild.once('error', reject)\n+\t\tchild.once('exit', (code) => resolve(code ?? 1))\n+\t})\n }\n \n-async function runWrangler(args: Array) {\n-\tconst result = spawnSync(process.execPath, ['./wrangler-env.ts', ...args], {\n+async function runCommand(\n+\tcommand: string,\n+\targs: Array,\n+\tenv?: Record,\n+) {\n+\tconst proc = spawn(command, args, {\n \t\tcwd: projectRoot,\n-\t\tenv: process.env,\n-\t\tencoding: 'utf8',\n+\t\tstdio: ['ignore', 'pipe', 'pipe'],\n+\t\tenv: {\n+\t\t\t...process.env,\n+\t\t\t...env,\n+\t\t},\n \t})\n-\tconst stdout = result.stdout ?? ''\n-\tconst stderr = result.stderr ?? ''\n-\tconst exitCode = result.status ?? 1\n+\tconst getStdout = captureOutput(proc.stdout)\n+\tconst getStderr = captureOutput(proc.stderr)\n+\tconst exitCode = await waitForExit(proc)\n+\tconst stdout = getStdout()\n+\tconst stderr = getStderr()\n \tif (exitCode !== 0) {\n \t\tthrow new Error(\n-\t\t\t`wrangler ${args.join(' ')} failed (${exitCode}). ${stderr || stdout}`,\n+\t\t\t`${command} ${args.join(' ')} failed (${exitCode}). ${stderr || stdout}`,\n \t\t)\n \t}\n \treturn { stdout, stderr }\n@@ -91,120 +77,35 @@ async function runWrangler(args: Array) {\n \n async function createTestDatabase() {\n \tconst persistDir = await mkdtemp(join(tmpdir(), 'epic-scheduler-mcp-e2e-'))\n-\tconst user = {\n-\t\temail: `mcp-${crypto.randomUUID()}@example.com`,\n-\t\tpassword: `pw-${crypto.randomUUID()}`,\n-\t}\n-\n-\tawait applyMigrations(persistDir)\n-\n-\tconst passwordHash = await createPasswordHash(user.password)\n-\tconst username = user.email.split('@')[0] || 'user'\n-\tconst insertSql = `INSERT INTO users (username, email, password_hash) VALUES ('${escapeSql(\n-\t\tusername,\n-\t)}', '${escapeSql(user.email)}', '${escapeSql(passwordHash)}');`\n-\n-\tawait runWrangler([\n-\t\t'd1',\n-\t\t'execute',\n-\t\t'APP_DB',\n-\t\t'--local',\n-\t\t'--env',\n-\t\t'test',\n-\t\t'--persist-to',\n-\t\tpersistDir,\n-\t\t'--command',\n-\t\tinsertSql,\n-\t])\n+\tconst npmCommand = process.platform === 'win32' ? 'npm.cmd' : 'npm'\n+\tawait runCommand(\n+\t\tnpmCommand,\n+\t\t['run', '--silent', 'migrate:local', '--', '--persist-to', persistDir],\n+\t\t{ CLOUDFLARE_ENV: 'test' },\n+\t)\n \n \treturn {\n \t\tpersistDir,\n-\t\tuser,\n \t\t[Symbol.asyncDispose]: async () => {\n \t\t\tawait rm(persistDir, { recursive: true, force: true })\n \t\t},\n \t}\n }\n \n-async function applyMigrations(persistDir: string) {\n-\tconst migrationFiles = await listMigrationFiles()\n-\tif (migrationFiles.length === 0) {\n-\t\tthrow new Error('No migration files found in migrations directory.')\n-\t}\n-\n-\tfor (const migrationFile of migrationFiles) {\n-\t\tawait runWrangler([\n-\t\t\t'd1',\n-\t\t\t'execute',\n-\t\t\t'APP_DB',\n-\t\t\t'--local',\n-\t\t\t'--env',\n-\t\t\t'test',\n-\t\t\t'--persist-to',\n-\t\t\tpersistDir,\n-\t\t\t'--file',\n-\t\t\tjoin('migrations', migrationFile),\n-\t\t])\n-\t}\n-}\n-\n-async function listMigrationFiles() {\n-\tconst entries = await readdir(migrationsDir, { withFileTypes: true })\n-\treturn entries\n-\t\t.filter((entry) => entry.isFile() && entry.name.endsWith('.sql'))\n-\t\t.map((entry) => entry.name)\n-\t\t.sort((left, right) => left.localeCompare(right))\n-}\n-\n-type ManagedProcess = {\n-\tprocess: ChildProcess\n-\texited: Promise\n-\tstdout: NodeJS.ReadableStream | null\n-\tstderr: NodeJS.ReadableStream | null\n-\tkill: (signal?: NodeJS.Signals) => void\n-}\n-\n-function captureOutput(stream: NodeJS.ReadableStream | null) {\n-\tlet output = ''\n-\tif (!stream) {\n-\t\treturn () => output\n-\t}\n-\n-\tstream.on('data', (chunk) => {\n-\t\toutput += String(chunk)\n-\t})\n-\treturn () => output\n-}\n-\n-function formatOutput(stdout: string, stderr: string) {\n-\tconst snippets: Array = []\n-\tif (stdout.trim()) {\n-\t\tsnippets.push(`stdout: ${stdout.trim().slice(-2000)}`)\n-\t}\n-\tif (stderr.trim()) {\n-\t\tsnippets.push(`stderr: ${stderr.trim().slice(-2000)}`)\n-\t}\n-\treturn snippets.length > 0 ? ` Output:\\n${snippets.join('\\n')}` : ''\n-}\n-\n async function waitForServer(\n \torigin: string,\n-\tproc: ManagedProcess,\n+\tproc: SpawnedProcess,\n \tgetStdout: () => string,\n \tgetStderr: () => string,\n ) {\n \tlet exited = false\n \tlet exitCode: number | null = null\n-\tvoid proc.exited\n-\t\t.then((code) => {\n+\tproc.once('exit', (code) => {\n \t\texited = true\n \t\texitCode = code\n \t})\n-\t\t.catch(() => {\n-\t\t\texited = true\n-\t\t})\n \n-\tconst metadataUrl = new URL('/.well-known/oauth-protected-resource', origin)\n+\tconst healthUrl = new URL('/health', origin)\n \tconst deadline = Date.now() + 25_000\n \twhile (Date.now() < deadline) {\n \t\tif (exited) {\n@@ -216,13 +117,13 @@ async function waitForServer(\n \t\t\t)\n \t\t}\n \t\ttry {\n-\t\t\tconst response = await fetch(metadataUrl)\n+\t\t\tconst response = await fetch(healthUrl)\n \t\t\tif (response.ok) {\n \t\t\t\tawait response.body?.cancel()\n \t\t\t\treturn\n \t\t\t}\n \t\t} catch {\n-\t\t\t// Retry until the server is ready.\n+\t\t\t// Retry until ready.\n \t\t}\n \t\tawait delay(250)\n \t}\n@@ -235,16 +136,35 @@ async function waitForServer(\n \t)\n }\n \n-async function stopProcess(proc: ManagedProcess) {\n+async function stopProcess(proc: SpawnedProcess) {\n \tlet exited = false\n-\tvoid proc.exited.then(() => {\n+\tproc.once('exit', () => {\n \t\texited = true\n \t})\n \tproc.kill('SIGINT')\n-\tawait Promise.race([proc.exited, delay(5_000)])\n+\tawait Promise.race([waitForExit(proc), delay(5_000)])\n \tif (!exited) {\n \t\tproc.kill('SIGKILL')\n-\t\tawait proc.exited\n+\t\tawait waitForExit(proc)\n+\t}\n+}\n+\n+function resolveWranglerCommand() {\n+\tconst localWranglerPath = resolve(\n+\t\tprojectRoot,\n+\t\t'node_modules',\n+\t\t'.bin',\n+\t\tprocess.platform === 'win32' ? 'wrangler.cmd' : 'wrangler',\n+\t)\n+\tif (existsSync(localWranglerPath)) {\n+\t\treturn {\n+\t\t\tcommand: localWranglerPath,\n+\t\t\targs: (args: Array) => args,\n+\t\t}\n+\t}\n+\treturn {\n+\t\tcommand: process.platform === 'win32' ? 'npx.cmd' : 'npx',\n+\t\targs: (args: Array) => ['-y', 'wrangler', ...args],\n \t}\n }\n \n@@ -254,15 +174,14 @@ async function startDevServer(persistDir: string) {\n \t\tport + 10_000 <= 65_535 ? port + 10_000 : Math.max(1, port - 10_000)\n \tconst inspectorPort = await getPort({\n \t\thost: '127.0.0.1',\n-\t\tport: Array.from(\n-\t\t\t{ length: 10 },\n-\t\t\t(_, index) => inspectorPortBase + index,\n-\t\t).filter((candidate) => candidate > 0 && candidate <= 65_535),\n+\t\tport: Array.from({ length: 10 }, (_, index) => inspectorPortBase + index)\n+\t\t\t.filter((candidate) => candidate > 0 && candidate <= 65_535),\n \t})\n \tconst origin = `http://127.0.0.1:${port}`\n-\tconst processHandle = createProcess([\n-\t\tprocess.execPath,\n-\t\t'./wrangler-env.ts',\n+\tconst wranglerCommand = resolveWranglerCommand()\n+\tconst proc = spawn(\n+\t\twranglerCommand.command,\n+\t\twranglerCommand.args([\n \t\t\t'dev',\n \t\t\t'--local',\n \t\t\t'--env',\n@@ -278,204 +197,39 @@ async function startDevServer(persistDir: string) {\n \t\t\t'--show-interactive-dev-session=false',\n \t\t\t'--log-level',\n \t\t\t'error',\n-\t])\n-\n-\tconst getStdout = captureOutput(processHandle.stdout)\n-\tconst getStderr = captureOutput(processHandle.stderr)\n-\n-\tawait waitForServer(origin, processHandle, getStdout, getStderr)\n-\n-\treturn {\n-\t\torigin,\n-\t\t[Symbol.asyncDispose]: async () => {\n-\t\t\tawait stopProcess(processHandle)\n-\t\t},\n-\t}\n-}\n-\n-function createProcess(args: Array): ManagedProcess {\n-\tconst child = spawn(args[0]!, args.slice(1), {\n+\t\t]),\n+\t\t{\n \t\t\tcwd: projectRoot,\n \t\t\tstdio: ['ignore', 'pipe', 'pipe'],\n \t\t\tenv: {\n \t\t\t\t...process.env,\n+\t\t\t\tAPP_BASE_URL: origin,\n \t\t\t\tCLOUDFLARE_ENV: 'test',\n \t\t\t},\n-\t})\n-\tconst exited = new Promise((resolve, reject) => {\n-\t\tchild.once('error', reject)\n-\t\tchild.once('exit', (code) => resolve(code ?? 1))\n-\t})\n-\treturn {\n-\t\tprocess: child,\n-\t\texited,\n-\t\tstdout: child.stdout,\n-\t\tstderr: child.stderr,\n-\t\tkill: (signal) => {\n-\t\t\tchild.kill(signal)\n \t\t},\n-\t}\n-}\n-\n-async function authorizeWithPassword(\n-\tauthorizationUrl: URL,\n-\tuser: { email: string; password: string },\n-\toptions: { simulateInteractiveAuthorize?: boolean } = {},\n-) {\n-\tif (options.simulateInteractiveAuthorize) {\n-\t\tconst authorizeInfoUrl = new URL('/oauth/authorize-info', authorizationUrl)\n-\t\tauthorizeInfoUrl.search = authorizationUrl.search\n-\t\tconst authorizeInfoResponse = await fetch(authorizeInfoUrl, {\n-\t\t\theaders: { Accept: 'application/json' },\n-\t\t})\n-\t\tconst authorizeInfoPayload = (await authorizeInfoResponse\n-\t\t\t.json()\n-\t\t\t.catch(() => null)) as unknown\n-\t\tconst authorizeInfo =\n-\t\t\tauthorizeInfoPayload &&\n-\t\t\ttypeof authorizeInfoPayload === 'object' &&\n-\t\t\t'ok' in authorizeInfoPayload\n-\t\t\t\t? (authorizeInfoPayload as { ok?: unknown })\n-\t\t\t\t: null\n-\t\tif (!authorizeInfoResponse.ok || authorizeInfo?.ok !== true) {\n-\t\t\tthrow new Error(\n-\t\t\t\t`OAuth authorize-info failed (${authorizeInfoResponse.status}). ${JSON.stringify(authorizeInfoPayload)}`,\n \t)\n-\t\t}\n-\t}\n \n-\tconst response = await fetch(authorizationUrl, {\n-\t\tmethod: 'POST',\n-\t\theaders: {\n-\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n-\t\t\tAccept: 'application/json',\n-\t\t},\n-\t\tbody: new URLSearchParams({\n-\t\t\tdecision: 'approve',\n-\t\t\temail: user.email,\n-\t\t\tpassword: user.password,\n-\t\t}),\n-\t})\n-\tconst payload = (await response.json().catch(() => null)) as unknown\n-\n-\tif (!response.ok || !payload || typeof payload !== 'object') {\n-\t\tthrow new Error(\n-\t\t\t`OAuth approval failed (${response.status}). ${JSON.stringify(payload)}`,\n-\t\t)\n-\t}\n-\n-\tconst approval = payload as { ok?: unknown; redirectTo?: unknown }\n-\tif (approval.ok !== true || typeof approval.redirectTo !== 'string') {\n-\t\tthrow new Error(\n-\t\t\t`OAuth approval failed (${response.status}). ${JSON.stringify(payload)}`,\n-\t\t)\n-\t}\n-\n-\tconst redirectUrl = new URL(approval.redirectTo)\n-\tconst code = redirectUrl.searchParams.get('code')\n-\tif (!code) {\n-\t\tthrow new Error('Authorization response missing code.')\n-\t}\n-\treturn code\n-}\n-\n-type TestOAuthProvider = OAuthClientProvider & {\n-\twaitForAuthorizationCode: () => Promise\n-}\n-\n-function createOAuthProvider({\n-\tredirectUrl,\n-\tclientMetadata,\n-\tauthorize,\n-}: {\n-\tredirectUrl: URL\n-\tclientMetadata: OAuthClientProvider['clientMetadata']\n-\tauthorize: (authorizationUrl: URL) => Promise\n-}): TestOAuthProvider {\n-\tlet clientInformation: OAuthClientInformationMixed | undefined\n-\tlet tokens: OAuthTokens | undefined\n-\tlet codeVerifier: string | undefined\n-\tlet authorizationCode: Promise | undefined\n+\tconst getStdout = captureOutput(proc.stdout)\n+\tconst getStderr = captureOutput(proc.stderr)\n+\tawait waitForServer(origin, proc, getStdout, getStderr)\n \n \treturn {\n-\t\tredirectUrl,\n-\t\tclientMetadata,\n-\t\tclientInformation() {\n-\t\t\treturn clientInformation\n-\t\t},\n-\t\tsaveClientInformation(nextClientInfo) {\n-\t\t\tclientInformation = nextClientInfo\n-\t\t},\n-\t\ttokens() {\n-\t\t\treturn tokens\n-\t\t},\n-\t\tsaveTokens(nextTokens) {\n-\t\t\ttokens = nextTokens\n-\t\t},\n-\t\tredirectToAuthorization(authorizationUrl) {\n-\t\t\tauthorizationCode = authorize(authorizationUrl)\n-\t\t},\n-\t\tsaveCodeVerifier(nextCodeVerifier) {\n-\t\t\tcodeVerifier = nextCodeVerifier\n-\t\t},\n-\t\tcodeVerifier() {\n-\t\t\tif (!codeVerifier) {\n-\t\t\t\tthrow new Error('No code verifier saved')\n-\t\t\t}\n-\t\t\treturn codeVerifier\n-\t\t},\n-\t\tasync waitForAuthorizationCode() {\n-\t\t\tif (!authorizationCode) {\n-\t\t\t\tthrow new Error('Authorization flow was not started')\n-\t\t\t}\n-\t\t\treturn authorizationCode\n+\t\torigin,\n+\t\t[Symbol.asyncDispose]: async () => {\n+\t\t\tawait stopProcess(proc)\n \t\t},\n \t}\n }\n \n-async function ensureAuthorized(\n-\tserverUrl: URL,\n-\ttransport: StreamableHTTPClientTransport,\n-\tprovider: TestOAuthProvider,\n-) {\n-\tconst result = await auth(provider, { serverUrl })\n-\tif (result === 'AUTHORIZED') {\n-\t\treturn\n-\t}\n-\tconst authorizationCode = await provider.waitForAuthorizationCode()\n-\tawait transport.finishAuth(authorizationCode)\n-}\n-\n-async function createMcpClient(\n-\torigin: string,\n-\tuser: { email: string; password: string },\n-\toptions: { simulateInteractiveAuthorize?: boolean } = {},\n-) {\n-\tconst redirectUrl = new URL('/oauth/callback', origin)\n-\tconst provider = createOAuthProvider({\n-\t\tredirectUrl,\n-\t\tclientMetadata: {\n-\t\t\tclient_name: 'mcp-e2e-client',\n-\t\t\tredirect_uris: [redirectUrl.toString()],\n-\t\t\tgrant_types: ['authorization_code', 'refresh_token'],\n-\t\t\tresponse_types: ['code'],\n-\t\t\ttoken_endpoint_auth_method: 'client_secret_post',\n-\t\t},\n-\t\tauthorize: (authorizationUrl) =>\n-\t\t\tauthorizeWithPassword(authorizationUrl, user, options),\n-\t})\n+async function createMcpClient(origin: string) {\n \tconst serverUrl = new URL('/mcp', origin)\n-\tconst transport = new StreamableHTTPClientTransport(serverUrl, {\n-\t\tauthProvider: provider,\n-\t})\n+\tconst transport = new StreamableHTTPClientTransport(serverUrl)\n \tconst client = new Client(\n \t\t{ name: 'mcp-e2e', version: '1.0.0' },\n \t\t{ capabilities: {} },\n \t)\n \n-\tawait ensureAuthorized(serverUrl, transport, provider)\n \tawait client.connect(transport)\n-\n \treturn {\n \t\tclient,\n \t\t[Symbol.asyncDispose]: async () => {\n@@ -484,167 +238,166 @@ async function createMcpClient(\n \t}\n }\n \n-test(\n-\t'mcp server lists tools after interactive oauth authorize flow',\n-\tasync () => {\n-\t\tawait using database = await createTestDatabase()\n-\t\tawait using server = await startDevServer(database.persistDir)\n-\t\tawait using mcpClient = await createMcpClient(\n-\t\t\tserver.origin,\n-\t\t\tdatabase.user,\n-\t\t\t{\n-\t\t\t\tsimulateInteractiveAuthorize: true,\n-\t\t\t},\n+function getTextContent(result: CallToolResult) {\n+\treturn (\n+\t\tresult.content.find(\n+\t\t\t(item): item is Extract =>\n+\t\t\t\titem.type === 'text',\n+\t\t)?.text ?? ''\n \t)\n+}\n \n-\t\tconst result = await mcpClient.client.listTools()\n-\t\tconst toolNames = result.tools.map((tool) => tool.name)\n-\n-\t\texpect(toolNames.sort()).toEqual(['do_math', 'open_calculator_ui'])\n-\t},\n-\tdefaultTimeoutMs,\n-)\n+function parseToolJson(result: CallToolResult) {\n+\treturn JSON.parse(getTextContent(result)) as Record\n+}\n \n test(\n-\t'mcp server lists tools after oauth flow',\n+\t'mcp server lists scheduling tools',\n \tasync () => {\n \t\tawait using database = await createTestDatabase()\n \t\tawait using server = await startDevServer(database.persistDir)\n-\t\tawait using mcpClient = await createMcpClient(server.origin, database.user)\n-\n-\t\tconst instructions = mcpClient.client.getInstructions() ?? ''\n-\t\texpect(instructions).toContain('Quick start')\n+\t\tawait using mcpClient = await createMcpClient(server.origin)\n \n \t\tconst result = await mcpClient.client.listTools()\n-\t\tconst toolNames = result.tools.map((tool) => tool.name)\n-\n-\t\texpect(toolNames.sort()).toEqual(['do_math', 'open_calculator_ui'])\n-\n-\t\tconst resourcesResult = await mcpClient.client.listResources()\n-\t\tconst resourceUris = resourcesResult.resources.map(\n-\t\t\t(resource) => resource.uri,\n-\t\t)\n-\n-\t\texpect(resourceUris).toContain(calculatorUiResourceUri)\n+\t\tconst toolNames = result.tools.map((tool) => tool.name).sort()\n+\n+\t\texpect(toolNames).toEqual([\n+\t\t\t'create_schedule',\n+\t\t\t'generate_schedule_slots',\n+\t\t\t'get_host_schedule',\n+\t\t\t'get_schedule',\n+\t\t\t'save_attendee_availability',\n+\t\t\t'update_host_schedule',\n+\t\t])\n \t},\n \tdefaultTimeoutMs,\n )\n \n test(\n-\t'mcp server executes do_math tool',\n+\t'mcp server creates and updates a schedule',\n \tasync () => {\n \t\tawait using database = await createTestDatabase()\n \t\tawait using server = await startDevServer(database.persistDir)\n-\t\tawait using mcpClient = await createMcpClient(server.origin, database.user)\n+\t\tawait using mcpClient = await createMcpClient(server.origin)\n \n-\t\tconst result = await mcpClient.client.callTool({\n-\t\t\tname: 'do_math',\n+\t\tconst slotsResult = await mcpClient.client.callTool({\n+\t\t\tname: 'generate_schedule_slots',\n \t\t\targuments: {\n-\t\t\t\tleft: 8,\n-\t\t\t\tright: 4,\n-\t\t\t\toperator: '+',\n+\t\t\t\tstartDate: '2026-03-10',\n+\t\t\t\tendDate: '2026-03-10',\n+\t\t\t\tslotMinutes: 60,\n+\t\t\t\ttimezone: 'UTC',\n \t\t\t},\n \t\t})\n+\t\tconst slotPayload = parseToolJson(slotsResult as CallToolResult)\n+\t\tconst slots = Array.isArray(slotPayload.slots)\n+\t\t\t? slotPayload.slots\n+\t\t\t: []\n+\t\texpect(slots.length).toBe(24)\n+\n+\t\tconst selectedSlotsUtc = slots\n+\t\t\t.slice(0, 2)\n+\t\t\t.map((slot) =>\n+\t\t\t\ttypeof slot === 'object' &&\n+\t\t\t\tslot &&\n+\t\t\t\t'utcIso' in slot &&\n+\t\t\t\ttypeof slot.utcIso === 'string'\n+\t\t\t\t\t? slot.utcIso\n+\t\t\t\t\t: '',\n+\t\t\t)\n+\t\t\t.filter((slot) => slot.length > 0)\n+\t\texpect(selectedSlotsUtc).toHaveLength(2)\n \n-\t\tconst structuredResult = (result as CallToolResult).structuredContent as\n-\t\t\t| Record\n-\t\t\t| undefined\n-\t\texpect(structuredResult?.result).toBe(12)\n-\n-\t\tconst textOutput =\n-\t\t\t(result as CallToolResult).content.find(\n-\t\t\t\t(item): item is Extract =>\n-\t\t\t\t\titem.type === 'text',\n-\t\t\t)?.text ?? ''\n-\n-\t\texpect(textOutput).toContain('12')\n+\t\tconst createResult = await mcpClient.client.callTool({\n+\t\t\tname: 'create_schedule',\n+\t\t\targuments: {\n+\t\t\t\ttitle: 'MCP test schedule',\n+\t\t\t\tstartDate: '2026-03-10',\n+\t\t\t\tendDate: '2026-03-10',\n+\t\t\t\tslotMinutes: 60,\n+\t\t\t\ttimezone: 'UTC',\n+\t\t\t\tselectedSlotsUtc,\n \t\t\t},\n-\tdefaultTimeoutMs,\n-)\n-\n-test(\n-\t'mcp server executes calculator ui tool and serves resource entry point',\n-\tasync () => {\n-\t\tawait using database = await createTestDatabase()\n-\t\tawait using server = await startDevServer(database.persistDir)\n-\t\tawait using mcpClient = await createMcpClient(server.origin, database.user)\n-\n-\t\tconst result = await mcpClient.client.callTool({\n-\t\t\tname: 'open_calculator_ui',\n \t\t})\n-\n-\t\tconst structuredResult = (result as CallToolResult).structuredContent as\n-\t\t\t| Record\n-\t\t\t| undefined\n-\t\texpect(structuredResult?.widget).toBe('calculator')\n-\t\texpect(structuredResult?.resourceUri).toBe(calculatorUiResourceUri)\n-\n-\t\tconst textOutput =\n-\t\t\t(result as CallToolResult).content.find(\n-\t\t\t\t(item): item is Extract =>\n-\t\t\t\t\titem.type === 'text',\n-\t\t\t)?.text ?? ''\n-\t\texpect(textOutput).toContain('Calculator widget')\n-\n-\t\tconst resourceResult = await mcpClient.client.readResource({\n-\t\t\turi: calculatorUiResourceUri,\n+\t\tconst createPayload = parseToolJson(createResult as CallToolResult)\n+\t\tconst scheduleKey =\n+\t\t\ttypeof createPayload.scheduleKey === 'string' ? createPayload.scheduleKey : ''\n+\t\tconst hostKey =\n+\t\t\ttypeof createPayload.hostKey === 'string' ? createPayload.hostKey : ''\n+\t\texpect(scheduleKey.length).toBeGreaterThan(4)\n+\t\texpect(hostKey.length).toBeGreaterThan(8)\n+\n+\t\tconst attendeeResult = await mcpClient.client.callTool({\n+\t\t\tname: 'get_schedule',\n+\t\t\targuments: { scheduleKey },\n \t\t})\n-\t\tconst calculatorResource = resourceResult.contents.find(\n-\t\t\t(content): content is { uri: string; mimeType?: string; text: string } =>\n-\t\t\t\tcontent.uri === calculatorUiResourceUri &&\n-\t\t\t\t'text' in content &&\n-\t\t\t\ttypeof content.text === 'string',\n+\t\tconst attendeePayload = parseToolJson(attendeeResult as CallToolResult)\n+\t\texpect(attendeePayload.ok).toBe(true)\n+\t\tconst attendeeSchedule =\n+\t\t\ttypeof attendeePayload.schedule === 'object' && attendeePayload.schedule\n+\t\t\t\t? (attendeePayload.schedule as Record)\n+\t\t\t\t: {}\n+\t\texpect(attendeeSchedule.title).toBe('MCP test schedule')\n+\n+\t\tconst saveAvailabilityResult = await mcpClient.client.callTool({\n+\t\t\tname: 'save_attendee_availability',\n+\t\t\targuments: {\n+\t\t\t\tscheduleKey,\n+\t\t\t\tattendeeName: 'Alex',\n+\t\t\t\tselectedSlotsUtc: [selectedSlotsUtc[0]],\n+\t\t\t},\n+\t\t})\n+\t\tconst saveAvailabilityPayload = parseToolJson(\n+\t\t\tsaveAvailabilityResult as CallToolResult,\n \t\t)\n-\t\tconst calculatorResourceMeta = (\n-\t\t\tresourceResult.contents.find(\n-\t\t\t\t(content) => content.uri === calculatorUiResourceUri,\n-\t\t\t) as { _meta?: Record } | undefined\n-\t\t)?._meta as\n-\t\t\t| {\n-\t\t\t\t\tui?: {\n-\t\t\t\t\t\tdomain?: string\n-\t\t\t\t\t\tcsp?: {\n-\t\t\t\t\t\t\tresourceDomains?: Array\n-\t\t\t\t\t\t}\n-\t\t\t\t\t}\n-\t\t\t\t\t'openai/widgetDomain'?: string\n-\t\t\t }\n-\t\t\t| undefined\n-\n-\t\texpect(calculatorResource).toBeDefined()\n-\t\texpect(calculatorResource?.mimeType).toBe('text/html;profile=mcp-app')\n-\t\texpect(calculatorResource?.text).toContain('data-calculator-ui')\n-\t\texpect(calculatorResource?.text).toContain('rel=\"stylesheet\"')\n-\t\texpect(calculatorResource?.text).toContain('styles.css')\n-\t\texpect(calculatorResource?.text).toContain('--color-primary')\n-\t\texpect(calculatorResource?.text).toContain('--color-background')\n-\t\texpect(calculatorResource?.text).toContain(\"data-theme='dark'\")\n-\t\texpect(calculatorResource?.text).toContain('type=\"module\"')\n-\t\texpect(calculatorResource?.text).toContain('/mcp-apps/calculator-widget.js')\n-\n-\t\tconst calculatorWidgetResponse = await fetch(\n-\t\t\tnew URL('/mcp-apps/calculator-widget.js', server.origin),\n+\t\texpect(saveAvailabilityPayload.ok).toBe(true)\n+\n+\t\tconst hostResult = await mcpClient.client.callTool({\n+\t\t\tname: 'get_host_schedule',\n+\t\t\targuments: { scheduleKey, hostKey },\n+\t\t})\n+\t\tconst hostPayload = parseToolJson(hostResult as CallToolResult)\n+\t\texpect(hostPayload.ok).toBe(true)\n+\t\tconst attendeeSummary = Array.isArray(hostPayload.attendeeSummary)\n+\t\t\t? hostPayload.attendeeSummary\n+\t\t\t: []\n+\t\texpect(attendeeSummary).toHaveLength(1)\n+\n+\t\tconst updatedSlotsUtc = [selectedSlotsUtc[1]]\n+\t\tconst updateResult = await mcpClient.client.callTool({\n+\t\t\tname: 'update_host_schedule',\n+\t\t\targuments: {\n+\t\t\t\tscheduleKey,\n+\t\t\t\thostKey,\n+\t\t\t\ttitle: 'Updated MCP schedule',\n+\t\t\t\tstartDate: '2026-03-10',\n+\t\t\t\tendDate: '2026-03-10',\n+\t\t\t\tslotMinutes: 60,\n+\t\t\t\ttimezone: 'UTC',\n+\t\t\t\tselectedSlotsUtc: updatedSlotsUtc,\n+\t\t\t},\n+\t\t})\n+\t\tconst updatePayload = parseToolJson(updateResult as CallToolResult)\n+\t\texpect(updatePayload.ok).toBe(true)\n+\t\tconst updatedSchedule =\n+\t\t\ttypeof updatePayload.schedule === 'object' && updatePayload.schedule\n+\t\t\t\t? (updatePayload.schedule as Record)\n+\t\t\t\t: {}\n+\t\texpect(updatedSchedule.title).toBe('Updated MCP schedule')\n+\n+\t\tconst postUpdateAttendeeResult = await mcpClient.client.callTool({\n+\t\t\tname: 'get_schedule',\n+\t\t\targuments: { scheduleKey, attendeeName: 'Alex' },\n+\t\t})\n+\t\tconst postUpdateAttendeePayload = parseToolJson(\n+\t\t\tpostUpdateAttendeeResult as CallToolResult,\n \t\t)\n-\t\texpect(calculatorWidgetResponse.ok).toBe(true)\n-\t\texpect(\n-\t\t\tcalculatorWidgetResponse.headers.get('access-control-allow-origin'),\n-\t\t).toBe('*')\n-\t\tconst calculatorWidgetSource = await calculatorWidgetResponse.text()\n-\t\texpect(calculatorWidgetSource).toContain('createWidgetHostBridge')\n-\t\texpect(calculatorWidgetSource).toContain('Calculator result:')\n-\t\texpect(calculatorWidgetSource).toContain('sendUserMessageWithFallback')\n-\t\texpect(calculatorWidgetSource).toContain('ui/initialize')\n-\t\texpect(calculatorWidgetSource).toContain('ui/message')\n-\n-\t\tconst stylesResponse = await fetch(new URL('/styles.css', server.origin))\n-\t\texpect(stylesResponse.ok).toBe(true)\n-\t\texpect(stylesResponse.headers.get('access-control-allow-origin')).toBe('*')\n-\n-\t\texpect(calculatorResourceMeta?.ui?.domain).toBe(server.origin)\n-\t\texpect(calculatorResourceMeta?.['openai/widgetDomain']).toBe(server.origin)\n-\t\texpect(calculatorResourceMeta?.ui?.csp?.resourceDomains).toContain(\n-\t\t\tserver.origin,\n+\t\tconst postUpdateSelection = Array.isArray(\n+\t\t\tpostUpdateAttendeePayload.attendeeSelection,\n \t\t)\n+\t\t\t? postUpdateAttendeePayload.attendeeSelection\n+\t\t\t: []\n+\t\texpect(postUpdateSelection).toEqual([])\n \t},\n \tdefaultTimeoutMs,\n )\ndiff --git a/mcp/register-resources.ts b/mcp/register-resources.ts\ndeleted file mode 100644\nindex 829a899..0000000\n--- a/mcp/register-resources.ts\n+++ /dev/null\n@@ -1,6 +0,0 @@\n-import { type MCP } from './index.ts'\n-import { registerCalculatorAppResource } from './resources/calculator-app-resource.ts'\n-\n-export async function registerResources(agent: MCP) {\n-\tawait registerCalculatorAppResource(agent)\n-}\ndiff --git a/mcp/register-tools.ts b/mcp/register-tools.ts\ndeleted file mode 100644\nindex 7b37046..0000000\n--- a/mcp/register-tools.ts\n+++ /dev/null\n@@ -1,8 +0,0 @@\n-import { type MCP } from './index.ts'\n-import { registerDoMathTool } from './tools/do-math.ts'\n-import { registerOpenCalculatorUiTool } from './tools/open-calculator-ui.ts'\n-\n-export async function registerTools(agent: MCP) {\n-\tawait registerDoMathTool(agent)\n-\tawait registerOpenCalculatorUiTool(agent)\n-}\ndiff --git a/mcp/resources/calculator-app-resource.ts b/mcp/resources/calculator-app-resource.ts\ndeleted file mode 100644\nindex 86905f0..0000000\n--- a/mcp/resources/calculator-app-resource.ts\n+++ /dev/null\n@@ -1,66 +0,0 @@\n-import {\n-\tRESOURCE_MIME_TYPE,\n-\tregisterAppResource,\n-} from '@modelcontextprotocol/ext-apps/server'\n-import { createUIResource } from '@mcp-ui/server'\n-import {\n-\tcalculatorUiResourceUri,\n-\trenderCalculatorUiEntryPoint,\n-} from '#mcp/apps/calculator-ui-entry-point.ts'\n-import { type MCP } from '#mcp/index.ts'\n-\n-const calculatorAppResource = {\n-\tname: 'calculator_app_resource',\n-\ttitle: 'Calculator App Resource',\n-\tdescription:\n-\t\t'Interactive calculator app entry point rendered by MCP App compatible hosts.',\n-} as const\n-\n-export async function registerCalculatorAppResource(agent: MCP) {\n-\tconst baseUrl = agent.requireDomain()\n-\tconst resourceDomain = new URL('/styles.css', baseUrl).origin\n-\n-\tregisterAppResource(\n-\t\tagent.server,\n-\t\tcalculatorAppResource.name,\n-\t\tcalculatorUiResourceUri,\n-\t\t{\n-\t\t\ttitle: calculatorAppResource.title,\n-\t\t\tdescription: calculatorAppResource.description,\n-\t\t},\n-\t\tasync () => {\n-\t\t\tconst calculatorUiResource = createUIResource({\n-\t\t\t\turi: calculatorUiResourceUri,\n-\t\t\t\tcontent: {\n-\t\t\t\t\ttype: 'rawHtml',\n-\t\t\t\t\thtmlString: renderCalculatorUiEntryPoint(baseUrl),\n-\t\t\t\t},\n-\t\t\t\tencoding: 'text',\n-\t\t\t\tadapters: {\n-\t\t\t\t\tmcpApps: {\n-\t\t\t\t\t\tenabled: true,\n-\t\t\t\t\t},\n-\t\t\t\t},\n-\t\t\t})\n-\n-\t\t\treturn {\n-\t\t\t\tcontents: [\n-\t\t\t\t\t{\n-\t\t\t\t\t\t...calculatorUiResource.resource,\n-\t\t\t\t\t\tmimeType: RESOURCE_MIME_TYPE,\n-\t\t\t\t\t\t_meta: {\n-\t\t\t\t\t\t\tui: {\n-\t\t\t\t\t\t\t\tprefersBorder: true,\n-\t\t\t\t\t\t\t\tdomain: resourceDomain,\n-\t\t\t\t\t\t\t\tcsp: {\n-\t\t\t\t\t\t\t\t\tresourceDomains: [resourceDomain],\n-\t\t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\t'openai/widgetDomain': resourceDomain,\n-\t\t\t\t\t\t},\n-\t\t\t\t\t},\n-\t\t\t\t],\n-\t\t\t}\n-\t\t},\n-\t)\n-}\ndiff --git a/mcp/server.ts b/mcp/server.ts\nnew file mode 100644\nindex 0000000..3acc2d0\n--- /dev/null\n+++ b/mcp/server.ts\n@@ -0,0 +1,274 @@\n+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'\n+import { z } from 'zod'\n+import {\n+\tcreateScheduleWithUrls,\n+\treadScheduleForAttendee,\n+\treadScheduleForHost,\n+\tsaveAttendeeAvailability,\n+\tupdateScheduleForHost,\n+} from '#server/schedule-service.ts'\n+import {\n+\tgenerateLocalSlotKeys,\n+\tlocalSlotKeyToLabel,\n+\tlocalSlotKeyToUtcIso,\n+\tnormalizeIanaTimeZone,\n+\tslotIncrementOptions,\n+} from '#shared/scheduling-time.ts'\n+\n+type ToolResult = {\n+\tcontent: Array<{ type: 'text'; text: string }>\n+\tisError?: boolean\n+}\n+\n+function formatJsonResult(value: unknown): ToolResult {\n+\treturn {\n+\t\tcontent: [{ type: 'text', text: JSON.stringify(value, null, 2) }],\n+\t}\n+}\n+\n+function formatError(message: string): ToolResult {\n+\treturn {\n+\t\tisError: true,\n+\t\tcontent: [{ type: 'text', text: message }],\n+\t}\n+}\n+\n+function ensureSlotIncrement(value: number) {\n+\tif (\n+\t\t!slotIncrementOptions.includes(value as (typeof slotIncrementOptions)[number])\n+\t) {\n+\t\tthrow new Error(\n+\t\t\t`slotMinutes must be one of ${slotIncrementOptions.join(', ')}.`,\n+\t\t)\n+\t}\n+\treturn value as (typeof slotIncrementOptions)[number]\n+}\n+\n+function registerTools(server: McpServer, env: Env) {\n+\tserver.tool(\n+\t\t'generate_schedule_slots',\n+\t\t'Generate valid local and UTC slot options for a date range, timezone, and slot increment. Use this before creating or updating a schedule so you can pass valid selectedSlotsUtc values.',\n+\t\t{\n+\t\t\tstartDate: z.string().describe('ISO date in YYYY-MM-DD format.'),\n+\t\t\tendDate: z.string().describe('ISO date in YYYY-MM-DD format.'),\n+\t\t\tslotMinutes: z\n+\t\t\t\t.number()\n+\t\t\t\t.describe('Slot size in minutes. Must be 15, 30, or 60.'),\n+\t\t\ttimezone: z.string().describe('IANA timezone such as America/Denver.'),\n+\t\t},\n+\t\tasync ({ startDate, endDate, slotMinutes, timezone }) => {\n+\t\t\ttry {\n+\t\t\t\tconst normalizedTimeZone = normalizeIanaTimeZone(timezone)\n+\t\t\t\tconst safeSlotMinutes = ensureSlotIncrement(slotMinutes)\n+\t\t\t\tconst localSlots = generateLocalSlotKeys(\n+\t\t\t\t\tstartDate,\n+\t\t\t\t\tendDate,\n+\t\t\t\t\tsafeSlotMinutes,\n+\t\t\t\t).map((localSlotKey) => ({\n+\t\t\t\t\tlocalSlotKey,\n+\t\t\t\t\tlabel: localSlotKeyToLabel(localSlotKey),\n+\t\t\t\t\tutcIso: localSlotKeyToUtcIso(localSlotKey, normalizedTimeZone),\n+\t\t\t\t}))\n+\n+\t\t\t\treturn formatJsonResult({\n+\t\t\t\t\tstartDate,\n+\t\t\t\t\tendDate,\n+\t\t\t\t\tslotMinutes: safeSlotMinutes,\n+\t\t\t\t\ttimezone: normalizedTimeZone,\n+\t\t\t\t\tslotCount: localSlots.length,\n+\t\t\t\t\tslots: localSlots,\n+\t\t\t\t})\n+\t\t\t} catch (error) {\n+\t\t\t\treturn formatError(\n+\t\t\t\t\terror instanceof Error\n+\t\t\t\t\t\t? error.message\n+\t\t\t\t\t\t: 'Unable to generate schedule slots.',\n+\t\t\t\t)\n+\t\t\t}\n+\t\t},\n+\t)\n+\n+\tserver.tool(\n+\t\t'create_schedule',\n+\t\t'Create a new schedule and return both the attendee URL and the private host URL. selectedSlotsUtc must be canonical UTC ISO timestamps.',\n+\t\t{\n+\t\t\ttitle: z.string().describe('Human-friendly schedule title.'),\n+\t\t\tstartDate: z.string().describe('ISO date in YYYY-MM-DD format.'),\n+\t\t\tendDate: z.string().describe('ISO date in YYYY-MM-DD format.'),\n+\t\t\tslotMinutes: z\n+\t\t\t\t.number()\n+\t\t\t\t.describe('Slot size in minutes. Must be 15, 30, or 60.'),\n+\t\t\ttimezone: z.string().describe('IANA timezone such as America/Denver.'),\n+\t\t\tselectedSlotsUtc: z\n+\t\t\t\t.array(z.string())\n+\t\t\t\t.describe('UTC ISO timestamps selected by the host.'),\n+\t\t},\n+\t\tasync ({\n+\t\t\ttitle,\n+\t\t\tstartDate,\n+\t\t\tendDate,\n+\t\t\tslotMinutes,\n+\t\t\ttimezone,\n+\t\t\tselectedSlotsUtc,\n+\t\t}) => {\n+\t\t\ttry {\n+\t\t\t\tconst created = await createScheduleWithUrls(env, {\n+\t\t\t\t\ttitle,\n+\t\t\t\t\tstartDate,\n+\t\t\t\t\tendDate,\n+\t\t\t\t\tslotMinutes: ensureSlotIncrement(slotMinutes),\n+\t\t\t\t\ttimezone: normalizeIanaTimeZone(timezone),\n+\t\t\t\t\tselectedSlotUtc: selectedSlotsUtc,\n+\t\t\t\t})\n+\t\t\t\treturn formatJsonResult(created)\n+\t\t\t} catch (error) {\n+\t\t\t\treturn formatError(\n+\t\t\t\t\terror instanceof Error ? error.message : 'Unable to create schedule.',\n+\t\t\t\t)\n+\t\t\t}\n+\t\t},\n+\t)\n+\n+\tserver.tool(\n+\t\t'get_schedule',\n+\t\t'Read the attendee-facing schedule details and current response counts. Optionally include attendeeName to fetch that attendee’s current saved selection.',\n+\t\t{\n+\t\t\tscheduleKey: z.string().describe('Public schedule key from /s/{scheduleKey}.'),\n+\t\t\tattendeeName: z\n+\t\t\t\t.string()\n+\t\t\t\t.optional()\n+\t\t\t\t.describe('Optional attendee name to load their saved selection.'),\n+\t\t},\n+\t\tasync ({ scheduleKey, attendeeName }) => {\n+\t\t\tconst result = await readScheduleForAttendee(\n+\t\t\t\tenv,\n+\t\t\t\tscheduleKey,\n+\t\t\t\tattendeeName ?? '',\n+\t\t\t)\n+\t\t\tif (!result) {\n+\t\t\t\treturn formatError(`Schedule ${scheduleKey} was not found.`)\n+\t\t\t}\n+\t\t\treturn formatJsonResult(result)\n+\t\t},\n+\t)\n+\n+\tserver.tool(\n+\t\t'get_host_schedule',\n+\t\t'Read the private host view, including attendee summary and response counts. Requires both the public schedule key and the private host key.',\n+\t\t{\n+\t\t\tscheduleKey: z.string().describe('Public schedule key.'),\n+\t\t\thostKey: z.string().describe('Private host key.'),\n+\t\t},\n+\t\tasync ({ scheduleKey, hostKey }) => {\n+\t\t\tconst result = await readScheduleForHost(env, scheduleKey, hostKey)\n+\t\t\tif (!result) {\n+\t\t\t\treturn formatError(\n+\t\t\t\t\t`Host schedule ${scheduleKey} was not found for the provided host key.`,\n+\t\t\t\t)\n+\t\t\t}\n+\t\t\treturn formatJsonResult(result)\n+\t\t},\n+\t)\n+\n+\tserver.tool(\n+\t\t'update_host_schedule',\n+\t\t'Update the host-managed schedule details and availability grid. Use generate_schedule_slots first so selectedSlotsUtc values match the configured range and timezone.',\n+\t\t{\n+\t\t\tscheduleKey: z.string().describe('Public schedule key.'),\n+\t\t\thostKey: z.string().describe('Private host key.'),\n+\t\t\ttitle: z.string().describe('Updated schedule title.'),\n+\t\t\tstartDate: z.string().describe('ISO date in YYYY-MM-DD format.'),\n+\t\t\tendDate: z.string().describe('ISO date in YYYY-MM-DD format.'),\n+\t\t\tslotMinutes: z\n+\t\t\t\t.number()\n+\t\t\t\t.describe('Slot size in minutes. Must be 15, 30, or 60.'),\n+\t\t\ttimezone: z.string().describe('IANA timezone such as America/Denver.'),\n+\t\t\tselectedSlotsUtc: z\n+\t\t\t\t.array(z.string())\n+\t\t\t\t.describe('Updated host-selected UTC ISO timestamps.'),\n+\t\t},\n+\t\tasync ({\n+\t\t\tscheduleKey,\n+\t\t\thostKey,\n+\t\t\ttitle,\n+\t\t\tstartDate,\n+\t\t\tendDate,\n+\t\t\tslotMinutes,\n+\t\t\ttimezone,\n+\t\t\tselectedSlotsUtc,\n+\t\t}) => {\n+\t\t\ttry {\n+\t\t\t\tconst result = await updateScheduleForHost(env, scheduleKey, hostKey, {\n+\t\t\t\t\ttitle,\n+\t\t\t\t\tstartDate,\n+\t\t\t\t\tendDate,\n+\t\t\t\t\tslotMinutes: ensureSlotIncrement(slotMinutes),\n+\t\t\t\t\ttimezone: normalizeIanaTimeZone(timezone),\n+\t\t\t\t\tselectedSlotUtc: selectedSlotsUtc,\n+\t\t\t\t})\n+\t\t\t\tif (!result) {\n+\t\t\t\t\treturn formatError(\n+\t\t\t\t\t\t`Host schedule ${scheduleKey} was not found for the provided host key.`,\n+\t\t\t\t\t)\n+\t\t\t\t}\n+\t\t\t\treturn formatJsonResult(result)\n+\t\t\t} catch (error) {\n+\t\t\t\treturn formatError(\n+\t\t\t\t\terror instanceof Error\n+\t\t\t\t\t\t? error.message\n+\t\t\t\t\t\t: 'Unable to update the host schedule.',\n+\t\t\t\t)\n+\t\t\t}\n+\t\t},\n+\t)\n+\n+\tserver.tool(\n+\t\t'save_attendee_availability',\n+\t\t'Save or replace one attendee’s availability for a public schedule.',\n+\t\t{\n+\t\t\tscheduleKey: z.string().describe('Public schedule key.'),\n+\t\t\tattendeeName: z.string().describe('Attendee display name.'),\n+\t\t\tselectedSlotsUtc: z\n+\t\t\t\t.array(z.string())\n+\t\t\t\t.describe('UTC ISO timestamps selected by the attendee.'),\n+\t\t},\n+\t\tasync ({ scheduleKey, attendeeName, selectedSlotsUtc }) => {\n+\t\t\ttry {\n+\t\t\t\tconst result = await saveAttendeeAvailability(\n+\t\t\t\t\tenv,\n+\t\t\t\t\tscheduleKey,\n+\t\t\t\t\tattendeeName,\n+\t\t\t\t\tselectedSlotsUtc,\n+\t\t\t\t)\n+\t\t\t\tif (!result) {\n+\t\t\t\t\treturn formatError(`Schedule ${scheduleKey} was not found.`)\n+\t\t\t\t}\n+\t\t\t\treturn formatJsonResult(result)\n+\t\t\t} catch (error) {\n+\t\t\t\treturn formatError(\n+\t\t\t\t\terror instanceof Error\n+\t\t\t\t\t\t? error.message\n+\t\t\t\t\t\t: 'Unable to save attendee availability.',\n+\t\t\t\t)\n+\t\t\t}\n+\t\t},\n+\t)\n+}\n+\n+export function createSchedulingMcpServer(env: Env) {\n+\tconst server = new McpServer(\n+\t\t{\n+\t\t\tname: 'epic-scheduler-mcp',\n+\t\t\tversion: '1.0.0',\n+\t\t},\n+\t\t{\n+\t\t\tinstructions: [\n+\t\t\t\t'Use these tools to create, inspect, and update schedules in epic-scheduler.',\n+\t\t\t\t'For create/update flows, generate candidate slots first so you can choose valid UTC slot IDs.',\n+\t\t\t\t'Host operations require the hostKey. Attendee operations only require the public scheduleKey.',\n+\t\t\t].join(' '),\n+\t\t},\n+\t)\n+\tregisterTools(server, env)\n+\treturn server\n+}\ndiff --git a/mcp/tools/do-math.ts b/mcp/tools/do-math.ts\ndeleted file mode 100644\nindex 590b16e..0000000\n--- a/mcp/tools/do-math.ts\n+++ /dev/null\n@@ -1,186 +0,0 @@\n-import { type ToolAnnotations } from '@modelcontextprotocol/sdk/types.js'\n-import { z } from 'zod'\n-import { type MCP } from '#mcp/index.ts'\n-\n-type OperationFn = (left: number, right: number) => number\n-type MathOperator = '+' | '-' | '*' | '/'\n-\n-const operations = {\n-\t'+': (left: number, right: number) => left + right,\n-\t'-': (left: number, right: number) => left - right,\n-\t'*': (left: number, right: number) => left * right,\n-\t'/': (left: number, right: number) => left / right,\n-} satisfies Record\n-\n-const mathOperators = Object.keys(operations) as Array\n-\n-const doMathTool = {\n-\tname: 'do_math',\n-\ttitle: 'Do Math',\n-\tdescription: `\n-Compute a single arithmetic operation over two numbers.\n-\n-Behavior:\n-- Division by zero is rejected.\n-\n-Examples:\n-- \"Add 8 and 4\" → { left: 8, operator: \"+\", right: 4 }\n-- \"Divide 1 by 3 with 3 decimals\" → { left: 1, operator: \"/\", right: 3, precision: 3 }\n-\t`.trim(),\n-\tannotations: {\n-\t\treadOnlyHint: true,\n-\t\tdestructiveHint: false,\n-\t\tidempotentHint: true,\n-\t\topenWorldHint: false,\n-\t} satisfies ToolAnnotations,\n-} as const\n-\n-function formatNumberForMarkdown(value: number, precision: number) {\n-\tif (Number.isInteger(value)) return String(value)\n-\tconst rounded = value.toFixed(precision)\n-\treturn rounded.includes('.') ? rounded.replace(/\\.?0+$/, '') : rounded\n-}\n-\n-export async function registerDoMathTool(agent: MCP) {\n-\tagent.server.registerTool(\n-\t\tdoMathTool.name,\n-\t\t{\n-\t\t\ttitle: doMathTool.title,\n-\t\t\tdescription: doMathTool.description,\n-\t\t\tinputSchema: {\n-\t\t\t\tleft: z\n-\t\t\t\t\t.number()\n-\t\t\t\t\t.finite()\n-\t\t\t\t\t.describe('Left operand (finite number). Example: 8'),\n-\t\t\t\tright: z\n-\t\t\t\t\t.number()\n-\t\t\t\t\t.finite()\n-\t\t\t\t\t.describe('Right operand (finite number). Example: 4'),\n-\t\t\t\toperator: z\n-\t\t\t\t\t.enum(mathOperators)\n-\t\t\t\t\t.describe('Operator. Valid values: \"+\", \"-\", \"*\", \"/\".'),\n-\t\t\t\tprecision: z\n-\t\t\t\t\t.number()\n-\t\t\t\t\t.int()\n-\t\t\t\t\t.min(0)\n-\t\t\t\t\t.max(15)\n-\t\t\t\t\t.optional()\n-\t\t\t\t\t.default(6)\n-\t\t\t\t\t.describe(\n-\t\t\t\t\t\t'Decimal places used ONLY for the markdown output (0-15, default: 6). Does not change the computed numeric result.',\n-\t\t\t\t\t),\n-\t\t\t},\n-\t\t\toutputSchema: {\n-\t\t\t\tleft: z\n-\t\t\t\t\t.number()\n-\t\t\t\t\t.finite()\n-\t\t\t\t\t.describe('Left operand used in the evaluated expression.'),\n-\t\t\t\toperator: z\n-\t\t\t\t\t.enum(mathOperators)\n-\t\t\t\t\t.describe('Operator used in the evaluated expression.'),\n-\t\t\t\tright: z\n-\t\t\t\t\t.number()\n-\t\t\t\t\t.finite()\n-\t\t\t\t\t.describe('Right operand used in the evaluated expression.'),\n-\t\t\t\texpression: z.string().describe('Expression string, e.g. \"8 + 4\".'),\n-\t\t\t\tresult: z\n-\t\t\t\t\t.number()\n-\t\t\t\t\t.finite()\n-\t\t\t\t\t.describe('Exact numeric result (not rounded).'),\n-\t\t\t\tprecisionUsed: z\n-\t\t\t\t\t.number()\n-\t\t\t\t\t.int()\n-\t\t\t\t\t.min(0)\n-\t\t\t\t\t.max(15)\n-\t\t\t\t\t.describe('Precision used ONLY for markdown formatting.'),\n-\t\t\t},\n-\t\t\tannotations: doMathTool.annotations,\n-\t\t},\n-\t\tasync ({\n-\t\t\tleft,\n-\t\t\tright,\n-\t\t\toperator,\n-\t\t\tprecision,\n-\t\t}: {\n-\t\t\tleft: number\n-\t\t\tright: number\n-\t\t\toperator: MathOperator\n-\t\t\tprecision: number\n-\t\t}) => {\n-\t\t\tif (operator === '/' && right === 0) {\n-\t\t\t\treturn {\n-\t\t\t\t\tcontent: [\n-\t\t\t\t\t\t{\n-\t\t\t\t\t\t\ttype: 'text',\n-\t\t\t\t\t\t\ttext: `\n-❌ Division by zero.\n-\n-Inputs: left=${left}, operator=\"${operator}\", right=${right}\n-\n-Next: Choose a non-zero right operand.\n-\t\t\t\t\t\t\t`.trim(),\n-\t\t\t\t\t\t},\n-\t\t\t\t\t],\n-\t\t\t\t\tstructuredContent: {\n-\t\t\t\t\t\terror: 'DIVISION_BY_ZERO',\n-\t\t\t\t\t\tleft,\n-\t\t\t\t\t\toperator,\n-\t\t\t\t\t\tright,\n-\t\t\t\t\t},\n-\t\t\t\t\tisError: true,\n-\t\t\t\t}\n-\t\t\t}\n-\n-\t\t\tconst operation = operations[operator]\n-\t\t\tconst result = operation(left, right)\n-\t\t\tif (!Number.isFinite(result)) {\n-\t\t\t\treturn {\n-\t\t\t\t\tcontent: [\n-\t\t\t\t\t\t{\n-\t\t\t\t\t\t\ttype: 'text',\n-\t\t\t\t\t\t\ttext: `\n-❌ Result is not a finite number.\n-\n-Inputs: left=${left}, operator=\"${operator}\", right=${right}\n-\n-Next: Use smaller inputs or choose a different operator.\n-\t\t\t\t\t\t\t`.trim(),\n-\t\t\t\t\t\t},\n-\t\t\t\t\t],\n-\t\t\t\t\tstructuredContent: {\n-\t\t\t\t\t\terror: 'NON_FINITE_RESULT',\n-\t\t\t\t\t\tleft,\n-\t\t\t\t\t\toperator,\n-\t\t\t\t\t\tright,\n-\t\t\t\t\t},\n-\t\t\t\t\tisError: true,\n-\t\t\t\t}\n-\t\t\t}\n-\n-\t\t\tconst expression = `${left} ${operator} ${right}`\n-\t\t\tconst markdownResult = formatNumberForMarkdown(result, precision)\n-\t\t\treturn {\n-\t\t\t\tcontent: [\n-\t\t\t\t\t{\n-\t\t\t\t\t\ttype: 'text',\n-\t\t\t\t\t\ttext: `\n-## ✅ Result\n-\n-**Expression**: \\`${expression}\\`\n-\n-**Result**: \\`${markdownResult}\\`\n-\t\t\t\t\t\t`.trim(),\n-\t\t\t\t\t},\n-\t\t\t\t],\n-\t\t\t\tstructuredContent: {\n-\t\t\t\t\tleft,\n-\t\t\t\t\toperator,\n-\t\t\t\t\tright,\n-\t\t\t\t\texpression,\n-\t\t\t\t\tresult,\n-\t\t\t\t\tprecisionUsed: precision,\n-\t\t\t\t},\n-\t\t\t}\n-\t\t},\n-\t)\n-}\ndiff --git a/mcp/tools/open-calculator-ui.ts b/mcp/tools/open-calculator-ui.ts\ndeleted file mode 100644\nindex d79308e..0000000\n--- a/mcp/tools/open-calculator-ui.ts\n+++ /dev/null\n@@ -1,72 +0,0 @@\n-import { registerAppTool } from '@modelcontextprotocol/ext-apps/server'\n-import { type ToolAnnotations } from '@modelcontextprotocol/sdk/types.js'\n-import { z } from 'zod'\n-import { calculatorUiResourceUri } from '#mcp/apps/calculator-ui-entry-point.ts'\n-import { type MCP } from '#mcp/index.ts'\n-\n-const openCalculatorUiTool = {\n-\tname: 'open_calculator_ui',\n-\ttitle: 'Open Calculator UI',\n-\tdescription: `\n-Show an interactive calculator MCP App widget.\n-\n-Behavior:\n-- Opens a calculator app resource that runs arithmetic directly in the UI.\n-- Supports mouse and keyboard input.\n-\n-Next:\n-- Use 'do_math' when you need a precise, machine-readable result in tool output.\n-\t`.trim(),\n-\tannotations: {\n-\t\treadOnlyHint: true,\n-\t\tdestructiveHint: false,\n-\t\tidempotentHint: true,\n-\t\topenWorldHint: false,\n-\t} satisfies ToolAnnotations,\n-} as const\n-\n-export async function registerOpenCalculatorUiTool(agent: MCP) {\n-\tregisterAppTool(\n-\t\tagent.server,\n-\t\topenCalculatorUiTool.name,\n-\t\t{\n-\t\t\ttitle: openCalculatorUiTool.title,\n-\t\t\tdescription: openCalculatorUiTool.description,\n-\t\t\toutputSchema: {\n-\t\t\t\twidget: z\n-\t\t\t\t\t.literal('calculator')\n-\t\t\t\t\t.describe('Identifier for the calculator widget.'),\n-\t\t\t\tresourceUri: z\n-\t\t\t\t\t.literal(calculatorUiResourceUri)\n-\t\t\t\t\t.describe('MCP App resource URI associated with this widget.'),\n-\t\t\t},\n-\t\t\tannotations: openCalculatorUiTool.annotations,\n-\t\t\t_meta: {\n-\t\t\t\tui: {\n-\t\t\t\t\tresourceUri: calculatorUiResourceUri,\n-\t\t\t\t},\n-\t\t\t},\n-\t\t},\n-\t\tasync () => {\n-\t\t\treturn {\n-\t\t\t\tcontent: [\n-\t\t\t\t\t{\n-\t\t\t\t\t\ttype: 'text',\n-\t\t\t\t\t\ttext: `\n-## Calculator widget ready\n-\n-The calculator UI is attached to this tool call.\n-\n-- Use number keys, operators, Enter, and Backspace.\n-- Use **AC** (or keyboard **c**) to reset all state.\n-\t\t\t\t\t\t`.trim(),\n-\t\t\t\t\t},\n-\t\t\t\t],\n-\t\t\t\tstructuredContent: {\n-\t\t\t\t\twidget: 'calculator',\n-\t\t\t\t\tresourceUri: calculatorUiResourceUri,\n-\t\t\t\t},\n-\t\t\t}\n-\t\t},\n-\t)\n-}\ndiff --git a/migrations/0001-init.sql b/migrations/0001-init.sql\nindex 5e16485..b55ef66 100644\n--- a/migrations/0001-init.sql\n+++ b/migrations/0001-init.sql\n@@ -1,37 +1,50 @@\n-CREATE TABLE IF NOT EXISTS users (\n+CREATE TABLE IF NOT EXISTS schedules (\n \tid INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,\n-\tusername TEXT NOT NULL UNIQUE,\n-\temail TEXT NOT NULL UNIQUE,\n-\tpassword_hash TEXT NOT NULL,\n-\tcreated_at TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP),\n-\tupdated_at TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP)\n+\tschedule_key TEXT NOT NULL UNIQUE,\n+\thost_key TEXT NOT NULL UNIQUE,\n+\ttitle TEXT NOT NULL,\n+\tstart_date TEXT NOT NULL,\n+\tend_date TEXT NOT NULL,\n+\tslot_minutes INTEGER NOT NULL,\n+\ttimezone TEXT NOT NULL,\n+\tcreated_at INTEGER NOT NULL\n );\n \n-CREATE INDEX IF NOT EXISTS idx_users_username ON users(username);\n-CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);\n+CREATE INDEX IF NOT EXISTS idx_schedules_schedule_key\n+\tON schedules(schedule_key);\n \n-CREATE TABLE IF NOT EXISTS password_resets (\n+CREATE INDEX IF NOT EXISTS idx_schedules_host_key\n+\tON schedules(host_key);\n+\n+CREATE TABLE IF NOT EXISTS schedule_slots (\n \tid INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,\n-\tuser_id INTEGER NOT NULL,\n-\ttoken_hash TEXT NOT NULL UNIQUE,\n-\texpires_at INTEGER NOT NULL,\n-\tcreated_at TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP),\n-\tFOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n+\tschedule_id INTEGER NOT NULL,\n+\tstarts_at_utc TEXT NOT NULL,\n+\tFOREIGN KEY (schedule_id) REFERENCES schedules(id) ON DELETE CASCADE,\n+\tUNIQUE(schedule_id, starts_at_utc)\n );\n \n-CREATE INDEX IF NOT EXISTS idx_password_resets_user_id ON password_resets(user_id);\n-CREATE INDEX IF NOT EXISTS idx_password_resets_token_hash ON password_resets(token_hash);\n-\n-CREATE TABLE IF NOT EXISTS mock_resend_messages (\n-\tid TEXT PRIMARY KEY,\n-\ttoken_hash TEXT NOT NULL,\n-\treceived_at INTEGER NOT NULL,\n-\tfrom_email TEXT NOT NULL,\n-\tto_json TEXT NOT NULL,\n-\tsubject TEXT NOT NULL,\n-\thtml TEXT NOT NULL,\n-\tpayload_json TEXT NOT NULL\n+CREATE INDEX IF NOT EXISTS idx_schedule_slots_schedule_id\n+\tON schedule_slots(schedule_id);\n+\n+CREATE INDEX IF NOT EXISTS idx_schedule_slots_starts_at_utc\n+\tON schedule_slots(starts_at_utc);\n+\n+CREATE TABLE IF NOT EXISTS attendee_availability (\n+\tid INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,\n+\tschedule_id INTEGER NOT NULL,\n+\tattendee_name TEXT NOT NULL,\n+\tattendee_name_key TEXT NOT NULL,\n+\tslot_utc TEXT NOT NULL,\n+\tcreated_at INTEGER NOT NULL,\n+\tFOREIGN KEY (schedule_id) REFERENCES schedules(id) ON DELETE CASCADE\n );\n \n-CREATE INDEX IF NOT EXISTS mock_resend_messages_token_received_at\n-\tON mock_resend_messages(token_hash, received_at DESC);\n+CREATE INDEX IF NOT EXISTS idx_attendee_availability_schedule\n+\tON attendee_availability(schedule_id);\n+\n+CREATE INDEX IF NOT EXISTS idx_attendee_availability_attendee\n+\tON attendee_availability(schedule_id, attendee_name_key);\n+\n+CREATE INDEX IF NOT EXISTS idx_attendee_availability_slot\n+\tON attendee_availability(schedule_id, slot_utc);\ndiff --git a/mock-servers/resend/resend-mock.test.ts b/mock-servers/resend/resend-mock.test.ts\ndeleted file mode 100644\nindex d2878b2..0000000\n--- a/mock-servers/resend/resend-mock.test.ts\n+++ /dev/null\n@@ -1,295 +0,0 @@\n-import { spawn, type ChildProcess } from 'node:child_process'\n-import { expect, test } from 'vitest'\n-import getPort from 'get-port'\n-import { setTimeout as delay } from 'node:timers/promises'\n-import { createTemporaryDirectory } from '#tools/temp-directory.ts'\n-\n-const workerConfig = 'mock-servers/resend/wrangler.jsonc'\n-const projectRoot = process.cwd()\n-const defaultTimeoutMs = 60_000\n-\n-type ManagedProcess = {\n-\tprocess: ChildProcess\n-\texited: Promise\n-\tstdout: NodeJS.ReadableStream | null\n-\tstderr: NodeJS.ReadableStream | null\n-\tkill: (signal?: NodeJS.Signals) => void\n-}\n-\n-function captureOutput(stream: NodeJS.ReadableStream | null) {\n-\tlet output = ''\n-\tif (!stream) {\n-\t\treturn () => output\n-\t}\n-\n-\tstream.on('data', (chunk) => {\n-\t\toutput += String(chunk)\n-\t})\n-\treturn () => output\n-}\n-\n-function formatOutput(stdout: string, stderr: string) {\n-\tconst snippets: Array = []\n-\tif (stdout.trim()) {\n-\t\tsnippets.push(`stdout: ${stdout.trim().slice(-2000)}`)\n-\t}\n-\tif (stderr.trim()) {\n-\t\tsnippets.push(`stderr: ${stderr.trim().slice(-2000)}`)\n-\t}\n-\treturn snippets.length > 0 ? ` Output:\\n${snippets.join('\\n')}` : ''\n-}\n-\n-async function waitForMockServer(\n-\torigin: string,\n-\tproc: ManagedProcess,\n-\tgetStdout: () => string,\n-\tgetStderr: () => string,\n-) {\n-\tlet exited = false\n-\tlet exitCode: number | null = null\n-\tvoid proc.exited\n-\t\t.then((code) => {\n-\t\t\texited = true\n-\t\t\texitCode = code\n-\t\t})\n-\t\t.catch(() => {\n-\t\t\texited = true\n-\t\t})\n-\n-\tconst metaUrl = new URL('/__mocks/meta', origin)\n-\tconst deadline = Date.now() + 25_000\n-\twhile (Date.now() < deadline) {\n-\t\tif (exited) {\n-\t\t\tthrow new Error(\n-\t\t\t\t`wrangler dev exited (${exitCode ?? 'unknown'}).${formatOutput(\n-\t\t\t\t\tgetStdout(),\n-\t\t\t\t\tgetStderr(),\n-\t\t\t\t)}`,\n-\t\t\t)\n-\t\t}\n-\t\ttry {\n-\t\t\tconst response = await fetch(metaUrl)\n-\t\t\tif (response.ok) {\n-\t\t\t\tawait response.body?.cancel()\n-\t\t\t\treturn\n-\t\t\t}\n-\t\t} catch {\n-\t\t\t// Retry until the server is ready.\n-\t\t}\n-\t\tawait delay(250)\n-\t}\n-\n-\tthrow new Error(\n-\t\t`Timed out waiting for mock server at ${origin}.${formatOutput(\n-\t\t\tgetStdout(),\n-\t\t\tgetStderr(),\n-\t\t)}`,\n-\t)\n-}\n-\n-async function stopProcess(proc: ManagedProcess) {\n-\tlet exited = false\n-\tvoid proc.exited.then(() => {\n-\t\texited = true\n-\t})\n-\tproc.kill('SIGINT')\n-\tawait Promise.race([proc.exited, delay(5_000)])\n-\tif (!exited) {\n-\t\tproc.kill('SIGKILL')\n-\t\tawait proc.exited\n-\t}\n-}\n-\n-async function startMockResendWorker(persistDir: string, token: string) {\n-\tconst port = await getPort({ host: '127.0.0.1' })\n-\tconst inspectorPortBase =\n-\t\tport + 10_000 <= 65_535 ? port + 10_000 : Math.max(1, port - 10_000)\n-\tconst inspectorPort = await getPort({\n-\t\thost: '127.0.0.1',\n-\t\tport: Array.from(\n-\t\t\t{ length: 10 },\n-\t\t\t(_, index) => inspectorPortBase + index,\n-\t\t).filter((candidate) => candidate > 0 && candidate <= 65_535),\n-\t})\n-\tconst origin = `http://127.0.0.1:${port}`\n-\tconst processHandle = createProcess([\n-\t\tprocess.execPath,\n-\t\t'./wrangler-env.ts',\n-\t\t'dev',\n-\t\t'--local',\n-\t\t'--env',\n-\t\t'test',\n-\t\t'--config',\n-\t\tworkerConfig,\n-\t\t'--var',\n-\t\t`MOCK_API_TOKEN:${token}`,\n-\t\t'--port',\n-\t\tString(port),\n-\t\t'--inspector-port',\n-\t\tString(inspectorPort),\n-\t\t'--ip',\n-\t\t'127.0.0.1',\n-\t\t'--persist-to',\n-\t\tpersistDir,\n-\t\t'--show-interactive-dev-session=false',\n-\t\t'--log-level',\n-\t\t'error',\n-\t])\n-\n-\tconst getStdout = captureOutput(processHandle.stdout)\n-\tconst getStderr = captureOutput(processHandle.stderr)\n-\n-\tawait waitForMockServer(origin, processHandle, getStdout, getStderr)\n-\n-\treturn {\n-\t\torigin,\n-\t\t[Symbol.asyncDispose]: async () => {\n-\t\t\tawait stopProcess(processHandle)\n-\t\t},\n-\t}\n-}\n-\n-function createProcess(args: Array): ManagedProcess {\n-\tconst child = spawn(args[0]!, args.slice(1), {\n-\t\tcwd: projectRoot,\n-\t\tstdio: ['ignore', 'pipe', 'pipe'],\n-\t\tenv: {\n-\t\t\t...process.env,\n-\t\t\tCLOUDFLARE_ENV: 'test',\n-\t\t},\n-\t})\n-\tconst exited = new Promise((resolve, reject) => {\n-\t\tchild.once('error', reject)\n-\t\tchild.once('exit', (code) => resolve(code ?? 1))\n-\t})\n-\treturn {\n-\t\tprocess: child,\n-\t\texited,\n-\t\tstdout: child.stdout,\n-\t\tstderr: child.stderr,\n-\t\tkill: (signal) => {\n-\t\t\tchild.kill(signal)\n-\t\t},\n-\t}\n-}\n-\n-test(\n-\t'resend mock stores messages in D1 and exposes a count',\n-\tasync () => {\n-\t\tawait using tempDir = await createTemporaryDirectory('resend-mock-d1-')\n-\t\tconst token = 'test-mock-token'\n-\t\tawait using server = await startMockResendWorker(tempDir.path, token)\n-\n-\t\tconst email = {\n-\t\t\tto: 'alex@example.com',\n-\t\t\tfrom: 'no-reply@example.com',\n-\t\t\tsubject: 'Reset your password',\n-\t\t\thtml: '

Reset link

',\n-\t\t}\n-\n-\t\tconst createResp = await fetch(new URL('/emails', server.origin), {\n-\t\t\tmethod: 'POST',\n-\t\t\theaders: {\n-\t\t\t\tauthorization: `Bearer ${token}`,\n-\t\t\t\t'content-type': 'application/json',\n-\t\t\t},\n-\t\t\tbody: JSON.stringify(email),\n-\t\t})\n-\t\texpect(createResp.status).toBe(200)\n-\t\tconst createJson = (await createResp.json()) as { id?: string }\n-\t\texpect(typeof createJson.id).toBe('string')\n-\n-\t\tconst metaResp = await fetch(new URL('/__mocks/meta', server.origin), {\n-\t\t\theaders: { authorization: `Bearer ${token}` },\n-\t\t})\n-\t\texpect(metaResp.status).toBe(200)\n-\t\tconst metaJson = (await metaResp.json()) as {\n-\t\t\tauthorized: boolean\n-\t\t\tmessageCount?: number\n-\t\t}\n-\t\texpect(metaJson.authorized).toBe(true)\n-\t\texpect(metaJson.messageCount).toBe(1)\n-\n-\t\tconst listUrl = new URL('/__mocks/messages', server.origin)\n-\t\tlistUrl.searchParams.set('limit', '10')\n-\t\tconst listResp = await fetch(listUrl, {\n-\t\t\theaders: { authorization: `Bearer ${token}` },\n-\t\t})\n-\t\texpect(listResp.status).toBe(200)\n-\t\tconst listJson = (await listResp.json()) as {\n-\t\t\tcount: number\n-\t\t\tmessages: Array<{\n-\t\t\t\tid: string\n-\t\t\t\treceived_at: number\n-\t\t\t\tfrom_email: string\n-\t\t\t\tto_json: string\n-\t\t\t\tsubject: string\n-\t\t\t\thtml: string\n-\t\t\t\tpayload_json: string\n-\t\t\t}>\n-\t\t}\n-\t\texpect(listJson.count).toBe(1)\n-\t\texpect(listJson.messages[0]?.subject).toBe(email.subject)\n-\t\texpect(listJson.messages[0]?.from_email).toBe(email.from)\n-\t\texpect(JSON.parse(listJson.messages[0]?.to_json ?? 'null')).toEqual(\n-\t\t\temail.to,\n-\t\t)\n-\t\texpect(listJson.messages[0]?.html).toBe(email.html)\n-\t\texpect(JSON.parse(listJson.messages[0]?.payload_json ?? 'null')).toEqual(\n-\t\t\temail,\n-\t\t)\n-\t},\n-\tdefaultTimeoutMs,\n-)\n-\n-test(\n-\t'resend mock rejects unauthenticated requests when a token is configured',\n-\tasync () => {\n-\t\tawait using tempDir = await createTemporaryDirectory('resend-mock-auth-')\n-\t\tconst token = 'test-mock-token'\n-\t\tawait using server = await startMockResendWorker(tempDir.path, token)\n-\n-\t\tconst createResp = await fetch(new URL('/emails', server.origin), {\n-\t\t\tmethod: 'POST',\n-\t\t\theaders: { 'content-type': 'application/json' },\n-\t\t\tbody: JSON.stringify({\n-\t\t\t\tto: 'alex@example.com',\n-\t\t\t\tfrom: 'no-reply@example.com',\n-\t\t\t\tsubject: 'hello',\n-\t\t\t\thtml: '

',\n-\t\t\t}),\n-\t\t})\n-\t\texpect(createResp.status).toBe(401)\n-\t},\n-\tdefaultTimeoutMs,\n-)\n-\n-test(\n-\t'resend mock dashboard keeps token in endpoint links',\n-\tasync () => {\n-\t\tawait using tempDir = await createTemporaryDirectory(\n-\t\t\t'resend-mock-dashboard-',\n-\t\t)\n-\t\tconst token = 'test-mock-token'\n-\t\tawait using server = await startMockResendWorker(tempDir.path, token)\n-\n-\t\tconst rootUrl = new URL('/', server.origin)\n-\t\trootUrl.searchParams.set('token', token)\n-\t\tconst rootResp = await fetch(rootUrl, { redirect: 'manual' })\n-\t\texpect(rootResp.status).toBe(302)\n-\t\tconst expectedRedirectUrl = new URL('/__mocks', server.origin)\n-\t\texpectedRedirectUrl.searchParams.set('token', token)\n-\t\texpect(rootResp.headers.get('location')).toBe(\n-\t\t\texpectedRedirectUrl.toString(),\n-\t\t)\n-\n-\t\tconst dashboardUrl = new URL('/__mocks', server.origin)\n-\t\tdashboardUrl.searchParams.set('token', token)\n-\t\tconst dashboardResp = await fetch(dashboardUrl)\n-\t\texpect(dashboardResp.status).toBe(200)\n-\t\tconst dashboardHtml = await dashboardResp.text()\n-\t\texpect(dashboardHtml).toContain(`href=\"/__mocks/meta?token=${token}\"`)\n-\t\texpect(dashboardHtml).toContain(`href=\"/__mocks/messages?token=${token}\"`)\n-\t},\n-\tdefaultTimeoutMs,\n-)\ndiff --git a/mock-servers/resend/worker.ts b/mock-servers/resend/worker.ts\ndeleted file mode 100644\nindex 83c8825..0000000\n--- a/mock-servers/resend/worker.ts\n+++ /dev/null\n@@ -1,498 +0,0 @@\n-import { parseSafe } from 'remix/data-schema'\n-import { resendEmailSchema } from '#shared/resend-email.ts'\n-import { createDb, mockResendMessagesTable } from '#worker/db.ts'\n-\n-type MockResendEnv = {\n-\tAPP_DB: D1Database\n-\tMOCK_API_TOKEN?: string\n-}\n-\n-type DashboardEndpoint = {\n-\tmethod: string\n-\tpath: string\n-\tdescription: string\n-\trequiresAuth: boolean\n-}\n-\n-const dashboardEndpoints: Array = [\n-\t{\n-\t\tmethod: 'POST',\n-\t\tpath: '/emails',\n-\t\tdescription: 'Create an email message (Resend API compatible)',\n-\t\trequiresAuth: true,\n-\t},\n-\t{\n-\t\tmethod: 'GET',\n-\t\tpath: '/__mocks',\n-\t\tdescription: 'Mock dashboard (HTML)',\n-\t\trequiresAuth: false,\n-\t},\n-\t{\n-\t\tmethod: 'GET',\n-\t\tpath: '/__mocks/meta',\n-\t\tdescription: 'Mock metadata (JSON)',\n-\t\trequiresAuth: false,\n-\t},\n-\t{\n-\t\tmethod: 'GET',\n-\t\tpath: '/__mocks/messages',\n-\t\tdescription: 'List stored messages (JSON)',\n-\t\trequiresAuth: true,\n-\t},\n-\t{\n-\t\tmethod: 'POST',\n-\t\tpath: '/__mocks/clear',\n-\t\tdescription: 'Delete stored messages for this token (JSON)',\n-\t\trequiresAuth: true,\n-\t},\n-]\n-\n-let schemaReady: Promise | null = null\n-\n-function htmlEscape(value: string) {\n-\treturn value\n-\t\t.replaceAll('&', '&')\n-\t\t.replaceAll('<', '<')\n-\t\t.replaceAll('>', '>')\n-\t\t.replaceAll('\"', '"')\n-\t\t.replaceAll(\"'\", ''')\n-}\n-\n-function withTokenQueryParam(baseUrl: URL, href: string, token: string | null) {\n-\tif (!token) return href\n-\tconst next = new URL(href, baseUrl)\n-\tnext.searchParams.set('token', token)\n-\treturn `${next.pathname}${next.search}${next.hash}`\n-}\n-\n-function json(data: unknown, init: ResponseInit = {}) {\n-\tconst headers = new Headers(init.headers)\n-\tif (!headers.has('content-type')) {\n-\t\theaders.set('content-type', 'application/json; charset=utf-8')\n-\t}\n-\treturn new Response(JSON.stringify(data, null, 2), { ...init, headers })\n-}\n-\n-function parseBearerToken(headerValue: string | null) {\n-\tif (!headerValue) return null\n-\tconst match = headerValue.match(/^Bearer\\s+(.+)\\s*$/i)\n-\treturn match?.[1]?.trim() || null\n-}\n-\n-function getCookieValue(cookieHeader: string | null, name: string) {\n-\tif (!cookieHeader) return null\n-\tfor (const part of cookieHeader.split(';')) {\n-\t\tconst [rawKey, ...rest] = part.trim().split('=')\n-\t\tif (!rawKey) continue\n-\t\tif (rawKey !== name) continue\n-\t\treturn rest.join('=')\n-\t}\n-\treturn null\n-}\n-\n-function readAuthToken(request: Request, url: URL) {\n-\tconst bearer = parseBearerToken(request.headers.get('authorization'))\n-\tif (bearer) return bearer\n-\n-\tconst headerToken = request.headers.get('x-mock-token')?.trim()\n-\tif (headerToken) return headerToken\n-\n-\tconst urlToken = url.searchParams.get('token')?.trim()\n-\tif (urlToken) return urlToken\n-\n-\tconst cookieToken = getCookieValue(\n-\t\trequest.headers.get('cookie'),\n-\t\t'mock_token',\n-\t)\n-\tif (cookieToken) return cookieToken\n-\n-\treturn null\n-}\n-\n-function isAuthorized(request: Request, env: MockResendEnv, url: URL) {\n-\tconst expected = env.MOCK_API_TOKEN?.trim() ?? ''\n-\tif (!expected) return true\n-\tconst provided = readAuthToken(request, url)\n-\treturn Boolean(provided && provided === expected)\n-}\n-\n-async function sha256Hex(value: string) {\n-\tconst data = new TextEncoder().encode(value)\n-\tconst digest = await crypto.subtle.digest('SHA-256', data)\n-\treturn Array.from(new Uint8Array(digest))\n-\t\t.map((byte) => byte.toString(16).padStart(2, '0'))\n-\t\t.join('')\n-}\n-\n-function getTokenPartition(env: MockResendEnv) {\n-\tconst expected = env.MOCK_API_TOKEN?.trim() ?? ''\n-\treturn expected ? sha256Hex(expected) : Promise.resolve('public')\n-}\n-\n-type MockResendDb = ReturnType\n-\n-async function ensureSchema(db: MockResendDb) {\n-\tif (!schemaReady) {\n-\t\tschemaReady = (async () => {\n-\t\t\tawait db.exec(`CREATE TABLE IF NOT EXISTS mock_resend_messages (\n-\t\t\t\tid TEXT PRIMARY KEY,\n-\t\t\t\ttoken_hash TEXT NOT NULL,\n-\t\t\t\treceived_at INTEGER NOT NULL,\n-\t\t\t\tfrom_email TEXT NOT NULL,\n-\t\t\t\tto_json TEXT NOT NULL,\n-\t\t\t\tsubject TEXT NOT NULL,\n-\t\t\t\thtml TEXT NOT NULL,\n-\t\t\t\tpayload_json TEXT NOT NULL\n-\t\t\t)`)\n-\t\t\tawait db.exec(`CREATE INDEX IF NOT EXISTS mock_resend_messages_token_received_at\n-\t\t\t\tON mock_resend_messages(token_hash, received_at DESC)`)\n-\t\t})().catch((error) => {\n-\t\t\tschemaReady = null\n-\t\t\tthrow error\n-\t\t})\n-\t}\n-\tawait schemaReady\n-}\n-\n-async function readJsonBody(request: Request) {\n-\ttry {\n-\t\treturn await request.json()\n-\t} catch {\n-\t\treturn null\n-\t}\n-}\n-\n-async function countMessages(db: MockResendDb, tokenHash: string) {\n-\tawait ensureSchema(db)\n-\treturn db.count(mockResendMessagesTable, {\n-\t\twhere: { token_hash: tokenHash },\n-\t})\n-}\n-\n-async function listMessages(\n-\tdb: MockResendDb,\n-\ttokenHash: string,\n-\tlimit: number,\n-) {\n-\tawait ensureSchema(db)\n-\treturn db.findMany(mockResendMessagesTable, {\n-\t\twhere: { token_hash: tokenHash },\n-\t\torderBy: ['received_at', 'desc'],\n-\t\tlimit,\n-\t})\n-}\n-\n-async function getMessage(db: MockResendDb, tokenHash: string, id: string) {\n-\tawait ensureSchema(db)\n-\treturn db.findOne(mockResendMessagesTable, {\n-\t\twhere: { token_hash: tokenHash, id },\n-\t})\n-}\n-\n-async function clearMessages(db: MockResendDb, tokenHash: string) {\n-\tawait ensureSchema(db)\n-\tawait db.deleteMany(mockResendMessagesTable, {\n-\t\twhere: { token_hash: tokenHash },\n-\t})\n-}\n-\n-async function handlePostEmails(\n-\trequest: Request,\n-\tenv: MockResendEnv,\n-\turl: URL,\n-) {\n-\tif (!isAuthorized(request, env, url)) {\n-\t\treturn json({ error: 'Unauthorized' }, { status: 401 })\n-\t}\n-\n-\tconst db = createDb(env.APP_DB)\n-\tconst body = await readJsonBody(request)\n-\tconst parsed = parseSafe(resendEmailSchema, body)\n-\tif (!parsed.success) {\n-\t\treturn json({ error: 'Invalid email payload.' }, { status: 400 })\n-\t}\n-\n-\tawait ensureSchema(db)\n-\tconst tokenHash = await getTokenPartition(env)\n-\tconst now = Date.now()\n-\tconst id = `email_${crypto.randomUUID()}`\n-\tconst payloadJson = JSON.stringify(parsed.value)\n-\n-\tawait db.create(mockResendMessagesTable, {\n-\t\tid,\n-\t\ttoken_hash: tokenHash,\n-\t\treceived_at: now,\n-\t\tfrom_email: parsed.value.from,\n-\t\tto_json: JSON.stringify(parsed.value.to),\n-\t\tsubject: parsed.value.subject,\n-\t\thtml: parsed.value.html,\n-\t\tpayload_json: payloadJson,\n-\t})\n-\n-\t// Mirror Resend's happy-path shape.\n-\treturn json({ id }, { status: 200 })\n-}\n-\n-async function handleGetMeta(request: Request, env: MockResendEnv, url: URL) {\n-\tconst authorized = isAuthorized(request, env, url)\n-\tconst tokenHash = authorized ? await getTokenPartition(env) : null\n-\tconst db = createDb(env.APP_DB)\n-\n-\treturn json({\n-\t\tservice: 'resend',\n-\t\tauthorized,\n-\t\tendpoints: dashboardEndpoints,\n-\t\t...(tokenHash\n-\t\t\t? {\n-\t\t\t\t\tmessageCount: await countMessages(db, tokenHash),\n-\t\t\t\t}\n-\t\t\t: {}),\n-\t})\n-}\n-\n-async function handleGetMessages(\n-\trequest: Request,\n-\tenv: MockResendEnv,\n-\turl: URL,\n-) {\n-\tif (!isAuthorized(request, env, url)) {\n-\t\treturn json({ error: 'Unauthorized' }, { status: 401 })\n-\t}\n-\tconst db = createDb(env.APP_DB)\n-\tconst tokenHash = await getTokenPartition(env)\n-\tconst messageId = url.pathname.startsWith('/__mocks/messages/')\n-\t\t? url.pathname.slice('/__mocks/messages/'.length).trim()\n-\t\t: ''\n-\tif (messageId) {\n-\t\tconst message = await getMessage(db, tokenHash, messageId)\n-\t\tif (!message) {\n-\t\t\treturn json({ error: 'Not Found' }, { status: 404 })\n-\t\t}\n-\t\treturn json({ message })\n-\t}\n-\tconst limitParam = url.searchParams.get('limit')?.trim() ?? ''\n-\tconst limit = Math.min(\n-\t\t100,\n-\t\tMath.max(1, Number.parseInt(limitParam || '50', 10)),\n-\t)\n-\n-\tconst messages = await listMessages(db, tokenHash, limit)\n-\treturn json({ count: messages.length, messages })\n-}\n-\n-async function handleClear(request: Request, env: MockResendEnv, url: URL) {\n-\tif (!isAuthorized(request, env, url)) {\n-\t\treturn json({ error: 'Unauthorized' }, { status: 401 })\n-\t}\n-\tconst db = createDb(env.APP_DB)\n-\tconst tokenHash = await getTokenPartition(env)\n-\tawait clearMessages(db, tokenHash)\n-\treturn json({ ok: true })\n-}\n-\n-async function handleDashboard(request: Request, env: MockResendEnv, url: URL) {\n-\tconst meta = (await handleGetMeta(request, env, url).then((res) =>\n-\t\tres.json(),\n-\t)) as {\n-\t\tauthorized: boolean\n-\t\tmessageCount?: number\n-\t}\n-\n-\tconst tokenParam = url.searchParams.get('token')\n-\tconst dashboardToken = tokenParam?.trim() ? tokenParam.trim() : null\n-\n-\tconst tokenHint = env.MOCK_API_TOKEN?.trim()\n-\t\t? 'This mock requires a token (Authorization: Bearer ... or ?token=...).'\n-\t\t: 'No token is configured; mock endpoints are open.'\n-\n-\tconst endpointRows = dashboardEndpoints\n-\t\t.map((endpoint) => {\n-\t\t\tconst authBadge = endpoint.requiresAuth\n-\t\t\t\t? 'auth'\n-\t\t\t\t: 'public'\n-\t\t\tconst endpointHref = withTokenQueryParam(\n-\t\t\t\turl,\n-\t\t\t\tendpoint.path,\n-\t\t\t\tdashboardToken,\n-\t\t\t)\n-\t\t\tconst pathCell =\n-\t\t\t\tendpoint.method === 'GET'\n-\t\t\t\t\t? `${htmlEscape(endpoint.path)}`\n-\t\t\t\t\t: `${htmlEscape(endpoint.path)}`\n-\t\t\treturn `\n-\t\t\t\t${htmlEscape(endpoint.method)}\n-\t\t\t\t${pathCell}\n-\t\t\t\t${authBadge}\n-\t\t\t\t${htmlEscape(endpoint.description)}\n-\t\t\t`\n-\t\t})\n-\t\t.join('')\n-\n-\tconst messageCountLine = meta.authorized\n-\t\t? `${meta.messageCount ?? 0}`\n-\t\t: `hidden`\n-\n-\tconst body = `\n-\n-\t\n-\t\t\n-\t\t\n-\t\tMock: Resend\n-\t\t\n-\t\n-\t\n-\t\t

\n-\t\t\t

Mock: Resend

\n-\t\t\t

${htmlEscape(tokenHint)}

\n-\t\t\t

\n-\t\t\t\t

\n-\t\t\t\t\t

Auth

\n-\t\t\t\t\t

${meta.authorized ? 'authorized' : 'unauthorized'}

\n-\t\t\t\t

\n-\t\t\t\t\t

Stored messages

\n-\t\t\t\t\t

${messageCountLine}

\n-\t\t\t\t

\n-\t\t\t

\n-\t\t\t\t

Endpoints

\n-\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\t\n-\t\t\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\n-\t\t\t\t\t\t${endpointRows}\n-\t\t\t\t\t\n-\t\t\t\t

Method	Path	Access	Description

\n-\t\t\t\t\n-\t\t\t

\n-\t\t

\n-\t\n-`\n-\n-\treturn new Response(body, {\n-\t\tstatus: 200,\n-\t\theaders: { 'content-type': 'text/html; charset=utf-8' },\n-\t})\n-}\n-\n-export default {\n-\tasync fetch(request: Request, env: MockResendEnv, ctx: ExecutionContext) {\n-\t\tvoid ctx\n-\t\tconst url = new URL(request.url)\n-\n-\t\tif (request.method === 'GET' && url.pathname === '/') {\n-\t\t\tconst destination = new URL('/__mocks', url)\n-\t\t\tdestination.search = url.search\n-\t\t\treturn Response.redirect(destination.toString(), 302)\n-\t\t}\n-\n-\t\tif (request.method === 'POST' && url.pathname === '/emails') {\n-\t\t\treturn handlePostEmails(request, env, url)\n-\t\t}\n-\n-\t\tif (request.method === 'GET' && url.pathname === '/__mocks') {\n-\t\t\treturn handleDashboard(request, env, url)\n-\t\t}\n-\n-\t\tif (request.method === 'GET' && url.pathname === '/__mocks/meta') {\n-\t\t\treturn handleGetMeta(request, env, url)\n-\t\t}\n-\n-\t\tif (request.method === 'GET' && url.pathname === '/__mocks/messages') {\n-\t\t\treturn handleGetMessages(request, env, url)\n-\t\t}\n-\n-\t\tif (\n-\t\t\trequest.method === 'GET' &&\n-\t\t\turl.pathname.startsWith('/__mocks/messages/')\n-\t\t) {\n-\t\t\treturn handleGetMessages(request, env, url)\n-\t\t}\n-\n-\t\tif (request.method === 'POST' && url.pathname === '/__mocks/clear') {\n-\t\t\treturn handleClear(request, env, url)\n-\t\t}\n-\n-\t\treturn new Response('Not Found', { status: 404 })\n-\t},\n-} satisfies ExportedHandler\ndiff --git a/mock-servers/resend/wrangler.jsonc b/mock-servers/resend/wrangler.jsonc\ndeleted file mode 100644\nindex 024c7a7..0000000\n--- a/mock-servers/resend/wrangler.jsonc\n+++ /dev/null\n@@ -1,41 +0,0 @@\n-{\n-\t\"$schema\": \"../../node_modules/wrangler/config-schema.json\",\n-\t\"name\": \"epic-scheduler-mock-resend\",\n-\t\"compatibility_date\": \"2026-01-31\",\n-\t\"compatibility_flags\": [\"nodejs_compat\", \"global_fetch_strictly_public\"],\n-\t\"main\": \"./worker.ts\",\n-\t\"preview_urls\": true,\n-\t\"observability\": { \"enabled\": true },\n-\t\"env\": {\n-\t\t\"production\": {\n-\t\t\t\"d1_databases\": [\n-\t\t\t\t{\n-\t\t\t\t\t\"binding\": \"APP_DB\",\n-\t\t\t\t\t\"database_name\": \"epic-scheduler\",\n-\t\t\t\t\t\"database_id\": \"c64eb497-a93d-4af4-bfb7-62beda9552b6\",\n-\t\t\t\t\t\"migrations_dir\": \"../../migrations\",\n-\t\t\t\t},\n-\t\t\t],\n-\t\t},\n-\t\t\"preview\": {\n-\t\t\t\"d1_databases\": [\n-\t\t\t\t{\n-\t\t\t\t\t\"binding\": \"APP_DB\",\n-\t\t\t\t\t\"database_name\": \"epic-scheduler-preview\",\n-\t\t\t\t\t\"database_id\": \"0e2f1e31-b7c4-42bc-8133-04627230a25f\",\n-\t\t\t\t\t\"migrations_dir\": \"../../migrations\",\n-\t\t\t\t},\n-\t\t\t],\n-\t\t},\n-\t\t\"test\": {\n-\t\t\t\"d1_databases\": [\n-\t\t\t\t{\n-\t\t\t\t\t\"binding\": \"APP_DB\",\n-\t\t\t\t\t\"database_name\": \"epic-scheduler-preview\",\n-\t\t\t\t\t\"database_id\": \"0e2f1e31-b7c4-42bc-8133-04627230a25f\",\n-\t\t\t\t\t\"migrations_dir\": \"../../migrations\",\n-\t\t\t\t},\n-\t\t\t],\n-\t\t},\n-\t},\n-}\ndiff --git a/package.json b/package.json\nindex a108bea..b0876e5 100644\n--- a/package.json\n+++ b/package.json\n@@ -1,5 +1,5 @@\n {\n- \"name\": \"extra_01.starter\",\n+ \"name\": \"extra_02.mvp-implementation\",\n \"private\": true,\n \"version\": \"0.0.0\",\n \"type\": \"module\",\n@@ -16,15 +16,12 @@\n },\n \"scripts\": {\n \"dev\": \"node ./cli.ts\",\n- \"dev:client\": \"concurrently --kill-others-on-fail -n web,mcp-apps -c green,cyan \\\"npm run --silent dev:client:web\\\" \\\"npm run --silent dev:mcp-apps\\\"\",\n+ \"dev:client\": \"npm run --silent dev:client:web\",\n \"dev:client:web\": \"esbuild client/entry.tsx --bundle --format=esm --target=es2022 --outdir=public --entry-names=client-entry --chunk-names=assets/[name] --asset-names=assets/[name] --jsx=automatic --jsx-import-source=remix/component --watch\",\n- \"dev:mcp-apps\": \"esbuild client/mcp-apps/calculator-widget.ts --bundle --format=esm --target=es2022 --outdir=public/mcp-apps --platform=browser --watch\",\n \"dev:worker\": \"node ./wrangler-env.ts dev --local\",\n- \"dev:mock-resend\": \"node ./wrangler-env.ts dev --local --config mock-servers/resend/wrangler.jsonc\",\n \"deploy\": \"npm run build && node ./wrangler-env.ts deploy\",\n- \"build:mcp-apps\": \"esbuild client/mcp-apps/calculator-widget.ts --bundle --format=esm --target=es2022 --outdir=public/mcp-apps --platform=browser\",\n \"build:client:web\": \"esbuild client/entry.tsx --bundle --format=esm --target=es2022 --outdir=public --entry-names=client-entry --chunk-names=assets/[name] --asset-names=assets/[name] --jsx=automatic --jsx-import-source=remix/component\",\n- \"build:client\": \"npm run build:client:web && npm run build:mcp-apps\",\n+ \"build:client\": \"npm run build:client:web\",\n \"build\": \"npm run build:client && node ./wrangler-env.ts build\",\n \"lint\": \"oxlint .\",\n \"lint:fix\": \"oxlint . --fix\",\n@@ -32,8 +29,8 @@\n \"format:check\": \"prettier --check .\",\n \"migrate:local\": \"node ./wrangler-env.ts d1 migrations apply APP_DB --local\",\n \"migrate:e2e\": \"node ./wrangler-env.ts d1 migrations apply APP_DB --local --persist-to .wrangler/state/e2e\",\n- \"preview\": \"npm run build:mcp-apps && npm run migrate:local && node ./wrangler-env.ts dev --local\",\n- \"preview:e2e\": \"npm run build:mcp-apps && npm run migrate:e2e && node ./wrangler-env.ts dev --local --persist-to .wrangler/state/e2e\",\n+ \"preview\": \"npm run migrate:local && node ./wrangler-env.ts dev --local\",\n+ \"preview:e2e\": \"npm run migrate:e2e && node ./wrangler-env.ts dev --local --persist-to .wrangler/state/e2e\",\n \"generate-types\": \"node ./wrangler-env.ts types ./types/worker-configuration.d.ts\",\n \"typecheck\": \"tsc -b --noEmit\",\n \"inspect\": \"npx -y @mcpjam/inspector inspector\",\n@@ -41,33 +38,24 @@\n \"test:e2e\": \"node ./tools/prepare-e2e-env.ts && playwright test\",\n \"test:e2e:ui\": \"node ./tools/prepare-e2e-env.ts && playwright test --ui\",\n \"test:e2e:install\": \"playwright install chromium --with-deps\",\n- \"test:mcp\": \"npm run build:mcp-apps && vitest run mcp/mcp-server-e2e.test.ts\"\n+ \"test:mcp\": \"vitest run mcp/mcp-server-e2e.test.ts\"\n },\n \"devDependencies\": {\n \"@epic-web/config\": \"^1.24.1\",\n \"@playwright/test\": \"^1.58.2\",\n- \"@types/set-cookie-parser\": \"^2.4.10\",\n \"concurrently\": \"^9.2.1\",\n \"esbuild\": \"^0.27.3\",\n \"oxlint\": \"^1.51.0\",\n \"prettier\": \"^3.8.1\",\n- \"set-cookie-parser\": \"^3.0.1\",\n \"typescript\": \"^5.9.3\",\n \"vitest\": \"^4.0.18\",\n \"wrangler\": \"^4.71.0\"\n },\n \"prettier\": \"@epic-web/config/prettier\",\n- \"overrides\": {\n- \"@modelcontextprotocol/sdk\": \"1.26.0\"\n- },\n \"dependencies\": {\n- \"@cloudflare/workers-oauth-provider\": \"^0.3.0\",\n \"@epic-web/invariant\": \"^1.0.0\",\n- \"@mcp-ui/server\": \"6.1.0\",\n- \"@modelcontextprotocol/ext-apps\": \"^1.2.0\",\n \"@modelcontextprotocol/sdk\": \"1.26.0\",\n \"agents\": \"^0.7.5\",\n- \"ai\": \"^6.0.116\",\n \"get-port\": \"^7.1.0\",\n \"remix\": \"3.0.0-alpha.3\",\n \"zod\": \"^4.3.6\"\ndiff --git a/public/styles.css b/public/styles.css\nindex 7c707ce..823fe53 100644\n--- a/public/styles.css\n+++ b/public/styles.css\n@@ -1,29 +1,29 @@\n :root {\n \tcolor-scheme: light dark;\n \n-\t/* Colors - Light mode (epic-scheduler ember) */\n-\t--color-primary: #f47c00;\n-\t--color-primary-hover: #e26c00;\n-\t--color-primary-active: #c85a00;\n-\t--color-on-primary: #120b08;\n-\t--color-primary-text: #b04700;\n-\t--color-background: #f6f6f8;\n-\t--color-surface: #ececf1;\n-\t--color-text: #2f2f34;\n-\t--color-text-muted: #676770;\n-\t--color-border: #d7d7df;\n-\n-\t/* Colors - Dark mode (smoldering ember) */\n-\t--color-primary-dark: #f6a23a;\n-\t--color-primary-hover-dark: #f08b1a;\n-\t--color-primary-active-dark: #d87305;\n-\t--color-on-primary-dark: #120b08;\n-\t--color-primary-text-dark: #f6a23a;\n-\t--color-background-dark: #121216;\n-\t--color-surface-dark: #1c1c22;\n-\t--color-text-dark: #f1f1f5;\n-\t--color-text-muted-dark: #b3b3bd;\n-\t--color-border-dark: #2b2b33;\n+\t/* Colors - Light mode */\n+\t--color-primary: #0f766e;\n+\t--color-primary-hover: #0d665f;\n+\t--color-primary-active: #0b5751;\n+\t--color-on-primary: #f0fdf9;\n+\t--color-primary-text: #0f766e;\n+\t--color-background: #f5fbff;\n+\t--color-surface: #ffffff;\n+\t--color-text: #17365d;\n+\t--color-text-muted: #4c5f7a;\n+\t--color-border: #c6d9ec;\n+\n+\t/* Colors - Dark mode */\n+\t--color-primary-dark: #2dd4bf;\n+\t--color-primary-hover-dark: #22c5b0;\n+\t--color-primary-active-dark: #1fb6a1;\n+\t--color-on-primary-dark: #062c28;\n+\t--color-primary-text-dark: #6ee7d8;\n+\t--color-background-dark: #091722;\n+\t--color-surface-dark: #0f2333;\n+\t--color-text-dark: #e0f2ff;\n+\t--color-text-muted-dark: #9bb8d3;\n+\t--color-border-dark: #1f3a52;\n \n \t/* Typography */\n \t--font-family: system-ui, sans-serif;\ndiff --git a/server/audit-log.ts b/server/audit-log.ts\ndeleted file mode 100644\nindex 9d2eb37..0000000\n--- a/server/audit-log.ts\n+++ /dev/null\n@@ -1,50 +0,0 @@\n-import { toHex } from './hex.ts'\n-\n-type AuditEvent = {\n-\tcategory: 'auth' | 'oauth'\n-\taction: string\n-\tresult: 'success' | 'failure' | 'rate_limited'\n-\temail?: string\n-\tip?: string\n-\tclientId?: string\n-\tpath?: string\n-\treason?: string\n-}\n-\n-async function hashIdentifier(value: string) {\n-\tconst data = new TextEncoder().encode(value.trim().toLowerCase())\n-\tconst digest = await crypto.subtle.digest('SHA-256', data)\n-\treturn toHex(new Uint8Array(digest))\n-}\n-\n-export function getRequestIp(request: Request) {\n-\tconst forwarded = request.headers.get('x-forwarded-for')\n-\tconst forwardedIp = forwarded?.split(',')[0]?.trim()\n-\treturn (\n-\t\trequest.headers.get('CF-Connecting-IP') ??\n-\t\t(forwardedIp && forwardedIp.length > 0 ? forwardedIp : null)\n-\t)\n-}\n-\n-export async function logAuditEvent(event: AuditEvent) {\n-\ttry {\n-\t\tconst [emailHash, ipHash] = await Promise.all([\n-\t\t\tevent.email ? hashIdentifier(event.email) : undefined,\n-\t\t\tevent.ip ? hashIdentifier(event.ip) : undefined,\n-\t\t])\n-\t\tconst payload = {\n-\t\t\tcategory: event.category,\n-\t\t\taction: event.action,\n-\t\t\tresult: event.result,\n-\t\t\temailHash,\n-\t\t\tipHash,\n-\t\t\tclientId: event.clientId,\n-\t\t\tpath: event.path,\n-\t\t\treason: event.reason,\n-\t\t\ttimestamp: new Date().toISOString(),\n-\t\t}\n-\t\tconsole.info('audit-event', JSON.stringify(payload))\n-\t} catch (error) {\n-\t\tconsole.warn('audit-event-failed', error)\n-\t}\n-}\ndiff --git a/server/auth-redirect.ts b/server/auth-redirect.ts\ndeleted file mode 100644\nindex 155cab1..0000000\n--- a/server/auth-redirect.ts\n+++ /dev/null\n@@ -1,27 +0,0 @@\n-type RedirectToLoginOptions = {\n-\tredirectTo?: string\n-}\n-\n-function normalizeRedirectTo(value: string | null) {\n-\tif (!value) return null\n-\tif (!value.startsWith('/')) return null\n-\tif (value.startsWith('//')) return null\n-\treturn value\n-}\n-\n-export function redirectToLogin(\n-\trequest: Request,\n-\toptions: RedirectToLoginOptions = {},\n-) {\n-\tconst requestUrl = new URL(request.url)\n-\tconst target =\n-\t\tnormalizeRedirectTo(options.redirectTo ?? null) ??\n-\t\t`${requestUrl.pathname}${requestUrl.search}`\n-\tconst loginUrl = new URL('/login', requestUrl)\n-\n-\tif (target) {\n-\t\tloginUrl.searchParams.set('redirectTo', target)\n-\t}\n-\n-\treturn Response.redirect(loginUrl, 302)\n-}\ndiff --git a/server/auth-session.ts b/server/auth-session.ts\ndeleted file mode 100644\nindex c18a2ad..0000000\n--- a/server/auth-session.ts\n+++ /dev/null\n@@ -1,80 +0,0 @@\n-import { createCookie } from '@remix-run/cookie'\n-\n-const sessionMaxAgeSeconds = 60 * 60 * 24 * 7\n-\n-export type AuthSession = {\n-\tid: string\n-\temail: string\n-}\n-\n-let sessionCookie: ReturnType | null = null\n-let sessionSecret: string | null = null\n-\n-export function setAuthSessionSecret(secret: string) {\n-\tif (!secret) {\n-\t\tthrow new Error('Missing COOKIE_SECRET for session signing.')\n-\t}\n-\n-\tif (sessionCookie && sessionSecret === secret) {\n-\t\treturn\n-\t}\n-\n-\tsessionSecret = secret\n-\tsessionCookie = createCookie('epic-scheduler_session', {\n-\t\thttpOnly: true,\n-\t\tsameSite: 'Lax',\n-\t\tpath: '/',\n-\t\tmaxAge: sessionMaxAgeSeconds,\n-\t\tsecrets: [secret],\n-\t})\n-}\n-\n-function getSessionCookie() {\n-\tif (!sessionCookie) {\n-\t\tthrow new Error('Session cookie not configured. Call setAuthSessionSecret.')\n-\t}\n-\n-\treturn sessionCookie\n-}\n-\n-function isAuthSession(value: unknown): value is AuthSession {\n-\tif (!value || typeof value !== 'object') return false\n-\tconst record = value as Record\n-\treturn (\n-\t\ttypeof record.id === 'string' &&\n-\t\trecord.id.length > 0 &&\n-\t\ttypeof record.email === 'string' &&\n-\t\trecord.email.length > 0\n-\t)\n-}\n-\n-export async function createAuthCookie(session: AuthSession, secure: boolean) {\n-\treturn getSessionCookie().serialize(JSON.stringify(session), { secure })\n-}\n-\n-export async function destroyAuthCookie(secure: boolean) {\n-\treturn getSessionCookie().serialize('', {\n-\t\tsecure,\n-\t\tmaxAge: 0,\n-\t\texpires: new Date(0),\n-\t})\n-}\n-\n-export async function readAuthSession(request: Request) {\n-\tconst cookieHeader = request.headers.get('Cookie')\n-\tif (!cookieHeader) return null\n-\n-\tconst stored = await getSessionCookie().parse(cookieHeader)\n-\tif (!stored || typeof stored !== 'string') return null\n-\n-\ttry {\n-\t\tconst parsed = JSON.parse(stored)\n-\t\tif (isAuthSession(parsed)) {\n-\t\t\treturn parsed\n-\t\t}\n-\t} catch {\n-\t\treturn null\n-\t}\n-\n-\treturn null\n-}\ndiff --git a/server/email/resend.ts b/server/email/resend.ts\ndeleted file mode 100644\nindex 2bde4a1..0000000\n--- a/server/email/resend.ts\n+++ /dev/null\n@@ -1,90 +0,0 @@\n-import { parseSafe } from 'remix/data-schema'\n-import { resendEmailSchema, type ResendEmail } from '#shared/resend-email.ts'\n-\n-type ResendClientConfig = {\n-\tapiBaseUrl: string\n-\tapiKey?: string\n-}\n-\n-type ResendSendResult = {\n-\tok: boolean\n-\tid?: string\n-\tskipped?: boolean\n-\terror?: string\n-}\n-\n-function normalizeEmailPayload(message: ResendEmail) {\n-\tconst result = parseSafe(resendEmailSchema, message)\n-\tif (!result.success) {\n-\t\tconst issueMessage = result.issues\n-\t\t\t.map((issue) => {\n-\t\t\t\tconst path =\n-\t\t\t\t\tArray.isArray(issue.path) && issue.path.length > 0\n-\t\t\t\t\t\t? issue.path.join('.')\n-\t\t\t\t\t\t: 'payload'\n-\t\t\t\treturn `${path}: ${issue.message}`\n-\t\t\t})\n-\t\t\t.join(', ')\n-\t\tthrow new Error(`Invalid Resend email payload: ${issueMessage}`)\n-\t}\n-\treturn result.value\n-}\n-\n-function logSkippedEmail(reason: string, message: ResendEmail) {\n-\tconsole.warn(\n-\t\treason,\n-\t\tJSON.stringify({\n-\t\t\tto: message.to,\n-\t\t\tfrom: message.from,\n-\t\t\tsubject: message.subject,\n-\t\t\tbody: message.html,\n-\t\t}),\n-\t)\n-}\n-\n-export async function sendResendEmail(\n-\tconfig: ResendClientConfig,\n-\tmessage: ResendEmail,\n-): Promise {\n-\tconst normalized = normalizeEmailPayload(message)\n-\tif (!config.apiKey) {\n-\t\tlogSkippedEmail('resend-api-key-missing', normalized)\n-\t\treturn { ok: false, skipped: true }\n-\t}\n-\n-\tconst baseUrl = config.apiBaseUrl.endsWith('/')\n-\t\t? config.apiBaseUrl\n-\t\t: `${config.apiBaseUrl}/`\n-\tconst endpoint = new URL('emails', baseUrl)\n-\tconst response = await fetch(endpoint.toString(), {\n-\t\tmethod: 'POST',\n-\t\theaders: {\n-\t\t\tAuthorization: `Bearer ${config.apiKey}`,\n-\t\t\t'Content-Type': 'application/json',\n-\t\t},\n-\t\tbody: JSON.stringify(normalized),\n-\t})\n-\tconst payload = (await response.json().catch(() => null)) as {\n-\t\tid?: string\n-\t} | null\n-\tif (!response.ok) {\n-\t\tconsole.warn(\n-\t\t\t'resend-email-failed',\n-\t\t\tJSON.stringify({\n-\t\t\t\tstatus: response.status,\n-\t\t\t\tbody: payload,\n-\t\t\t\tto: normalized.to,\n-\t\t\t\tfrom: normalized.from,\n-\t\t\t\tsubject: normalized.subject,\n-\t\t\t}),\n-\t\t)\n-\t\treturn { ok: false, error: 'Resend API returned an error response.' }\n-\t}\n-\n-\treturn {\n-\t\tok: true,\n-\t\tid: typeof payload?.id === 'string' ? payload.id : undefined,\n-\t}\n-}\n-\n-export { resendEmailSchema }\ndiff --git a/server/handler.ts b/server/handler.ts\nindex a511bdc..a38cbfe 100644\n--- a/server/handler.ts\n+++ b/server/handler.ts\n@@ -1,11 +1,9 @@\n-import { setAuthSessionSecret } from './auth-session.ts'\n import { getEnv } from './env.ts'\n import { createAppRouter } from './router.ts'\n \n export async function handleRequest(request: Request, env: Env) {\n \ttry {\n \t\tconst appEnv = getEnv(env)\n-\t\tsetAuthSessionSecret(appEnv.COOKIE_SECRET)\n \t\tconst router = createAppRouter(appEnv)\n \t\treturn await router.fetch(request)\n \t} catch (error) {\ndiff --git a/server/handlers/account.ts b/server/handlers/account.ts\ndeleted file mode 100644\nindex 96b931e..0000000\n--- a/server/handlers/account.ts\n+++ /dev/null\n@@ -1,26 +0,0 @@\n-import { type BuildAction } from 'remix/fetch-router'\n-import { readAuthSession } from '#server/auth-session.ts'\n-import { redirectToLogin } from '#server/auth-redirect.ts'\n-import { Layout } from '#server/layout.ts'\n-import { render } from '#server/render.ts'\n-import { type routes } from '#server/routes.ts'\n-\n-export const account = {\n-\tmiddleware: [],\n-\tasync action({ request }) {\n-\t\tconst session = await readAuthSession(request)\n-\n-\t\tif (!session) {\n-\t\t\treturn redirectToLogin(request)\n-\t\t}\n-\n-\t\treturn render(\n-\t\t\tLayout({\n-\t\t\t\ttitle: 'Account',\n-\t\t\t}),\n-\t\t)\n-\t},\n-} satisfies BuildAction<\n-\ttypeof routes.account.method,\n-\ttypeof routes.account.pattern\n->\ndiff --git a/server/handlers/auth-handler.test.ts b/server/handlers/auth-handler.test.ts\ndeleted file mode 100644\nindex 2f4deb4..0000000\n--- a/server/handlers/auth-handler.test.ts\n+++ /dev/null\n@@ -1,238 +0,0 @@\n-import { beforeAll, expect, test } from 'vitest'\n-import { RequestContext } from 'remix/fetch-router'\n-import { setAuthSessionSecret } from '#server/auth-session.ts'\n-import { createPasswordHash } from '#server/password-hash.ts'\n-import { createAuthHandler } from './auth.ts'\n-\n-const testCookieSecret = 'test-cookie-secret-0123456789abcdef0123456789'\n-\n-function createAuthRequest(\n-\tbody: unknown,\n-\turl: string,\n-\thandler: ReturnType,\n-) {\n-\tconst request = new Request(url, {\n-\t\tmethod: 'POST',\n-\t\theaders: { 'Content-Type': 'application/json' },\n-\t\tbody: typeof body === 'string' ? body : JSON.stringify(body),\n-\t})\n-\tconst context = new RequestContext(request)\n-\n-\treturn {\n-\t\trun: () => handler.action(context),\n-\t}\n-}\n-\n-type TestUser = {\n-\tid: number\n-\temail: string\n-\tusername: string\n-\tpassword_hash: string\n-}\n-\n-function createTestDb() {\n-\tlet nextId = 1\n-\tconst users = new Map()\n-\tconst db = {\n-\t\tprepare(query: string) {\n-\t\t\tconst normalizedQuery = query.replace(/\\s+/g, ' ').trim().toLowerCase()\n-\t\t\treturn {\n-\t\t\t\tbind(...params: Array) {\n-\t\t\t\t\tconst readUserByEmail = () => {\n-\t\t\t\t\t\tconst email = String(params[0] ?? '').toLowerCase()\n-\t\t\t\t\t\treturn users.get(email) ?? null\n-\t\t\t\t\t}\n-\n-\t\t\t\t\tconst insertUser = () => {\n-\t\t\t\t\t\tconst [username, email, passwordHash] = params as Array\n-\t\t\t\t\t\tconst normalizedEmail = String(email).toLowerCase()\n-\t\t\t\t\t\tif (users.has(normalizedEmail)) {\n-\t\t\t\t\t\t\tthrow new Error('UNIQUE constraint failed: users.email')\n-\t\t\t\t\t\t}\n-\t\t\t\t\t\tconst user: TestUser = {\n-\t\t\t\t\t\t\tid: nextId,\n-\t\t\t\t\t\t\temail: String(email),\n-\t\t\t\t\t\t\tusername: String(username),\n-\t\t\t\t\t\t\tpassword_hash: String(passwordHash),\n-\t\t\t\t\t\t}\n-\t\t\t\t\t\tnextId += 1\n-\t\t\t\t\t\tusers.set(normalizedEmail, user)\n-\t\t\t\t\t\treturn user\n-\t\t\t\t\t}\n-\n-\t\t\t\t\tconst executeAll = async () => {\n-\t\t\t\t\t\tif (\n-\t\t\t\t\t\t\tnormalizedQuery.startsWith('select') &&\n-\t\t\t\t\t\t\tnormalizedQuery.includes('from \"users\"') &&\n-\t\t\t\t\t\t\tnormalizedQuery.includes('email')\n-\t\t\t\t\t\t) {\n-\t\t\t\t\t\t\tconst user = readUserByEmail()\n-\t\t\t\t\t\t\treturn {\n-\t\t\t\t\t\t\t\tresults: user ? [{ ...user }] : [],\n-\t\t\t\t\t\t\t\tmeta: { changes: 0, last_row_id: 0 },\n-\t\t\t\t\t\t\t}\n-\t\t\t\t\t\t}\n-\n-\t\t\t\t\t\tif (normalizedQuery.includes('insert into \"users\"')) {\n-\t\t\t\t\t\t\tconst user = insertUser()\n-\t\t\t\t\t\t\treturn {\n-\t\t\t\t\t\t\t\tresults: [{ ...user }],\n-\t\t\t\t\t\t\t\tmeta: { changes: 1, last_row_id: user.id },\n-\t\t\t\t\t\t\t}\n-\t\t\t\t\t\t}\n-\n-\t\t\t\t\t\treturn {\n-\t\t\t\t\t\t\tresults: [],\n-\t\t\t\t\t\t\tmeta: { changes: 0, last_row_id: 0 },\n-\t\t\t\t\t\t}\n-\t\t\t\t\t}\n-\n-\t\t\t\t\treturn {\n-\t\t\t\t\t\tasync all() {\n-\t\t\t\t\t\t\treturn executeAll()\n-\t\t\t\t\t\t},\n-\t\t\t\t\t\tasync first() {\n-\t\t\t\t\t\t\tconst result = await executeAll()\n-\t\t\t\t\t\t\treturn result.results[0] ?? null\n-\t\t\t\t\t\t},\n-\t\t\t\t\t\tasync run() {\n-\t\t\t\t\t\t\tif (normalizedQuery.includes('insert into \"users\"')) {\n-\t\t\t\t\t\t\t\tconst user = insertUser()\n-\t\t\t\t\t\t\t\treturn { meta: { changes: 1, last_row_id: user.id } }\n-\t\t\t\t\t\t\t}\n-\t\t\t\t\t\t\treturn { meta: { changes: 0, last_row_id: 0 } }\n-\t\t\t\t\t\t},\n-\t\t\t\t\t}\n-\t\t\t\t},\n-\t\t\t}\n-\t\t},\n-\t\tasync exec() {\n-\t\t\treturn\n-\t\t},\n-\t} as unknown as D1Database\n-\n-\tasync function addUser(email: string, password: string) {\n-\t\tconst passwordHash = await createPasswordHash(password)\n-\t\tconst user: TestUser = {\n-\t\t\tid: nextId,\n-\t\t\temail,\n-\t\t\tusername: email,\n-\t\t\tpassword_hash: passwordHash,\n-\t\t}\n-\t\tnextId += 1\n-\t\tusers.set(email.toLowerCase(), user)\n-\t\treturn user\n-\t}\n-\n-\treturn { db, users, addUser }\n-}\n-\n-beforeAll(() => {\n-\tsetAuthSessionSecret(testCookieSecret)\n-})\n-\n-test('auth handler returns 400 for invalid JSON', async () => {\n-\tconst testDb = createTestDb()\n-\tconst handler = createAuthHandler({\n-\t\tCOOKIE_SECRET: testCookieSecret,\n-\t\tAPP_DB: testDb.db,\n-\t})\n-\tconst authRequest = createAuthRequest('{', 'http://example.com/auth', handler)\n-\tconst response = await authRequest.run()\n-\texpect(response.status).toBe(400)\n-\tconst payload = await response.json()\n-\texpect(payload).toEqual({ error: 'Invalid JSON payload.' })\n-})\n-\n-test('auth handler returns 400 for missing fields', async () => {\n-\tconst testDb = createTestDb()\n-\tconst handler = createAuthHandler({\n-\t\tCOOKIE_SECRET: testCookieSecret,\n-\t\tAPP_DB: testDb.db,\n-\t})\n-\tconst authRequest = createAuthRequest(\n-\t\t{ email: 'a@b.com' },\n-\t\t'http://example.com/auth',\n-\t\thandler,\n-\t)\n-\tconst response = await authRequest.run()\n-\texpect(response.status).toBe(400)\n-\tconst payload = await response.json()\n-\texpect(payload).toEqual({\n-\t\terror: 'Invalid request body.',\n-\t})\n-})\n-\n-test('auth handler rejects login with unknown user', async () => {\n-\tconst testDb = createTestDb()\n-\tconst handler = createAuthHandler({\n-\t\tCOOKIE_SECRET: testCookieSecret,\n-\t\tAPP_DB: testDb.db,\n-\t})\n-\tconst authRequest = createAuthRequest(\n-\t\t{ email: 'a@b.com', password: 'secret', mode: 'login' },\n-\t\t'http://example.com/auth',\n-\t\thandler,\n-\t)\n-\tconst response = await authRequest.run()\n-\texpect(response.status).toBe(401)\n-\tconst payload = await response.json()\n-\texpect(payload).toEqual({ error: 'Invalid email or password.' })\n-})\n-\n-test('auth handler creates a user and cookie for signup', async () => {\n-\tconst testDb = createTestDb()\n-\tconst handler = createAuthHandler({\n-\t\tCOOKIE_SECRET: testCookieSecret,\n-\t\tAPP_DB: testDb.db,\n-\t})\n-\tconst authRequest = createAuthRequest(\n-\t\t{ email: 'new@b.com', password: 'secret', mode: 'signup' },\n-\t\t'http://example.com/auth',\n-\t\thandler,\n-\t)\n-\tconst response = await authRequest.run()\n-\texpect(response.status).toBe(200)\n-\tconst payload = await response.json()\n-\texpect(payload).toEqual({ ok: true, mode: 'signup' })\n-\texpect(testDb.users.has('new@b.com')).toBe(true)\n-\tconst setCookie = response.headers.get('Set-Cookie') ?? ''\n-\texpect(setCookie).toContain('epic-scheduler_session=')\n-})\n-\n-test('auth handler returns ok with a session cookie for login', async () => {\n-\tconst testDb = createTestDb()\n-\tconst handler = createAuthHandler({\n-\t\tCOOKIE_SECRET: testCookieSecret,\n-\t\tAPP_DB: testDb.db,\n-\t})\n-\tawait testDb.addUser('a@b.com', 'secret')\n-\tconst authRequest = createAuthRequest(\n-\t\t{ email: 'a@b.com', password: 'secret', mode: 'login' },\n-\t\t'http://example.com/auth',\n-\t\thandler,\n-\t)\n-\tconst response = await authRequest.run()\n-\texpect(response.status).toBe(200)\n-\tconst payload = await response.json()\n-\texpect(payload).toEqual({ ok: true, mode: 'login' })\n-\tconst setCookie = response.headers.get('Set-Cookie') ?? ''\n-\texpect(setCookie).toContain('epic-scheduler_session=')\n-})\n-\n-test('auth handler sets Secure cookie over https', async () => {\n-\tconst testDb = createTestDb()\n-\tconst handler = createAuthHandler({\n-\t\tCOOKIE_SECRET: testCookieSecret,\n-\t\tAPP_DB: testDb.db,\n-\t})\n-\tawait testDb.addUser('secure@b.com', 'secret')\n-\tconst authRequest = createAuthRequest(\n-\t\t{ email: 'secure@b.com', password: 'secret', mode: 'login' },\n-\t\t'https://example.com/auth',\n-\t\thandler,\n-\t)\n-\tconst response = await authRequest.run()\n-\tconst setCookie = response.headers.get('Set-Cookie') ?? ''\n-\texpect(setCookie).toContain('Secure')\n-})\ndiff --git a/server/handlers/auth-page.ts b/server/handlers/auth-page.ts\ndeleted file mode 100644\nindex 7704cf9..0000000\n--- a/server/handlers/auth-page.ts\n+++ /dev/null\n@@ -1,29 +0,0 @@\n-import { readAuthSession } from '#server/auth-session.ts'\n-import { Layout } from '#server/layout.ts'\n-import { render } from '#server/render.ts'\n-\n-function normalizeRedirectTo(value: string | null) {\n-\tif (!value) return null\n-\tif (!value.startsWith('/')) return null\n-\tif (value.startsWith('//')) return null\n-\treturn value\n-}\n-\n-export function createAuthPageHandler() {\n-\treturn {\n-\t\tmiddleware: [],\n-\t\tasync action({ request }: { request: Request }) {\n-\t\t\tconst session = await readAuthSession(request)\n-\t\t\tif (session) {\n-\t\t\t\tconst url = new URL(request.url)\n-\t\t\t\tconst redirectTo = normalizeRedirectTo(\n-\t\t\t\t\turl.searchParams.get('redirectTo'),\n-\t\t\t\t)\n-\t\t\t\tconst redirectTarget = redirectTo ?? '/account'\n-\t\t\t\treturn Response.redirect(new URL(redirectTarget, request.url), 302)\n-\t\t\t}\n-\n-\t\t\treturn render(Layout({}))\n-\t\t},\n-\t}\n-}\ndiff --git a/server/handlers/auth.ts b/server/handlers/auth.ts\ndeleted file mode 100644\nindex b7d61d3..0000000\n--- a/server/handlers/auth.ts\n+++ /dev/null\n@@ -1,220 +0,0 @@\n-import { type BuildAction } from 'remix/fetch-router'\n-import { enum_, object, parseSafe, string } from 'remix/data-schema'\n-import { createAuthCookie } from '#server/auth-session.ts'\n-import { getRequestIp, logAuditEvent } from '#server/audit-log.ts'\n-import { normalizeEmail } from '#server/normalize-email.ts'\n-import { createPasswordHash, verifyPassword } from '#server/password-hash.ts'\n-import { type routes } from '#server/routes.ts'\n-import { type AppEnv } from '#types/env-schema.ts'\n-import { createDb, usersTable } from '#worker/db.ts'\n-\n-const authModes = ['login', 'signup'] as const\n-type AuthMode = (typeof authModes)[number]\n-\n-function isUniqueConstraintError(error: unknown) {\n-\treturn (\n-\t\terror instanceof Error && /unique constraint failed/i.test(error.message)\n-\t)\n-}\n-\n-const authRequestSchema = object({\n-\temail: string(),\n-\tpassword: string(),\n-\tmode: enum_(authModes),\n-})\n-\n-const dummyPasswordHash =\n-\t'pbkdf2_sha256$100000$00000000000000000000000000000000$0000000000000000000000000000000000000000000000000000000000000000'\n-\n-export function createAuthHandler(appEnv: AppEnv) {\n-\tconst db = createDb(appEnv.APP_DB)\n-\n-\treturn {\n-\t\tmiddleware: [],\n-\t\tasync action({ request, url }) {\n-\t\t\tlet body: unknown\n-\n-\t\t\ttry {\n-\t\t\t\tbody = await request.json()\n-\t\t\t} catch {\n-\t\t\t\treturn Response.json(\n-\t\t\t\t\t{ error: 'Invalid JSON payload.' },\n-\t\t\t\t\t{ status: 400 },\n-\t\t\t\t)\n-\t\t\t}\n-\n-\t\t\tconst parsedBody = parseSafe(authRequestSchema, body)\n-\t\t\tif (!parsedBody.success) {\n-\t\t\t\treturn Response.json(\n-\t\t\t\t\t{ error: 'Invalid request body.' },\n-\t\t\t\t\t{ status: 400 },\n-\t\t\t\t)\n-\t\t\t}\n-\n-\t\t\tconst normalizedEmail = normalizeEmail(parsedBody.value.email)\n-\t\t\tconst normalizedPassword = parsedBody.value.password\n-\t\t\tconst normalizedMode: AuthMode = parsedBody.value.mode\n-\t\t\tconst requestIp = getRequestIp(request) ?? undefined\n-\n-\t\t\tif (!normalizedEmail || !normalizedPassword) {\n-\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\taction: 'authenticate',\n-\t\t\t\t\tresult: 'failure',\n-\t\t\t\t\temail: normalizedEmail || undefined,\n-\t\t\t\t\tip: requestIp,\n-\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t\treason: 'missing_fields',\n-\t\t\t\t})\n-\t\t\t\treturn Response.json(\n-\t\t\t\t\t{ error: 'Email, password, and mode are required.' },\n-\t\t\t\t\t{ status: 400 },\n-\t\t\t\t)\n-\t\t\t}\n-\n-\t\t\tif (normalizedMode === 'signup') {\n-\t\t\t\tconst existingUser = await db.findOne(usersTable, {\n-\t\t\t\t\twhere: { email: normalizedEmail },\n-\t\t\t\t})\n-\t\t\t\tif (existingUser) {\n-\t\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\t\taction: 'signup',\n-\t\t\t\t\t\tresult: 'failure',\n-\t\t\t\t\t\temail: normalizedEmail,\n-\t\t\t\t\t\tip: requestIp,\n-\t\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t\t\treason: 'email_exists',\n-\t\t\t\t\t})\n-\t\t\t\t\treturn Response.json(\n-\t\t\t\t\t\t{ error: 'Email already registered.' },\n-\t\t\t\t\t\t{ status: 409 },\n-\t\t\t\t\t)\n-\t\t\t\t}\n-\n-\t\t\t\tconst passwordHash = await createPasswordHash(normalizedPassword)\n-\t\t\t\tconst username = normalizedEmail\n-\t\t\t\tlet record: { id: number } | null = null\n-\t\t\t\ttry {\n-\t\t\t\t\tconst createdUser = await db.create(\n-\t\t\t\t\t\tusersTable,\n-\t\t\t\t\t\t{\n-\t\t\t\t\t\t\tusername,\n-\t\t\t\t\t\t\temail: normalizedEmail,\n-\t\t\t\t\t\t\tpassword_hash: passwordHash,\n-\t\t\t\t\t\t},\n-\t\t\t\t\t\t{\n-\t\t\t\t\t\t\treturnRow: true,\n-\t\t\t\t\t\t},\n-\t\t\t\t\t)\n-\t\t\t\t\trecord = { id: createdUser.id }\n-\t\t\t\t} catch (error) {\n-\t\t\t\t\tif (isUniqueConstraintError(error)) {\n-\t\t\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\t\t\taction: 'signup',\n-\t\t\t\t\t\t\tresult: 'failure',\n-\t\t\t\t\t\t\temail: normalizedEmail,\n-\t\t\t\t\t\t\tip: requestIp,\n-\t\t\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t\t\t\treason: 'email_exists',\n-\t\t\t\t\t\t})\n-\t\t\t\t\t\treturn Response.json(\n-\t\t\t\t\t\t\t{ error: 'Email already registered.' },\n-\t\t\t\t\t\t\t{ status: 409 },\n-\t\t\t\t\t\t)\n-\t\t\t\t\t}\n-\t\t\t\t\tthrow error\n-\t\t\t\t}\n-\t\t\t\tif (!record) {\n-\t\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\t\taction: 'signup',\n-\t\t\t\t\t\tresult: 'failure',\n-\t\t\t\t\t\temail: normalizedEmail,\n-\t\t\t\t\t\tip: requestIp,\n-\t\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t\t\treason: 'insert_failed',\n-\t\t\t\t\t})\n-\t\t\t\t\treturn Response.json(\n-\t\t\t\t\t\t{ error: 'Unable to create account.' },\n-\t\t\t\t\t\t{ status: 500 },\n-\t\t\t\t\t)\n-\t\t\t\t}\n-\n-\t\t\t\tconst cookie = await createAuthCookie(\n-\t\t\t\t\t{ id: String(record.id), email: normalizedEmail },\n-\t\t\t\t\turl.protocol === 'https:',\n-\t\t\t\t)\n-\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\taction: 'signup',\n-\t\t\t\t\tresult: 'success',\n-\t\t\t\t\temail: normalizedEmail,\n-\t\t\t\t\tip: requestIp,\n-\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t})\n-\t\t\t\treturn Response.json(\n-\t\t\t\t\t{ ok: true, mode: normalizedMode },\n-\t\t\t\t\t{\n-\t\t\t\t\t\theaders: {\n-\t\t\t\t\t\t\t'Set-Cookie': cookie,\n-\t\t\t\t\t\t},\n-\t\t\t\t\t},\n-\t\t\t\t)\n-\t\t\t}\n-\n-\t\t\tconst userRecord = await db.findOne(usersTable, {\n-\t\t\t\twhere: { email: normalizedEmail },\n-\t\t\t})\n-\t\t\tlet passwordValid = false\n-\t\t\tif (userRecord) {\n-\t\t\t\tpasswordValid = await verifyPassword(\n-\t\t\t\t\tnormalizedPassword,\n-\t\t\t\t\tuserRecord.password_hash,\n-\t\t\t\t)\n-\t\t\t} else {\n-\t\t\t\tawait verifyPassword(normalizedPassword, dummyPasswordHash)\n-\t\t\t}\n-\t\t\tif (!userRecord || !passwordValid) {\n-\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\taction: 'login',\n-\t\t\t\t\tresult: 'failure',\n-\t\t\t\t\temail: normalizedEmail,\n-\t\t\t\t\tip: requestIp,\n-\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t\treason: 'invalid_credentials',\n-\t\t\t\t})\n-\t\t\t\treturn Response.json(\n-\t\t\t\t\t{ error: 'Invalid email or password.' },\n-\t\t\t\t\t{ status: 401 },\n-\t\t\t\t)\n-\t\t\t}\n-\n-\t\t\tconst cookie = await createAuthCookie(\n-\t\t\t\t{\n-\t\t\t\t\tid: String(userRecord.id),\n-\t\t\t\t\temail: normalizedEmail,\n-\t\t\t\t},\n-\t\t\t\turl.protocol === 'https:',\n-\t\t\t)\n-\t\t\tvoid logAuditEvent({\n-\t\t\t\tcategory: 'auth',\n-\t\t\t\taction: 'login',\n-\t\t\t\tresult: 'success',\n-\t\t\t\temail: normalizedEmail,\n-\t\t\t\tip: requestIp,\n-\t\t\t\tpath: url.pathname,\n-\t\t\t})\n-\t\t\treturn Response.json(\n-\t\t\t\t{ ok: true, mode: normalizedMode },\n-\t\t\t\t{\n-\t\t\t\t\theaders: {\n-\t\t\t\t\t\t'Set-Cookie': cookie,\n-\t\t\t\t\t},\n-\t\t\t\t},\n-\t\t\t)\n-\t\t},\n-\t} satisfies BuildAction\n-}\ndiff --git a/server/handlers/chat.ts b/server/handlers/chat.ts\ndeleted file mode 100644\nindex 099ba5f..0000000\n--- a/server/handlers/chat.ts\n+++ /dev/null\n@@ -1,19 +0,0 @@\n-import { type BuildAction } from 'remix/fetch-router'\n-import { readAuthSession } from '#server/auth-session.ts'\n-import { redirectToLogin } from '#server/auth-redirect.ts'\n-import { Layout } from '#server/layout.ts'\n-import { render } from '#server/render.ts'\n-import { type routes } from '#server/routes.ts'\n-\n-export const chat = {\n-\tmiddleware: [],\n-\tasync action({ request }) {\n-\t\tconst session = await readAuthSession(request)\n-\n-\t\tif (!session) {\n-\t\t\treturn redirectToLogin(request)\n-\t\t}\n-\n-\t\treturn render(Layout({}))\n-\t},\n-} satisfies BuildAction\ndiff --git a/server/handlers/login.ts b/server/handlers/login.ts\ndeleted file mode 100644\nindex b05f133..0000000\n--- a/server/handlers/login.ts\n+++ /dev/null\n@@ -1,8 +0,0 @@\n-import { type BuildAction } from 'remix/fetch-router'\n-import { type routes } from '#server/routes.ts'\n-import { createAuthPageHandler } from './auth-page.ts'\n-\n-export const login = createAuthPageHandler() satisfies BuildAction<\n-\ttypeof routes.login.method,\n-\ttypeof routes.login.pattern\n->\ndiff --git a/server/handlers/logout.ts b/server/handlers/logout.ts\ndeleted file mode 100644\nindex d7f2fc6..0000000\n--- a/server/handlers/logout.ts\n+++ /dev/null\n@@ -1,56 +0,0 @@\n-import { type BuildAction } from 'remix/fetch-router'\n-import { destroyAuthCookie } from '#server/auth-session.ts'\n-import { type routes } from '#server/routes.ts'\n-\n-function normalizeProto(value: string) {\n-\treturn value.trim().replace(/^\"|\"$/g, '').toLowerCase()\n-}\n-\n-function getForwardedProto(request: Request) {\n-\tconst forwarded = request.headers.get('forwarded')\n-\tif (forwarded) {\n-\t\tfor (const entry of forwarded.split(',')) {\n-\t\t\tfor (const pair of entry.split(';')) {\n-\t\t\t\tconst [key, rawValue] = pair.split('=')\n-\t\t\t\tif (!key || !rawValue) continue\n-\t\t\t\tif (key.trim().toLowerCase() === 'proto') {\n-\t\t\t\t\treturn normalizeProto(rawValue)\n-\t\t\t\t}\n-\t\t\t}\n-\t\t}\n-\t}\n-\n-\tconst xForwardedProto = request.headers.get('x-forwarded-proto')\n-\tif (xForwardedProto) {\n-\t\treturn normalizeProto(xForwardedProto.split(',')[0] ?? '')\n-\t}\n-\n-\treturn null\n-}\n-\n-function isSecureRequest(request: Request) {\n-\tconst forwardedProto = getForwardedProto(request)\n-\tif (forwardedProto) {\n-\t\treturn forwardedProto === 'https'\n-\t}\n-\treturn new URL(request.url).protocol === 'https:'\n-}\n-\n-export const logout = {\n-\tmiddleware: [],\n-\tasync action({ request }) {\n-\t\tconst cookie = await destroyAuthCookie(isSecureRequest(request))\n-\t\tconst location = new URL('/login', request.url)\n-\n-\t\treturn new Response(null, {\n-\t\t\tstatus: 302,\n-\t\t\theaders: {\n-\t\t\t\tLocation: location.toString(),\n-\t\t\t\t'Set-Cookie': cookie,\n-\t\t\t},\n-\t\t})\n-\t},\n-} satisfies BuildAction<\n-\ttypeof routes.logout.method,\n-\ttypeof routes.logout.pattern\n->\ndiff --git a/server/handlers/password-reset.ts b/server/handlers/password-reset.ts\ndeleted file mode 100644\nindex 7198774..0000000\n--- a/server/handlers/password-reset.ts\n+++ /dev/null\n@@ -1,272 +0,0 @@\n-import { type BuildAction } from 'remix/fetch-router'\n-import { object, parseSafe, string } from 'remix/data-schema'\n-import { type AppEnv } from '#types/env-schema.ts'\n-import { createDb, passwordResetsTable, usersTable } from '#worker/db.ts'\n-import { logAuditEvent, getRequestIp } from '#server/audit-log.ts'\n-import { sendResendEmail } from '#server/email/resend.ts'\n-import { toHex } from '#server/hex.ts'\n-import { normalizeEmail } from '#server/normalize-email.ts'\n-import { createPasswordHash } from '#server/password-hash.ts'\n-import { type routes } from '#server/routes.ts'\n-\n-const resetTokenBytes = 32\n-const resetTokenExpiryMs = 60 * 60 * 1000\n-\n-const resetRequestSchema = object({\n-\temail: string(),\n-})\n-\n-const resetConfirmSchema = object({\n-\ttoken: string(),\n-\tpassword: string(),\n-})\n-\n-function buildResetEmail(resetUrl: string) {\n-\treturn {\n-\t\tsubject: 'Reset your epic-scheduler password',\n-\t\thtml: `\n-\n- \n- \n- Password reset\n- \n- \n-

We received a request to reset your epic-scheduler password.

\n-

Reset your password

\n-

If you did not request a reset, you can safely ignore this email.

\n- \n-`,\n-\t}\n-}\n-\n-function generateResetToken() {\n-\tconst bytes = new Uint8Array(resetTokenBytes)\n-\tcrypto.getRandomValues(bytes)\n-\treturn toHex(bytes)\n-}\n-\n-async function hashResetToken(token: string) {\n-\tconst data = new TextEncoder().encode(token)\n-\tconst digest = await crypto.subtle.digest('SHA-256', data)\n-\treturn toHex(new Uint8Array(digest))\n-}\n-\n-function logMissingEmailConfig(payload: {\n-\tto: string\n-\tfrom: string\n-\tsubject: string\n-\thtml: string\n-}) {\n-\tconsole.warn(\n-\t\t'resend-from-email-missing',\n-\t\tJSON.stringify({\n-\t\t\tto: payload.to,\n-\t\t\tfrom: payload.from,\n-\t\t\tsubject: payload.subject,\n-\t\t\tbody: payload.html,\n-\t\t}),\n-\t)\n-}\n-\n-export function createPasswordResetRequestHandler(appEnv: AppEnv) {\n-\tconst db = createDb(appEnv.APP_DB)\n-\n-\treturn {\n-\t\tmiddleware: [],\n-\t\tasync action({ request, url }) {\n-\t\t\tlet body: unknown\n-\t\t\ttry {\n-\t\t\t\tbody = await request.json()\n-\t\t\t} catch {\n-\t\t\t\treturn Response.json(\n-\t\t\t\t\t{ error: 'Invalid JSON payload.' },\n-\t\t\t\t\t{ status: 400 },\n-\t\t\t\t)\n-\t\t\t}\n-\t\t\tconst parsed = parseSafe(resetRequestSchema, body)\n-\t\t\tconst requestIp = getRequestIp(request) ?? undefined\n-\t\t\tconst normalizedEmail = parsed.success\n-\t\t\t\t? normalizeEmail(parsed.value.email)\n-\t\t\t\t: ''\n-\n-\t\t\tif (!parsed.success || !normalizedEmail) {\n-\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\taction: 'password_reset_request',\n-\t\t\t\t\tresult: 'failure',\n-\t\t\t\t\temail: normalizedEmail || undefined,\n-\t\t\t\t\tip: requestIp,\n-\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t\treason: 'invalid_payload',\n-\t\t\t\t})\n-\t\t\t\treturn Response.json({ error: 'Email is required.' }, { status: 400 })\n-\t\t\t}\n-\n-\t\t\tconst userRecord = await db.findOne(usersTable, {\n-\t\t\t\twhere: { email: normalizedEmail },\n-\t\t\t})\n-\n-\t\t\tconst token = generateResetToken()\n-\t\t\tconst tokenHash = await hashResetToken(token)\n-\t\t\tconst expiresAt = Date.now() + resetTokenExpiryMs\n-\n-\t\t\tif (userRecord) {\n-\t\t\t\tawait db.deleteMany(passwordResetsTable, {\n-\t\t\t\t\twhere: { user_id: userRecord.id },\n-\t\t\t\t})\n-\t\t\t\tawait db.create(passwordResetsTable, {\n-\t\t\t\t\tuser_id: userRecord.id,\n-\t\t\t\t\ttoken_hash: tokenHash,\n-\t\t\t\t\texpires_at: expiresAt,\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\tif (userRecord) {\n-\t\t\t\tconst appBaseUrl = appEnv.APP_BASE_URL ?? url.origin\n-\t\t\t\tconst resetUrl = new URL('/reset-password', appBaseUrl)\n-\t\t\t\tresetUrl.searchParams.set('token', token)\n-\t\t\t\tconst email = buildResetEmail(resetUrl.toString())\n-\t\t\t\tconst fromEmail = appEnv.RESEND_FROM_EMAIL?.trim() ?? ''\n-\n-\t\t\t\tif (!fromEmail) {\n-\t\t\t\t\tlogMissingEmailConfig({\n-\t\t\t\t\t\tto: normalizedEmail,\n-\t\t\t\t\t\tfrom: fromEmail,\n-\t\t\t\t\t\tsubject: email.subject,\n-\t\t\t\t\t\thtml: email.html,\n-\t\t\t\t\t})\n-\t\t\t\t} else {\n-\t\t\t\t\ttry {\n-\t\t\t\t\t\tconst apiBaseUrl =\n-\t\t\t\t\t\t\tappEnv.RESEND_API_BASE_URL ?? 'https://api.resend.com'\n-\t\t\t\t\t\tawait sendResendEmail(\n-\t\t\t\t\t\t\t{\n-\t\t\t\t\t\t\t\tapiBaseUrl,\n-\t\t\t\t\t\t\t\tapiKey: appEnv.RESEND_API_KEY,\n-\t\t\t\t\t\t\t},\n-\t\t\t\t\t\t\t{\n-\t\t\t\t\t\t\t\tto: normalizedEmail,\n-\t\t\t\t\t\t\t\tfrom: fromEmail,\n-\t\t\t\t\t\t\t\tsubject: email.subject,\n-\t\t\t\t\t\t\t\thtml: email.html,\n-\t\t\t\t\t\t\t},\n-\t\t\t\t\t\t)\n-\t\t\t\t\t} catch (error) {\n-\t\t\t\t\t\tconsole.warn('resend-email-error', error)\n-\t\t\t\t\t}\n-\t\t\t\t}\n-\n-\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\taction: 'password_reset_request',\n-\t\t\t\t\tresult: 'success',\n-\t\t\t\t\temail: normalizedEmail,\n-\t\t\t\t\tip: requestIp,\n-\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t})\n-\t\t\t} else {\n-\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\taction: 'password_reset_request',\n-\t\t\t\t\tresult: 'failure',\n-\t\t\t\t\temail: normalizedEmail,\n-\t\t\t\t\tip: requestIp,\n-\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t\treason: 'email_not_found',\n-\t\t\t\t})\n-\t\t\t}\n-\n-\t\t\treturn Response.json({\n-\t\t\t\tok: true,\n-\t\t\t\tmessage: 'If the account exists, a reset email has been sent.',\n-\t\t\t})\n-\t\t},\n-\t} satisfies BuildAction<\n-\t\ttypeof routes.passwordResetRequest.method,\n-\t\ttypeof routes.passwordResetRequest.pattern\n-\t>\n-}\n-\n-export function createPasswordResetConfirmHandler(appEnv: AppEnv) {\n-\tconst db = createDb(appEnv.APP_DB)\n-\n-\treturn {\n-\t\tmiddleware: [],\n-\t\tasync action({ request, url }) {\n-\t\t\tlet body: unknown\n-\t\t\ttry {\n-\t\t\t\tbody = await request.json()\n-\t\t\t} catch {\n-\t\t\t\treturn Response.json(\n-\t\t\t\t\t{ error: 'Invalid JSON payload.' },\n-\t\t\t\t\t{ status: 400 },\n-\t\t\t\t)\n-\t\t\t}\n-\t\t\tconst parsed = parseSafe(resetConfirmSchema, body)\n-\t\t\tconst requestIp = getRequestIp(request) ?? undefined\n-\t\t\tconst token = parsed.success ? parsed.value.token.trim() : ''\n-\t\t\tconst password = parsed.success ? parsed.value.password : ''\n-\n-\t\t\tif (!parsed.success || !token || !password) {\n-\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\taction: 'password_reset_confirm',\n-\t\t\t\t\tresult: 'failure',\n-\t\t\t\t\tip: requestIp,\n-\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t\treason: 'invalid_payload',\n-\t\t\t\t})\n-\t\t\t\treturn Response.json(\n-\t\t\t\t\t{ error: 'Token and password are required.' },\n-\t\t\t\t\t{ status: 400 },\n-\t\t\t\t)\n-\t\t\t}\n-\n-\t\t\tconst tokenHash = await hashResetToken(token)\n-\t\t\tconst resetRecord = await db.findOne(passwordResetsTable, {\n-\t\t\t\twhere: { token_hash: tokenHash },\n-\t\t\t})\n-\t\t\tconst now = Date.now()\n-\n-\t\t\tif (!resetRecord || resetRecord.expires_at < now) {\n-\t\t\t\tif (resetRecord && resetRecord.expires_at < now) {\n-\t\t\t\t\tawait db.delete(passwordResetsTable, resetRecord.id)\n-\t\t\t\t}\n-\t\t\t\tvoid logAuditEvent({\n-\t\t\t\t\tcategory: 'auth',\n-\t\t\t\t\taction: 'password_reset_confirm',\n-\t\t\t\t\tresult: 'failure',\n-\t\t\t\t\tip: requestIp,\n-\t\t\t\t\tpath: url.pathname,\n-\t\t\t\t\treason: resetRecord ? 'expired_token' : 'invalid_token',\n-\t\t\t\t})\n-\t\t\t\treturn Response.json(\n-\t\t\t\t\t{ error: 'Reset link is invalid or expired.' },\n-\t\t\t\t\t{ status: 400 },\n-\t\t\t\t)\n-\t\t\t}\n-\n-\t\t\tconst passwordHash = await createPasswordHash(password)\n-\t\t\tawait db.update(usersTable, resetRecord.user_id, {\n-\t\t\t\tpassword_hash: passwordHash,\n-\t\t\t\tupdated_at: new Date().toISOString().replace('T', ' ').slice(0, 19),\n-\t\t\t})\n-\t\t\tawait db.deleteMany(passwordResetsTable, {\n-\t\t\t\twhere: { user_id: resetRecord.user_id },\n-\t\t\t})\n-\n-\t\t\tvoid logAuditEvent({\n-\t\t\t\tcategory: 'auth',\n-\t\t\t\taction: 'password_reset_confirm',\n-\t\t\t\tresult: 'success',\n-\t\t\t\tip: requestIp,\n-\t\t\t\tpath: url.pathname,\n-\t\t\t})\n-\n-\t\t\treturn Response.json({ ok: true })\n-\t\t},\n-\t} satisfies BuildAction<\n-\t\ttypeof routes.passwordResetConfirm.method,\n-\t\ttypeof routes.passwordResetConfirm.pattern\n-\t>\n-}\ndiff --git a/server/handlers/schedule-pages.ts b/server/handlers/schedule-pages.ts\nnew file mode 100644\nindex 0000000..98430b8\n--- /dev/null\n+++ b/server/handlers/schedule-pages.ts\n@@ -0,0 +1,32 @@\n+import { type BuildAction } from 'remix/fetch-router'\n+import { Layout } from '#server/layout.ts'\n+import { render } from '#server/render.ts'\n+import { type routes } from '#server/routes.ts'\n+\n+export const home = {\n+\tmiddleware: [],\n+\tasync action() {\n+\t\treturn render(Layout({ title: 'Epic Scheduler' }))\n+\t},\n+} satisfies BuildAction\n+\n+export const scheduleRespondPage = {\n+\tmiddleware: [],\n+\tasync action() {\n+\t\treturn render(Layout({ title: 'Respond | Epic Scheduler' }))\n+\t},\n+} satisfies BuildAction<\n+\ttypeof routes.scheduleRespondPage.method,\n+\ttypeof routes.scheduleRespondPage.pattern\n+>\n+\n+export const scheduleHostPage = {\n+\tmiddleware: [],\n+\tasync action() {\n+\t\treturn render(Layout({ title: 'Host dashboard | Epic Scheduler' }))\n+\t},\n+} satisfies BuildAction<\n+\ttypeof routes.scheduleHostPage.method,\n+\ttypeof routes.scheduleHostPage.pattern\n+>\n+\ndiff --git a/server/handlers/schedules-api.ts b/server/handlers/schedules-api.ts\nnew file mode 100644\nindex 0000000..d6d9e41\n--- /dev/null\n+++ b/server/handlers/schedules-api.ts\n@@ -0,0 +1,179 @@\n+import { type BuildAction } from 'remix/fetch-router'\n+import {\n+\tcreateScheduleWithUrls,\n+\tparseSlotList,\n+\treadScheduleForAttendee,\n+\treadScheduleForHost,\n+\tupdateScheduleForHost,\n+\tvalidateSchedulePayload,\n+\tsaveAttendeeAvailability,\n+} from '#server/schedule-service.ts'\n+import { type routes } from '#server/routes.ts'\n+import { type AppEnv } from '#types/env-schema.ts'\n+\n+export function createCreateScheduleHandler(appEnv: AppEnv) {\n+\treturn {\n+\t\tmiddleware: [],\n+\t\tasync action({ request, url }) {\n+\t\t\tlet body: unknown\n+\t\t\ttry {\n+\t\t\t\tbody = await request.json()\n+\t\t\t} catch {\n+\t\t\t\treturn Response.json({ error: 'Invalid JSON body.' }, { status: 400 })\n+\t\t\t}\n+\n+\t\t\tconst payload = validateSchedulePayload(body)\n+\t\t\tif (!payload) {\n+\t\t\t\treturn Response.json({ error: 'Invalid schedule payload.' }, { status: 400 })\n+\t\t\t}\n+\n+\t\t\ttry {\n+\t\t\t\tconst created = await createScheduleWithUrls(appEnv, payload)\n+\t\t\t\treturn Response.json(\n+\t\t\t\t\tcreated,\n+\t\t\t\t\t{\n+\t\t\t\t\t\tstatus: 201,\n+\t\t\t\t\t\theaders: {\n+\t\t\t\t\t\t\tLocation: new URL(created.hostUrl, url.origin).toString(),\n+\t\t\t\t\t\t},\n+\t\t\t\t\t},\n+\t\t\t\t)\n+\t\t\t} catch (error) {\n+\t\t\t\tconst message =\n+\t\t\t\t\terror instanceof Error ? error.message : 'Unable to create schedule.'\n+\t\t\t\treturn Response.json({ error: message }, { status: 400 })\n+\t\t\t}\n+\t\t},\n+\t} satisfies BuildAction<\n+\t\ttypeof routes.apiCreateSchedule.method,\n+\t\ttypeof routes.apiCreateSchedule.pattern\n+\t>\n+}\n+\n+export function createReadScheduleHandler(appEnv: AppEnv) {\n+\treturn {\n+\t\tmiddleware: [],\n+\t\tasync action({ params, url }) {\n+\t\t\tconst result = await readScheduleForAttendee(\n+\t\t\t\tappEnv,\n+\t\t\t\tparams.scheduleKey,\n+\t\t\t\turl.searchParams.get('attendeeName')?.trim() ?? '',\n+\t\t\t)\n+\t\t\tif (!result) {\n+\t\t\t\treturn Response.json({ error: 'Schedule not found.' }, { status: 404 })\n+\t\t\t}\n+\t\t\treturn Response.json(result)\n+\t\t},\n+\t} satisfies BuildAction<\n+\t\ttypeof routes.apiSchedule.method,\n+\t\ttypeof routes.apiSchedule.pattern\n+\t>\n+}\n+\n+export function createSubmitResponseHandler(appEnv: AppEnv) {\n+\treturn {\n+\t\tmiddleware: [],\n+\t\tasync action({ request, params }) {\n+\t\t\tconst schedule = await readScheduleForAttendee(appEnv, params.scheduleKey)\n+\t\t\tif (!schedule) {\n+\t\t\t\treturn Response.json({ error: 'Schedule not found.' }, { status: 404 })\n+\t\t\t}\n+\n+\t\t\tlet body: unknown\n+\t\t\ttry {\n+\t\t\t\tbody = await request.json()\n+\t\t\t} catch {\n+\t\t\t\treturn Response.json({ error: 'Invalid JSON body.' }, { status: 400 })\n+\t\t\t}\n+\n+\t\t\tif (!body || typeof body !== 'object') {\n+\t\t\t\treturn Response.json({ error: 'Invalid payload.' }, { status: 400 })\n+\t\t\t}\n+\n+\t\t\tconst raw = body as Record\n+\t\t\tconst attendeeName =\n+\t\t\t\ttypeof raw.attendeeName === 'string' ? raw.attendeeName : ''\n+\t\t\tconst selectedSlotUtc = parseSlotList(raw.selectedSlotsUtc)\n+\n+\t\t\ttry {\n+\t\t\t\tconst result = await saveAttendeeAvailability(\n+\t\t\t\t\tappEnv,\n+\t\t\t\t\tparams.scheduleKey,\n+\t\t\t\t\tattendeeName,\n+\t\t\t\t\tselectedSlotUtc,\n+\t\t\t\t)\n+\t\t\t\tif (!result) {\n+\t\t\t\t\treturn Response.json({ error: 'Schedule not found.' }, { status: 404 })\n+\t\t\t\t}\n+\t\t\t\treturn Response.json({ ok: true, attendeeName: result.attendeeName })\n+\t\t\t} catch (error) {\n+\t\t\t\tconst message =\n+\t\t\t\t\terror instanceof Error ? error.message : 'Unable to save response.'\n+\t\t\t\treturn Response.json({ error: message }, { status: 400 })\n+\t\t\t}\n+\t\t},\n+\t} satisfies BuildAction<\n+\t\ttypeof routes.apiScheduleResponses.method,\n+\t\ttypeof routes.apiScheduleResponses.pattern\n+\t>\n+}\n+\n+export function createReadHostScheduleHandler(appEnv: AppEnv) {\n+\treturn {\n+\t\tmiddleware: [],\n+\t\tasync action({ params }) {\n+\t\t\tconst result = await readScheduleForHost(\n+\t\t\t\tappEnv,\n+\t\t\t\tparams.scheduleKey,\n+\t\t\t\tparams.hostKey,\n+\t\t\t)\n+\t\t\tif (!result) {\n+\t\t\t\treturn Response.json({ error: 'Host schedule not found.' }, { status: 404 })\n+\t\t\t}\n+\t\t\treturn Response.json(result)\n+\t\t},\n+\t} satisfies BuildAction<\n+\t\ttypeof routes.apiHostSchedule.method,\n+\t\ttypeof routes.apiHostSchedule.pattern\n+\t>\n+}\n+\n+export function createUpdateHostScheduleHandler(appEnv: AppEnv) {\n+\treturn {\n+\t\tmiddleware: [],\n+\t\tasync action({ request, params }) {\n+\t\t\tlet body: unknown\n+\t\t\ttry {\n+\t\t\t\tbody = await request.json()\n+\t\t\t} catch {\n+\t\t\t\treturn Response.json({ error: 'Invalid JSON body.' }, { status: 400 })\n+\t\t\t}\n+\n+\t\t\tconst payload = validateSchedulePayload(body)\n+\t\t\tif (!payload) {\n+\t\t\t\treturn Response.json({ error: 'Invalid schedule payload.' }, { status: 400 })\n+\t\t\t}\n+\n+\t\t\ttry {\n+\t\t\t\tconst result = await updateScheduleForHost(\n+\t\t\t\t\tappEnv,\n+\t\t\t\t\tparams.scheduleKey,\n+\t\t\t\t\tparams.hostKey,\n+\t\t\t\t\tpayload,\n+\t\t\t\t)\n+\t\t\t\tif (!result) {\n+\t\t\t\t\treturn Response.json({ error: 'Host schedule not found.' }, { status: 404 })\n+\t\t\t\t}\n+\t\t\t\treturn Response.json(result)\n+\t\t\t} catch (error) {\n+\t\t\t\tconst message =\n+\t\t\t\t\terror instanceof Error ? error.message : 'Unable to update schedule.'\n+\t\t\t\treturn Response.json({ error: message }, { status: 400 })\n+\t\t\t}\n+\t\t},\n+\t} satisfies BuildAction<\n+\t\ttypeof routes.apiHostScheduleUpdate.method,\n+\t\ttypeof routes.apiHostScheduleUpdate.pattern\n+\t>\n+}\n+\ndiff --git a/server/handlers/session.ts b/server/handlers/session.ts\ndeleted file mode 100644\nindex c41fac5..0000000\n--- a/server/handlers/session.ts\n+++ /dev/null\n@@ -1,29 +0,0 @@\n-import { type BuildAction } from 'remix/fetch-router'\n-import { readAuthSession } from '#server/auth-session.ts'\n-import { type routes } from '#server/routes.ts'\n-\n-function jsonResponse(data: unknown, init?: ResponseInit) {\n-\treturn new Response(JSON.stringify(data), {\n-\t\t...init,\n-\t\theaders: {\n-\t\t\t'Content-Type': 'application/json',\n-\t\t\t'Cache-Control': 'no-store',\n-\t\t\t...init?.headers,\n-\t\t},\n-\t})\n-}\n-\n-export const session = {\n-\tmiddleware: [],\n-\tasync action({ request }) {\n-\t\tconst session = await readAuthSession(request)\n-\t\tif (!session) {\n-\t\t\treturn jsonResponse({ ok: false })\n-\t\t}\n-\n-\t\treturn jsonResponse({ ok: true, session: { email: session.email } })\n-\t},\n-} satisfies BuildAction<\n-\ttypeof routes.session.method,\n-\ttypeof routes.session.pattern\n->\ndiff --git a/server/handlers/signup.ts b/server/handlers/signup.ts\ndeleted file mode 100644\nindex 4c193ec..0000000\n--- a/server/handlers/signup.ts\n+++ /dev/null\n@@ -1,8 +0,0 @@\n-import { type BuildAction } from 'remix/fetch-router'\n-import { type routes } from '#server/routes.ts'\n-import { createAuthPageHandler } from './auth-page.ts'\n-\n-export const signup = createAuthPageHandler() satisfies BuildAction<\n-\ttypeof routes.signup.method,\n-\ttypeof routes.signup.pattern\n->\ndiff --git a/server/hex.ts b/server/hex.ts\ndeleted file mode 100644\nindex 4f97b9c..0000000\n--- a/server/hex.ts\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-export function toHex(bytes: Uint8Array) {\n-\treturn Array.from(bytes)\n-\t\t.map((value) => value.toString(16).padStart(2, '0'))\n-\t\t.join('')\n-}\ndiff --git a/server/layout.ts b/server/layout.ts\nindex 4d1be7d..9cb99a3 100644\n--- a/server/layout.ts\n+++ b/server/layout.ts\n@@ -44,7 +44,7 @@ export function Layout({\n \t\t\t\thref=\"/apple-touch-icon.png\"\n \t\t\t/>\n \t\t\t\n-\t\t\t\n+\t\t\t\n \t\t\t${title}\n \t\t\t\n \t\t\ndiff --git a/server/password-hash.ts b/server/password-hash.ts\ndeleted file mode 100644\nindex ea5611b..0000000\n--- a/server/password-hash.ts\n+++ /dev/null\n@@ -1 +0,0 @@\n-export { createPasswordHash, verifyPassword } from '#shared/password-hash.ts'\ndiff --git a/server/router.ts b/server/router.ts\nindex a7027f8..eb1cb9f 100644\n--- a/server/router.ts\n+++ b/server/router.ts\n@@ -1,18 +1,14 @@\n import { createRouter } from 'remix/fetch-router'\n import { type AppEnv } from '#types/env-schema.ts'\n-import { account } from './handlers/account.ts'\n-import { createAuthHandler } from './handlers/auth.ts'\n-import { chat } from './handlers/chat.ts'\n import { createHealthHandler } from './handlers/health.ts'\n-import { home } from './handlers/home.ts'\n-import { login } from './handlers/login.ts'\n-import { logout } from './handlers/logout.ts'\n+import { home, scheduleHostPage, scheduleRespondPage } from './handlers/schedule-pages.ts'\n import {\n-\tcreatePasswordResetConfirmHandler,\n-\tcreatePasswordResetRequestHandler,\n-} from './handlers/password-reset.ts'\n-import { session } from './handlers/session.ts'\n-import { signup } from './handlers/signup.ts'\n+\tcreateCreateScheduleHandler,\n+\tcreateReadHostScheduleHandler,\n+\tcreateReadScheduleHandler,\n+\tcreateSubmitResponseHandler,\n+\tcreateUpdateHostScheduleHandler,\n+} from './handlers/schedules-api.ts'\n import { Layout } from './layout.ts'\n import { render } from './render.ts'\n import { routes } from './routes.ts'\n@@ -26,22 +22,14 @@ export function createAppRouter(appEnv: AppEnv) {\n \t})\n \n \trouter.map(routes.home, home)\n-\trouter.map(routes.chat, chat)\n+\trouter.map(routes.scheduleRespondPage, scheduleRespondPage)\n+\trouter.map(routes.scheduleHostPage, scheduleHostPage)\n \trouter.map(routes.health, createHealthHandler(appEnv))\n-\trouter.map(routes.login, login)\n-\trouter.map(routes.signup, signup)\n-\trouter.map(routes.account, account)\n-\trouter.map(routes.auth, createAuthHandler(appEnv))\n-\trouter.map(routes.session, session)\n-\trouter.map(routes.logout, logout)\n-\trouter.map(\n-\t\troutes.passwordResetRequest,\n-\t\tcreatePasswordResetRequestHandler(appEnv),\n-\t)\n-\trouter.map(\n-\t\troutes.passwordResetConfirm,\n-\t\tcreatePasswordResetConfirmHandler(appEnv),\n-\t)\n+\trouter.map(routes.apiCreateSchedule, createCreateScheduleHandler(appEnv))\n+\trouter.map(routes.apiSchedule, createReadScheduleHandler(appEnv))\n+\trouter.map(routes.apiScheduleResponses, createSubmitResponseHandler(appEnv))\n+\trouter.map(routes.apiHostSchedule, createReadHostScheduleHandler(appEnv))\n+\trouter.map(routes.apiHostScheduleUpdate, createUpdateHostScheduleHandler(appEnv))\n \n \treturn router\n }\ndiff --git a/server/routes.ts b/server/routes.ts\nindex d08f070..84a4b40 100644\n--- a/server/routes.ts\n+++ b/server/routes.ts\n@@ -2,14 +2,12 @@ import { post, route } from 'remix/fetch-router/routes'\n \n export const routes = route({\n \thome: '/',\n-\tchat: '/chat',\n \thealth: '/health',\n-\tlogin: '/login',\n-\tsignup: '/signup',\n-\taccount: '/account',\n-\tauth: post('/auth'),\n-\tsession: '/session',\n-\tlogout: post('/logout'),\n-\tpasswordResetRequest: post('/password-reset'),\n-\tpasswordResetConfirm: post('/password-reset/confirm'),\n+\tscheduleRespondPage: '/s/:scheduleKey',\n+\tscheduleHostPage: '/s/:scheduleKey/:hostKey',\n+\tapiCreateSchedule: post('/api/schedules'),\n+\tapiSchedule: '/api/schedules/:scheduleKey',\n+\tapiScheduleResponses: post('/api/schedules/:scheduleKey/responses'),\n+\tapiHostSchedule: '/api/schedules/:scheduleKey/:hostKey',\n+\tapiHostScheduleUpdate: post('/api/schedules/:scheduleKey/:hostKey'),\n })\ndiff --git a/server/schedule-service.ts b/server/schedule-service.ts\nnew file mode 100644\nindex 0000000..66ce641\n--- /dev/null\n+++ b/server/schedule-service.ts\n@@ -0,0 +1,285 @@\n+import {\n+\tnormalizeIanaTimeZone,\n+\tslotIncrementOptions,\n+\ttype SlotIncrement,\n+} from '#shared/scheduling-time.ts'\n+import {\n+\tcreateSchedule,\n+\tlistAttendeeAvailability,\n+\tlistAttendeeSummary,\n+\tlistResponseCountsBySlot,\n+\tlistScheduleSlotsUtc,\n+\treadScheduleByHostAccess,\n+\treadScheduleByKey,\n+\tupdateScheduleByHostAccess,\n+\tupsertAttendeeAvailability,\n+} from '#server/scheduling-repository.ts'\n+import { type AppEnv } from '#types/env-schema.ts'\n+\n+export type ScheduleView = {\n+\tscheduleKey: string\n+\ttitle: string\n+\tstartDate: string\n+\tendDate: string\n+\tslotMinutes: SlotIncrement\n+\ttimezone: string\n+\tslotsUtc: Array\n+\tresponseCounts: Record\n+\ttotalResponders: number\n+\tbestSlotUtc: string | null\n+}\n+\n+export type ReadScheduleResult = {\n+\tok: true\n+\tmode: 'respond'\n+\tschedule: ScheduleView\n+\tattendeeSelection: Array\n+}\n+\n+export type ReadHostScheduleResult = {\n+\tok: true\n+\tmode: 'host'\n+\tschedule: ScheduleView\n+\thostKey: string\n+\tattendeeSummary: Array<{ attendeeName: string; slots: Array }>\n+}\n+\n+export type CreateScheduleResult = {\n+\tok: true\n+\tscheduleKey: string\n+\thostKey: string\n+\tattendeeUrl: string\n+\thostUrl: string\n+}\n+\n+export type ValidSchedulePayload = {\n+\ttitle: string\n+\tstartDate: string\n+\tendDate: string\n+\tslotMinutes: SlotIncrement\n+\ttimezone: string\n+\tselectedSlotUtc: Array\n+}\n+\n+function isIsoDate(value: string) {\n+\treturn /^\\d{4}-\\d{2}-\\d{2}$/.test(value)\n+}\n+\n+export function parseSlotIncrement(value: unknown): SlotIncrement | null {\n+\tconst numeric =\n+\t\ttypeof value === 'number'\n+\t\t\t? value\n+\t\t\t: typeof value === 'string'\n+\t\t\t\t? Number(value)\n+\t\t\t\t: NaN\n+\tif (!Number.isInteger(numeric)) return null\n+\treturn slotIncrementOptions.includes(numeric as SlotIncrement)\n+\t\t? (numeric as SlotIncrement)\n+\t\t: null\n+}\n+\n+export function parseSlotList(value: unknown) {\n+\tif (!Array.isArray(value)) return []\n+\treturn value.filter((item): item is string => typeof item === 'string')\n+}\n+\n+export function validateSchedulePayload(body: unknown): ValidSchedulePayload | null {\n+\tif (!body || typeof body !== 'object') return null\n+\n+\tconst raw = body as Record\n+\tconst title =\n+\t\ttypeof raw.title === 'string' && raw.title.trim()\n+\t\t\t? raw.title.trim()\n+\t\t\t: 'New plan'\n+\tconst startDate =\n+\t\ttypeof raw.startDate === 'string' ? raw.startDate.trim() : ''\n+\tconst endDate = typeof raw.endDate === 'string' ? raw.endDate.trim() : ''\n+\tconst slotMinutes = parseSlotIncrement(raw.slotMinutes)\n+\tconst timezone = normalizeIanaTimeZone(\n+\t\ttypeof raw.timezone === 'string' ? raw.timezone : '',\n+\t)\n+\tconst selectedSlotUtc = parseSlotList(raw.selectedSlotsUtc)\n+\n+\tif (!isIsoDate(startDate) || !isIsoDate(endDate) || !slotMinutes) {\n+\t\treturn null\n+\t}\n+\n+\treturn {\n+\t\ttitle,\n+\t\tstartDate,\n+\t\tendDate,\n+\t\tslotMinutes,\n+\t\ttimezone,\n+\t\tselectedSlotUtc,\n+\t}\n+}\n+\n+function mapResponseCountsToRecord(counts: Map) {\n+\tconst responseCounts: Record = {}\n+\tfor (const [slot, count] of counts.entries()) {\n+\t\tresponseCounts[slot] = count\n+\t}\n+\treturn responseCounts\n+}\n+\n+function computeBestSlot(counts: Map) {\n+\tlet bestSlotUtc: string | null = null\n+\tlet bestCount = -1\n+\tfor (const [slotUtc, count] of counts.entries()) {\n+\t\tif (count > bestCount) {\n+\t\t\tbestSlotUtc = slotUtc\n+\t\t\tbestCount = count\n+\t\t\tcontinue\n+\t\t}\n+\t\tif (\n+\t\t\tcount === bestCount &&\n+\t\t\tbestSlotUtc &&\n+\t\t\tslotUtc.localeCompare(bestSlotUtc) < 0\n+\t\t) {\n+\t\t\tbestSlotUtc = slotUtc\n+\t\t}\n+\t}\n+\treturn bestSlotUtc\n+}\n+\n+export async function buildScheduleView(\n+\tdb: D1Database,\n+\tscheduleId: number,\n+\tschedule: {\n+\t\tscheduleKey: string\n+\t\ttitle: string\n+\t\tstartDate: string\n+\t\tendDate: string\n+\t\tslotMinutes: SlotIncrement\n+\t\ttimezone: string\n+\t},\n+) {\n+\tconst slotsUtc = await listScheduleSlotsUtc(db, scheduleId)\n+\tconst responseCountsMap = await listResponseCountsBySlot(db, scheduleId)\n+\tconst responseCounts = mapResponseCountsToRecord(responseCountsMap)\n+\tconst bestSlotUtc = computeBestSlot(responseCountsMap)\n+\tconst totalRespondersRows = await db\n+\t\t.prepare(\n+\t\t\t'select count(distinct attendee_name_key) as total from attendee_availability where schedule_id = ?',\n+\t\t)\n+\t\t.bind(scheduleId)\n+\t\t.first<{ total: number }>()\n+\n+\treturn {\n+\t\tscheduleKey: schedule.scheduleKey,\n+\t\ttitle: schedule.title,\n+\t\tstartDate: schedule.startDate,\n+\t\tendDate: schedule.endDate,\n+\t\tslotMinutes: schedule.slotMinutes,\n+\t\ttimezone: schedule.timezone,\n+\t\tslotsUtc,\n+\t\tresponseCounts,\n+\t\ttotalResponders: Number(totalRespondersRows?.total ?? 0),\n+\t\tbestSlotUtc,\n+\t} satisfies ScheduleView\n+}\n+\n+export async function createScheduleWithUrls(\n+\tappEnv: AppEnv,\n+\tpayload: ValidSchedulePayload,\n+) {\n+\tconst schedule = await createSchedule(appEnv.APP_DB, payload)\n+\tconst attendeeUrl = `/s/${schedule.scheduleKey}`\n+\tconst hostUrl = `/s/${schedule.scheduleKey}/${schedule.hostKey}`\n+\treturn {\n+\t\tok: true,\n+\t\tscheduleKey: schedule.scheduleKey,\n+\t\thostKey: schedule.hostKey,\n+\t\tattendeeUrl,\n+\t\thostUrl,\n+\t} satisfies CreateScheduleResult\n+}\n+\n+export async function readScheduleForAttendee(\n+\tappEnv: AppEnv,\n+\tscheduleKey: string,\n+\tattendeeName = '',\n+) {\n+\tconst schedule = await readScheduleByKey(appEnv.APP_DB, scheduleKey)\n+\tif (!schedule) return null\n+\n+\tconst view = await buildScheduleView(appEnv.APP_DB, schedule.id, schedule)\n+\tconst attendeeSelection = attendeeName.trim()\n+\t\t? await listAttendeeAvailability(appEnv.APP_DB, schedule.id, attendeeName)\n+\t\t: []\n+\n+\treturn {\n+\t\tok: true,\n+\t\tmode: 'respond',\n+\t\tschedule: view,\n+\t\tattendeeSelection,\n+\t} satisfies ReadScheduleResult\n+}\n+\n+export async function readScheduleForHost(\n+\tappEnv: AppEnv,\n+\tscheduleKey: string,\n+\thostKey: string,\n+) {\n+\tconst schedule = await readScheduleByHostAccess(\n+\t\tappEnv.APP_DB,\n+\t\tscheduleKey,\n+\t\thostKey,\n+\t)\n+\tif (!schedule) return null\n+\n+\tconst view = await buildScheduleView(appEnv.APP_DB, schedule.id, schedule)\n+\tconst attendeeSummary = await listAttendeeSummary(appEnv.APP_DB, schedule.id)\n+\treturn {\n+\t\tok: true,\n+\t\tmode: 'host',\n+\t\tschedule: view,\n+\t\thostKey: schedule.hostKey,\n+\t\tattendeeSummary,\n+\t} satisfies ReadHostScheduleResult\n+}\n+\n+export async function updateScheduleForHost(\n+\tappEnv: AppEnv,\n+\tscheduleKey: string,\n+\thostKey: string,\n+\tpayload: ValidSchedulePayload,\n+) {\n+\tconst schedule = await updateScheduleByHostAccess(\n+\t\tappEnv.APP_DB,\n+\t\tscheduleKey,\n+\t\thostKey,\n+\t\tpayload,\n+\t)\n+\tif (!schedule) return null\n+\n+\tconst view = await buildScheduleView(appEnv.APP_DB, schedule.id, schedule)\n+\tconst attendeeSummary = await listAttendeeSummary(appEnv.APP_DB, schedule.id)\n+\treturn {\n+\t\tok: true,\n+\t\tmode: 'host',\n+\t\tschedule: view,\n+\t\thostKey: schedule.hostKey,\n+\t\tattendeeSummary,\n+\t} satisfies ReadHostScheduleResult\n+}\n+\n+export async function saveAttendeeAvailability(\n+\tappEnv: AppEnv,\n+\tscheduleKey: string,\n+\tattendeeName: string,\n+\tselectedSlotUtc: ReadonlyArray,\n+) {\n+\tconst schedule = await readScheduleByKey(appEnv.APP_DB, scheduleKey)\n+\tif (!schedule) return null\n+\n+\tconst result = await upsertAttendeeAvailability(appEnv.APP_DB, schedule.id, {\n+\t\tattendeeName,\n+\t\tselectedSlotUtc,\n+\t})\n+\treturn {\n+\t\tok: true,\n+\t\tattendeeName: result.attendeeName,\n+\t\tselectedSlotUtc: result.selectedSlotUtc,\n+\t}\n+}\ndiff --git a/server/scheduling-repository.ts b/server/scheduling-repository.ts\nnew file mode 100644\nindex 0000000..808f869\n--- /dev/null\n+++ b/server/scheduling-repository.ts\n@@ -0,0 +1,394 @@\n+import {\n+\tslotIncrementOptions,\n+\ttype SlotIncrement,\n+} from '#shared/scheduling-time.ts'\n+\n+type ScheduleRecord = {\n+\tid: number\n+\tschedule_key: string\n+\thost_key: string\n+\ttitle: string\n+\tstart_date: string\n+\tend_date: string\n+\tslot_minutes: number\n+\ttimezone: string\n+\tcreated_at: number\n+}\n+\n+type CreateScheduleInput = {\n+\ttitle: string\n+\tstartDate: string\n+\tendDate: string\n+\tslotMinutes: SlotIncrement\n+\ttimezone: string\n+\tselectedSlotUtc: ReadonlyArray\n+}\n+\n+type UpdateScheduleInput = {\n+\ttitle: string\n+\tstartDate: string\n+\tendDate: string\n+\tslotMinutes: SlotIncrement\n+\ttimezone: string\n+\tselectedSlotUtc: ReadonlyArray\n+}\n+\n+type AttendeeAvailabilityInput = {\n+\tattendeeName: string\n+\tselectedSlotUtc: ReadonlyArray\n+}\n+\n+const isoUtcPattern = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.000Z$/\n+\n+function uniqueSortedUtcSlots(slots: ReadonlyArray) {\n+\tconst filtered = slots\n+\t\t.map((slot) => slot.trim())\n+\t\t.filter((slot) => isoUtcPattern.test(slot))\n+\treturn [...new Set(filtered)].sort((a, b) => a.localeCompare(b))\n+}\n+\n+function randomKey(length: number) {\n+\tconst alphabet = 'abcdefghjkmnpqrstuvwxyz23456789'\n+\tconst bytes = crypto.getRandomValues(new Uint8Array(length))\n+\tlet key = ''\n+\tfor (const byte of bytes) {\n+\t\tkey += alphabet[byte % alphabet.length]\n+\t}\n+\treturn key\n+}\n+\n+function toSchedule(record: ScheduleRecord) {\n+\treturn {\n+\t\tid: record.id,\n+\t\tscheduleKey: record.schedule_key,\n+\t\thostKey: record.host_key,\n+\t\ttitle: record.title,\n+\t\tstartDate: record.start_date,\n+\t\tendDate: record.end_date,\n+\t\tslotMinutes: Number(record.slot_minutes) as SlotIncrement,\n+\t\ttimezone: record.timezone,\n+\t\tcreatedAt: Number(record.created_at),\n+\t}\n+}\n+\n+async function getScheduleRecordByScheduleKey(db: D1Database, scheduleKey: string) {\n+\tconst record = await db\n+\t\t.prepare('select * from schedules where schedule_key = ? limit 1')\n+\t\t.bind(scheduleKey)\n+\t\t.first()\n+\treturn record ?? null\n+}\n+\n+async function getScheduleRecordByHostAccess(\n+\tdb: D1Database,\n+\tscheduleKey: string,\n+\thostKey: string,\n+) {\n+\tconst record = await db\n+\t\t.prepare(\n+\t\t\t'select * from schedules where schedule_key = ? and host_key = ? limit 1',\n+\t\t)\n+\t\t.bind(scheduleKey, hostKey)\n+\t\t.first()\n+\treturn record ?? null\n+}\n+\n+async function deleteInvalidAttendeeSlots(\n+\tdb: D1Database,\n+\tscheduleId: number,\n+\tallowedSlots: ReadonlyArray,\n+) {\n+\tif (allowedSlots.length === 0) {\n+\t\tawait db\n+\t\t\t.prepare('delete from attendee_availability where schedule_id = ?')\n+\t\t\t.bind(scheduleId)\n+\t\t\t.run()\n+\t\treturn\n+\t}\n+\n+\tconst existingRows = await db\n+\t\t.prepare(\n+\t\t\t'select distinct slot_utc from attendee_availability where schedule_id = ?',\n+\t\t)\n+\t\t.bind(scheduleId)\n+\t\t.all<{ slot_utc: string }>()\n+\tconst existingSlots = (existingRows.results ?? []).map((row) => row.slot_utc)\n+\tconst allowed = new Set(allowedSlots)\n+\tconst invalidSlots = existingSlots.filter((slot) => !allowed.has(slot))\n+\n+\tfor (let start = 0; start < invalidSlots.length; start += 200) {\n+\t\tconst chunk = invalidSlots.slice(start, start + 200)\n+\t\tif (chunk.length === 0) continue\n+\t\tconst placeholders = chunk.map(() => '?').join(', ')\n+\t\tawait db\n+\t\t\t.prepare(\n+\t\t\t\t`delete from attendee_availability where schedule_id = ? and slot_utc in (${placeholders})`,\n+\t\t\t)\n+\t\t\t.bind(scheduleId, ...chunk)\n+\t\t\t.run()\n+\t}\n+}\n+\n+export async function createSchedule(db: D1Database, input: CreateScheduleInput) {\n+\tconst slotMinutes = Number(input.slotMinutes) as SlotIncrement\n+\tif (!slotIncrementOptions.includes(slotMinutes)) {\n+\t\tthrow new Error('Unsupported slot increment.')\n+\t}\n+\n+\tconst selectedSlotUtc = uniqueSortedUtcSlots(input.selectedSlotUtc)\n+\tif (selectedSlotUtc.length === 0) {\n+\t\tthrow new Error('Host availability must include at least one time slot.')\n+\t}\n+\n+\tconst trimmedTitle = input.title.trim().slice(0, 120)\n+\tconst title = trimmedTitle || 'New plan'\n+\tconst timezone = input.timezone.trim()\n+\tif (!timezone) {\n+\t\tthrow new Error('Timezone is required.')\n+\t}\n+\n+\tconst createdAt = Date.now()\n+\tlet scheduleRecord: ScheduleRecord | null = null\n+\tfor (let attempt = 0; attempt < 5; attempt += 1) {\n+\t\tconst scheduleKey = randomKey(8)\n+\t\tconst hostKey = randomKey(24)\n+\t\ttry {\n+\t\t\tawait db\n+\t\t\t\t.prepare(\n+\t\t\t\t\t`insert into schedules\n+\t\t\t\t\t\t(schedule_key, host_key, title, start_date, end_date, slot_minutes, timezone, created_at)\n+\t\t\t\t\t\tvalues (?, ?, ?, ?, ?, ?, ?, ?)`,\n+\t\t\t\t)\n+\t\t\t\t.bind(\n+\t\t\t\t\tscheduleKey,\n+\t\t\t\t\thostKey,\n+\t\t\t\t\ttitle,\n+\t\t\t\t\tinput.startDate,\n+\t\t\t\t\tinput.endDate,\n+\t\t\t\t\tslotMinutes,\n+\t\t\t\t\ttimezone,\n+\t\t\t\t\tcreatedAt,\n+\t\t\t\t)\n+\t\t\t\t.run()\n+\t\t} catch (error) {\n+\t\t\tif (\n+\t\t\t\terror instanceof Error &&\n+\t\t\t\t/unique constraint failed: schedules\\.(schedule_key|host_key)/i.test(\n+\t\t\t\t\terror.message,\n+\t\t\t\t)\n+\t\t\t) {\n+\t\t\t\tcontinue\n+\t\t\t}\n+\t\t\tthrow error\n+\t\t}\n+\n+\t\tscheduleRecord = await getScheduleRecordByScheduleKey(db, scheduleKey)\n+\t\tif (scheduleRecord) {\n+\t\t\tbreak\n+\t\t}\n+\t}\n+\n+\tif (!scheduleRecord) {\n+\t\tthrow new Error('Unable to create schedule keys.')\n+\t}\n+\n+\tawait replaceHostAvailability(db, scheduleRecord.id, selectedSlotUtc)\n+\treturn toSchedule(scheduleRecord)\n+}\n+\n+export async function readScheduleByKey(db: D1Database, scheduleKey: string) {\n+\tconst record = await getScheduleRecordByScheduleKey(db, scheduleKey)\n+\treturn record ? toSchedule(record) : null\n+}\n+\n+export async function readScheduleByHostAccess(\n+\tdb: D1Database,\n+\tscheduleKey: string,\n+\thostKey: string,\n+) {\n+\tconst record = await getScheduleRecordByHostAccess(db, scheduleKey, hostKey)\n+\treturn record ? toSchedule(record) : null\n+}\n+\n+export async function replaceHostAvailability(\n+\tdb: D1Database,\n+\tscheduleId: number,\n+\tnextSlotUtc: ReadonlyArray,\n+) {\n+\tconst selectedSlotUtc = uniqueSortedUtcSlots(nextSlotUtc)\n+\tif (selectedSlotUtc.length === 0) {\n+\t\tthrow new Error('Host availability must include at least one time slot.')\n+\t}\n+\n+\tawait db\n+\t\t.prepare('delete from schedule_slots where schedule_id = ?')\n+\t\t.bind(scheduleId)\n+\t\t.run()\n+\n+\tconst inserts = selectedSlotUtc.map((slot) =>\n+\t\tdb\n+\t\t\t.prepare(\n+\t\t\t\t'insert into schedule_slots (schedule_id, starts_at_utc) values (?, ?)',\n+\t\t\t)\n+\t\t\t.bind(scheduleId, slot),\n+\t)\n+\tif (inserts.length > 0) {\n+\t\tawait db.batch(inserts)\n+\t}\n+\n+\tawait deleteInvalidAttendeeSlots(db, scheduleId, selectedSlotUtc)\n+}\n+\n+export async function updateScheduleByHostAccess(\n+\tdb: D1Database,\n+\tscheduleKey: string,\n+\thostKey: string,\n+\tinput: UpdateScheduleInput,\n+) {\n+\tconst record = await getScheduleRecordByHostAccess(db, scheduleKey, hostKey)\n+\tif (!record) return null\n+\n+\tconst slotMinutes = Number(input.slotMinutes) as SlotIncrement\n+\tif (!slotIncrementOptions.includes(slotMinutes)) {\n+\t\tthrow new Error('Unsupported slot increment.')\n+\t}\n+\n+\tconst title = input.title.trim().slice(0, 120) || 'New plan'\n+\tconst timezone = input.timezone.trim()\n+\tif (!timezone) {\n+\t\tthrow new Error('Timezone is required.')\n+\t}\n+\n+\tawait db\n+\t\t.prepare(\n+\t\t\t`update schedules\n+\t\t\t\tset title = ?, start_date = ?, end_date = ?, slot_minutes = ?, timezone = ?\n+\t\t\t\twhere id = ?`,\n+\t\t)\n+\t\t.bind(\n+\t\t\ttitle,\n+\t\t\tinput.startDate,\n+\t\t\tinput.endDate,\n+\t\t\tslotMinutes,\n+\t\t\ttimezone,\n+\t\t\trecord.id,\n+\t\t)\n+\t\t.run()\n+\n+\tawait replaceHostAvailability(db, record.id, input.selectedSlotUtc)\n+\treturn readScheduleByHostAccess(db, scheduleKey, hostKey)\n+}\n+\n+export async function listScheduleSlotsUtc(db: D1Database, scheduleId: number) {\n+\tconst rows = await db\n+\t\t.prepare(\n+\t\t\t'select starts_at_utc from schedule_slots where schedule_id = ? order by starts_at_utc asc',\n+\t\t)\n+\t\t.bind(scheduleId)\n+\t\t.all<{ starts_at_utc: string }>()\n+\treturn (rows.results ?? []).map((row) => row.starts_at_utc)\n+}\n+\n+export async function listResponseCountsBySlot(db: D1Database, scheduleId: number) {\n+\tconst rows = await db\n+\t\t.prepare(\n+\t\t\t`select slot_utc, count(*) as response_count\n+\t\t\t\tfrom attendee_availability\n+\t\t\t\twhere schedule_id = ?\n+\t\t\t\tgroup by slot_utc`,\n+\t\t)\n+\t\t.bind(scheduleId)\n+\t\t.all<{ slot_utc: string; response_count: number }>()\n+\n+\tconst counts = new Map()\n+\tfor (const row of rows.results ?? []) {\n+\t\tcounts.set(row.slot_utc, Number(row.response_count))\n+\t}\n+\treturn counts\n+}\n+\n+export async function listAttendeeAvailability(\n+\tdb: D1Database,\n+\tscheduleId: number,\n+\tattendeeName: string,\n+) {\n+\tconst attendeeNameKey = attendeeName.trim().toLowerCase()\n+\tif (!attendeeNameKey) return []\n+\tconst rows = await db\n+\t\t.prepare(\n+\t\t\t`select slot_utc from attendee_availability\n+\t\t\t\twhere schedule_id = ? and attendee_name_key = ?\n+\t\t\t\torder by slot_utc asc`,\n+\t\t)\n+\t\t.bind(scheduleId, attendeeNameKey)\n+\t\t.all<{ slot_utc: string }>()\n+\treturn (rows.results ?? []).map((row) => row.slot_utc)\n+}\n+\n+export async function upsertAttendeeAvailability(\n+\tdb: D1Database,\n+\tscheduleId: number,\n+\tinput: AttendeeAvailabilityInput,\n+) {\n+\tconst attendeeName = input.attendeeName.trim().slice(0, 80)\n+\tif (!attendeeName) {\n+\t\tthrow new Error('Attendee name is required.')\n+\t}\n+\n+\tconst selectedSlotUtc = uniqueSortedUtcSlots(input.selectedSlotUtc)\n+\tconst allowedSlots = new Set(await listScheduleSlotsUtc(db, scheduleId))\n+\tfor (const slot of selectedSlotUtc) {\n+\t\tif (!allowedSlots.has(slot)) {\n+\t\t\tthrow new Error('One or more selected slots are no longer available.')\n+\t\t}\n+\t}\n+\n+\tconst attendeeNameKey = attendeeName.toLowerCase()\n+\tawait db\n+\t\t.prepare(\n+\t\t\t'delete from attendee_availability where schedule_id = ? and attendee_name_key = ?',\n+\t\t)\n+\t\t.bind(scheduleId, attendeeNameKey)\n+\t\t.run()\n+\n+\tif (selectedSlotUtc.length === 0) {\n+\t\treturn { attendeeName, selectedSlotUtc }\n+\t}\n+\n+\tconst inserts = selectedSlotUtc.map((slot) =>\n+\t\tdb\n+\t\t\t.prepare(\n+\t\t\t\t`insert into attendee_availability\n+\t\t\t\t\t(schedule_id, attendee_name, attendee_name_key, slot_utc, created_at)\n+\t\t\t\t\tvalues (?, ?, ?, ?, ?)`,\n+\t\t\t)\n+\t\t\t.bind(scheduleId, attendeeName, attendeeNameKey, slot, Date.now()),\n+\t)\n+\tawait db.batch(inserts)\n+\treturn { attendeeName, selectedSlotUtc }\n+}\n+\n+export async function listAttendeeSummary(db: D1Database, scheduleId: number) {\n+\tconst rows = await db\n+\t\t.prepare(\n+\t\t\t`select attendee_name, slot_utc\n+\t\t\t\tfrom attendee_availability\n+\t\t\t\twhere schedule_id = ?\n+\t\t\t\torder by attendee_name_key asc, slot_utc asc`,\n+\t\t)\n+\t\t.bind(scheduleId)\n+\t\t.all<{ attendee_name: string; slot_utc: string }>()\n+\n+\tconst availabilityByAttendee = new Map>()\n+\tfor (const row of rows.results ?? []) {\n+\t\tconst slots = availabilityByAttendee.get(row.attendee_name) ?? []\n+\t\tslots.push(row.slot_utc)\n+\t\tavailabilityByAttendee.set(row.attendee_name, slots)\n+\t}\n+\n+\treturn [...availabilityByAttendee.entries()].map(([attendeeName, slots]) => ({\n+\t\tattendeeName,\n+\t\tslots,\n+\t}))\n+}\n+\ndiff --git a/shared/hex.ts b/shared/hex.ts\ndeleted file mode 100644\nindex 4f97b9c..0000000\n--- a/shared/hex.ts\n+++ /dev/null\n@@ -1,5 +0,0 @@\n-export function toHex(bytes: Uint8Array) {\n-\treturn Array.from(bytes)\n-\t\t.map((value) => value.toString(16).padStart(2, '0'))\n-\t\t.join('')\n-}\ndiff --git a/shared/password-hash.test.ts b/shared/password-hash.test.ts\ndeleted file mode 100644\nindex 2a4f787..0000000\n--- a/shared/password-hash.test.ts\n+++ /dev/null\n@@ -1,19 +0,0 @@\n-import { expect, test } from 'vitest'\n-\n-import { createPasswordHash, verifyPassword } from './password-hash.ts'\n-\n-test('verifyPassword accepts valid hashes', async () => {\n-\tconst password = 'kodylovesyou'\n-\tconst hash = await createPasswordHash(password)\n-\n-\tawait expect(verifyPassword(password, hash)).resolves.toBe(true)\n-})\n-\n-test('verifyPassword rejects iteration values with trailing characters', async () => {\n-\tconst password = 'kodylovesyou'\n-\tconst hash = await createPasswordHash(password)\n-\tconst [prefix, iterations, saltHex, hashHex] = hash.split('$')\n-\tconst tamperedHash = `${prefix}$${iterations}abc$${saltHex}$${hashHex}`\n-\n-\tawait expect(verifyPassword(password, tamperedHash)).resolves.toBe(false)\n-})\ndiff --git a/shared/password-hash.ts b/shared/password-hash.ts\ndeleted file mode 100644\nindex 69a7b2e..0000000\n--- a/shared/password-hash.ts\n+++ /dev/null\n@@ -1,129 +0,0 @@\n-import { toHex } from './hex.ts'\n-\n-const passwordHashPrefix = 'pbkdf2_sha256'\n-const passwordSaltBytes = 16\n-const passwordHashBytes = 32\n-const maxPasswordHashIterations = 100_000\n-const passwordHashIterations = maxPasswordHashIterations\n-\n-function fromHex(value: string): Uint8Array | null {\n-\tconst normalized = value.trim().toLowerCase()\n-\tif (!/^[0-9a-f]+$/.test(normalized) || normalized.length % 2 !== 0) {\n-\t\treturn null\n-\t}\n-\tconst bytes = new Uint8Array(normalized.length / 2)\n-\tfor (let index = 0; index < normalized.length; index += 2) {\n-\t\tconst byte = Number.parseInt(normalized.slice(index, index + 2), 16)\n-\t\tif (Number.isNaN(byte)) return null\n-\t\tbytes[index / 2] = byte\n-\t}\n-\treturn bytes\n-}\n-\n-function padToLength(buffer: Uint8Array, length: number) {\n-\tif (buffer.length === length) return buffer\n-\tconst padded = new Uint8Array(length)\n-\tpadded.set(buffer)\n-\treturn padded\n-}\n-\n-function timingSafeEqual(left: Uint8Array, right: Uint8Array) {\n-\tconst maxLength = Math.max(left.length, right.length)\n-\tconst leftPadded = padToLength(left, maxLength)\n-\tconst rightPadded = padToLength(right, maxLength)\n-\tconst subtle = crypto.subtle as SubtleCrypto & {\n-\t\ttimingSafeEqual?: (\n-\t\t\ta: ArrayBuffer | ArrayBufferView,\n-\t\t\tb: ArrayBuffer | ArrayBufferView,\n-\t\t) => boolean\n-\t}\n-\tconst isEqual =\n-\t\ttypeof subtle.timingSafeEqual === 'function'\n-\t\t\t? subtle.timingSafeEqual(leftPadded, rightPadded)\n-\t\t\t: (() => {\n-\t\t\t\t\tlet result = 0\n-\t\t\t\t\tfor (let index = 0; index < maxLength; index += 1) {\n-\t\t\t\t\t\tconst leftValue = leftPadded[index] ?? 0\n-\t\t\t\t\t\tconst rightValue = rightPadded[index] ?? 0\n-\t\t\t\t\t\tresult |= leftValue ^ rightValue\n-\t\t\t\t\t}\n-\t\t\t\t\treturn result === 0\n-\t\t\t\t})()\n-\treturn isEqual && left.length === right.length\n-}\n-\n-async function derivePasswordKey(\n-\tpassword: string,\n-\tsalt: Uint8Array,\n-\titerations: number,\n-\tlength: number,\n-) {\n-\tconst key = await crypto.subtle.importKey(\n-\t\t'raw',\n-\t\tnew TextEncoder().encode(password),\n-\t\t'PBKDF2',\n-\t\tfalse,\n-\t\t['deriveBits'],\n-\t)\n-\tconst derivedBits = await crypto.subtle.deriveBits(\n-\t\t{\n-\t\t\tname: 'PBKDF2',\n-\t\t\tsalt,\n-\t\t\titerations,\n-\t\t\thash: 'SHA-256',\n-\t\t},\n-\t\tkey,\n-\t\tlength * 8,\n-\t)\n-\treturn new Uint8Array(derivedBits)\n-}\n-\n-export async function createPasswordHash(password: string) {\n-\tconst salt = new Uint8Array(new ArrayBuffer(passwordSaltBytes))\n-\tcrypto.getRandomValues(salt)\n-\tconst hash = await derivePasswordKey(\n-\t\tpassword,\n-\t\tsalt,\n-\t\tpasswordHashIterations,\n-\t\tpasswordHashBytes,\n-\t)\n-\treturn `${passwordHashPrefix}$${passwordHashIterations}$${toHex(salt)}$${toHex(\n-\t\thash,\n-\t)}`\n-}\n-\n-export async function verifyPassword(\n-\tpassword: string,\n-\tstoredHash: string,\n-): Promise {\n-\tif (!storedHash) {\n-\t\treturn false\n-\t}\n-\tconst normalizedHash = storedHash.trim()\n-\tif (normalizedHash.startsWith(`${passwordHashPrefix}$`)) {\n-\t\tconst [prefix, iterationsRaw, saltHex, hashHex, ...extra] =\n-\t\t\tnormalizedHash.split('$')\n-\t\tif (prefix !== passwordHashPrefix || extra.length > 0) {\n-\t\t\treturn false\n-\t\t}\n-\t\tif (!iterationsRaw || !/^\\d+$/.test(iterationsRaw)) return false\n-\t\tconst iterations = Number(iterationsRaw)\n-\t\tconst salt = saltHex ? fromHex(saltHex) : null\n-\t\tconst hash = hashHex ? fromHex(hashHex) : null\n-\t\tif (!Number.isSafeInteger(iterations) || iterations < 1 || !salt || !hash) {\n-\t\t\treturn false\n-\t\t}\n-\t\tif (iterations > maxPasswordHashIterations) {\n-\t\t\treturn false\n-\t\t}\n-\t\tconst derived = await derivePasswordKey(\n-\t\t\tpassword,\n-\t\t\tsalt,\n-\t\t\titerations,\n-\t\t\thash.length,\n-\t\t)\n-\t\treturn timingSafeEqual(derived, hash)\n-\t}\n-\n-\treturn false\n-}\ndiff --git a/shared/resend-email.ts b/shared/resend-email.ts\ndeleted file mode 100644\nindex e179126..0000000\n--- a/shared/resend-email.ts\n+++ /dev/null\n@@ -1,21 +0,0 @@\n-import {\n-\tarray,\n-\tobject,\n-\tstring,\n-\tunion,\n-\ttype InferOutput,\n-} from 'remix/data-schema'\n-import { minLength } from 'remix/data-schema/checks'\n-\n-const nonEmptyStringSchema = string().pipe(minLength(1))\n-\n-const resendEmailSchema = object({\n-\tfrom: nonEmptyStringSchema,\n-\tto: union([nonEmptyStringSchema, array(nonEmptyStringSchema)]),\n-\tsubject: nonEmptyStringSchema,\n-\thtml: nonEmptyStringSchema,\n-})\n-\n-export type ResendEmail = InferOutput\n-\n-export { resendEmailSchema }\ndiff --git a/shared/scheduling-time.test.ts b/shared/scheduling-time.test.ts\nnew file mode 100644\nindex 0000000..71551f0\n--- /dev/null\n+++ b/shared/scheduling-time.test.ts\n@@ -0,0 +1,21 @@\n+import { expect, test } from 'vitest'\n+import {\n+\tgenerateLocalSlotKeys,\n+\tlocalSlotKeyToUtcIso,\n+\tutcIsoToLocalSlotKey,\n+} from './scheduling-time.ts'\n+\n+test('generateLocalSlotKeys creates full-day coverage for slot increment', () => {\n+\tconst slots = generateLocalSlotKeys('2026-03-07', '2026-03-07', 30)\n+\texpect(slots).toHaveLength(48)\n+\texpect(slots[0]).toBe('2026-03-07T00:00')\n+\texpect(slots.at(-1)).toBe('2026-03-07T23:30')\n+})\n+\n+test('timezone conversion round-trips local key through UTC', () => {\n+\tconst localSlotKey = '2026-11-01T01:30'\n+\tconst utcIso = localSlotKeyToUtcIso(localSlotKey, 'America/New_York')\n+\tconst backToLocal = utcIsoToLocalSlotKey(utcIso, 'America/New_York')\n+\texpect(backToLocal).toBe(localSlotKey)\n+})\n+\ndiff --git a/shared/scheduling-time.ts b/shared/scheduling-time.ts\nnew file mode 100644\nindex 0000000..b266c15\n--- /dev/null\n+++ b/shared/scheduling-time.ts\n@@ -0,0 +1,212 @@\n+export const slotIncrementOptions = [15, 30, 60] as const\n+\n+export type SlotIncrement = (typeof slotIncrementOptions)[number]\n+\n+type DateParts = {\n+\tyear: number\n+\tmonth: number\n+\tday: number\n+\thour: number\n+\tminute: number\n+\tsecond: number\n+}\n+\n+const dateFormatterCache = new Map()\n+\n+function getFormatter(\n+\ttimeZone: string,\n+\toptions: Intl.DateTimeFormatOptions,\n+\tlocale = 'en-US',\n+) {\n+\tconst cacheKey = JSON.stringify([locale, timeZone, options])\n+\tconst existing = dateFormatterCache.get(cacheKey)\n+\tif (existing) return existing\n+\tconst formatter = new Intl.DateTimeFormat(locale, {\n+\t\t...options,\n+\t\ttimeZone,\n+\t})\n+\tdateFormatterCache.set(cacheKey, formatter)\n+\treturn formatter\n+}\n+\n+function parseIsoDate(date: string) {\n+\tconst match = /^(\\d{4})-(\\d{2})-(\\d{2})$/.exec(date.trim())\n+\tif (!match) return null\n+\tconst year = Number(match[1])\n+\tconst month = Number(match[2])\n+\tconst day = Number(match[3])\n+\tif (!Number.isInteger(year) || !Number.isInteger(month) || !Number.isInteger(day)) {\n+\t\treturn null\n+\t}\n+\tif (month < 1 || month > 12 || day < 1 || day > 31) return null\n+\treturn { year, month, day }\n+}\n+\n+function parseLocalSlotKey(localSlotKey: string) {\n+\tconst match =\n+\t\t/^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2})$/.exec(localSlotKey.trim())\n+\tif (!match) return null\n+\tconst year = Number(match[1])\n+\tconst month = Number(match[2])\n+\tconst day = Number(match[3])\n+\tconst hour = Number(match[4])\n+\tconst minute = Number(match[5])\n+\tif (\n+\t\t!Number.isInteger(year) ||\n+\t\t!Number.isInteger(month) ||\n+\t\t!Number.isInteger(day) ||\n+\t\t!Number.isInteger(hour) ||\n+\t\t!Number.isInteger(minute)\n+\t) {\n+\t\treturn null\n+\t}\n+\tif (month < 1 || month > 12 || day < 1 || day > 31) return null\n+\tif (hour < 0 || hour > 23 || minute < 0 || minute > 59) return null\n+\treturn { year, month, day, hour, minute }\n+}\n+\n+function pad(numberValue: number) {\n+\treturn String(numberValue).padStart(2, '0')\n+}\n+\n+function extractDateParts(date: Date, timeZone: string): DateParts {\n+\tconst formatter = getFormatter(\n+\t\ttimeZone,\n+\t\t{\n+\t\t\tyear: 'numeric',\n+\t\t\tmonth: '2-digit',\n+\t\t\tday: '2-digit',\n+\t\t\thour: '2-digit',\n+\t\t\tminute: '2-digit',\n+\t\t\tsecond: '2-digit',\n+\t\t\thourCycle: 'h23',\n+\t\t},\n+\t\t'en-CA',\n+\t)\n+\n+\tconst parts = formatter.formatToParts(date)\n+\tconst lookup = new Map(parts.map((part) => [part.type, part.value]))\n+\tconst year = Number(lookup.get('year'))\n+\tconst month = Number(lookup.get('month'))\n+\tconst day = Number(lookup.get('day'))\n+\tconst hour = Number(lookup.get('hour'))\n+\tconst minute = Number(lookup.get('minute'))\n+\tconst second = Number(lookup.get('second'))\n+\n+\treturn { year, month, day, hour, minute, second }\n+}\n+\n+export function formatUtcInTimeZone(\n+\tutcIso: string,\n+\ttimeZone: string,\n+\toptions: Intl.DateTimeFormatOptions,\n+\tlocale = 'en-US',\n+) {\n+\tconst formatter = getFormatter(timeZone, options, locale)\n+\treturn formatter.format(new Date(utcIso))\n+}\n+\n+export function generateLocalSlotKeys(\n+\tstartDate: string,\n+\tendDate: string,\n+\tslotMinutes: SlotIncrement,\n+) {\n+\tconst start = parseIsoDate(startDate)\n+\tconst end = parseIsoDate(endDate)\n+\tif (!start || !end) return []\n+\tif (!slotIncrementOptions.includes(slotMinutes)) return []\n+\n+\tconst startMs = Date.UTC(start.year, start.month - 1, start.day)\n+\tconst endMs = Date.UTC(end.year, end.month - 1, end.day)\n+\tif (endMs < startMs) return []\n+\n+\tconst slots: Array = []\n+\tfor (let dayMs = startMs; dayMs <= endMs; dayMs += 24 * 60 * 60 * 1000) {\n+\t\tconst current = new Date(dayMs)\n+\t\tconst yyyy = current.getUTCFullYear()\n+\t\tconst mm = pad(current.getUTCMonth() + 1)\n+\t\tconst dd = pad(current.getUTCDate())\n+\t\tfor (let minuteOfDay = 0; minuteOfDay < 24 * 60; minuteOfDay += slotMinutes) {\n+\t\t\tconst hour = Math.floor(minuteOfDay / 60)\n+\t\t\tconst minute = minuteOfDay % 60\n+\t\t\tslots.push(`${yyyy}-${mm}-${dd}T${pad(hour)}:${pad(minute)}`)\n+\t\t}\n+\t}\n+\n+\treturn slots\n+}\n+\n+/**\n+ * Converts a local wall-clock slot key (`YYYY-MM-DDTHH:mm`) in a given IANA\n+ * timezone into a canonical UTC ISO string.\n+ */\n+export function localSlotKeyToUtcIso(localSlotKey: string, timeZone: string) {\n+\tconst parsed = parseLocalSlotKey(localSlotKey)\n+\tif (!parsed) {\n+\t\tthrow new Error('Invalid local slot key.')\n+\t}\n+\n+\tlet utcMs = Date.UTC(\n+\t\tparsed.year,\n+\t\tparsed.month - 1,\n+\t\tparsed.day,\n+\t\tparsed.hour,\n+\t\tparsed.minute,\n+\t\t0,\n+\t)\n+\tconst desiredMs = utcMs\n+\n+\t// Iteratively align the guessed instant to the desired local wall-clock time.\n+\tfor (let attempt = 0; attempt < 4; attempt += 1) {\n+\t\tconst zoned = extractDateParts(new Date(utcMs), timeZone)\n+\t\tconst zonedAsUtcMs = Date.UTC(\n+\t\t\tzoned.year,\n+\t\t\tzoned.month - 1,\n+\t\t\tzoned.day,\n+\t\t\tzoned.hour,\n+\t\t\tzoned.minute,\n+\t\t\t0,\n+\t\t)\n+\t\tconst offsetMs = desiredMs - zonedAsUtcMs\n+\t\tif (offsetMs === 0) {\n+\t\t\treturn new Date(utcMs).toISOString()\n+\t\t}\n+\t\tutcMs += offsetMs\n+\t}\n+\n+\treturn new Date(utcMs).toISOString()\n+}\n+\n+export function utcIsoToLocalSlotKey(utcIso: string, timeZone: string) {\n+\tconst parts = extractDateParts(new Date(utcIso), timeZone)\n+\treturn `${parts.year}-${pad(parts.month)}-${pad(parts.day)}T${pad(parts.hour)}:${pad(parts.minute)}`\n+}\n+\n+export function localSlotKeyToLabel(localSlotKey: string) {\n+\tconst parsed = parseLocalSlotKey(localSlotKey)\n+\tif (!parsed) return localSlotKey\n+\tconst pseudoUtc = new Date(\n+\t\tDate.UTC(parsed.year, parsed.month - 1, parsed.day, parsed.hour, parsed.minute),\n+\t)\n+\treturn new Intl.DateTimeFormat('en-US', {\n+\t\tweekday: 'short',\n+\t\tmonth: 'short',\n+\t\tday: 'numeric',\n+\t\thour: 'numeric',\n+\t\tminute: '2-digit',\n+\t\thourCycle: 'h23',\n+\t\ttimeZone: 'UTC',\n+\t}).format(pseudoUtc)\n+}\n+\n+export function normalizeIanaTimeZone(timeZone: string) {\n+\tconst trimmed = timeZone.trim()\n+\tif (!trimmed) return 'UTC'\n+\ttry {\n+\t\treturn Intl.DateTimeFormat('en-US', { timeZone: trimmed }).resolvedOptions()\n+\t\t\t.timeZone\n+\t} catch {\n+\t\treturn 'UTC'\n+\t}\n+}\n+\ndiff --git a/tools/seed-test-data.test.ts b/tools/seed-test-data.test.ts\ndeleted file mode 100644\nindex 8486d7b..0000000\n--- a/tools/seed-test-data.test.ts\n+++ /dev/null\n@@ -1,23 +0,0 @@\n-import { expect, test } from 'vitest'\n-\n-import { parseArgs } from './seed-test-data.ts'\n-\n-test('parseArgs defaults username to provided email when omitted', () => {\n-\tconst options = parseArgs(['--email', 'alice@example.com', '--local'])\n-\n-\texpect(options.email).toBe('alice@example.com')\n-\texpect(options.username).toBe('alice@example.com')\n-})\n-\n-test('parseArgs keeps explicit username when provided', () => {\n-\tconst options = parseArgs([\n-\t\t'--email',\n-\t\t'alice@example.com',\n-\t\t'--username',\n-\t\t'alice',\n-\t\t'--local',\n-\t])\n-\n-\texpect(options.email).toBe('alice@example.com')\n-\texpect(options.username).toBe('alice')\n-})\ndiff --git a/tools/seed-test-data.ts b/tools/seed-test-data.ts\ndeleted file mode 100644\nindex 8919f5f..0000000\n--- a/tools/seed-test-data.ts\n+++ /dev/null\n@@ -1,206 +0,0 @@\n-import { existsSync } from 'node:fs'\n-import path from 'node:path'\n-import { spawnSync } from 'node:child_process'\n-import { createPasswordHash } from '#shared/password-hash.ts'\n-\n-type CliOptions = {\n-\temail: string\n-\tusername: string\n-\tpassword: string\n-\tlocal: boolean\n-\tremote: boolean\n-\tconfig?: string\n-\tpersistTo?: string\n-}\n-\n-const defaultTestEmail = 'kody@kcd.dev'\n-const defaultTestPassword = 'kodylovesyou'\n-\n-function fail(message: string): never {\n-\tconsole.error(message)\n-\tprocess.exit(1)\n-}\n-\n-function runWrangler(args: Array) {\n-\tconst localWranglerPath = path.join(\n-\t\tprocess.cwd(),\n-\t\t'node_modules',\n-\t\t'.bin',\n-\t\tprocess.platform === 'win32' ? 'wrangler.cmd' : 'wrangler',\n-\t)\n-\tconst wranglerCommand = existsSync(localWranglerPath)\n-\t\t? localWranglerPath\n-\t\t: process.platform === 'win32'\n-\t\t\t? 'wrangler.cmd'\n-\t\t\t: 'wrangler'\n-\tconst result = spawnSync(wranglerCommand, args, {\n-\t\tencoding: 'utf8',\n-\t\tstdio: 'pipe',\n-\t\tenv: process.env,\n-\t})\n-\n-\treturn {\n-\t\tstatus: result.status ?? 1,\n-\t\tstdout: result.stdout ?? '',\n-\t\tstderr: result.stderr ?? '',\n-\t}\n-}\n-\n-export function parseArgs(argv: Array): CliOptions {\n-\tconst options: CliOptions = {\n-\t\temail: defaultTestEmail,\n-\t\tusername: defaultTestEmail,\n-\t\tpassword: defaultTestPassword,\n-\t\tlocal: false,\n-\t\tremote: false,\n-\t\tconfig: undefined,\n-\t\tpersistTo: undefined,\n-\t}\n-\tlet usernameProvided = false\n-\n-\tfor (let index = 0; index < argv.length; index += 1) {\n-\t\tconst arg = argv[index]\n-\t\tif (!arg) continue\n-\n-\t\tswitch (arg) {\n-\t\t\tcase '--email': {\n-\t\t\t\toptions.email = argv[index + 1] ?? ''\n-\t\t\t\tindex += 1\n-\t\t\t\tbreak\n-\t\t\t}\n-\t\t\tcase '--username': {\n-\t\t\t\tusernameProvided = true\n-\t\t\t\toptions.username = argv[index + 1] ?? ''\n-\t\t\t\tindex += 1\n-\t\t\t\tbreak\n-\t\t\t}\n-\t\t\tcase '--password': {\n-\t\t\t\toptions.password = argv[index + 1] ?? ''\n-\t\t\t\tindex += 1\n-\t\t\t\tbreak\n-\t\t\t}\n-\t\t\tcase '--local': {\n-\t\t\t\toptions.local = true\n-\t\t\t\tbreak\n-\t\t\t}\n-\t\t\tcase '--remote': {\n-\t\t\t\toptions.remote = true\n-\t\t\t\tbreak\n-\t\t\t}\n-\t\t\tcase '--config': {\n-\t\t\t\toptions.config = argv[index + 1] ?? ''\n-\t\t\t\tindex += 1\n-\t\t\t\tbreak\n-\t\t\t}\n-\t\t\tcase '--persist-to': {\n-\t\t\t\toptions.persistTo = argv[index + 1] ?? ''\n-\t\t\t\tindex += 1\n-\t\t\t\tbreak\n-\t\t\t}\n-\t\t\tdefault: {\n-\t\t\t\tif (arg.startsWith('-')) {\n-\t\t\t\t\tfail(\n-\t\t\t\t\t\t[\n-\t\t\t\t\t\t\t`Unknown flag: ${arg}`,\n-\t\t\t\t\t\t\t'Usage: node tools/seed-test-data.ts [--local|--remote] [--config ] [--persist-to ] [--email ] [--username ] [--password ]',\n-\t\t\t\t\t\t].join('\\n'),\n-\t\t\t\t\t)\n-\t\t\t\t}\n-\t\t\t}\n-\t\t}\n-\t}\n-\n-\tif (options.local && options.remote) {\n-\t\tfail('Choose only one target mode: --local or --remote.')\n-\t}\n-\tif (!options.local && !options.remote) {\n-\t\toptions.local = true\n-\t}\n-\tif (!options.email) {\n-\t\tfail('Missing required --email value.')\n-\t}\n-\tconst effectiveEmail = options.email\n-\tif (!usernameProvided) {\n-\t\toptions.username = effectiveEmail\n-\t}\n-\tif (!options.username) {\n-\t\tfail('Missing required --username value.')\n-\t}\n-\tif (!options.password) {\n-\t\tfail('Missing required --password value.')\n-\t}\n-\tif (options.remote && options.persistTo) {\n-\t\tfail('--persist-to is only valid with --local.')\n-\t}\n-\tif (options.config !== undefined && options.config.length === 0) {\n-\t\tfail('Missing value for --config .')\n-\t}\n-\tif (options.persistTo !== undefined && options.persistTo.length === 0) {\n-\t\tfail('Missing value for --persist-to .')\n-\t}\n-\n-\treturn options\n-}\n-\n-function quoteSql(value: string) {\n-\treturn `'${value.replace(/'/g, \"''\")}'`\n-}\n-\n-function buildSeedSql({\n-\temail,\n-\tusername,\n-\tpasswordHash,\n-}: {\n-\temail: string\n-\tusername: string\n-\tpasswordHash: string\n-}) {\n-\treturn `\n-INSERT INTO users (username, email, password_hash)\n-VALUES (${quoteSql(username)}, ${quoteSql(email)}, ${quoteSql(passwordHash)})\n-ON CONFLICT(email) DO UPDATE SET\n- username = excluded.username,\n- password_hash = excluded.password_hash,\n- updated_at = CURRENT_TIMESTAMP;\n-`.trim()\n-}\n-\n-function executeSeedSql(sql: string, options: CliOptions) {\n-\tconst args = ['d1', 'execute', 'APP_DB', '--command', sql]\n-\tif (options.local) {\n-\t\targs.push('--local')\n-\t\tif (options.persistTo) {\n-\t\t\targs.push('--persist-to', options.persistTo)\n-\t\t}\n-\t}\n-\tif (options.remote) {\n-\t\targs.push('--remote')\n-\t}\n-\tif (options.config) {\n-\t\targs.push('--config', options.config)\n-\t}\n-\n-\tconst result = runWrangler(args)\n-\tif (result.status !== 0) {\n-\t\tfail('Failed to write seed user directly to D1.')\n-\t}\n-}\n-\n-async function main() {\n-\tconst options = parseArgs(process.argv.slice(2))\n-\tconst passwordHash = await createPasswordHash(options.password)\n-\tconst sql = buildSeedSql({\n-\t\temail: options.email,\n-\t\tusername: options.username,\n-\t\tpasswordHash,\n-\t})\n-\texecuteSeedSql(sql, options)\n-\n-\tconsole.log(\n-\t\t`Seeded test account in D1 (${options.local ? 'local' : 'remote'}): ${options.email}`,\n-\t)\n-}\n-\n-if (import.meta.main) {\n-\tawait main()\n-}\ndiff --git a/types/env-schema.ts b/types/env-schema.ts\nindex 19ac522..171b06b 100644\n--- a/types/env-schema.ts\n+++ b/types/env-schema.ts\n@@ -2,7 +2,6 @@ import {\n \tcreateSchema,\n \tfail,\n \tobject,\n-\tstring,\n \ttype InferOutput,\n } from 'remix/data-schema'\n \n@@ -13,16 +12,6 @@ const d1DatabaseSchema = createSchema((value, context) => {\n \treturn fail('Missing APP_DB binding for database access.', context.path)\n })\n \n-const optionalNonEmptyStringSchema = createSchema(\n-\t(value, context) => {\n-\t\tif (value === undefined) return { value: undefined }\n-\t\tif (typeof value !== 'string') return fail('Expected string', context.path)\n-\n-\t\tconst trimmed = value.trim()\n-\t\treturn { value: trimmed.length > 0 ? trimmed : undefined }\n-\t},\n-)\n-\n const optionalUrlStringSchema = createSchema(\n \t(value, context) => {\n \t\tif (value === undefined) return { value: undefined }\n@@ -59,16 +48,9 @@ const optionalCommitShaSchema = createSchema(\n )\n \n export const EnvSchema = object({\n-\tCOOKIE_SECRET: string().refine(\n-\t\t(value) => value.length >= 32,\n-\t\t'COOKIE_SECRET must be at least 32 characters for session signing.',\n-\t),\n \tAPP_DB: d1DatabaseSchema,\n \tAPP_BASE_URL: optionalUrlStringSchema,\n \tAPP_COMMIT_SHA: optionalCommitShaSchema,\n-\tRESEND_API_BASE_URL: optionalUrlStringSchema,\n-\tRESEND_API_KEY: optionalNonEmptyStringSchema,\n-\tRESEND_FROM_EMAIL: optionalNonEmptyStringSchema,\n })\n \n export type AppEnv = InferOutput\ndiff --git a/types/tsconfig-client.json b/types/tsconfig-client.json\nindex db5f966..c0ab202 100644\n--- a/types/tsconfig-client.json\n+++ b/types/tsconfig-client.json\n@@ -9,5 +9,9 @@\n \t\t\"jsx\": \"react-jsx\",\n \t\t\"jsxImportSource\": \"remix/component\"\n \t},\n-\t\"include\": [\"../client/**/*.ts\", \"../client/**/*.tsx\"]\n+\t\"include\": [\n+\t\t\"../client/**/*.ts\",\n+\t\t\"../client/**/*.tsx\",\n+\t\t\"../shared/**/*.ts\"\n+\t]\n }\ndiff --git a/worker/d1-data-table-adapter.ts b/worker/d1-data-table-adapter.ts\ndeleted file mode 100644\nindex 4b61be6..0000000\n--- a/worker/d1-data-table-adapter.ts\n+++ /dev/null\n@@ -1,893 +0,0 @@\n-import {\n-\tgetTableName,\n-\tgetTablePrimaryKey,\n-\ttype AdapterCapabilityOverrides,\n-\ttype AdapterExecuteRequest,\n-\ttype AdapterResult,\n-\ttype AdapterStatement,\n-\ttype DatabaseAdapter,\n-\ttype TransactionOptions,\n-\ttype TransactionToken,\n-} from 'remix/data-table'\n-\n-type SqliteCompileContext = {\n-\tvalues: Array\n-}\n-\n-type CompiledSqlStatement = {\n-\ttext: string\n-\tvalues: Array\n-}\n-\n-type D1Meta = {\n-\tchanges?: number\n-\tlast_row_id?: number\n-}\n-\n-type D1StatementResult = {\n-\tresults?: Array>\n-\tmeta?: D1Meta\n-}\n-\n-type D1PreparedQuery = {\n-\tall>(): Promise<{\n-\t\tresults?: Array\n-\t\tmeta?: D1Meta\n-\t}>\n-\trun>(): Promise<{\n-\t\tresults?: Array\n-\t\tmeta?: D1Meta\n-\t}>\n-}\n-\n-/**\n- * `DatabaseAdapter` implementation for Cloudflare D1.\n- *\n- * This adapter intentionally mirrors SQLite SQL generation because D1 uses\n- * SQLite semantics.\n- */\n-export class D1DataTableAdapter implements DatabaseAdapter {\n-\tdialect = 'sqlite'\n-\tcapabilities: {\n-\t\treturning: boolean\n-\t\tsavepoints: boolean\n-\t\tupsert: boolean\n-\t}\n-\n-\t#database: D1Database\n-\t#transactions = new Set()\n-\t#transactionCounter = 0\n-\n-\tconstructor(\n-\t\tdatabase: D1Database,\n-\t\toptions?: {\n-\t\t\tcapabilities?: AdapterCapabilityOverrides\n-\t\t},\n-\t) {\n-\t\tthis.#database = database\n-\t\tthis.capabilities = {\n-\t\t\treturning: options?.capabilities?.returning ?? true,\n-\t\t\tsavepoints: options?.capabilities?.savepoints ?? false,\n-\t\t\tupsert: options?.capabilities?.upsert ?? true,\n-\t\t}\n-\t}\n-\n-\tasync execute(request: AdapterExecuteRequest): Promise {\n-\t\tif (\n-\t\t\trequest.statement.kind === 'insertMany' &&\n-\t\t\trequest.statement.values.length === 0\n-\t\t) {\n-\t\t\treturn {\n-\t\t\t\taffectedRows: 0,\n-\t\t\t\tinsertId: undefined,\n-\t\t\t\trows: request.statement.returning ? [] : undefined,\n-\t\t\t}\n-\t\t}\n-\n-\t\tconst statement = compileSqliteStatement(request.statement)\n-\t\tconst prepared = this.#database\n-\t\t\t.prepare(statement.text)\n-\t\t\t.bind(...statement.values) as unknown as D1PreparedQuery\n-\n-\t\tconst shouldReadRows =\n-\t\t\trequest.statement.kind === 'select' ||\n-\t\t\trequest.statement.kind === 'count' ||\n-\t\t\trequest.statement.kind === 'exists' ||\n-\t\t\thasReturningClause(request.statement)\n-\n-\t\tif (shouldReadRows) {\n-\t\t\tconst result = (await prepared.all()) as D1StatementResult\n-\t\t\tlet rows = normalizeRows(result.results ?? [])\n-\t\t\tif (\n-\t\t\t\trequest.statement.kind === 'count' ||\n-\t\t\t\trequest.statement.kind === 'exists'\n-\t\t\t) {\n-\t\t\t\trows = normalizeCountRows(rows)\n-\t\t\t}\n-\t\t\treturn {\n-\t\t\t\trows,\n-\t\t\t\taffectedRows: normalizeAffectedRowsForReader(\n-\t\t\t\t\trequest.statement.kind,\n-\t\t\t\t\trows,\n-\t\t\t\t\tresult.meta,\n-\t\t\t\t),\n-\t\t\t\tinsertId: normalizeInsertIdForReader(\n-\t\t\t\t\trequest.statement.kind,\n-\t\t\t\t\trequest.statement,\n-\t\t\t\t\trows,\n-\t\t\t\t\tresult.meta,\n-\t\t\t\t),\n-\t\t\t}\n-\t\t}\n-\n-\t\tconst result = (await prepared.run()) as D1StatementResult\n-\t\treturn {\n-\t\t\taffectedRows: normalizeAffectedRowsForRun(request.statement.kind, result),\n-\t\t\tinsertId: normalizeInsertIdForRun(\n-\t\t\t\trequest.statement.kind,\n-\t\t\t\trequest.statement,\n-\t\t\t\tresult,\n-\t\t\t),\n-\t\t}\n-\t}\n-\n-\tasync beginTransaction(\n-\t\toptions?: TransactionOptions,\n-\t): Promise {\n-\t\tif (options?.isolationLevel === 'read uncommitted') {\n-\t\t\tawait this.#database.exec('PRAGMA read_uncommitted = true')\n-\t\t}\n-\n-\t\tawait this.#database.exec('BEGIN')\n-\t\tthis.#transactionCounter += 1\n-\t\tconst token = { id: 'tx_' + String(this.#transactionCounter) }\n-\t\tthis.#transactions.add(token.id)\n-\t\treturn token\n-\t}\n-\n-\tasync commitTransaction(token: TransactionToken): Promise {\n-\t\tthis.#assertTransaction(token)\n-\t\tawait this.#database.exec('COMMIT')\n-\t\tthis.#transactions.delete(token.id)\n-\t}\n-\n-\tasync rollbackTransaction(token: TransactionToken): Promise {\n-\t\tthis.#assertTransaction(token)\n-\t\tawait this.#database.exec('ROLLBACK')\n-\t\tthis.#transactions.delete(token.id)\n-\t}\n-\n-\tasync createSavepoint(\n-\t\t_token: TransactionToken,\n-\t\t_name: string,\n-\t): Promise {\n-\t\tthrow new Error('D1DataTableAdapter savepoints are not supported')\n-\t}\n-\n-\tasync rollbackToSavepoint(\n-\t\t_token: TransactionToken,\n-\t\t_name: string,\n-\t): Promise {\n-\t\tthrow new Error('D1DataTableAdapter savepoints are not supported')\n-\t}\n-\n-\tasync releaseSavepoint(\n-\t\t_token: TransactionToken,\n-\t\t_name: string,\n-\t): Promise {\n-\t\tthrow new Error('D1DataTableAdapter savepoints are not supported')\n-\t}\n-\n-\t#assertTransaction(token: TransactionToken) {\n-\t\tif (!this.#transactions.has(token.id)) {\n-\t\t\tthrow new Error('Unknown transaction token: ' + token.id)\n-\t\t}\n-\t}\n-}\n-\n-export function createD1DataTableAdapter(\n-\tdatabase: D1Database,\n-\toptions?: {\n-\t\tcapabilities?: AdapterCapabilityOverrides\n-\t},\n-) {\n-\treturn new D1DataTableAdapter(database, options)\n-}\n-\n-function hasReturningClause(statement: AdapterStatement) {\n-\treturn (\n-\t\t(statement.kind === 'insert' ||\n-\t\t\tstatement.kind === 'insertMany' ||\n-\t\t\tstatement.kind === 'update' ||\n-\t\t\tstatement.kind === 'delete' ||\n-\t\t\tstatement.kind === 'upsert') &&\n-\t\tBoolean(statement.returning)\n-\t)\n-}\n-\n-function normalizeRows(rows: Array>) {\n-\treturn rows.map((row) => {\n-\t\tif (typeof row !== 'object' || row === null) {\n-\t\t\treturn {}\n-\t\t}\n-\t\treturn { ...row }\n-\t})\n-}\n-\n-function normalizeCountRows(rows: Array>) {\n-\treturn rows.map((row) => {\n-\t\tconst count = row.count\n-\t\tif (typeof count === 'string') {\n-\t\t\tconst numeric = Number(count)\n-\t\t\tif (!Number.isNaN(numeric)) {\n-\t\t\t\treturn {\n-\t\t\t\t\t...row,\n-\t\t\t\t\tcount: numeric,\n-\t\t\t\t}\n-\t\t\t}\n-\t\t}\n-\t\tif (typeof count === 'bigint') {\n-\t\t\treturn {\n-\t\t\t\t...row,\n-\t\t\t\tcount: Number(count),\n-\t\t\t}\n-\t\t}\n-\t\treturn row\n-\t})\n-}\n-\n-function normalizeAffectedRowsForReader(\n-\tkind: AdapterStatement['kind'],\n-\trows: Array>,\n-\tmeta?: D1Meta,\n-) {\n-\tif (isWriteStatementKind(kind)) {\n-\t\tif (typeof meta?.changes === 'number') {\n-\t\t\treturn meta.changes\n-\t\t}\n-\t\treturn rows.length\n-\t}\n-\treturn undefined\n-}\n-\n-function normalizeInsertIdForReader(\n-\tkind: AdapterStatement['kind'],\n-\tstatement: AdapterStatement,\n-\trows: Array>,\n-\tmeta?: D1Meta,\n-) {\n-\tif (!isInsertStatementKind(kind) || !isInsertStatement(statement)) {\n-\t\treturn undefined\n-\t}\n-\tconst primaryKey = getTablePrimaryKey(statement.table)\n-\tif (primaryKey.length !== 1) {\n-\t\treturn undefined\n-\t}\n-\tconst key = primaryKey[0]\n-\tif (!key) {\n-\t\treturn meta?.last_row_id\n-\t}\n-\tconst row = rows[rows.length - 1]\n-\treturn row?.[key] ?? meta?.last_row_id\n-}\n-\n-function normalizeAffectedRowsForRun(\n-\tkind: AdapterStatement['kind'],\n-\tresult: D1StatementResult,\n-) {\n-\tif (kind === 'select' || kind === 'count' || kind === 'exists') {\n-\t\treturn undefined\n-\t}\n-\treturn result.meta?.changes\n-}\n-\n-function normalizeInsertIdForRun(\n-\tkind: AdapterStatement['kind'],\n-\tstatement: AdapterStatement,\n-\tresult: D1StatementResult,\n-) {\n-\tif (!isInsertStatementKind(kind) || !isInsertStatement(statement)) {\n-\t\treturn undefined\n-\t}\n-\tif (getTablePrimaryKey(statement.table).length !== 1) {\n-\t\treturn undefined\n-\t}\n-\treturn result.meta?.last_row_id\n-}\n-\n-function isWriteStatementKind(kind: AdapterStatement['kind']) {\n-\treturn (\n-\t\tkind === 'insert' ||\n-\t\tkind === 'insertMany' ||\n-\t\tkind === 'update' ||\n-\t\tkind === 'delete' ||\n-\t\tkind === 'upsert'\n-\t)\n-}\n-\n-function isInsertStatementKind(kind: AdapterStatement['kind']) {\n-\treturn kind === 'insert' || kind === 'insertMany' || kind === 'upsert'\n-}\n-\n-function isInsertStatement(\n-\tstatement: AdapterStatement,\n-): statement is Extract<\n-\tAdapterStatement,\n-\t{ kind: 'insert' | 'insertMany' | 'upsert' }\n-> {\n-\treturn (\n-\t\tstatement.kind === 'insert' ||\n-\t\tstatement.kind === 'insertMany' ||\n-\t\tstatement.kind === 'upsert'\n-\t)\n-}\n-\n-/**\n- * Adapted from `@remix-run/data-table-sqlite` SQL compiler to keep this D1\n- * adapter self-contained without depending on internal package paths.\n- */\n-function compileSqliteStatement(\n-\tstatement: AdapterStatement,\n-): CompiledSqlStatement {\n-\tif (statement.kind === 'raw') {\n-\t\treturn {\n-\t\t\ttext: statement.sql.text,\n-\t\t\tvalues: [...statement.sql.values],\n-\t\t}\n-\t}\n-\n-\tconst context: SqliteCompileContext = { values: [] }\n-\n-\tif (statement.kind === 'select') {\n-\t\tlet selection = '*'\n-\t\tif (statement.select !== '*') {\n-\t\t\tselection = statement.select\n-\t\t\t\t.map(\n-\t\t\t\t\t(field) =>\n-\t\t\t\t\t\tquotePath(field.column) + ' as ' + quoteIdentifier(field.alias),\n-\t\t\t\t)\n-\t\t\t\t.join(', ')\n-\t\t}\n-\t\treturn {\n-\t\t\ttext:\n-\t\t\t\t'select ' +\n-\t\t\t\t(statement.distinct ? 'distinct ' : '') +\n-\t\t\t\tselection +\n-\t\t\t\tcompileFromClause(\n-\t\t\t\t\tstatement.table,\n-\t\t\t\t\tstatement.joins as Array,\n-\t\t\t\t\tcontext,\n-\t\t\t\t) +\n-\t\t\t\tcompileWhereClause(statement.where as Array, context) +\n-\t\t\t\tcompileGroupByClause(statement.groupBy) +\n-\t\t\t\tcompileHavingClause(statement.having as Array, context) +\n-\t\t\t\tcompileOrderByClause(statement.orderBy as Array) +\n-\t\t\t\tcompileLimitClause(statement.limit) +\n-\t\t\t\tcompileOffsetClause(statement.offset),\n-\t\t\tvalues: context.values,\n-\t\t}\n-\t}\n-\n-\tif (statement.kind === 'count' || statement.kind === 'exists') {\n-\t\tconst inner =\n-\t\t\t'select 1' +\n-\t\t\tcompileFromClause(\n-\t\t\t\tstatement.table,\n-\t\t\t\tstatement.joins as Array,\n-\t\t\t\tcontext,\n-\t\t\t) +\n-\t\t\tcompileWhereClause(statement.where as Array, context) +\n-\t\t\tcompileGroupByClause(statement.groupBy) +\n-\t\t\tcompileHavingClause(statement.having as Array, context)\n-\t\treturn {\n-\t\t\ttext:\n-\t\t\t\t'select count(*) as ' +\n-\t\t\t\tquoteIdentifier('count') +\n-\t\t\t\t' from (' +\n-\t\t\t\tinner +\n-\t\t\t\t') as ' +\n-\t\t\t\tquoteIdentifier('__dt_count'),\n-\t\t\tvalues: context.values,\n-\t\t}\n-\t}\n-\n-\tif (statement.kind === 'insert') {\n-\t\treturn compileInsertStatement(\n-\t\t\tstatement.table,\n-\t\t\tstatement.values as Record,\n-\t\t\tstatement.returning,\n-\t\t\tcontext,\n-\t\t)\n-\t}\n-\n-\tif (statement.kind === 'insertMany') {\n-\t\treturn compileInsertManyStatement(\n-\t\t\tstatement.table,\n-\t\t\tstatement.values as Array>,\n-\t\t\tstatement.returning,\n-\t\t\tcontext,\n-\t\t)\n-\t}\n-\n-\tif (statement.kind === 'update') {\n-\t\tconst columns = Object.keys(statement.changes)\n-\t\treturn {\n-\t\t\ttext:\n-\t\t\t\t'update ' +\n-\t\t\t\tquotePath(getTableName(statement.table)) +\n-\t\t\t\t' set ' +\n-\t\t\t\tcolumns\n-\t\t\t\t\t.map(\n-\t\t\t\t\t\t(column) =>\n-\t\t\t\t\t\t\tquotePath(column) +\n-\t\t\t\t\t\t\t' = ' +\n-\t\t\t\t\t\t\tpushValue(\n-\t\t\t\t\t\t\t\tcontext,\n-\t\t\t\t\t\t\t\t(statement.changes as Record)[column],\n-\t\t\t\t\t\t\t),\n-\t\t\t\t\t)\n-\t\t\t\t\t.join(', ') +\n-\t\t\t\tcompileWhereClause(statement.where as Array, context) +\n-\t\t\t\tcompileReturningClause(statement.returning),\n-\t\t\tvalues: context.values,\n-\t\t}\n-\t}\n-\n-\tif (statement.kind === 'delete') {\n-\t\treturn {\n-\t\t\ttext:\n-\t\t\t\t'delete from ' +\n-\t\t\t\tquotePath(getTableName(statement.table)) +\n-\t\t\t\tcompileWhereClause(statement.where as Array, context) +\n-\t\t\t\tcompileReturningClause(statement.returning),\n-\t\t\tvalues: context.values,\n-\t\t}\n-\t}\n-\n-\tif (statement.kind === 'upsert') {\n-\t\treturn compileUpsertStatement(statement, context)\n-\t}\n-\n-\tthrow new Error('Unsupported statement kind')\n-}\n-\n-function compileInsertStatement(\n-\ttable: Extract['table'],\n-\tvalues: Record,\n-\treturning: Extract['returning'],\n-\tcontext: SqliteCompileContext,\n-): CompiledSqlStatement {\n-\tconst columns = Object.keys(values)\n-\tif (columns.length === 0) {\n-\t\treturn {\n-\t\t\ttext:\n-\t\t\t\t'insert into ' +\n-\t\t\t\tquotePath(getTableName(table)) +\n-\t\t\t\t' default values' +\n-\t\t\t\tcompileReturningClause(returning),\n-\t\t\tvalues: context.values,\n-\t\t}\n-\t}\n-\n-\treturn {\n-\t\ttext:\n-\t\t\t'insert into ' +\n-\t\t\tquotePath(getTableName(table)) +\n-\t\t\t' (' +\n-\t\t\tcolumns.map((column) => quotePath(column)).join(', ') +\n-\t\t\t') values (' +\n-\t\t\tcolumns.map((column) => pushValue(context, values[column])).join(', ') +\n-\t\t\t')' +\n-\t\t\tcompileReturningClause(returning),\n-\t\tvalues: context.values,\n-\t}\n-}\n-\n-function compileInsertManyStatement(\n-\ttable: Extract['table'],\n-\trows: Array>,\n-\treturning: Extract['returning'],\n-\tcontext: SqliteCompileContext,\n-): CompiledSqlStatement {\n-\tif (rows.length === 0) {\n-\t\treturn {\n-\t\t\ttext: 'select 0 where 1 = 0',\n-\t\t\tvalues: context.values,\n-\t\t}\n-\t}\n-\n-\tconst columns = collectColumns(rows)\n-\tif (columns.length === 0) {\n-\t\treturn {\n-\t\t\ttext:\n-\t\t\t\t'insert into ' +\n-\t\t\t\tquotePath(getTableName(table)) +\n-\t\t\t\t' default values' +\n-\t\t\t\tcompileReturningClause(returning),\n-\t\t\tvalues: context.values,\n-\t\t}\n-\t}\n-\n-\treturn {\n-\t\ttext:\n-\t\t\t'insert into ' +\n-\t\t\tquotePath(getTableName(table)) +\n-\t\t\t' (' +\n-\t\t\tcolumns.map((column) => quotePath(column)).join(', ') +\n-\t\t\t') values ' +\n-\t\t\trows\n-\t\t\t\t.map(\n-\t\t\t\t\t(row) =>\n-\t\t\t\t\t\t'(' +\n-\t\t\t\t\t\tcolumns\n-\t\t\t\t\t\t\t.map((column) => {\n-\t\t\t\t\t\t\t\tconst value = Object.prototype.hasOwnProperty.call(row, column)\n-\t\t\t\t\t\t\t\t\t? row[column]\n-\t\t\t\t\t\t\t\t\t: null\n-\t\t\t\t\t\t\t\treturn pushValue(context, value)\n-\t\t\t\t\t\t\t})\n-\t\t\t\t\t\t\t.join(', ') +\n-\t\t\t\t\t\t')',\n-\t\t\t\t)\n-\t\t\t\t.join(', ') +\n-\t\t\tcompileReturningClause(returning),\n-\t\tvalues: context.values,\n-\t}\n-}\n-\n-function compileUpsertStatement(\n-\tstatement: Extract,\n-\tcontext: SqliteCompileContext,\n-): CompiledSqlStatement {\n-\tconst insertColumns = Object.keys(statement.values)\n-\tconst conflictTarget = statement.conflictTarget ?? [\n-\t\t...getTablePrimaryKey(statement.table),\n-\t]\n-\tif (insertColumns.length === 0) {\n-\t\tthrow new Error('upsert requires at least one value')\n-\t}\n-\n-\tconst updateValues = statement.update ?? statement.values\n-\tconst updateColumns = Object.keys(updateValues)\n-\tlet conflictClause = ''\n-\n-\tif (updateColumns.length === 0) {\n-\t\tconflictClause =\n-\t\t\t' on conflict (' +\n-\t\t\tconflictTarget.map((column) => quotePath(column)).join(', ') +\n-\t\t\t') do nothing'\n-\t} else {\n-\t\tconflictClause =\n-\t\t\t' on conflict (' +\n-\t\t\tconflictTarget.map((column) => quotePath(column)).join(', ') +\n-\t\t\t') do update set ' +\n-\t\t\tupdateColumns\n-\t\t\t\t.map(\n-\t\t\t\t\t(column) =>\n-\t\t\t\t\t\tquotePath(column) +\n-\t\t\t\t\t\t' = ' +\n-\t\t\t\t\t\tpushValue(\n-\t\t\t\t\t\t\tcontext,\n-\t\t\t\t\t\t\t(updateValues as Record)[column],\n-\t\t\t\t\t\t),\n-\t\t\t\t)\n-\t\t\t\t.join(', ')\n-\t}\n-\n-\treturn {\n-\t\ttext:\n-\t\t\t'insert into ' +\n-\t\t\tquotePath(getTableName(statement.table)) +\n-\t\t\t' (' +\n-\t\t\tinsertColumns.map((column) => quotePath(column)).join(', ') +\n-\t\t\t') values (' +\n-\t\t\tinsertColumns\n-\t\t\t\t.map((column) =>\n-\t\t\t\t\tpushValue(\n-\t\t\t\t\t\tcontext,\n-\t\t\t\t\t\t(statement.values as Record)[column],\n-\t\t\t\t\t),\n-\t\t\t\t)\n-\t\t\t\t.join(', ') +\n-\t\t\t')' +\n-\t\t\tconflictClause +\n-\t\t\tcompileReturningClause(statement.returning),\n-\t\tvalues: context.values,\n-\t}\n-}\n-\n-function compileFromClause(\n-\ttable: AdapterStatement extends infer T\n-\t\t? T extends { table: infer tableType }\n-\t\t\t? tableType\n-\t\t\t: never\n-\t\t: never,\n-\tjoins: Array,\n-\tcontext: SqliteCompileContext,\n-) {\n-\tlet output = ' from ' + quotePath(getTableName(table))\n-\tfor (const join of joins) {\n-\t\tconst typedJoin = join as {\n-\t\t\ttype: 'inner' | 'left' | 'right'\n-\t\t\ttable: Parameters[0]\n-\t\t\ton: unknown\n-\t\t}\n-\t\toutput +=\n-\t\t\t' ' +\n-\t\t\tnormalizeJoinType(typedJoin.type) +\n-\t\t\t' join ' +\n-\t\t\tquotePath(getTableName(typedJoin.table)) +\n-\t\t\t' on ' +\n-\t\t\tcompilePredicate(typedJoin.on, context)\n-\t}\n-\treturn output\n-}\n-\n-function compileWhereClause(\n-\tpredicates: Array,\n-\tcontext: SqliteCompileContext,\n-) {\n-\tif (predicates.length === 0) {\n-\t\treturn ''\n-\t}\n-\treturn (\n-\t\t' where ' +\n-\t\tpredicates\n-\t\t\t.map((predicate) => '(' + compilePredicate(predicate, context) + ')')\n-\t\t\t.join(' and ')\n-\t)\n-}\n-\n-function compileGroupByClause(columns: Array) {\n-\tif (columns.length === 0) {\n-\t\treturn ''\n-\t}\n-\treturn ' group by ' + columns.map((column) => quotePath(column)).join(', ')\n-}\n-\n-function compileHavingClause(\n-\tpredicates: Array,\n-\tcontext: SqliteCompileContext,\n-) {\n-\tif (predicates.length === 0) {\n-\t\treturn ''\n-\t}\n-\treturn (\n-\t\t' having ' +\n-\t\tpredicates\n-\t\t\t.map((predicate) => '(' + compilePredicate(predicate, context) + ')')\n-\t\t\t.join(' and ')\n-\t)\n-}\n-\n-function compileOrderByClause(orderBy: Array) {\n-\tif (orderBy.length === 0) {\n-\t\treturn ''\n-\t}\n-\treturn (\n-\t\t' order by ' +\n-\t\torderBy\n-\t\t\t.map((clause) => {\n-\t\t\t\tconst typedClause = clause as {\n-\t\t\t\t\tcolumn: string\n-\t\t\t\t\tdirection: 'asc' | 'desc'\n-\t\t\t\t}\n-\t\t\t\treturn (\n-\t\t\t\t\tquotePath(typedClause.column) +\n-\t\t\t\t\t' ' +\n-\t\t\t\t\ttypedClause.direction.toUpperCase()\n-\t\t\t\t)\n-\t\t\t})\n-\t\t\t.join(', ')\n-\t)\n-}\n-\n-function compileLimitClause(limit?: number) {\n-\tif (limit === undefined) {\n-\t\treturn ''\n-\t}\n-\treturn ' limit ' + String(limit)\n-}\n-\n-function compileOffsetClause(offset?: number) {\n-\tif (offset === undefined) {\n-\t\treturn ''\n-\t}\n-\treturn ' offset ' + String(offset)\n-}\n-\n-function compileReturningClause(returning?: '*' | Array) {\n-\tif (!returning) {\n-\t\treturn ''\n-\t}\n-\tif (returning === '*') {\n-\t\treturn ' returning *'\n-\t}\n-\treturn ' returning ' + returning.map((column) => quotePath(column)).join(', ')\n-}\n-\n-function compilePredicate(\n-\tpredicate: unknown,\n-\tcontext: SqliteCompileContext,\n-): string {\n-\tconst typedPredicate = predicate as {\n-\t\ttype: string\n-\t\t[column: string]: unknown\n-\t}\n-\n-\tif (typedPredicate.type === 'comparison') {\n-\t\tconst column = quotePath(String(typedPredicate.column))\n-\n-\t\tif (typedPredicate.operator === 'eq') {\n-\t\t\tif (\n-\t\t\t\ttypedPredicate.valueType === 'value' &&\n-\t\t\t\t(typedPredicate.value === null || typedPredicate.value === undefined)\n-\t\t\t) {\n-\t\t\t\treturn column + ' is null'\n-\t\t\t}\n-\t\t\tconst comparisonValue = compileComparisonValue(typedPredicate, context)\n-\t\t\treturn column + ' = ' + comparisonValue\n-\t\t}\n-\n-\t\tif (typedPredicate.operator === 'ne') {\n-\t\t\tif (\n-\t\t\t\ttypedPredicate.valueType === 'value' &&\n-\t\t\t\t(typedPredicate.value === null || typedPredicate.value === undefined)\n-\t\t\t) {\n-\t\t\t\treturn column + ' is not null'\n-\t\t\t}\n-\t\t\tconst comparisonValue = compileComparisonValue(typedPredicate, context)\n-\t\t\treturn column + ' <> ' + comparisonValue\n-\t\t}\n-\n-\t\tif (typedPredicate.operator === 'gt') {\n-\t\t\tconst comparisonValue = compileComparisonValue(typedPredicate, context)\n-\t\t\treturn column + ' > ' + comparisonValue\n-\t\t}\n-\n-\t\tif (typedPredicate.operator === 'gte') {\n-\t\t\tconst comparisonValue = compileComparisonValue(typedPredicate, context)\n-\t\t\treturn column + ' >= ' + comparisonValue\n-\t\t}\n-\n-\t\tif (typedPredicate.operator === 'lt') {\n-\t\t\tconst comparisonValue = compileComparisonValue(typedPredicate, context)\n-\t\t\treturn column + ' < ' + comparisonValue\n-\t\t}\n-\n-\t\tif (typedPredicate.operator === 'lte') {\n-\t\t\tconst comparisonValue = compileComparisonValue(typedPredicate, context)\n-\t\t\treturn column + ' <= ' + comparisonValue\n-\t\t}\n-\n-\t\tif (\n-\t\t\ttypedPredicate.operator === 'in' ||\n-\t\t\ttypedPredicate.operator === 'notIn'\n-\t\t) {\n-\t\t\tconst values = Array.isArray(typedPredicate.value)\n-\t\t\t\t? typedPredicate.value\n-\t\t\t\t: []\n-\t\t\tif (values.length === 0) {\n-\t\t\t\treturn typedPredicate.operator === 'in' ? '1 = 0' : '1 = 1'\n-\t\t\t}\n-\n-\t\t\tconst keyword = typedPredicate.operator === 'in' ? 'in' : 'not in'\n-\t\t\treturn (\n-\t\t\t\tcolumn +\n-\t\t\t\t' ' +\n-\t\t\t\tkeyword +\n-\t\t\t\t' (' +\n-\t\t\t\tvalues.map((value) => pushValue(context, value)).join(', ') +\n-\t\t\t\t')'\n-\t\t\t)\n-\t\t}\n-\n-\t\tif (typedPredicate.operator === 'like') {\n-\t\t\tconst comparisonValue = compileComparisonValue(typedPredicate, context)\n-\t\t\treturn column + ' like ' + comparisonValue\n-\t\t}\n-\n-\t\tif (typedPredicate.operator === 'ilike') {\n-\t\t\tconst comparisonValue = compileComparisonValue(typedPredicate, context)\n-\t\t\treturn 'lower(' + column + ') like lower(' + comparisonValue + ')'\n-\t\t}\n-\t}\n-\n-\tif (typedPredicate.type === 'between') {\n-\t\treturn (\n-\t\t\tquotePath(String(typedPredicate.column)) +\n-\t\t\t' between ' +\n-\t\t\tpushValue(context, typedPredicate.lower) +\n-\t\t\t' and ' +\n-\t\t\tpushValue(context, typedPredicate.upper)\n-\t\t)\n-\t}\n-\n-\tif (typedPredicate.type === 'null') {\n-\t\treturn (\n-\t\t\tquotePath(String(typedPredicate.column)) +\n-\t\t\t(typedPredicate.operator === 'isNull' ? ' is null' : ' is not null')\n-\t\t)\n-\t}\n-\n-\tif (typedPredicate.type === 'logical') {\n-\t\tconst predicates = Array.isArray(typedPredicate.predicates)\n-\t\t\t? typedPredicate.predicates\n-\t\t\t: []\n-\t\tif (predicates.length === 0) {\n-\t\t\treturn typedPredicate.operator === 'and' ? '1 = 1' : '1 = 0'\n-\t\t}\n-\t\tconst joiner = typedPredicate.operator === 'and' ? ' and ' : ' or '\n-\t\treturn predicates\n-\t\t\t.map((child) => '(' + compilePredicate(child, context) + ')')\n-\t\t\t.join(joiner)\n-\t}\n-\n-\tthrow new Error('Unsupported predicate')\n-}\n-\n-function compileComparisonValue(predicate: any, context: SqliteCompileContext) {\n-\tif (predicate.valueType === 'column') {\n-\t\treturn quotePath(String(predicate.value))\n-\t}\n-\treturn pushValue(context, predicate.value)\n-}\n-\n-function normalizeJoinType(type: 'inner' | 'left' | 'right') {\n-\tif (type === 'left') {\n-\t\treturn 'left'\n-\t}\n-\tif (type === 'right') {\n-\t\treturn 'right'\n-\t}\n-\treturn 'inner'\n-}\n-\n-function quoteIdentifier(value: string) {\n-\treturn '\"' + value.replace(/\"/g, '\"\"') + '\"'\n-}\n-\n-function quotePath(path: string) {\n-\tif (path === '*') {\n-\t\treturn '*'\n-\t}\n-\treturn path\n-\t\t.split('.')\n-\t\t.map((segment) => {\n-\t\t\tif (segment === '*') {\n-\t\t\t\treturn '*'\n-\t\t\t}\n-\t\t\treturn quoteIdentifier(segment)\n-\t\t})\n-\t\t.join('.')\n-}\n-\n-function pushValue(context: SqliteCompileContext, value: unknown) {\n-\tcontext.values.push(normalizeBoundValue(value))\n-\treturn '?'\n-}\n-\n-function normalizeBoundValue(value: unknown) {\n-\tif (typeof value === 'boolean') {\n-\t\treturn value ? 1 : 0\n-\t}\n-\treturn value\n-}\n-\n-function collectColumns(rows: Array>) {\n-\tconst columns: Array = []\n-\tconst seen = new Set()\n-\tfor (const row of rows) {\n-\t\tfor (const key in row) {\n-\t\t\tif (!Object.prototype.hasOwnProperty.call(row, key)) {\n-\t\t\t\tcontinue\n-\t\t\t}\n-\t\t\tif (seen.has(key)) {\n-\t\t\t\tcontinue\n-\t\t\t}\n-\t\t\tseen.add(key)\n-\t\t\tcolumns.push(key)\n-\t\t}\n-\t}\n-\treturn columns\n-}\ndiff --git a/worker/db.ts b/worker/db.ts\ndeleted file mode 100644\nindex 9aab5e2..0000000\n--- a/worker/db.ts\n+++ /dev/null\n@@ -1,50 +0,0 @@\n-import { createDatabase, createTable, sql } from 'remix/data-table'\n-import { number, string } from 'remix/data-schema'\n-import { createD1DataTableAdapter } from './d1-data-table-adapter.ts'\n-\n-export const usersTable = createTable({\n-\tname: 'users',\n-\tcolumns: {\n-\t\tid: number(),\n-\t\tusername: string(),\n-\t\temail: string(),\n-\t\tpassword_hash: string(),\n-\t\tcreated_at: string(),\n-\t\tupdated_at: string(),\n-\t},\n-\tprimaryKey: 'id',\n-})\n-\n-export const passwordResetsTable = createTable({\n-\tname: 'password_resets',\n-\tcolumns: {\n-\t\tid: number(),\n-\t\tuser_id: number(),\n-\t\ttoken_hash: string(),\n-\t\texpires_at: number(),\n-\t\tcreated_at: string(),\n-\t},\n-\tprimaryKey: 'id',\n-})\n-\n-export const mockResendMessagesTable = createTable({\n-\tname: 'mock_resend_messages',\n-\tcolumns: {\n-\t\tid: string(),\n-\t\ttoken_hash: string(),\n-\t\treceived_at: number(),\n-\t\tfrom_email: string(),\n-\t\tto_json: string(),\n-\t\tsubject: string(),\n-\t\thtml: string(),\n-\t\tpayload_json: string(),\n-\t},\n-\tprimaryKey: 'id',\n-})\n-\n-export function createDb(db: D1Database) {\n-\treturn createDatabase(createD1DataTableAdapter(db))\n-}\n-\n-export type AppDatabase = ReturnType\n-export { sql }\ndiff --git a/worker/index.ts b/worker/index.ts\nindex e68dda1..999d772 100644\n--- a/worker/index.ts\n+++ b/worker/index.ts\n@@ -1,135 +1,20 @@\n-import { OAuthProvider } from '@cloudflare/workers-oauth-provider'\n-import { MCP } from '#mcp/index.ts'\n+import { createSchedulingMcpHandler } from '#mcp/index.ts'\n import { handleRequest } from '#server/handler.ts'\n-import {\n-\tapiHandler,\n-\thandleAuthorizeRequest,\n-\thandleAuthorizeInfo,\n-\thandleOAuthCallback,\n-\toauthPaths,\n-\toauthScopes,\n-} from './oauth-handlers.ts'\n-import {\n-\thandleMcpRequest,\n-\thandleProtectedResourceMetadata,\n-\tisProtectedResourceMetadataRequest,\n-\tmcpResourcePath,\n-} from './mcp-auth.ts'\n-import { withCors } from './utils.ts'\n \n-export { MCP }\n-\n-const appHandler = withCors({\n-\tgetCorsHeaders(request) {\n-\t\tconst origin = request.headers.get('Origin')\n-\t\tif (!origin) return null\n-\t\tconst requestOrigin = new URL(request.url).origin\n-\t\tif (origin !== requestOrigin) return null\n-\t\treturn {\n-\t\t\t'Access-Control-Allow-Origin': origin,\n-\t\t\t'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',\n-\t\t\t'Access-Control-Allow-Headers': 'content-type, authorization',\n-\t\t\tVary: 'Origin',\n-\t\t}\n-\t},\n-\tasync handler(request, env, ctx) {\n+export default {\n+\tasync fetch(request: Request, env: Env, ctx: ExecutionContext) {\n \t\tconst url = new URL(request.url)\n-\n-\t\tif (url.pathname === oauthPaths.authorize) {\n-\t\t\treturn handleAuthorizeRequest(request, env)\n-\t\t}\n-\n-\t\tif (url.pathname === oauthPaths.authorizeInfo) {\n-\t\t\treturn handleAuthorizeInfo(request, env)\n+\t\tif (url.pathname === '/mcp' || url.pathname.startsWith('/mcp/')) {\n+\t\t\treturn createSchedulingMcpHandler(env)(request, env, ctx)\n \t\t}\n \n-\t\tif (url.pathname === oauthPaths.callback) {\n-\t\t\treturn handleOAuthCallback(request)\n-\t\t}\n-\n-\t\tif (url.pathname === '/.well-known/appspecific/com.chrome.devtools.json') {\n-\t\t\treturn new Response(null, { status: 204 })\n-\t\t}\n-\n-\t\tif (isProtectedResourceMetadataRequest(url.pathname)) {\n-\t\t\treturn handleProtectedResourceMetadata(request)\n-\t\t}\n-\n-\t\tif (url.pathname === mcpResourcePath) {\n-\t\t\treturn handleMcpRequest({\n-\t\t\t\trequest,\n-\t\t\t\tenv,\n-\t\t\t\tctx,\n-\t\t\t\tfetchMcp: MCP.serve(mcpResourcePath, {\n-\t\t\t\t\tbinding: 'MCP_OBJECT',\n-\t\t\t\t}).fetch,\n-\t\t\t})\n-\t\t}\n-\n-\t\t// Sandboxed widget iframes have an opaque origin, so JS/CSS loads become CORS fetches.\n-\t\t// ChatGPT/MCP Jam can render with sandbox=\"allow-scripts\", which requires these headers.\n-\t\tif (\n-\t\t\tenv.ASSETS &&\n-\t\t\t(request.method === 'GET' || request.method === 'HEAD') &&\n-\t\t\t(url.pathname.startsWith('/mcp-apps/') || url.pathname === '/styles.css')\n-\t\t) {\n-\t\t\tconst assetResponse = await env.ASSETS.fetch(request)\n-\t\t\tif (assetResponse.status !== 404) {\n-\t\t\t\tconst headers = new Headers(assetResponse.headers)\n-\t\t\t\theaders.set('Access-Control-Allow-Origin', '*')\n-\t\t\t\treturn new Response(assetResponse.body, {\n-\t\t\t\t\tstatus: assetResponse.status,\n-\t\t\t\t\tstatusText: assetResponse.statusText,\n-\t\t\t\t\theaders,\n-\t\t\t\t})\n-\t\t\t}\n-\t\t}\n-\n-\t\t// Dev route: serve calculator UI for iframe testing (simulates ChatGPT/MCP Jam)\n-\t\tif (\n-\t\t\turl.pathname === '/dev/calculator-ui' &&\n-\t\t\t(request.method === 'GET' || request.method === 'HEAD')\n-\t\t) {\n-\t\t\tconst { renderCalculatorUiEntryPoint } =\n-\t\t\t\tawait import('#mcp/apps/calculator-ui-entry-point.ts')\n-\t\t\tconst baseUrl = new URL('/', url.origin)\n-\t\t\tconst html = renderCalculatorUiEntryPoint(baseUrl)\n-\t\t\treturn new Response(html, {\n-\t\t\t\theaders: {\n-\t\t\t\t\t'Content-Type': 'text/html; charset=utf-8',\n-\t\t\t\t},\n-\t\t\t})\n-\t\t}\n-\n-\t\t// Try to serve static assets for safe methods only\n \t\tif (env.ASSETS && (request.method === 'GET' || request.method === 'HEAD')) {\n \t\t\tconst response = await env.ASSETS.fetch(request)\n-\t\t\tif (response.ok) {\n+\t\t\tif (response.status !== 404) {\n \t\t\t\treturn response\n \t\t\t}\n \t\t}\n \n \t\treturn handleRequest(request, env)\n \t},\n-})\n-\n-const oauthProvider = new OAuthProvider({\n-\tapiRoute: oauthPaths.apiPrefix,\n-\tapiHandler,\n-\tdefaultHandler: {\n-\t\tfetch(request, env, ctx) {\n-\t\t\t// @ts-expect-error https://github.com/cloudflare/workers-oauth-provider/issues/71\n-\t\t\treturn appHandler(request, env, ctx)\n-\t\t},\n-\t},\n-\tauthorizeEndpoint: oauthPaths.authorize,\n-\ttokenEndpoint: oauthPaths.token,\n-\tclientRegistrationEndpoint: oauthPaths.register,\n-\tscopesSupported: oauthScopes,\n-})\n-\n-export default {\n-\tfetch(request: Request, env: Env, ctx: ExecutionContext) {\n-\t\treturn oauthProvider.fetch(request, env, ctx)\n-\t},\n } satisfies ExportedHandler\ndiff --git a/worker/mcp-auth.test.ts b/worker/mcp-auth.test.ts\ndeleted file mode 100644\nindex 9bf4092..0000000\n--- a/worker/mcp-auth.test.ts\n+++ /dev/null\n@@ -1,160 +0,0 @@\n-import { expect, test } from 'vitest'\n-import {\n-\ttype OAuthHelpers,\n-\ttype TokenSummary,\n-} from '@cloudflare/workers-oauth-provider'\n-import {\n-\tbuildProtectedResourceMetadata,\n-\thandleMcpRequest,\n-\thandleProtectedResourceMetadata,\n-\tmcpResourcePath,\n-\tprotectedResourceMetadataPath,\n-} from './mcp-auth.ts'\n-import { oauthScopes } from './oauth-handlers.ts'\n-\n-function createHelpers(overrides: Partial = {}): OAuthHelpers {\n-\treturn {\n-\t\tasync parseAuthRequest() {\n-\t\t\tthrow new Error('Not implemented')\n-\t\t},\n-\t\tlookupClient: async () => null,\n-\t\tcompleteAuthorization: async () => ({ redirectTo: 'https://example.com' }),\n-\t\tasync createClient() {\n-\t\t\tthrow new Error('Not implemented')\n-\t\t},\n-\t\tlistClients: async () => ({ items: [] }),\n-\t\tupdateClient: async () => null,\n-\t\tdeleteClient: async () => undefined,\n-\t\tlistUserGrants: async () => ({ items: [] }),\n-\t\trevokeGrant: async () => undefined,\n-\t\tunwrapToken: async () => null,\n-\t\t...overrides,\n-\t}\n-}\n-\n-function createEnv(helpers: OAuthHelpers) {\n-\treturn { OAUTH_PROVIDER: helpers } as unknown as Env\n-}\n-\n-function createContext() {\n-\treturn {\n-\t\tprops: {},\n-\t\twaitUntil: () => undefined,\n-\t\tpassThroughOnException: () => undefined,\n-\t} as unknown as ExecutionContext\n-}\n-\n-test('protected resource metadata describes MCP server', async () => {\n-\tconst request = new Request(\n-\t\t`https://example.com${protectedResourceMetadataPath}`,\n-\t)\n-\tconst response = handleProtectedResourceMetadata(request)\n-\n-\texpect(response.status).toBe(200)\n-\tconst payload = await response.json()\n-\texpect(payload).toEqual(buildProtectedResourceMetadata('https://example.com'))\n-})\n-\n-test('mcp request without token returns 401 with resource metadata', async () => {\n-\tconst request = new Request(`https://example.com${mcpResourcePath}`)\n-\tconst response = await handleMcpRequest({\n-\t\trequest,\n-\t\tenv: createEnv(createHelpers()),\n-\t\tctx: createContext(),\n-\t\tfetchMcp: () => new Response('ok'),\n-\t})\n-\n-\texpect(response.status).toBe(401)\n-\tconst header = response.headers.get('WWW-Authenticate') ?? ''\n-\texpect(header).toContain(\n-\t\t`resource_metadata=\"https://example.com${protectedResourceMetadataPath}\"`,\n-\t)\n-\tif (oauthScopes.length > 0) {\n-\t\texpect(header).toContain(`scope=\"${oauthScopes.join(' ')}\"`)\n-\t}\n-})\n-\n-test('mcp request rejects invalid tokens', async () => {\n-\tconst request = new Request(`https://example.com${mcpResourcePath}`, {\n-\t\theaders: { Authorization: 'Bearer invalid' },\n-\t})\n-\tconst response = await handleMcpRequest({\n-\t\trequest,\n-\t\tenv: createEnv(\n-\t\t\tcreateHelpers({\n-\t\t\t\tunwrapToken: async () => null,\n-\t\t\t}),\n-\t\t),\n-\t\tctx: createContext(),\n-\t\tfetchMcp: () => new Response('ok'),\n-\t})\n-\n-\texpect(response.status).toBe(401)\n-})\n-\n-test('mcp request rejects tokens without resource audience', async () => {\n-\tconst tokenSummary: TokenSummary = {\n-\t\tid: 'token',\n-\t\tgrantId: 'grant',\n-\t\tuserId: 'user',\n-\t\tcreatedAt: 0,\n-\t\texpiresAt: 999999,\n-\t\tgrant: {\n-\t\t\tclientId: 'client',\n-\t\t\tscope: oauthScopes,\n-\t\t\tprops: { userId: 'user' },\n-\t\t},\n-\t}\n-\tconst response = await handleMcpRequest({\n-\t\trequest: new Request(`https://example.com${mcpResourcePath}`, {\n-\t\t\theaders: { Authorization: 'Bearer valid' },\n-\t\t}),\n-\t\tenv: createEnv(\n-\t\t\tcreateHelpers({\n-\t\t\t\tunwrapToken: async () => tokenSummary,\n-\t\t\t}),\n-\t\t),\n-\t\tctx: createContext(),\n-\t\tfetchMcp: () => new Response('ok'),\n-\t})\n-\n-\texpect(response.status).toBe(401)\n-})\n-\n-test('mcp request forwards when token is valid', async () => {\n-\tconst tokenSummary: TokenSummary = {\n-\t\tid: 'token',\n-\t\tgrantId: 'grant',\n-\t\tuserId: 'user',\n-\t\tcreatedAt: 0,\n-\t\texpiresAt: 999999,\n-\t\taudience: `https://example.com${mcpResourcePath}`,\n-\t\tgrant: {\n-\t\t\tclientId: 'client',\n-\t\t\tscope: oauthScopes,\n-\t\t\tprops: { userId: 'user' },\n-\t\t},\n-\t}\n-\tlet receivedProps: unknown = null\n-\tconst response = await handleMcpRequest({\n-\t\trequest: new Request(`https://example.com${mcpResourcePath}`, {\n-\t\t\theaders: { Authorization: 'Bearer valid' },\n-\t\t}),\n-\t\tenv: createEnv(\n-\t\t\tcreateHelpers({\n-\t\t\t\tunwrapToken: async () => tokenSummary,\n-\t\t\t}),\n-\t\t),\n-\t\tctx: createContext(),\n-\t\tfetchMcp: (_request, _env, ctx) => {\n-\t\t\treceivedProps = ctx.props\n-\t\t\treturn new Response('ok')\n-\t\t},\n-\t})\n-\n-\texpect(response.status).toBe(200)\n-\texpect(receivedProps).toEqual({\n-\t\tbaseUrl: 'https://example.com',\n-\t\tuser: { userId: 'user' },\n-\t})\n-})\ndiff --git a/worker/mcp-auth.ts b/worker/mcp-auth.ts\ndeleted file mode 100644\nindex 4f2d0c4..0000000\n--- a/worker/mcp-auth.ts\n+++ /dev/null\n@@ -1,117 +0,0 @@\n-import {\n-\ttype OAuthHelpers,\n-\ttype TokenSummary,\n-} from '@cloudflare/workers-oauth-provider'\n-import { oauthScopes } from './oauth-handlers.ts'\n-\n-export const mcpResourcePath = '/mcp'\n-export const protectedResourceMetadataPath =\n-\t'/.well-known/oauth-protected-resource'\n-\n-type OAuthEnv = Env & {\n-\tOAUTH_PROVIDER?: OAuthHelpers\n-}\n-\n-type OAuthContextProps = {\n-\tbaseUrl: string\n-\tuser?: TokenSummary['grant']['props']\n-}\n-\n-type OAuthExecutionContext = ExecutionContext & {\n-\tprops?: OAuthContextProps\n-}\n-\n-export function buildProtectedResourceMetadata(origin: string) {\n-\treturn {\n-\t\tresource: `${origin}${mcpResourcePath}`,\n-\t\tauthorization_servers: [origin],\n-\t\tscopes_supported: oauthScopes,\n-\t}\n-}\n-\n-export function isProtectedResourceMetadataRequest(pathname: string) {\n-\treturn (\n-\t\tpathname === protectedResourceMetadataPath ||\n-\t\tpathname === `${protectedResourceMetadataPath}${mcpResourcePath}`\n-\t)\n-}\n-\n-export function handleProtectedResourceMetadata(request: Request) {\n-\tconst url = new URL(request.url)\n-\treturn new Response(\n-\t\tJSON.stringify(buildProtectedResourceMetadata(url.origin)),\n-\t\t{\n-\t\t\theaders: { 'Content-Type': 'application/json' },\n-\t\t},\n-\t)\n-}\n-\n-function buildWwwAuthenticateHeader(origin: string) {\n-\tconst resourceMetadata = `${origin}${protectedResourceMetadataPath}`\n-\tconst scope =\n-\t\toauthScopes.length > 0 ? ` scope=\"${oauthScopes.join(' ')}\"` : ''\n-\treturn `Bearer resource_metadata=\"${resourceMetadata}\"${scope}`\n-}\n-\n-function createUnauthorizedResponse(requestUrl: URL) {\n-\treturn new Response(null, {\n-\t\tstatus: 401,\n-\t\theaders: {\n-\t\t\t'WWW-Authenticate': buildWwwAuthenticateHeader(requestUrl.origin),\n-\t\t},\n-\t})\n-}\n-\n-function audienceMatches(\n-\taudience: string | Array | undefined,\n-\trequestUrl: URL,\n-) {\n-\tif (!audience) return false\n-\tconst allowed = Array.isArray(audience) ? audience : [audience]\n-\tconst origin = requestUrl.origin\n-\tconst resourcePath = `${origin}${mcpResourcePath}`\n-\treturn allowed.some((value) => value === origin || value === resourcePath)\n-}\n-\n-export async function handleMcpRequest({\n-\trequest,\n-\tenv,\n-\tctx,\n-\tfetchMcp,\n-}: {\n-\trequest: Request\n-\tenv: Env\n-\tctx: ExecutionContext\n-\tfetchMcp: CustomExportedHandler['fetch']\n-}) {\n-\tconst url = new URL(request.url)\n-\tconst authHeader = request.headers.get('Authorization')\n-\tif (!authHeader || !authHeader.startsWith('Bearer ')) {\n-\t\treturn createUnauthorizedResponse(url)\n-\t}\n-\n-\tconst token = authHeader.slice('Bearer '.length).trim()\n-\tif (!token) {\n-\t\treturn createUnauthorizedResponse(url)\n-\t}\n-\n-\tconst helpers = (env as OAuthEnv).OAUTH_PROVIDER\n-\tif (!helpers) {\n-\t\treturn createUnauthorizedResponse(url)\n-\t}\n-\n-\tconst tokenSummary = await helpers.unwrapToken(token)\n-\tif (!tokenSummary || !audienceMatches(tokenSummary.audience, url)) {\n-\t\treturn createUnauthorizedResponse(url)\n-\t}\n-\n-\tconst context = ctx as OAuthExecutionContext\n-\tconst props: OAuthContextProps = {\n-\t\t...context.props,\n-\t\tbaseUrl: url.origin,\n-\t\tuser: tokenSummary.grant.props,\n-\t}\n-\tcontext.props = props\n-\n-\treturn fetchMcp(request, env, context as ExecutionContext)\n-}\ndiff --git a/worker/oauth-handlers.test.ts b/worker/oauth-handlers.test.ts\ndeleted file mode 100644\nindex 491eda6..0000000\n--- a/worker/oauth-handlers.test.ts\n+++ /dev/null\n@@ -1,250 +0,0 @@\n-import { expect, test } from 'vitest'\n-import {\n-\ttype AuthRequest,\n-\ttype ClientInfo,\n-\ttype CompleteAuthorizationOptions,\n-\ttype OAuthHelpers,\n-} from '@cloudflare/workers-oauth-provider'\n-import { createAuthCookie, setAuthSessionSecret } from '#server/auth-session.ts'\n-import { createPasswordHash } from '#server/password-hash.ts'\n-import {\n-\thandleAuthorizeInfo,\n-\thandleAuthorizeRequest,\n-\thandleOAuthCallback,\n-\toauthScopes,\n-} from './oauth-handlers.ts'\n-\n-const baseAuthRequest: AuthRequest = {\n-\tresponseType: 'code',\n-\tclientId: 'client-123',\n-\tredirectUri: 'https://example.com/callback',\n-\tscope: ['profile'],\n-\tstate: 'demo',\n-}\n-\n-const baseClient: ClientInfo = {\n-\tclientId: 'client-123',\n-\tredirectUris: ['https://example.com/callback'],\n-\tclientName: 'epic-scheduler Demo',\n-\ttokenEndpointAuthMethod: 'client_secret_basic',\n-}\n-const cookieSecret = 'test-secret-0123456789abcdef0123456789'\n-\n-function createHelpers(overrides: Partial = {}): OAuthHelpers {\n-\treturn {\n-\t\tparseAuthRequest: async () => baseAuthRequest,\n-\t\tlookupClient: async () => baseClient,\n-\t\tcompleteAuthorization: async () => ({\n-\t\t\tredirectTo: 'https://example.com/callback?code=demo',\n-\t\t}),\n-\t\tasync createClient() {\n-\t\t\tthrow new Error('Not implemented')\n-\t\t},\n-\t\tlistClients: async () => ({ items: [] }),\n-\t\tupdateClient: async () => null,\n-\t\tdeleteClient: async () => undefined,\n-\t\tlistUserGrants: async () => ({ items: [] }),\n-\t\trevokeGrant: async () => undefined,\n-\t\tunwrapToken: async () => null,\n-\t\t...overrides,\n-\t}\n-}\n-\n-async function createDatabase(password: string) {\n-\tconst passwordHash = await createPasswordHash(password)\n-\treturn {\n-\t\tprepare() {\n-\t\t\treturn {\n-\t\t\t\tbind() {\n-\t\t\t\t\treturn {\n-\t\t\t\t\t\tasync all() {\n-\t\t\t\t\t\t\treturn {\n-\t\t\t\t\t\t\t\tresults: [{ id: 1, password_hash: passwordHash }],\n-\t\t\t\t\t\t\t\tmeta: { changes: 0, last_row_id: 0 },\n-\t\t\t\t\t\t\t}\n-\t\t\t\t\t\t},\n-\t\t\t\t\t\tasync first() {\n-\t\t\t\t\t\t\treturn { id: 1, password_hash: passwordHash }\n-\t\t\t\t\t\t},\n-\t\t\t\t\t\tasync run() {\n-\t\t\t\t\t\t\treturn { meta: { changes: 1, last_row_id: 1 } }\n-\t\t\t\t\t\t},\n-\t\t\t\t\t}\n-\t\t\t\t},\n-\t\t\t}\n-\t\t},\n-\t\tasync exec() {\n-\t\t\treturn\n-\t\t},\n-\t} as unknown as D1Database\n-}\n-\n-function createEnv(\n-\thelpers: OAuthHelpers,\n-\tappDb?: D1Database,\n-\tcookieSecretValue: string = cookieSecret,\n-) {\n-\tconst resolvedDb = appDb ?? ({} as D1Database)\n-\treturn {\n-\t\tOAUTH_PROVIDER: helpers,\n-\t\tAPP_DB: resolvedDb,\n-\t\tCOOKIE_SECRET: cookieSecretValue,\n-\t} as unknown as Env\n-}\n-\n-function createFormRequest(\n-\tdata: Record,\n-\theaders: Record = {},\n-) {\n-\treturn new Request('https://example.com/oauth/authorize', {\n-\t\tmethod: 'POST',\n-\t\theaders: {\n-\t\t\t'Content-Type': 'application/x-www-form-urlencoded',\n-\t\t\t...headers,\n-\t\t},\n-\t\tbody: new URLSearchParams(data),\n-\t})\n-}\n-\n-test('authorize page returns SPA shell', async () => {\n-\tconst response = await handleAuthorizeRequest(\n-\t\tnew Request('https://example.com/oauth/authorize'),\n-\t\tcreateEnv(createHelpers()),\n-\t)\n-\n-\texpect(response.status).toBe(200)\n-\tconst body = await response.text()\n-\texpect(body).toContain('client-entry.js')\n-\texpect(body).toContain('app-shell')\n-})\n-\n-test('authorize info returns client and scopes', async () => {\n-\tconst response = await handleAuthorizeInfo(\n-\t\tnew Request(\n-\t\t\t'https://example.com/oauth/authorize-info?response_type=code&client_id=client-123&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback&scope=profile&state=demo',\n-\t\t),\n-\t\tcreateEnv(createHelpers()),\n-\t)\n-\n-\texpect(response.status).toBe(200)\n-\tconst payload = await response.json()\n-\texpect(payload).toEqual({\n-\t\tok: true,\n-\t\tclient: { id: baseClient.clientId, name: baseClient.clientName },\n-\t\tscopes: baseAuthRequest.scope,\n-\t})\n-})\n-\n-test('authorize denies access and redirects with error', async () => {\n-\tconst response = await handleAuthorizeRequest(\n-\t\tcreateFormRequest({ decision: 'deny' }),\n-\t\tcreateEnv(createHelpers()),\n-\t)\n-\n-\texpect(response.status).toBe(302)\n-\tconst location = response.headers.get('Location')\n-\texpect(location).toBeTruthy()\n-\tconst redirectUrl = new URL(location as string)\n-\tconst expectedRedirect = new URL(baseAuthRequest.redirectUri)\n-\texpect(redirectUrl.origin).toBe(expectedRedirect.origin)\n-\texpect(redirectUrl.pathname).toBe(expectedRedirect.pathname)\n-\texpect(redirectUrl.searchParams.get('error')).toBe('access_denied')\n-\texpect(redirectUrl.searchParams.get('state')).toBe('demo')\n-})\n-\n-test('authorize requires email and password for approval', async () => {\n-\tconst response = await handleAuthorizeRequest(\n-\t\tcreateFormRequest(\n-\t\t\t{ decision: 'approve', email: 'user@example.com' },\n-\t\t\t{ Accept: 'application/json' },\n-\t\t),\n-\t\tcreateEnv(createHelpers()),\n-\t)\n-\n-\texpect(response.status).toBe(400)\n-\tconst payload = await response.json()\n-\texpect(payload).toEqual({\n-\t\tok: false,\n-\t\terror: 'Email and password are required.',\n-\t\tcode: 'invalid_request',\n-\t})\n-})\n-\n-test('authorize allows approval with an existing session', async () => {\n-\tlet capturedOptions: CompleteAuthorizationOptions | null = null\n-\tconst helpers = createHelpers({\n-\t\tasync completeAuthorization(options) {\n-\t\t\tcapturedOptions = options\n-\t\t\treturn { redirectTo: 'https://example.com/callback?code=session' }\n-\t\t},\n-\t})\n-\tsetAuthSessionSecret(cookieSecret)\n-\tconst cookie = await createAuthCookie(\n-\t\t{ id: 'session-id', email: 'user@example.com' },\n-\t\tfalse,\n-\t)\n-\n-\tconst response = await handleAuthorizeRequest(\n-\t\tcreateFormRequest(\n-\t\t\t{ decision: 'approve' },\n-\t\t\t{ Accept: 'application/json', Cookie: cookie },\n-\t\t),\n-\t\tcreateEnv(helpers),\n-\t)\n-\n-\texpect(response.status).toBe(200)\n-\tconst payload = await response.json()\n-\texpect(payload).toEqual({\n-\t\tok: true,\n-\t\tredirectTo: 'https://example.com/callback?code=session',\n-\t})\n-\texpect(capturedOptions).not.toBeNull()\n-})\n-\n-test('authorize uses default scopes when none requested', async () => {\n-\tlet resolveCapturedOptions:\n-\t\t| ((value: CompleteAuthorizationOptions) => void)\n-\t\t| undefined\n-\tconst capturedOptionsPromise = new Promise(\n-\t\t(resolve) => {\n-\t\t\tresolveCapturedOptions = resolve\n-\t\t},\n-\t)\n-\n-\tconst helpers = createHelpers({\n-\t\tparseAuthRequest: async () => ({\n-\t\t\t...baseAuthRequest,\n-\t\t\tscope: [],\n-\t\t}),\n-\t\tasync completeAuthorization(options) {\n-\t\t\tresolveCapturedOptions?.(options)\n-\t\t\treturn { redirectTo: 'https://example.com/callback?code=ok' }\n-\t\t},\n-\t})\n-\tconst response = await handleAuthorizeRequest(\n-\t\tcreateFormRequest({\n-\t\t\tdecision: 'approve',\n-\t\t\temail: 'user@example.com',\n-\t\t\tpassword: 'password123',\n-\t\t}),\n-\t\tcreateEnv(helpers, await createDatabase('password123')),\n-\t)\n-\n-\texpect(response.status).toBe(302)\n-\texpect(response.headers.get('Location')).toBe(\n-\t\t'https://example.com/callback?code=ok',\n-\t)\n-\tconst capturedOptions = await capturedOptionsPromise\n-\texpect(capturedOptions.scope).toEqual(oauthScopes)\n-})\n-\n-test('oauth callback page returns SPA shell', async () => {\n-\tconst response = handleOAuthCallback(\n-\t\tnew Request('https://example.com/oauth/callback?code=abc123&state=demo'),\n-\t)\n-\n-\texpect(response.status).toBe(200)\n-\tconst body = await response.text()\n-\texpect(body).toContain('client-entry.js')\n-\texpect(body).toContain('app-shell')\n-})\ndiff --git a/worker/oauth-handlers.ts b/worker/oauth-handlers.ts\ndeleted file mode 100644\nindex b70385c..0000000\n--- a/worker/oauth-handlers.ts\n+++ /dev/null\n@@ -1,324 +0,0 @@\n-import {\n-\ttype AuthRequest,\n-\ttype OAuthHelpers,\n-} from '@cloudflare/workers-oauth-provider'\n-import { getRequestIp, logAuditEvent } from '#server/audit-log.ts'\n-import { readAuthSession, setAuthSessionSecret } from '#server/auth-session.ts'\n-import { getEnv } from '#server/env.ts'\n-import { toHex } from '#server/hex.ts'\n-import { verifyPassword } from '#server/password-hash.ts'\n-import { Layout } from '#server/layout.ts'\n-import { render } from '#server/render.ts'\n-import { createDb, usersTable } from './db.ts'\n-import { wantsJson } from './utils.ts'\n-\n-export const oauthPaths = {\n-\tauthorize: '/oauth/authorize',\n-\tauthorizeInfo: '/oauth/authorize-info',\n-\ttoken: '/oauth/token',\n-\tregister: '/oauth/register',\n-\tcallback: '/oauth/callback',\n-\tapiPrefix: '/api/',\n-}\n-\n-export const oauthScopes: Array = ['profile', 'email']\n-\n-type OAuthProps = {\n-\tuserId: string\n-\temail: string\n-\tdisplayName: string\n-}\n-\n-type OAuthEnv = Env & {\n-\tOAUTH_PROVIDER: OAuthHelpers\n-}\n-\n-type OAuthContext = ExecutionContext & {\n-\tprops?: OAuthProps\n-}\n-\n-function renderSpaShell(status = 200) {\n-\treturn render(Layout({}), { status })\n-}\n-\n-const dummyPasswordHash =\n-\t'pbkdf2_sha256$100000$00000000000000000000000000000000$0000000000000000000000000000000000000000000000000000000000000000'\n-\n-async function createUserId(email: string) {\n-\tconst normalized = email.trim().toLowerCase()\n-\tconst data = new TextEncoder().encode(normalized)\n-\tconst hash = await crypto.subtle.digest('SHA-256', data)\n-\treturn toHex(new Uint8Array(hash))\n-}\n-\n-function jsonResponse(data: unknown, init?: ResponseInit) {\n-\treturn new Response(JSON.stringify(data), {\n-\t\t...init,\n-\t\theaders: {\n-\t\t\t'Content-Type': 'application/json',\n-\t\t\t...init?.headers,\n-\t\t},\n-\t})\n-}\n-\n-function getOAuthHelpers(env: Env) {\n-\tconst helpers = (env as OAuthEnv).OAUTH_PROVIDER\n-\tif (!helpers) {\n-\t\tthrow new Error('OAuth provider helpers are not available.')\n-\t}\n-\treturn helpers\n-}\n-\n-async function resolveAuthRequest(helpers: OAuthHelpers, request: Request) {\n-\ttry {\n-\t\tconst authRequest = await helpers.parseAuthRequest(request)\n-\t\tif (!authRequest.clientId || !authRequest.redirectUri) {\n-\t\t\treturn {\n-\t\t\t\terror:\n-\t\t\t\t\t'Invalid OAuth request. Client ID and redirect URI are required.',\n-\t\t\t}\n-\t\t}\n-\t\tconst client = await helpers.lookupClient(authRequest.clientId)\n-\t\tif (!client) {\n-\t\t\treturn { error: 'Unknown OAuth client.' }\n-\t\t}\n-\t\treturn { authRequest, client }\n-\t} catch (error) {\n-\t\tconst message =\n-\t\t\terror instanceof Error ? error.message : 'Unable to parse OAuth request.'\n-\t\treturn { error: message }\n-\t}\n-}\n-\n-function resolveScopes(requestedScopes: Array) {\n-\tif (requestedScopes.length === 0) return oauthScopes\n-\tconst invalidScopes = requestedScopes.filter(\n-\t\t(scope) => !oauthScopes.includes(scope),\n-\t)\n-\tif (invalidScopes.length > 0) {\n-\t\treturn {\n-\t\t\terror: `Unsupported scopes requested: ${invalidScopes.join(', ')}`,\n-\t\t}\n-\t}\n-\treturn requestedScopes\n-}\n-\n-function createAccessDeniedRedirectUrl(request: AuthRequest) {\n-\tif (!request.redirectUri) {\n-\t\treturn null\n-\t}\n-\tconst redirectUrl = new URL(request.redirectUri)\n-\tredirectUrl.searchParams.set('error', 'access_denied')\n-\tif (request.state) redirectUrl.searchParams.set('state', request.state)\n-\treturn redirectUrl.toString()\n-}\n-\n-function createAuthorizeErrorRedirect(\n-\trequest: Request,\n-\terror: string,\n-\tdescription: string,\n-) {\n-\tconst redirectUrl = new URL(request.url)\n-\tredirectUrl.searchParams.set('error', error)\n-\tredirectUrl.searchParams.set('error_description', description)\n-\treturn Response.redirect(redirectUrl.toString(), 303)\n-}\n-\n-function respondAuthorizeError(\n-\trequest: Request,\n-\tmessage: string,\n-\tstatus = 400,\n-\terrorCode = 'invalid_request',\n-) {\n-\treturn wantsJson(request)\n-\t\t? jsonResponse({ ok: false, error: message, code: errorCode }, { status })\n-\t\t: createAuthorizeErrorRedirect(request, errorCode, message)\n-}\n-\n-async function resolveSessionEmail(request: Request, env: Env) {\n-\ttry {\n-\t\tconst appEnv = getEnv(env)\n-\t\tsetAuthSessionSecret(appEnv.COOKIE_SECRET)\n-\t\tconst session = await readAuthSession(request)\n-\t\tconst email = session?.email?.trim()\n-\t\treturn email ? email.toLowerCase() : null\n-\t} catch {\n-\t\treturn null\n-\t}\n-}\n-\n-export async function handleAuthorizeInfo(\n-\trequest: Request,\n-\tenv: Env,\n-): Promise {\n-\tconst helpers = getOAuthHelpers(env)\n-\tconst resolution = await resolveAuthRequest(helpers, request)\n-\tif ('error' in resolution) {\n-\t\treturn jsonResponse({ ok: false, error: resolution.error }, { status: 400 })\n-\t}\n-\n-\tconst { authRequest, client } = resolution\n-\tconst resolvedScopes = resolveScopes(authRequest.scope)\n-\tif (!Array.isArray(resolvedScopes)) {\n-\t\treturn jsonResponse(\n-\t\t\t{ ok: false, error: resolvedScopes.error },\n-\t\t\t{ status: 400 },\n-\t\t)\n-\t}\n-\n-\treturn jsonResponse({\n-\t\tok: true,\n-\t\tclient: {\n-\t\t\tid: client.clientId,\n-\t\t\tname: client.clientName ?? client.clientId,\n-\t\t},\n-\t\tscopes: resolvedScopes,\n-\t})\n-}\n-\n-export async function handleAuthorizeRequest(\n-\trequest: Request,\n-\tenv: Env,\n-): Promise {\n-\tif (request.method === 'GET') {\n-\t\treturn renderSpaShell()\n-\t}\n-\n-\tif (request.method !== 'POST') {\n-\t\treturn new Response('Method not allowed', { status: 405 })\n-\t}\n-\n-\tconst requestIp = getRequestIp(request) ?? undefined\n-\tconst helpers = getOAuthHelpers(env)\n-\tconst resolution = await resolveAuthRequest(helpers, request)\n-\tif ('error' in resolution) {\n-\t\treturn respondAuthorizeError(\n-\t\t\trequest,\n-\t\t\tresolution.error ?? 'Unable to process OAuth request.',\n-\t\t)\n-\t}\n-\n-\tconst { authRequest } = resolution\n-\tconst formData = await request.formData()\n-\tconst decision = String(formData.get('decision') ?? 'approve')\n-\tif (decision === 'deny') {\n-\t\tconst redirectTo = createAccessDeniedRedirectUrl(authRequest)\n-\t\tif (!redirectTo) {\n-\t\t\treturn respondAuthorizeError(\n-\t\t\t\trequest,\n-\t\t\t\t'Missing redirect URI for access denial.',\n-\t\t\t)\n-\t\t}\n-\t\treturn wantsJson(request)\n-\t\t\t? jsonResponse({ ok: true, redirectTo })\n-\t\t\t: Response.redirect(redirectTo, 302)\n-\t}\n-\n-\tconst email = String(formData.get('email') ?? '').trim()\n-\tconst password = String(formData.get('password') ?? '')\n-\tconst normalizedEmail = email.toLowerCase()\n-\tconst sessionEmail = await resolveSessionEmail(request, env)\n-\tconst hasFormCredentials = Boolean(email && password)\n-\tconst hasSession = Boolean(sessionEmail)\n-\n-\tif (!hasFormCredentials && !hasSession) {\n-\t\tvoid logAuditEvent({\n-\t\t\tcategory: 'oauth',\n-\t\t\taction: 'authorize',\n-\t\t\tresult: 'failure',\n-\t\t\temail: normalizedEmail || undefined,\n-\t\t\tip: requestIp,\n-\t\t\tclientId: authRequest.clientId,\n-\t\t\treason: 'missing_credentials',\n-\t\t})\n-\t\treturn respondAuthorizeError(request, 'Email and password are required.')\n-\t}\n-\n-\tlet approvedEmail = ''\n-\tif (hasFormCredentials) {\n-\t\tconst db = createDb(env.APP_DB)\n-\t\tconst userRecord = await db.findOne(usersTable, {\n-\t\t\twhere: { email: normalizedEmail },\n-\t\t})\n-\t\tlet passwordValid = false\n-\t\tif (userRecord) {\n-\t\t\tpasswordValid = await verifyPassword(password, userRecord.password_hash)\n-\t\t} else {\n-\t\t\tawait verifyPassword(password, dummyPasswordHash)\n-\t\t}\n-\n-\t\tif (!userRecord || !passwordValid) {\n-\t\t\tvoid logAuditEvent({\n-\t\t\t\tcategory: 'oauth',\n-\t\t\t\taction: 'authorize',\n-\t\t\t\tresult: 'failure',\n-\t\t\t\temail: normalizedEmail,\n-\t\t\t\tip: requestIp,\n-\t\t\t\tclientId: authRequest.clientId,\n-\t\t\t\treason: 'invalid_credentials',\n-\t\t\t})\n-\t\t\treturn respondAuthorizeError(request, 'Invalid email or password.')\n-\t\t}\n-\t\tapprovedEmail = normalizedEmail\n-\t} else if (sessionEmail) {\n-\t\tapprovedEmail = sessionEmail\n-\t}\n-\n-\tconst resolvedScopes = resolveScopes(authRequest.scope)\n-\tif (Array.isArray(resolvedScopes)) {\n-\t\tconst userId = await createUserId(approvedEmail)\n-\t\tconst displayName = approvedEmail.split('@')[0] || 'user'\n-\t\tconst { redirectTo } = await helpers.completeAuthorization({\n-\t\t\trequest: authRequest,\n-\t\t\tuserId,\n-\t\t\tmetadata: {\n-\t\t\t\temail: approvedEmail,\n-\t\t\t\tclientId: authRequest.clientId,\n-\t\t\t},\n-\t\t\tscope: resolvedScopes,\n-\t\t\tprops: {\n-\t\t\t\tuserId,\n-\t\t\t\temail: approvedEmail,\n-\t\t\t\tdisplayName,\n-\t\t\t},\n-\t\t})\n-\t\tvoid logAuditEvent({\n-\t\t\tcategory: 'oauth',\n-\t\t\taction: 'authorize',\n-\t\t\tresult: 'success',\n-\t\t\temail: approvedEmail,\n-\t\t\tip: requestIp,\n-\t\t\tclientId: authRequest.clientId,\n-\t\t})\n-\t\treturn wantsJson(request)\n-\t\t\t? jsonResponse({ ok: true, redirectTo })\n-\t\t\t: Response.redirect(redirectTo, 302)\n-\t}\n-\n-\treturn respondAuthorizeError(request, resolvedScopes.error)\n-}\n-\n-export function handleOAuthCallback(request: Request): Response {\n-\tconst url = new URL(request.url)\n-\tconst hasError =\n-\t\turl.searchParams.has('error') || url.searchParams.has('error_description')\n-\treturn renderSpaShell(hasError ? 400 : 200)\n-}\n-\n-export const apiHandler = {\n-\tasync fetch(request: Request, _env: unknown, ctx: ExecutionContext) {\n-\t\tconst url = new URL(request.url)\n-\t\tif (url.pathname === '/api/me') {\n-\t\t\tconst props = (ctx as OAuthContext).props\n-\t\t\tif (!props) {\n-\t\t\t\treturn jsonResponse(\n-\t\t\t\t\t{ ok: false, error: 'Unauthorized' },\n-\t\t\t\t\t{ status: 401 },\n-\t\t\t\t)\n-\t\t\t}\n-\t\t\treturn jsonResponse({ ok: true, user: props })\n-\t\t}\n-\n-\t\treturn jsonResponse({ error: 'Not found' }, { status: 404 })\n-\t},\n-} satisfies ExportedHandler\ndiff --git a/wrangler.jsonc b/wrangler.jsonc\nindex 77feba6..b9b9e9c 100644\n--- a/wrangler.jsonc\n+++ b/wrangler.jsonc\n@@ -4,12 +4,6 @@\n \t\"compatibility_date\": \"2026-01-31\",\n \t\"compatibility_flags\": [\"nodejs_compat\", \"global_fetch_strictly_public\"],\n \t\"main\": \"./worker/index.ts\",\n-\t\"migrations\": [\n-\t\t{\n-\t\t\t\"new_sqlite_classes\": [\"MCP\"],\n-\t\t\t\"tag\": \"v1\",\n-\t\t},\n-\t],\n \n \t\"observability\": {\n \t\t\"enabled\": true,\n@@ -19,15 +13,7 @@\n \t\t\t\"assets\": {\n \t\t\t\t\"directory\": \"./public\",\n \t\t\t\t\"binding\": \"ASSETS\",\n-\t\t\t\t\"run_worker_first\": [\"/mcp-apps/*\", \"/styles.css\"],\n-\t\t\t},\n-\t\t\t\"durable_objects\": {\n-\t\t\t\t\"bindings\": [\n-\t\t\t\t\t{\n-\t\t\t\t\t\t\"class_name\": \"MCP\",\n-\t\t\t\t\t\t\"name\": \"MCP_OBJECT\",\n-\t\t\t\t\t},\n-\t\t\t\t],\n+\t\t\t\t\"run_worker_first\": [\"/styles.css\"],\n \t\t\t},\n \t\t\t\"d1_databases\": [\n \t\t\t\t{\n@@ -37,27 +23,12 @@\n \t\t\t\t\t\"migrations_dir\": \"migrations\",\n \t\t\t\t},\n \t\t\t],\n-\t\t\t\"kv_namespaces\": [\n-\t\t\t\t{\n-\t\t\t\t\t\"binding\": \"OAUTH_KV\",\n-\t\t\t\t\t\"id\": \"e2c0caa629a04af198d90fb5ec388f62\",\n-\t\t\t\t\t\"preview_id\": \"becbb91b27364709a7e8a9c7533c9ff5\",\n-\t\t\t\t},\n-\t\t\t],\n \t\t},\n \t\t\"preview\": {\n \t\t\t\"assets\": {\n \t\t\t\t\"directory\": \"./public\",\n \t\t\t\t\"binding\": \"ASSETS\",\n-\t\t\t\t\"run_worker_first\": [\"/mcp-apps/*\", \"/styles.css\"],\n-\t\t\t},\n-\t\t\t\"durable_objects\": {\n-\t\t\t\t\"bindings\": [\n-\t\t\t\t\t{\n-\t\t\t\t\t\t\"class_name\": \"MCP\",\n-\t\t\t\t\t\t\"name\": \"MCP_OBJECT\",\n-\t\t\t\t\t},\n-\t\t\t\t],\n+\t\t\t\t\"run_worker_first\": [\"/styles.css\"],\n \t\t\t},\n \t\t\t\"d1_databases\": [\n \t\t\t\t{\n@@ -67,27 +38,12 @@\n \t\t\t\t\t\"migrations_dir\": \"migrations\",\n \t\t\t\t},\n \t\t\t],\n-\t\t\t\"kv_namespaces\": [\n-\t\t\t\t{\n-\t\t\t\t\t\"binding\": \"OAUTH_KV\",\n-\t\t\t\t\t\"id\": \"e2c0caa629a04af198d90fb5ec388f62\",\n-\t\t\t\t\t\"preview_id\": \"becbb91b27364709a7e8a9c7533c9ff5\",\n-\t\t\t\t},\n-\t\t\t],\n \t\t},\n \t\t\"test\": {\n \t\t\t\"assets\": {\n \t\t\t\t\"directory\": \"./public\",\n \t\t\t\t\"binding\": \"ASSETS\",\n-\t\t\t\t\"run_worker_first\": [\"/mcp-apps/*\", \"/styles.css\"],\n-\t\t\t},\n-\t\t\t\"durable_objects\": {\n-\t\t\t\t\"bindings\": [\n-\t\t\t\t\t{\n-\t\t\t\t\t\t\"class_name\": \"MCP\",\n-\t\t\t\t\t\t\"name\": \"MCP_OBJECT\",\n-\t\t\t\t\t},\n-\t\t\t\t],\n+\t\t\t\t\"run_worker_first\": [\"/styles.css\"],\n \t\t\t},\n \t\t\t\"d1_databases\": [\n \t\t\t\t{\n@@ -97,13 +53,6 @@\n \t\t\t\t\t\"migrations_dir\": \"migrations\",\n \t\t\t\t},\n \t\t\t],\n-\t\t\t\"kv_namespaces\": [\n-\t\t\t\t{\n-\t\t\t\t\t\"binding\": \"OAUTH_KV\",\n-\t\t\t\t\t\"id\": \"e2c0caa629a04af198d90fb5ec388f62\",\n-\t\t\t\t\t\"preview_id\": \"becbb91b27364709a7e8a9c7533c9ff5\",\n-\t\t\t\t},\n-\t\t\t],\n \t\t},\n \t},\n }"]

.env-14+2App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

.env.example-14+6App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

AGENTS.md-5+4App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

cli.ts-130+42App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/app-session-refresh.test.ts-80+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/app.tsx-119+28App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/auth-links.ts-5+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/mcp-apps/calculator-widget.ts-299+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/mcp-apps/widget-host-bridge.test.ts-125+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/mcp-apps/widget-host-bridge.ts-248+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/account.tsx-82+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/chat.tsx-20+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/create-schedule.tsx-0+469App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/host-schedule.tsx-0+679App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/index.tsx-18+9App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/login.tsx-322+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/oauth-authorize.tsx-420+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/oauth-callback.tsx-73+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/reset-password.tsx-269+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/routes/respond-schedule.tsx-0+386App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/schedule-grid.tsx-0+322App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

client/session.ts-26+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/agents/end-to-end-testing.md-41+39App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/agents/setup.md-96+59App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/architecture/authentication.md-87+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/architecture/data-storage.md-46+27App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/architecture/index.md-15+11App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/architecture/request-lifecycle.md-47+34App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/cloudflare-offerings.md-61+49App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/environment-variables.md-12+7App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/getting-started.md-47+32App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

docs/setup-manifest.md-62+42App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

e2e/account.spec.ts-67+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

e2e/chat.spec.ts-15+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

e2e/home.spec.ts-32+13App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

e2e/login.spec.ts-46+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

e2e/oauth-authorize.spec.ts-229+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

e2e/playwright-utils.ts-76+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mcp/apps/calculator-ui-entry-point.ts-211+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mcp/index.ts-43+7App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mcp/mcp-server-e2e.test.ts-624+377App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mcp/register-resources.ts-6+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mcp/register-tools.ts-8+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mcp/resources/calculator-app-resource.ts-66+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mcp/server.ts-0+274App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mcp/tools/do-math.ts-186+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mcp/tools/open-calculator-ui.ts-72+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

migrations/0001-init.sql-37+50App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mock-servers/resend/resend-mock.test.ts-295+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mock-servers/resend/worker.ts-498+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

mock-servers/resend/wrangler.jsonc-41+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

package.json-61+49App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

public/styles.css-29+29App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/audit-log.ts-50+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/auth-redirect.ts-27+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/auth-session.ts-80+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/email/resend.ts-90+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handler.ts-11+9App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/account.ts-26+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/auth-handler.test.ts-238+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/auth-page.ts-29+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/auth.ts-220+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/chat.ts-19+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/login.ts-8+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/logout.ts-56+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/password-reset.ts-272+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/schedule-pages.ts-0+32App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/schedules-api.ts-0+179App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/session.ts-29+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/handlers/signup.ts-8+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/hex.ts-5+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/layout.ts-7+7App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/password-hash.ts-1+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/router.ts-40+28App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/routes.ts-14+12App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/schedule-service.ts-0+285App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

server/scheduling-repository.ts-0+394App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

shared/hex.ts-5+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

shared/password-hash.test.ts-19+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

shared/password-hash.ts-129+0App 1Copy app 2 file to app 1 (Option+Command to sync without opening)Copy app 1 file to app 2 (Option+Command to sync without opening)App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2

App 1
App 2