@aaronsb/google-workspace-mcp 4.2.0 → 4.3.0

package/README.md

@@ -5,7 +5,7 @@
 [![Node](https://img.shields.io/node/v/@aaronsb/google-workspace-mcp?logo=node.js&label=node)](https://nodejs.org)
 [![License](https://img.shields.io/github/license/aaronsb/google-workspace-mcp)](LICENSE)
 
-**Give your AI agent real access to Google Workspace** — Gmail, Calendar, Drive, Docs, Sheets, Tasks and Meet — from one MCP server, across as many accounts as you have.
+**Give your AI agent real access to Google Workspace** — Gmail, Calendar, Drive, Docs, Sheets, Tasks, Meet and Contacts — from one MCP server, across as many accounts as you have.
 
 Search your mail, check your calendar, write a doc, file a task — in conversation, as yourself.
 
@@ -15,7 +15,7 @@ First, you need **Google OAuth credentials** — the one prerequisite common to
 
 1. Go to [console.cloud.google.com/apis/credentials](https://console.cloud.google.com/apis/credentials)
 2. Create an **OAuth 2.0 Client ID**, application type **Desktop app**
-3. Enable the APIs you want (Gmail, Calendar, Drive, Sheets, Docs, Tasks, Meet)
+3. Enable the APIs you want (Gmail, Calendar, Drive, Sheets, Docs, Tasks, Meet — and **People API** for contacts, which is what Google calls it in the console)
 4. Keep the **Client ID** and **Client Secret** handy — you'll paste them in below
 
 Then pick the path that matches how you work. All three run the same server.
@@ -90,7 +90,7 @@ flowchart LR
     agent["🤖 Your AI agent<br>Claude Desktop, Claude Code…"]
     server["⚙️ This MCP server<br>picks the right account,<br>builds the real request"]
     keys[("🔑 Your accounts<br>OAuth tokens, kept<br>on your own machine")]
-    google["☁️ Google<br>Gmail · Calendar · Drive<br>Docs · Sheets · Tasks · Meet"]
+    google["☁️ Google<br>Gmail · Calendar · Drive · Docs<br>Sheets · Tasks · Meet · Contacts"]
 
     human -->|"“what's on my calendar?”"| agent
     agent -->|"tool call"| server
@@ -117,7 +117,7 @@ flowchart LR
 
 ## What it can do
 
-**11 tools across 7 Google services**, plus multi-account handling, batching, content authoring, and a file sandbox.
+**12 tools across 8 Google services**, plus multi-account handling, batching, content authoring, and a file sandbox.
 
 | Tool | What It Does |
 |------|--------------|
@@ -127,7 +127,8 @@ flowchart LR
 | `manage_sheets` | Sheets — read / write ranges (row-numbered output), append, clear, manage tabs, copy / duplicate / rename |
 | `manage_docs` | Docs — get, create, append, insert text, find-and-replace |
 | `manage_tasks` | Tasks — list / create / update / complete tasks and task lists |
-| `manage_meet` | Meet — browse past conferences, participants, transcripts, recordings, smart notes |
+| `manage_meet` | Meet — create and configure meeting spaces, see who is in a call now, browse past conferences, participants, transcripts, recordings, smart notes |
+| `manage_contacts` | Contacts — look people up in your saved contacts, the addresses you have only corresponded with, and your organization's directory; create, update and delete contacts |
 | `manage_accounts` | Multi-account lifecycle — add accounts, manage credentials and scopes |
 | `manage_scratchpad` | Compose / edit multi-line content (line- or JSON-path-addressed), attach files, send to any target; JSON mode live-syncs to Docs / Sheets |
 | `manage_workspace` | File operations in the workspace sandbox (exchange point for attachments, downloads, exports) |

package/build/accounts/auth.d.ts

@@ -1,9 +1,18 @@
+import type { AccessLevel } from './oauth.js';
 export interface AuthResult {
     status: 'success' | 'error';
     account?: string;
     credentialPath?: string;
     error?: string;
     errorType?: string;
+    /** What the account was authorized for. */
+    access?: AccessLevel;
+    /**
+     * Services asked for as read-only that can still write, because Google offers no
+     * read-only scope for them. Non-empty means this account got more access than was
+     * asked for, and the response has to say so (ADR-202).
+     */
+    stillAllowWrites?: string[];
 }
 export interface AccountStatus {
     email: string;
@@ -11,17 +20,24 @@ export interface AccountStatus {
     scopes: string[];
     scopeCount: number;
     hasRefreshToken: boolean;
+    /** Absent on credentials written before ADR-202, which are all read/write. */
+    access: AccessLevel;
+    /** Services that can still write despite `access: 'read'`. Empty for full access. */
+    stillAllowWrites: string[];
 }
 /**
  * Authenticate a new account via our own OAuth2 flow.
  * Requests all service scopes by default.
+ *
+ * `access` defaults to 'readwrite', so an account authorized without naming it is
+ * granted exactly what it would have been before ADR-202.
  */
-export declare function authenticateAccount(clientId: string, clientSecret: string): Promise<AuthResult>;
+export declare function authenticateAccount(clientId: string, clientSecret: string, access?: AccessLevel): Promise<AuthResult>;
 /**
  * Re-authenticate with a specific set of services.
  * Used by the `scopes` operation as an escape hatch.
  */
-export declare function reauthWithServices(clientId: string, clientSecret: string, services: string): Promise<AuthResult>;
+export declare function reauthWithServices(clientId: string, clientSecret: string, services: string, access?: AccessLevel): Promise<AuthResult>;
 /**
  * Check account status: token validity and granted scopes.
  * Reads scopes from the per-account credential file.

package/build/accounts/auth.js

@@ -5,18 +5,23 @@ import { getAccessToken, invalidateToken } from './token-service.js';
 /**
  * Authenticate a new account via our own OAuth2 flow.
  * Requests all service scopes by default.
+ *
+ * `access` defaults to 'readwrite', so an account authorized without naming it is
+ * granted exactly what it would have been before ADR-202.
  */
-export async function authenticateAccount(clientId, clientSecret) {
-    const scopes = scopesForServices(ALL_SERVICES);
-    return runOAuth(clientId, clientSecret, scopes);
+export async function authenticateAccount(clientId, clientSecret, access = 'readwrite') {
+    const { scopes, stillAllowWrites } = scopesForServices(ALL_SERVICES, access);
+    const result = await runOAuth(clientId, clientSecret, scopes, access, stillAllowWrites);
+    return { ...result, access, stillAllowWrites };
 }
 /**
  * Re-authenticate with a specific set of services.
  * Used by the `scopes` operation as an escape hatch.
  */
-export async function reauthWithServices(clientId, clientSecret, services) {
-    const scopes = scopesForServices(services);
-    return runOAuth(clientId, clientSecret, scopes);
+export async function reauthWithServices(clientId, clientSecret, services, access = 'readwrite') {
+    const { scopes, stillAllowWrites } = scopesForServices(services, access);
+    const result = await runOAuth(clientId, clientSecret, scopes, access, stillAllowWrites);
+    return { ...result, access, stillAllowWrites };
 }
 /**
  * Check account status: token validity and granted scopes.
@@ -32,6 +37,8 @@ export async function checkAccountStatus(email) {
             scopes: [],
             scopeCount: 0,
             hasRefreshToken: false,
+            access: 'readwrite',
+            stillAllowWrites: [],
         };
     }
     const cred = await readCredential(email);
@@ -51,18 +58,35 @@ export async function checkAccountStatus(email) {
         scopes,
         scopeCount: scopes.length,
         hasRefreshToken,
+        // Absent means read/write — see AuthorizedUserCredential.access.
+        access: cred.access ?? 'readwrite',
+        stillAllowWrites: cred.stillAllowWrites ?? [],
     };
 }
 // --- Internal ---
-async function runOAuth(clientId, clientSecret, scopes) {
+async function runOAuth(clientId, clientSecret, scopes, access = 'readwrite', stillAllowWrites = []) {
     try {
         const result = await runOAuthFlow(clientId, clientSecret, scopes);
+        // `result.scopes` is what Google GRANTED, which is not always what was asked for:
+        // the consent screen lets the user untick individual permissions before approving.
+        // Storing what was granted rather than what was requested means the call-time check
+        // in factory/safety.ts tests what the token can actually do (ADR-202).
+        //
+        // `access` is stored because nothing else records what this account was authorized
+        // FOR. The granted scopes say what the token can do; they do not say whether a human
+        // chose to hold it back. `status` reads it, and the call-time policy in ADR-202 will.
+        //
+        // It is NOT needed to protect `refresh`: refreshAccessToken posts grant_type=
+        // refresh_token with no scope parameter and never writes a credential, so a refresh
+        // cannot widen anything. An earlier version of this comment claimed otherwise.
         await saveCredential(result.email, {
             type: 'authorized_user',
             client_id: clientId,
             client_secret: clientSecret,
             refresh_token: result.refreshToken,
             scopes: result.scopes,
+            access,
+            ...(stillAllowWrites.length ? { stillAllowWrites } : {}),
         });
         invalidateToken(result.email);
         return {

package/build/accounts/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/accounts/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAkBrE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,YAAoB;IAEpB,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,YAAoB,EACpB,QAAgB;IAEhB,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK;YACL,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAEjC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5B,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO;QACL,KAAK;QACL,UAAU;QACV,MAAM;QACN,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,mBAAmB;AAEnB,KAAK,UAAU,QAAQ,CACrB,QAAgB,EAChB,YAAoB,EACpB,MAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAElE,MAAM,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE;YACjC,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,OAAO;YACf,KAAK,EAAG,GAAa,CAAC,OAAO;YAC7B,SAAS,EAAG,GAAa,CAAC,IAAI;SAC/B,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/accounts/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE3E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA8BrE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,YAAoB,EACpB,SAAsB,WAAW;IAEjC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACxF,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAgB,EAChB,YAAoB,EACpB,QAAgB,EAChB,SAAsB,WAAW;IAEjC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACxF,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAa;IACpD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK;YACL,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,WAAW;YACnB,gBAAgB,EAAE,EAAE;SACrB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IAEjC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5B,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO;QACL,KAAK;QACL,UAAU;QACV,MAAM;QACN,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,eAAe;QACf,iEAAiE;QACjE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW;QAClC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,mBAAmB;AAEnB,KAAK,UAAU,QAAQ,CACrB,QAAgB,EAChB,YAAoB,EACpB,MAAgB,EAChB,SAAsB,WAAW,EACjC,mBAA6B,EAAE;IAE/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAElE,kFAAkF;QAClF,mFAAmF;QACnF,oFAAoF;QACpF,uEAAuE;QACvE,EAAE;QACF,mFAAmF;QACnF,qFAAqF;QACrF,sFAAsF;QACtF,EAAE;QACF,8EAA8E;QAC9E,oFAAoF;QACpF,+EAA+E;QAC/E,MAAM,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE;YACjC,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM;YACN,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QAEH,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE9B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,OAAO;YACf,KAAK,EAAG,GAAa,CAAC,OAAO;YAC7B,SAAS,EAAG,GAAa,CAAC,IAAI;SAC/B,CAAC;IACJ,CAAC;AACH,CAAC"}

package/build/accounts/credentials.d.ts

@@ -3,7 +3,27 @@ export interface AuthorizedUserCredential {
     client_id: string;
     client_secret: string;
     refresh_token: string;
+    /**
+     * The scopes Google actually GRANTED. Can be fewer than were requested: the consent
+     * screen lets the user untick individual permissions before approving.
+     */
     scopes?: string[];
+    /**
+     * What this account was authorized for (ADR-202).
+     *
+     * ABSENT means read/write. Every credential written before ADR-202 lacks the field and
+     * carries read/write scopes, so absence and 'readwrite' are the same claim — reading it
+     * as 'read' would lock existing accounts out of operations their tokens permit.
+     */
+    access?: 'read' | 'readwrite';
+    /**
+     * Services that were asked for as read-only and can still write, because Google offers
+     * no read-only scope for them and the caller confirmed anyway.
+     *
+     * Stored because `access` alone would misdescribe such an account: it says 'read' while
+     * the token can change these services.
+     */
+    stillAllowWrites?: string[];
 }
 export declare function hasCredential(email: string): Promise<boolean>;
 export declare function saveCredential(email: string, credential: AuthorizedUserCredential): Promise<string>;

package/build/accounts/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/accounts/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAUtE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,UAAoC;IACtF,IAAI,UAAU,EAAE,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;IAE9D,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,2CAA2C,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,oCAAoC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,sCAAsC,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,MAA6C,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/accounts/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AA8BtE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,UAAoC;IACtF,IAAI,UAAU,EAAE,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;IAE9D,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,2CAA2C,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,oCAAoC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,sCAAsC,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,MAA6C,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/build/accounts/oauth.d.ts

@@ -1,5 +1,39 @@
 /** Service name → OAuth scope URL(s). */
 export declare const SERVICE_SCOPE_MAP: Record<string, string[]>;
+/**
+ * Service name → READ-ONLY scope URL(s), for accounts authorized with `access: 'read'`.
+ *
+ * A service is missing from this map when Google offers no read-only scope for it. That
+ * is NOT treated as "use the read/write scope and say nothing": someone who asked for
+ * read access would get write access without being told. `scopesForServices` reports
+ * those services instead, so the person consenting can be told before the browser opens
+ * (ADR-202).
+ *
+ * Every service currently has an entry, so nothing is granted more than was asked for
+ * today. The reporting path still exists because the next service added may not have
+ * one, and finding that out from a silently broad token is the wrong way to find out.
+ *
+ * Measured against descriptor.json rather than assumed:
+ *
+ * - calendar, docs, gmail, tasks — the scope below covers every GET method exposed.
+ * - meet — `meetings.space.readonly` authorizes every READ manage_meet exposes: all the
+ *   conference-record operations, plus getSpace. The tool also creates, updates and ends
+ *   meeting spaces, and those three need `meetings.space.created` or `.settings`, so a
+ *   read-only meet account holds the readonly scope alone and Google refuses the writes.
+ *   That is the mapping working, not a gap in it. Meet was very nearly left out of this
+ *   map entirely by reading "has no read-only variant" off the scope list instead of off
+ *   what each operation needs.
+ * - drive, sheets — two GET methods and one respectively that no read-only scope covers,
+ *   so read access there allows less than full access but slightly more than reading.
+ * - contacts — only the first of its three scopes has a write form. `contacts.readonly`
+ *   replaces `contacts`; `contacts.other.readonly` and `directory.readonly` are already
+ *   read-only and so are identical in both maps. A read-only contacts account reaches
+ *   every read manage_contacts has and is refused `create` by Google, which is the
+ *   mapping working.
+ */
+export declare const SERVICE_SCOPE_MAP_READONLY: Record<string, string[]>;
+/** How much authority an account's token carries. */
+export type AccessLevel = 'read' | 'readwrite';
 /** All service names that have scope mappings. */
 export declare const ALL_SERVICES: string;
 export interface OAuthResult {
@@ -9,11 +43,27 @@ export interface OAuthResult {
     expiresIn: number;
     scopes: string[];
 }
+/** The scopes to request, plus any service that did not get the access level asked for. */
+export interface ResolvedScopes {
+    scopes: string[];
+    /**
+     * Services asked for as read-only that will still be able to write, because Google
+     * offers no read-only scope for them. Always empty when asking for read/write.
+     *
+     * The caller has to tell the user about these. It is the difference between "you asked
+     * for read access and got read access" and "you asked for read access and part of this
+     * can still change your data".
+     */
+    stillAllowWrites: string[];
+}
 /**
  * Convert comma-separated service names to deduplicated scope URLs.
  * Always includes base scopes (openid, userinfo.email).
+ *
+ * `access` defaults to 'readwrite', so every existing caller and every account
+ * authorized before ADR-202 resolves exactly as it did.
  */
-export declare function scopesForServices(services: string): string[];
+export declare function scopesForServices(services: string, access?: AccessLevel): ResolvedScopes;
 /**
  * Run a full OAuth2 authorization code flow with a localhost callback server.
  *

package/build/accounts/oauth.js

@@ -20,6 +20,60 @@ export const SERVICE_SCOPE_MAP = {
         'https://www.googleapis.com/auth/meetings.space.readonly',
         'https://www.googleapis.com/auth/meetings.space.settings',
     ],
+    // manage_contacts reads three separate collections and Google gates each behind its
+    // own scope: your saved contacts, the addresses you have only corresponded with, and
+    // the organization directory. Two of the three have no write form at all.
+    contacts: [
+        'https://www.googleapis.com/auth/contacts',
+        'https://www.googleapis.com/auth/contacts.other.readonly',
+        'https://www.googleapis.com/auth/directory.readonly',
+    ],
+};
+/**
+ * Service name → READ-ONLY scope URL(s), for accounts authorized with `access: 'read'`.
+ *
+ * A service is missing from this map when Google offers no read-only scope for it. That
+ * is NOT treated as "use the read/write scope and say nothing": someone who asked for
+ * read access would get write access without being told. `scopesForServices` reports
+ * those services instead, so the person consenting can be told before the browser opens
+ * (ADR-202).
+ *
+ * Every service currently has an entry, so nothing is granted more than was asked for
+ * today. The reporting path still exists because the next service added may not have
+ * one, and finding that out from a silently broad token is the wrong way to find out.
+ *
+ * Measured against descriptor.json rather than assumed:
+ *
+ * - calendar, docs, gmail, tasks — the scope below covers every GET method exposed.
+ * - meet — `meetings.space.readonly` authorizes every READ manage_meet exposes: all the
+ *   conference-record operations, plus getSpace. The tool also creates, updates and ends
+ *   meeting spaces, and those three need `meetings.space.created` or `.settings`, so a
+ *   read-only meet account holds the readonly scope alone and Google refuses the writes.
+ *   That is the mapping working, not a gap in it. Meet was very nearly left out of this
+ *   map entirely by reading "has no read-only variant" off the scope list instead of off
+ *   what each operation needs.
+ * - drive, sheets — two GET methods and one respectively that no read-only scope covers,
+ *   so read access there allows less than full access but slightly more than reading.
+ * - contacts — only the first of its three scopes has a write form. `contacts.readonly`
+ *   replaces `contacts`; `contacts.other.readonly` and `directory.readonly` are already
+ *   read-only and so are identical in both maps. A read-only contacts account reaches
+ *   every read manage_contacts has and is refused `create` by Google, which is the
+ *   mapping working.
+ */
+export const SERVICE_SCOPE_MAP_READONLY = {
+    gmail: ['https://www.googleapis.com/auth/gmail.readonly'],
+    drive: ['https://www.googleapis.com/auth/drive.readonly'],
+    calendar: ['https://www.googleapis.com/auth/calendar.readonly'],
+    sheets: ['https://www.googleapis.com/auth/spreadsheets.readonly'],
+    docs: ['https://www.googleapis.com/auth/documents.readonly'],
+    tasks: ['https://www.googleapis.com/auth/tasks.readonly'],
+    slides: ['https://www.googleapis.com/auth/presentations.readonly'],
+    meet: ['https://www.googleapis.com/auth/meetings.space.readonly'],
+    contacts: [
+        'https://www.googleapis.com/auth/contacts.readonly',
+        'https://www.googleapis.com/auth/contacts.other.readonly',
+        'https://www.googleapis.com/auth/directory.readonly',
+    ],
 };
 const BASE_SCOPES = [
     'openid',
@@ -30,19 +84,29 @@ export const ALL_SERVICES = Object.keys(SERVICE_SCOPE_MAP).join(',');
 /**
  * Convert comma-separated service names to deduplicated scope URLs.
  * Always includes base scopes (openid, userinfo.email).
+ *
+ * `access` defaults to 'readwrite', so every existing caller and every account
+ * authorized before ADR-202 resolves exactly as it did.
  */
-export function scopesForServices(services) {
+export function scopesForServices(services, access = 'readwrite') {
     const names = services.split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
     const scopes = new Set(BASE_SCOPES);
+    const stillAllowWrites = [];
     for (const name of names) {
-        const mapped = SERVICE_SCOPE_MAP[name];
-        if (!mapped) {
+        const readwrite = SERVICE_SCOPE_MAP[name];
+        if (!readwrite) {
             throw new Error(`Unknown service: '${name}'. Known: ${Object.keys(SERVICE_SCOPE_MAP).join(', ')}`);
         }
-        for (const scope of mapped)
+        // Read access uses the read-only scope where Google offers one. Where it does not,
+        // the service keeps its read/write scope AND is reported — see
+        // SERVICE_SCOPE_MAP_READONLY.
+        const readonly = access === 'read' ? SERVICE_SCOPE_MAP_READONLY[name] : undefined;
+        if (access === 'read' && !readonly)
+            stillAllowWrites.push(name);
+        for (const scope of readonly ?? readwrite)
             scopes.add(scope);
     }
-    return [...scopes];
+    return { scopes: [...scopes], stillAllowWrites };
 }
 /**
  * Run a full OAuth2 authorization code flow with a localhost callback server.

package/build/accounts/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/accounts/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,MAAM,eAAe,GAAG,2CAA2C,CAAC;AACpE,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAE5E,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,YAAY;AAEjD,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAA6B;IACzD,KAAK,EAAK,CAAC,8CAA8C,CAAC;IAC1D,KAAK,EAAK,CAAC,uCAAuC,CAAC;IACnD,QAAQ,EAAE,CAAC,0CAA0C,CAAC;IACtD,MAAM,EAAI,CAAC,8CAA8C,CAAC;IAC1D,IAAI,EAAM,CAAC,2CAA2C,CAAC;IACvD,KAAK,EAAK,CAAC,uCAAuC,CAAC;IACnD,MAAM,EAAI,CAAC,+CAA+C,CAAC;IAC3D,IAAI,EAAE;QACJ,wDAAwD;QACxD,yDAAyD;QACzD,yDAAyD;KAC1D;CACF,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,QAAQ;IACR,gDAAgD;CACjD,CAAC;AAEF,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAUrE;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,aAAa,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,YAAoB,EACpB,MAAgB;IAEhB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE9C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAE/E,yCAAyC;IACzC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,IAAI;YACJ,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAKzC,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uFAAuF;YACvF,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;QACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;KAC/D,CAAC,CAAC;IAEH,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAuB,CAAC;IAEpE,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,SAAS,CAAC,YAAY;QACnC,YAAY,EAAE,SAAS,CAAC,aAAa;QACrC,SAAS,EAAE,SAAS,CAAC,UAAU;QAC/B,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,mBAAmB;AAEnB,SAAS,iBAAiB,CACxB,QAAgB,EAChB,MAAgB,EAChB,KAAa;IAEb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACxE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,oCAAoC;YACpC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAC;gBAClG,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAEpD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,uBAAuB;YAE1C,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;gBACtG,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;YACtG,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,oFAAoF;QACpF,IAAI,KAAoC,CAAC;QAEzC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,WAAW,GAAG,oBAAoB,IAAI,CAAC,IAAI,WAAW,CAAC;YAEvD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACpF,WAAW,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACpF,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,QAAgB,EAChB,WAAmB,EACnB,MAAgB,EAChB,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,SAAS;QACjB,KAAK;KACN,CAAC,CAAC;IACH,OAAO,GAAG,eAAe,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,OAAO,GAAG,CAAC,GAAiB,EAAE,EAAE;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,GAAG,IAAI,CAAC,CAAC;IACnF,CAAC,CAAC;IAEF,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,+DAA+D;QAC/D,oEAAoE;QACpE,2CAA2C;QAC3C,IAAI,CAAC,oBAAoB,GAAG,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,QAAQ,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAC1D,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;AACH,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../src/accounts/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,MAAM,eAAe,GAAG,2CAA2C,CAAC;AACpE,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAE5E,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,YAAY;AAEjD,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAA6B;IACzD,KAAK,EAAK,CAAC,8CAA8C,CAAC;IAC1D,KAAK,EAAK,CAAC,uCAAuC,CAAC;IACnD,QAAQ,EAAE,CAAC,0CAA0C,CAAC;IACtD,MAAM,EAAI,CAAC,8CAA8C,CAAC;IAC1D,IAAI,EAAM,CAAC,2CAA2C,CAAC;IACvD,KAAK,EAAK,CAAC,uCAAuC,CAAC;IACnD,MAAM,EAAI,CAAC,+CAA+C,CAAC;IAC3D,IAAI,EAAE;QACJ,wDAAwD;QACxD,yDAAyD;QACzD,yDAAyD;KAC1D;IACD,oFAAoF;IACpF,qFAAqF;IACrF,0EAA0E;IAC1E,QAAQ,EAAE;QACR,0CAA0C;QAC1C,yDAAyD;QACzD,oDAAoD;KACrD;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA6B;IAClE,KAAK,EAAK,CAAC,gDAAgD,CAAC;IAC5D,KAAK,EAAK,CAAC,gDAAgD,CAAC;IAC5D,QAAQ,EAAE,CAAC,mDAAmD,CAAC;IAC/D,MAAM,EAAI,CAAC,uDAAuD,CAAC;IACnE,IAAI,EAAM,CAAC,oDAAoD,CAAC;IAChE,KAAK,EAAK,CAAC,gDAAgD,CAAC;IAC5D,MAAM,EAAI,CAAC,wDAAwD,CAAC;IACpE,IAAI,EAAM,CAAC,yDAAyD,CAAC;IACrE,QAAQ,EAAE;QACR,mDAAmD;QACnD,yDAAyD;QACzD,oDAAoD;KACrD;CACF,CAAC;AAKF,MAAM,WAAW,GAAG;IAClB,QAAQ;IACR,gDAAgD;CACjD,CAAC;AAEF,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAwBrE;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,SAAsB,WAAW;IAEjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAC5C,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,aAAa,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QAED,mFAAmF;QACnF,+DAA+D;QAC/D,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ;YAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhE,KAAK,MAAM,KAAK,IAAI,QAAQ,IAAI,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,YAAoB,EACpB,MAAgB;IAEhB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE9C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAE/E,yCAAyC;IACzC,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,IAAI;YACJ,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;SACjC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAKzC,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,uFAAuF;YACvF,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,mBAAmB,EAAE;QACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;KAC/D,CAAC,CAAC;IAEH,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4BAA4B,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAuB,CAAC;IAEpE,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,SAAS,CAAC,YAAY;QACnC,YAAY,EAAE,SAAS,CAAC,aAAa;QACrC,SAAS,EAAE,SAAS,CAAC,UAAU;QAC/B,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,mBAAmB;AAEnB,SAAS,iBAAiB,CACxB,QAAgB,EAChB,MAAgB,EAChB,KAAa;IAEb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACxE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAExD,oCAAoC;YACpC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBAC/D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAC;gBAClG,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAEpD,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,uBAAuB;YAE1C,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;gBACtG,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;YACtG,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,oFAAoF;QACpF,IAAI,KAAoC,CAAC;QAEzC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,WAAW,GAAG,oBAAoB,IAAI,CAAC,IAAI,WAAW,CAAC;YAEvD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACpF,WAAW,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACpF,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,QAAgB,EAChB,WAAmB,EACnB,MAAgB,EAChB,KAAa;IAEb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,SAAS;QACjB,KAAK;KACN,CAAC,CAAC;IACH,OAAO,GAAG,eAAe,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,OAAO,GAAG,CAAC,GAAiB,EAAE,EAAE;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QACxF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,GAAG,IAAI,CAAC,CAAC;IACnF,CAAC,CAAC;IAEF,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,+DAA+D;QAC/D,oEAAoE;QACpE,2CAA2C;QAC3C,IAAI,CAAC,oBAAoB,GAAG,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,QAAQ,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAC1D,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;AACH,CAAC"}

package/build/accounts/registry.d.ts

@@ -1,3 +1,4 @@
+import type { AccessLevel } from './oauth.js';
 import { type AuthResult } from './auth.js';
 export interface Account {
     email: string;
@@ -8,4 +9,4 @@ export declare function listAccounts(): Promise<Account[]>;
 export declare function getAccount(email: string): Promise<Account | undefined>;
 export declare function addAccount(email: string, category?: Account['category'], description?: string): Promise<Account>;
 export declare function removeAccount(email: string): Promise<void>;
-export declare function authenticateAndAddAccount(clientId: string, clientSecret: string, category?: Account['category'], description?: string): Promise<AuthResult>;
+export declare function authenticateAndAddAccount(clientId: string, clientSecret: string, category?: Account['category'], description?: string, access?: AccessLevel): Promise<AuthResult>;

package/build/accounts/registry.js

@@ -49,8 +49,8 @@ export async function removeAccount(email) {
     await writeAccounts(data);
     await removeCredential(email);
 }
-export async function authenticateAndAddAccount(clientId, clientSecret, category = 'personal', description) {
-    const result = await authenticateAccount(clientId, clientSecret);
+export async function authenticateAndAddAccount(clientId, clientSecret, category = 'personal', description, access = 'readwrite') {
+    const result = await authenticateAccount(clientId, clientSecret, access);
     if (result.status === 'success' && result.account) {
         const existing = await getAccount(result.account);
         if (!existing) {

package/build/accounts/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/accounts/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAmB,MAAM,WAAW,CAAC;AAYjE,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAkB;IAC7C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAC1C,gCAAgC;IAChC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,OAAO;QACV,aAAa,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;KAClD,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa;IAC5C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAa,EACb,WAAgC,UAAU,EAC1C,WAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAElC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAE9D,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgB,EAChB,YAAoB,EACpB,WAAgC,UAAU,EAC1C,WAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEjE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/accounts/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAmB,MAAM,WAAW,CAAC;AAYjE,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAkB;IAC7C,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAC1C,gCAAgC;IAChC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,OAAO;QACV,aAAa,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;KAClD,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa;IAC5C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;IAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAa,EACb,WAAgC,UAAU,EAC1C,WAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAElC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAa;IAC/C,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAE9D,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgB,EAChB,YAAoB,EACpB,WAAgC,UAAU,EAC1C,WAAoB,EACpB,SAAsB,WAAW;IAEjC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAEzE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/build/factory/manifest/calendar.yaml

@@ -13,10 +13,10 @@ operations:
     params:
       calendarId:
         type: string
-        description: "Calendar ID to query (default: 'primary'). Use 'calendars' operation to list available IDs."
+        description: "Calendar ID. Use the `calendars` operation to list available IDs; required for events on shared calendars. Defaults to 'primary' on the event operations (`list`, `get`, `create`, `quickAdd`, `update`, `delete`). On `agenda`, a calendar name or ID to filter to — OMIT it to span all calendars, and do not pass 'primary', which is an API alias rather than an id agenda matches on. On `freebusy`, a comma-separated list of calendar IDs to check IN ADDITION to your own."
       timeMin:
         type: string
-        description: "Start of range (ISO 8601) — defaults to today"
+        description: "Start of range (ISO 8601). On `list`, defaults to today."
       timeMax:
         type: string
         description: "End of range (ISO 8601)"
@@ -40,7 +40,7 @@ operations:
     params:
       calendarId:
         type: string
-        description: "Filter to a specific calendar name or ID"
+        description: "Calendar ID. Use the `calendars` operation to list available IDs; required for events on shared calendars. Defaults to 'primary' on the event operations (`list`, `get`, `create`, `quickAdd`, `update`, `delete`). On `agenda`, a calendar name or ID to filter to — OMIT it to span all calendars, and do not pass 'primary', which is an API alias rather than an id agenda matches on. On `freebusy`, a comma-separated list of calendar IDs to check IN ADDITION to your own."
       days:
         type: number
         description: "Number of days ahead to show (default: today only)"
@@ -58,7 +58,7 @@ operations:
     params:
       calendarId:
         type: string
-        description: "Calendar ID (default: 'primary'). Required for events on shared calendars."
+        description: "Calendar ID. Use the `calendars` operation to list available IDs; required for events on shared calendars. Defaults to 'primary' on the event operations (`list`, `get`, `create`, `quickAdd`, `update`, `delete`). On `agenda`, a calendar name or ID to filter to — OMIT it to span all calendars, and do not pass 'primary', which is an API alias rather than an id agenda matches on. On `freebusy`, a comma-separated list of calendar IDs to check IN ADDITION to your own."
       eventId:
         type: string
         description: "Event ID"
@@ -74,7 +74,7 @@ operations:
     params:
       calendarId:
         type: string
-        description: "Calendar ID (default: 'primary')"
+        description: "Calendar ID. Use the `calendars` operation to list available IDs; required for events on shared calendars. Defaults to 'primary' on the event operations (`list`, `get`, `create`, `quickAdd`, `update`, `delete`). On `agenda`, a calendar name or ID to filter to — OMIT it to span all calendars, and do not pass 'primary', which is an API alias rather than an id agenda matches on. On `freebusy`, a comma-separated list of calendar IDs to check IN ADDITION to your own."
       summary:
         type: string
         description: "Event title"
@@ -95,10 +95,10 @@ operations:
         description: "Event location"
       attendees:
         type: string
-        description: "Comma-separated attendee emails"
+        description: "Comma-separated email addresses. On `update`, whatever you pass REPLACES the existing list — addresses you leave out are removed, and an empty string clears everyone. OMIT the parameter to leave the attendee list untouched while changing other fields. On `freebusy`, the addresses whose availability to check."
       meet:
         type: boolean
-        description: "Add a Google Meet video conference link to the event"
+        description: "Add a Google Meet video conference link. On `update`, true adds a link and false REMOVES an existing one; omit it to leave the link as it is."
 
   quickAdd:
     type: action
@@ -107,7 +107,7 @@ operations:
     params:
       calendarId:
         type: string
-        description: "Calendar ID (default: 'primary')"
+        description: "Calendar ID. Use the `calendars` operation to list available IDs; required for events on shared calendars. Defaults to 'primary' on the event operations (`list`, `get`, `create`, `quickAdd`, `update`, `delete`). On `agenda`, a calendar name or ID to filter to — OMIT it to span all calendars, and do not pass 'primary', which is an API alias rather than an id agenda matches on. On `freebusy`, a comma-separated list of calendar IDs to check IN ADDITION to your own."
       text:
         type: string
         description: "Natural language event description"
@@ -122,32 +122,32 @@ operations:
     params:
       calendarId:
         type: string
-        description: "Calendar ID (default: 'primary')"
+        description: "Calendar ID. Use the `calendars` operation to list available IDs; required for events on shared calendars. Defaults to 'primary' on the event operations (`list`, `get`, `create`, `quickAdd`, `update`, `delete`). On `agenda`, a calendar name or ID to filter to — OMIT it to span all calendars, and do not pass 'primary', which is an API alias rather than an id agenda matches on. On `freebusy`, a comma-separated list of calendar IDs to check IN ADDITION to your own."
       eventId:
         type: string
-        description: "Event ID to update"
+        description: "Event ID"
         required: true
       summary:
         type: string
-        description: "Updated event title"
+        description: "Event title"
       start:
         type: string
-        description: "Updated start time (ISO 8601)"
+        description: "Start time (ISO 8601)"
       end:
         type: string
-        description: "Updated end time (ISO 8601)"
+        description: "End time (ISO 8601)"
       description:
         type: string
-        description: "Updated description"
+        description: "Event description or notes"
       location:
         type: string
-        description: "Updated location"
+        description: "Event location"
       attendees:
         type: string
-        description: "Comma-separated attendee emails. REPLACES the existing attendee list entirely (Google events.patch overwrites arrays). Pass an empty string to clear all attendees."
+        description: "Comma-separated email addresses. On `update`, whatever you pass REPLACES the existing list — addresses you leave out are removed, and an empty string clears everyone. OMIT the parameter to leave the attendee list untouched while changing other fields. On `freebusy`, the addresses whose availability to check."
       meet:
         type: boolean
-        description: "Add a Google Meet video conference link. Note: Google Calendar does not allow removing an existing Meet link via patch; omit or set false to leave the link untouched."
+        description: "Add a Google Meet video conference link. On `update`, true adds a link and false REMOVES an existing one; omit it to leave the link as it is."
     defaults:
       calendarId: primary
 
@@ -158,10 +158,10 @@ operations:
     params:
       calendarId:
         type: string
-        description: "Calendar ID (default: 'primary')"
+        description: "Calendar ID. Use the `calendars` operation to list available IDs; required for events on shared calendars. Defaults to 'primary' on the event operations (`list`, `get`, `create`, `quickAdd`, `update`, `delete`). On `agenda`, a calendar name or ID to filter to — OMIT it to span all calendars, and do not pass 'primary', which is an API alias rather than an id agenda matches on. On `freebusy`, a comma-separated list of calendar IDs to check IN ADDITION to your own."
       eventId:
         type: string
-        description: "Event ID to delete"
+        description: "Event ID"
         required: true
     defaults:
       calendarId: primary
@@ -180,7 +180,7 @@ operations:
     params:
       timeMin:
         type: string
-        description: "Start of range (ISO 8601)"
+        description: "Start of range (ISO 8601). On `list`, defaults to today."
         required: true
       timeMax:
         type: string
@@ -188,7 +188,7 @@ operations:
         required: true
       attendees:
         type: string
-        description: "Comma-separated email addresses to check availability for"
+        description: "Comma-separated email addresses. On `update`, whatever you pass REPLACES the existing list — addresses you leave out are removed, and an empty string clears everyone. OMIT the parameter to leave the attendee list untouched while changing other fields. On `freebusy`, the addresses whose availability to check."
       calendarId:
         type: string
-        description: "Comma-separated calendar IDs to check (in addition to own calendar)"
+        description: "Calendar ID. Use the `calendars` operation to list available IDs; required for events on shared calendars. Defaults to 'primary' on the event operations (`list`, `get`, `create`, `quickAdd`, `update`, `delete`). On `agenda`, a calendar name or ID to filter to — OMIT it to span all calendars, and do not pass 'primary', which is an API alias rather than an id agenda matches on. On `freebusy`, a comma-separated list of calendar IDs to check IN ADDITION to your own."