{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "A connected calendar whose busy time subtracts from availability.",
      "key": "tid",
      "record": {
        "properties": {
          "createdAt": {
            "format": "datetime",
            "type": "string"
          },
          "kind": {
            "enum": [
              "ics",
              "caldav",
              "google"
            ],
            "type": "string"
          },
          "name": {
            "maxLength": 200,
            "type": "string"
          },
          "secret": {
            "description": "CalDAV password / app password (at most 1000 characters of plaintext), sealed at rest: an AES-256-GCM envelope (enc1:<iv>.<ciphertext>) under a key derived per host from the Tandem deployment's key, so only that deployment can read it. Records written before 2026-09-07 may still hold the plaintext until the host's next visit reseals them.",
            "maxLength": 2000,
            "type": "string"
          },
          "url": {
            "description": "ICS feed address, CalDAV calendar URL, or for kind=google the calendar's REST URL (https://www.googleapis.com/calendar/v3/calendars/<id>). For google, `username` is the account and no secret is stored: the OAuth grant lives with the Tandem deployment that made it.",
            "format": "uri",
            "type": "string"
          },
          "username": {
            "maxLength": 300,
            "type": "string"
          },
          "writeBack": {
            "description": "This calendar receives an event for each booking. CalDAV only; at most one source per host carries it.",
            "type": "boolean"
          }
        },
        "required": [
          "name",
          "kind",
          "url",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "id": "space.intandem.calendarSource",
  "lexicon": 1
}