Address the following comment on packages/auth/src/storage.ts at line 2:

<comment>Use a type-only import for SecondaryStorage to avoid adding an unnecessary runtime dependency to the bundle.

(This reflects your team&#39;s feedback about using type-only imports for types to keep bundles lean.)</comment>

<file context>
@@ -0,0 +1,27 @@
+import { Redis } from &quot;@upstash/redis&quot;;
+import { SecondaryStorage } from &quot;better-auth&quot;;
+
+import { env } from &quot;@repo/env/server&quot;;
</file context>

Address the following comment on packages/auth/src/storage.ts at line 15:

<comment>Ensure get always returns a string or null; stringify non-string values to prevent downstream type/parse errors.

(Based on your team&#39;s feedback about strict adherence to SecondaryStorage string contract to avoid runtime inconsistencies.)</comment>

<file context>
@@ -0,0 +1,27 @@
+  get: async (key) =&gt; {
+    const value = await redis.get&lt;string&gt;(key);
+
+    return value ?? null;
+  },
+  set: async (key, value, ttl) =&gt; {
</file context>

Address the following comment on packages/api/src/providers/google-calendar/channel.ts at line 67:

<comment>Channel token not enforced when missing, allowing spoofed notifications without token</comment>

<file context>
@@ -0,0 +1,115 @@
+      return new Response(&quot;Channel not found&quot;, { status: 404 });
+    }
+
+    if (headers.token &amp;&amp; headers.token !== channel.token) {
+      return new Response(&quot;Invalid channel token&quot;, { status: 401 });
+    }
</file context>

Address the following comment on packages/db/src/schema/auth.ts at line 80:

<comment>Schema change without migration: added account.calendarListSyncToken but no DB migration adds the column, causing runtime query errors</comment>

<file context>
@@ -77,6 +77,7 @@ export const account = pgTable(
     refreshTokenExpiresAt: timestamp(),
     scope: text(),
     password: text(),
+    calendarListSyncToken: text(&quot;calendar_list_sync_token&quot;),
     createdAt: timestamp().notNull(),
     updatedAt: timestamp().notNull(),
</file context>

Address the following comment on packages/api/src/providers/google-calendar/subscribe.ts at line 29:

<comment>expiration is a string millisecond timestamp; constructing Date with a numeric string yields Invalid Date, causing incorrect expiresAt and potential runtime errors.</comment>

<file context>
@@ -0,0 +1,79 @@
+    type: &quot;google.calendar&quot; as const,
+    subscriptionId,
+    resourceId: response.resourceId!,
+    expiresAt: new Date(response.expiration!),
+  };
+}
</file context>

Address the following comment on packages/db/src/schema/channel.ts at line 13:

<comment>Add indexes for accountId and resourceId to avoid slow lookups and joins; consider a composite index if queries filter by both.</comment>

<file context>
@@ -0,0 +1,31 @@
+    .$default(() =&gt; newId(&quot;channel&quot;)),
+
+  // TODO: when an account is deleted, we should first stop channel subscriptions and then delete all channels associated with it
+  accountId: text()
+    .notNull()
+    .references(() =&gt; account.id, { onDelete: &quot;cascade&quot; }),
</file context>

Address the following comment on packages/api/src/providers/google-calendar/channels/headers.ts at line 3:

<comment>Import is used only in a type position; prefer a type-only import to avoid an unnecessary runtime dependency and improve tree-shaking.</comment>

<file context>
@@ -0,0 +1,40 @@
+import { z } from &quot;zod&quot;;
+
+import { channel } from &quot;@repo/db/schema&quot;;
+
+export type ChannelHeaders = z.infer&lt;typeof headersSchema&gt;;
</file context>

Address the following comment on packages/api/src/providers/calendars/google-calendar.ts at line 281:

<comment>Hard-coding readOnly to false misrepresents destination calendar permissions; use destinationCalendar.readOnly for correctness and consistency.</comment>

<file context>
@@ -273,7 +277,8 @@ export class GoogleCalendarProvider implements CalendarProvider {
       return parseGoogleCalendarEvent({
-        calendar: destinationCalendar,
+        calendarId: destinationCalendar.id,
+        readOnly: false,
         accountId: this.accountId,
         event: moved,
</file context>

Address the following comment on packages/api/src/providers/google-calendar/channels/calendars.ts at line 21:

<comment>Primary key conflates calendars across accounts; upsert updates cross-tenant due to conflict on id only.</comment>

<file context>
@@ -0,0 +1,74 @@
+      calendarId: calendar.id,
+    })
+    .onConflictDoUpdate({
+      target: [calendars.id],
+      set: calendar,
+    });
</file context>

Address the following comment on packages/db/src/schema/resource.ts at line 8:

<comment>Use $defaultFn for function-based default so newId(&quot;resource&quot;) is evaluated per insert.</comment>

<file context>
@@ -0,0 +1,16 @@
+export const resource = pgTable(&quot;resource&quot;, {
+  id: text()
+    .primaryKey()
+    .$default(() =&gt; newId(&quot;resource&quot;)),
+  providerId: text({ enum: [&quot;google&quot;] }).notNull(),
+
</file context>